News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Fri 29 Aug 2025· 72 articles
-
New zero-click exploit allegedly used to hack WhatsApp users
A new zero-click exploit allegedly used to hack WhatsApp users has been reported, with WhatsApp sending threat notifications to individuals they believe were targeted in the past 90 days. The attack required no user interaction, and Amnesty researchers…
Security Affairs -
Docker Engine API botnet
OracleIV is a dockerized DDoS botnet discovered by Cado Security Labs (now part of Darktrace) targeting publicly exposed Docker Engine APIs. The campaign delivers a malicious Docker container built from an image named oracleiv_latest, containing Python code…
darktrace.com -
Emerging malware campaign
Darktrace reports an emerging cryptojacking campaign named Qubitstrike that targets exposed Jupyter Notebooks, exfiltrates cloud credentials, and mines XMRig, using Discord as its command and control channel and deploying a Diamorphine rootkit to hide its…
darktrace.com -
WhatsApp Zero-Day Vulnerability Exploited with 0-Click Attacks to Hack Apple Devices
WhatsApp has issued a critical security advisory about a newly discovered zero-day vulnerability, tracked as CVE-2025-55177, which has been exploited in highly sophisticated zero-click attacks targeting Mac and iOS users. The vulnerability, combined with an…
gbhackers.com -
Windows 11 KB5064081 update clears up CPU usage metrics in Task Manager
Microsoft has released the KB5064081 preview cumulative update for Windows 11 24H2, which the article states includes 36 new features or changes and is part of the optional non-security preview updates. The update, dated 29 August 2025, raises Windows 11 to…
BleepingComputer -
QNAP Patches Critical Flaw (CVE-2025-52856) with CVSS 9.3
QNAP has released a security advisory addressing multiple vulnerabilities affecting the QVR firmware on legacy VioStor NVR devices. The first issue, tracked as CVE-2025-52856 and rated Critical (CVSSv4 9.3), is an improper authentication vulnerability;…
SecurityOnline -
Microsoft fixes bug behind Windows certificate enrollment errors
Microsoft has fixed a bug that caused false CertificateServicesClient (CertEnroll) error messages after the July 2025 preview and subsequent Windows 11 24H2 updates. According to Microsoft, the error events shown in Event Viewer can be safely ignored, and…
BleepingComputer -
A Critical Zero-Click WhatsApp Flaw, CVE-2025-55177, Was Exploited in Zero-Day Attacks
WhatsApp and Apple were jointly highlighted in a report about a critical zero-click flaw, CVE-2025-55177, that was exploited in zero‑day attacks. Meta’s WhatsApp Security Team patched the issue affecting iOS, WhatsApp Business for iOS, and Mac, specifying…
SecurityOnline -
US and Dutch Police dismantle VerifTools fake ID marketplace
US and Dutch police have shut down VerifTools, a major fake ID marketplace that sold documents to bypass KYC checks and access online accounts. Authorities seized two marketplace domains and one blog, with the Dutch police also dismantling the infrastructure…
Security Affairs -
Researchers Warn of Sitecore Exploit Chain Linking Cache Poisoning and Remote Code Execution
Three new security vulnerabilities in the Sitecore Experience Platform could be abused to achieve information disclosure and remote code execution, with flaws listed as CVE-2025-53693 (HTML cache poisoning through unsafe reflections), CVE-2025-53691 (Remote…
The Hacker News -
WhatsApp patches vulnerability exploited in zero-day attacks
WhatsApp has patched a zero-click vulnerability in its iOS and macOS messaging clients that was exploited in targeted zero-day attacks, with the flaw tracked as CVE-2025-55177 and affecting WhatsApp for iOS prior to version 2.25.21[.]73, WhatsApp Business…
BleepingComputer -
Microsoft to enforce MFA for Azure resource management in October
Starting in October, Microsoft will enforce multi-factor authentication (MFA) for all Azure resource management actions to protect Azure clients from unauthorised access attempts. This change, part of the Secure Future Initiative, will be applied gradually…
BleepingComputer -
