News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 61 so far |
Thu 24 Jul 2025· 84 articles
-
Untangling the web: Darktrace’s investigation of Scattered Spider’s evolving tactics
Learn about a recent Scattered Spider attack observed by Darktrace, comparing tactics with those seen in previous attacks. Widespread use of LOTL techniques alongside continued changes in TTPs such as their recent use of Ransomware-as-a-Service (RaaS)…
darktrace.comOriginal report -
Pentests once a year? Nope. It’s time to build an offensive SOC
You wouldn’t run your blue team once a year, so why accept this substandard schedule for your offensive side? Your cybersecurity teams are under intense pressure to be proactive and to find your network’s weaknesses before adversaries do. But in many…
The Hacker NewsOriginal report -
China-Based APTs Deploy Fake Dalai Lama Apps to Spy on Tibetan Community
The Tibetan community has been targeted by a China-nexus cyber espionage group as part of two campaigns conducted last month ahead of the Dalai Lama's 90th birthday on July 6, 2025. The multi-stage attacks have been codenamed Operation GhostChat and…
The Hacker NewsOriginal report -
AI-generated image watermarks can be easily removed, say researchers
Now that AI can make fake images that look real, how can we know what’s legitimate and what isn’t? One of the primary ways has been the use of defensive watermarking, which means embedding invisible markers in AI-generated images to show they were made up.…
MalwarebytesOriginal report -
Researchers Exploit Cursor Background Agents to Take Over Amazon EC2 Instance
Security researchers have successfully exploited vulnerabilities in Cursor’s Background Agents to gain unauthorized access to an Amazon EC2 instance, demonstrating critical risks associated with SaaS applications that integrate deeply with cloud…
gbhackers.comOriginal report -
Storm-2603 Exploits SharePoint Flaws to Deploy Warlock Ransomware on Unpatched Systems
Microsoft has revealed that one of the threat actors behind the active exploitation of SharePoint flaws is deploying Warlock ransomware on targeted systems. The tech giant, in an update shared Wednesday, said the findings are based on an "expanded analysis…
The Hacker NewsOriginal report -
SonicWall Patches Critical SMA 100 Vulnerability, Warns of Recent Malware Attack
SonicWall advises organizations to patch SMA 100 appliances and look for IoCs associated with Overstep malware attacks.
SecurityWeekOriginal report -
AI-Driven Wi-Fi Biometrics WhoFi Tracks Humans Behind Walls with 95.5% Accuracy
Researchers have introduced WhoFi, an AI-powered deep learning pipeline that leverages Wi-Fi Channel State Information (CSI) for person re-identification (Re-ID), achieving a remarkable 95.5% Rank-1 accuracy on the NTU-Fi dataset. Traditional visual Re-ID…
gbhackers.comOriginal report -
Microsoft: SharePoint servers also targeted in ransomware attacks
A China-based hacking group is deploying Warlock ransomware on Microsoft SharePoint servers vulnerable to widespread attacks targeting the recently patched ToolShell zero-day exploit chain. [...]
BleepingComputerOriginal report -
Bitnami Helm Chart Flaw (CVSS 10.0) Exposes Kubernetes Secrets: Publicly Accessible & Exploitable Remotely
SecurityOnlineOriginal report -
Chinese Hackers Launch Targeted Campaign to Infect Windows Systems with Ghost RAT and PhantomNet Malware
Zscaler ThreatLabz, in collaboration with TibCERT, has uncovered two linked attack campaigns dubbed Operation GhostChat and Operation PhantomPrayers, attributed with high confidence to a China-nexus advanced persistent threat (APT) group. These operations…
gbhackers.comOriginal report -
From Tech Podcasts to Policy: Trump’s New AI Plan Leans Heavily on Silicon Valley Industry Ideas
President Donald Trump has unveiled a sweeping new plan for America’s “global dominance” in artificial intelligence.
SecurityWeekOriginal report -
Google Introduces OSS Rebuild to Boost Security in Open-Source Package Ecosystems
Google has unveiled OSS Rebuild, a pioneering project designed to enhance trust in package registries by independently reproducing upstream artifacts. This initiative targets the escalating threat of supply chain attacks on widely-used dependencies across…
gbhackers.comOriginal report -
ToolShell Attacks Hit 400+ SharePoint Servers, US Government Victims Named
More information has emerged on the ToolShell SharePoint zero-day attacks, including impact, victims, and threat actors.