In Other News: Iranian Ships Hacked, Verified Android Developers, AI Used in Attacks
A SecurityWeek round-up reports that a hacking group known as Lab Dookhtegan disrupted the communications of dozens of Iranian ships, according to Marine Insight. The attack affected 60 ships in total, comprising 39 tankers and 25 cargo ships operated by…
SecurityWeek -
Microsoft says recent Windows update didn't kill your SSD
Microsoft says the August 2025 KB5063878 security update for Windows 11 24H2 is not to blame for reported SSD and HDD failures. The company previously told BleepingComputer it was aware of user reports of SSD issues after installing this month’s update and…
BleepingComputer -
VerifTools Fake ID Operation Dismantled by Law Enforcement
Authorities said VerifTools sold fake driver’s licences and passports worldwide, enabling fraudsters to bypass KYC checks and access online accounts. As part of the operation, the FBI seized two domains and one blog associated with VerifTools, while the…
SecurityWeek -
Weaponized PDFs and LNK Files Used in Windows Attacks
GBHackers reports a clandestine campaign in which threat actors weaponise a legitimate-looking PDF titled “국가정보연구회 소식지 (52호)” alongside a malicious Windows shortcut file named 국가정보연구회 소식지(52호). When victims open the LNK file, a PowerShell payload silently…
gbhackers.com -
VS Code Marketplace Abused by Threat Actors to Deliver Malware via Trusted Extensions
A recently uncovered flaw in the VS Code Marketplace has allowed malicious actors to hijack discontinued extension names and slip malware past developers, according to ReversingLabs (RL) researchers. In March RL identified two extensions, ahban[.]shiba and…
gbhackers.com -
An Audit Isn't a Speed Bump — It's Your Cloud Co-Pilot
Auditing should be viewed as a multiplier of trust, not a bottleneck of progress, argues Ravi Sharma, who has spent more than 15 years leading IT audits for global enterprises. The piece reframes audits as proactive partners in cloud transformation,…
Dark Reading -
AppSuite PDF Editor Exploit Lets Hackers Run Arbitrary Commands
According to GBHackers On Security, AppSuite PDF Editor is a sophisticated backdoor masquerading as a PDF editing tool, initially flagged as a potentially unwanted program because of its aggressive installation behaviour. Threat actors distributed a…
gbhackers.com -
Amazon Disrupts APT29 Watering Hole Campaign Abusing Microsoft Device Code Authentication
Amazon said it flagged and disrupted an opportunistic watering hole campaign attributed to the Russia-linked APT29, as part of its intelligence efforts. The operation redirected about 10% of visitors on compromised sites to actor‑controlled domains, including…
The Hacker NewsAPT29 -
Experts warn of actively exploited FreePBX zero-day
Sangoma’s FreePBX Security Team has warned of an actively exploited zero-day vulnerability in FreePBX, tracked as CVE-2025-57819 with a CVSS score of 10.0, affecting systems exposed to the internet via an administrator control panel. The advisory states that…
Security Affairs -
Abandoned Sogou Zhuyin Update Server Hijacked, Weaponized in Taiwan Espionage Campaign
The Abandoned Sogou Zhuyin update server was hijacked and weaponised as part of an espionage campaign codenamed TAOTH, with C6DOOR, GTELAM, DESFY and TOSHIS among the malware families deployed. Trend Micro researchers Nick Dai and Pierre Lee said the…
The Hacker News -
Proof-of-Concept in 15 Minutes? AI Turbocharges Exploitation
An AI-powered offensive research system developed by two Israeli cybersecurity researchers has produced more than a dozen exploits, shrinking the time to create proofs of concept to under 15 minutes in many cases. The pipeline uses prompts to a large…
Dark Reading -
Google Confirms Workspace Accounts Also Hit in Salesforce–Salesloft Drift Data Theft Campaign
Google says the same OAuth token compromise that enabled Salesforce data theft also allowed attackers to access a small number of Google Workspace accounts via the Salesloft Drift integration. The campaign was carried out between 8 August and 18 August 2025,…
SecurityWeek -
TransUnion Data Breach Impacts 4.4 Million