SecurityWeekOriginal report -
Metasploit Module Released to Exploit SharePoint 0-Day Vulnerabilities
Security researchers have released a Metasploit exploitation module targeting critical zero-day vulnerabilities in Microsoft SharePoint Server, marking a significant escalation in the threat landscape for enterprise collaboration platforms. The module…
gbhackers.comOriginal report -
TP-Link Network Video Recorder Vulnerability Enables Arbitrary Command Execution
TP-Link has disclosed critical security vulnerabilities affecting two of its VIGI Network Video Recorder models, potentially allowing attackers to execute arbitrary commands on the underlying operating system. The vulnerabilities, identified as CVE-2025-7723…
gbhackers.comOriginal report -
U.S. CISA adds CrushFTP, Google Chromium, and SysAid flaws to its Known Exploited Vulnerabilities catalog
U.S. CISA adds CrushFTP, Google Chromium, and SysAid flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CrushFTP, Google Chromium, and SysAid flaws to its Known Exploited…
Security AffairsOriginal report -
Europol Arrests XSS Forum Admin in Kyiv After 12-Year Run Operating Cybercrime Marketplace
Europol on Monday announced the arrest of the suspected administrator of XSS.is (formerly DaMaGeLaB), a notorious Russian-speaking cybercrime platform. The arrest, which took place in Kyiv, Ukraine, on July 222, 2025, was led by the French Police and Paris…
The Hacker NewsOriginal report -
Weidmueller Industrial Routers Exposed to Remote Code Execution Flaws
Multiple high-severity security vulnerabilities have been discovered in Weidmueller Industrial Routers, potentially allowing attackers to execute arbitrary code with root privileges on affected devices. The German industrial automation company has released…
gbhackers.comOriginal report -
AWS Client VPN for Windows Vulnerability Could Allow Privilege Escalation
Amazon Web Services has disclosed a critical security vulnerability in its Client VPN software for Windows that could allow non-administrative users to escalate their privileges to root-level access during the installation process. The vulnerability, tracked…
gbhackers.comOriginal report -
GitLab Publishes Security Update Addressing Several Vulnerabilities in Community and Enterprise Edition
GitLab has released critical security patches addressing six vulnerabilities across its Community Edition (CE) and Enterprise Edition (EE) platforms, with two high-severity cross-site scripting (XSS) flaws requiring immediate attention from self-managed…
gbhackers.comOriginal report -
SonicWall SMA 100 Vulnerabilities Allow Remote Execution of Arbitrary JavaScript
Cybersecurity vendor SonicWall issued a critical advisory highlighting three serious vulnerabilities affecting its Secure Mobile Access (SMA) 100 series appliances. Impacting SMA 210, SMA 410, and SMA 500v models running firmware version 10.2.1.15-81sv and…
gbhackers.comOriginal report -
CISA Alerts on Google Chromium Input Validation Flaw Actively Exploited
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding a severe input validation vulnerability in Google Chromium that is currently being actively exploited by threat actors. The vulnerability, designated as…
gbhackers.comOriginal report -
Hackers Deploy Stealth Backdoor in WordPress Mu-Plugins to Maintain Admin Access
Cybersecurity researchers have uncovered a new stealthy backdoor concealed within the "mu-plugins" directory in WordPress sites to grant threat actors persistent access and allow them to perform arbitrary actions. Must-use plugins (aka mu-plugins) are…
The Hacker NewsOriginal report -
Key Operator of World’s Largest XSS Dark Web Platform Detained
International law enforcement agencies have dismantled one of the world’s most influential Russian-speaking cybercrime platforms following the arrest of its suspected administrator in a coordinated operation spanning France, Ukraine, and broader European…
gbhackers.comOriginal report -
High-severity flaw (CVE-2025-8069) in AWS Client VPN for Windows Allows Privilege Escalation
SecurityOnlineOriginal report -
T-Mobile & Starlink Launch “T-Satellite”: Eradicating Dead Zones for US Mobile Users
SecurityOnlineOriginal report -
Paying cyberattackers is wrong, right? Should Taos County’s incident be an exception?
How many times have we read that paying a threat actor’s extortion demands only encourages more financially motivated crime and doesn’t ensure that the data won’t be retained or re-sold or leaked? Those making that argument appear to be generally correct,…
DataBreachesOriginal report -
Proton Unveils Lumo AI Assistant: Fully Encrypted, No Data Logging, European-Hosted AI for Ultimate Privacy
SecurityOnlineOriginal report -
Apple Unveils AppleCare One: Single Plan Covers 3 Devices, Extends Eligibility to 4 Years
SecurityOnlineOriginal report -
UK Moves to Ban Ransomware Payments for Public Sector Bodies, Criminalizing Extortion Compliance
SecurityOnlineOriginal report -
Buffer Overflows & XSS in SonicWall SMA 100 Expose Devices to RCE – Patch Immediately!
SecurityOnlineOriginal report -
Critical Flaws in Weidmueller Industrial Routers Allow Unauthenticated RCE
SecurityOnlineOriginal report -
TP-Link NVR Update: Command Injection Flaws Expose Devices to Remote Code Execution
SecurityOnlineOriginal report -
HHS OCR Settles HIPAA Ransomware Investigation with Syracuse ASC for $250k plus corrective action plan
Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a settlement with Syracuse ASC, LLC doing business as Specialty Surgery Center of Central New York, for potential violations of the Health Insurance…
DataBreachesOriginal report -
Synology BeeDrive Flaws Allow Code Execution & Arbitrary File Deletion
SecurityOnlineOriginal report -
EdskManager RAT: New Stealthy Malware Leverages HVNC for Covert Remote Access & Evasion
SecurityOnlineOriginal report -
First in the Wild: Coyote Banking Trojan Exploits Microsoft’s UI Automation to Steal Credentials Undetected
SecurityOnlineOriginal report -
Critical Flaw (CVE-2025-8070) in ASUSTOR Backup & EZSync Allows Local SYSTEM Privilege Escalation
SecurityOnlineOriginal report -
CVE-2025-31700 & CVE-2025-31701: Buffer Overflow Flaws in Dahua IP Cameras Expose Devices to RCE
SecurityOnlineOriginal report