TransUnion has disclosed that more than 4.4 million people were affected by a data breach, with 4,461,511 individuals identified as impacted. The incident occurred on 28 July 2025 and was discovered two days later, according to a filing with the Maine…
SecurityWeek -
Nevada Confirms Ransomware Attack Behind Statewide Service Disruptions
Nevada on 29 August 2025 confirmed that a ransomware attack caused days-long disruption to state systems and services, with offices closed on Monday and Tuesday as a result. The incident, first disclosed as a network security incident, occurred on Sunday and…
SecurityWeek -
Critical Hikvision Vulnerabilities Allow Remote Command Injection
On 28 August 2025, the Hikvision Security Response Center issued Security Advisory SN No. HSRC-202508-01 detailing three critical vulnerabilities across HikCentral products. Collectively assigned CVEs CVE-2025-39245, CVE-2025-39246, and CVE-2025-39247 range…
gbhackers.com -
US Sanctions Russian National, Chinese Firm Aiding North Korean IT Workers
According to US Treasury Department’s Office of Foreign Assets Control (OFAC), sanctions were issued on a Russian national and a Chinese firm for their roles in North Korea’s fraudulent IT worker schemes. The agency said hundreds of US companies have been…
SecurityWeek -
Ransomware Group Exploits Hybrid Cloud Gaps, Gains Full Azure Control in Enterprise Attacks
Storm-0501, a financially motivated threat actor, has been active since at least 2021 and now focuses on cloud environments for data theft and extortion, according to Microsoft. The group has used ransomware families such as Sabbath, Alphv/BlackCat, Hive,…
SecurityWeek -
VirusTotal Launches Endpoint That Explains Code Functionality for Malware Analysts
VirusTotal has unveiled a dedicated API endpoint as part of its Code Insight suite that accepts code snippets—either disassembled or decompiled—and returns a concise summary and a detailed description tailored for malware analysts. The endpoint,…
gbhackers.com -
FBI cyber cop: Salt Typhoon pwned ‘nearly every American’
FBI cyber cop: Salt Typhoon pwned ‘nearly every American’ reports that China’s Salt Typhoon cyberspies hoovered up information belonging to millions of people in the United States during a years-long intrusion into telecommunications networks. According to…
DataBreachesGhostEmperor -
EuroFins cancer screening hack far bigger than thought, agency says
On 29 August 2025, DutchNews[.]nl reported that Bevolkingsonderzoek Nederland said the scale of the data theft from the Dutch cervical cancer screening programme is far greater than first reported. Hackers may have accessed the personal and medical details…
DataBreaches -
Fake ID website busted; Dutch police deal a blow to criminal infrastructure
According to Politie[.]nl, on 27 August the Rotterdam Police Cybercrime Team seized data from the VerifTools website’s servers during a data centre seizure in Amsterdam, with the operation carried out in collaboration with the FBI, which simultaneously took…
DataBreaches -
3rd Circuit Clarifies Scope of Computer Fraud Abuse Act With Employer’s Policies
The Third Circuit this week clarified that an employee’s alleged breaches of workplace computer-use policies cannot be criminalised under the Computer Fraud and Abuse Act (CFAA) if there is no evidence of hacking or violations of trade secrets, according to…
DataBreaches -
Popular Nx Packages Compromised by Credential-Stealing Malware
A widespread supply chain attack against the popular Nx build system has compromised dozens of high-traffic packages, exposing sensitive credentials, according to GitGuardian. Security researchers confirmed that malicious versions of Nx—numbered 20.9.0…
gbhackers.com -
CISA steps in to help Nevada state government recover from cyberattack
Federal officials are working with Nevada’s state government to help it recover from a cyberattack discovered on Sunday, with the Cybersecurity and Infrastructure Security Agency (CISA) liaising with the FBI and other agencies to help the state get back…
DataBreaches -
Can Your Security Stack See ChatGPT? Why Network Visibility Matters
Generative AI platforms such as ChatGPT, Gemini, Copilot and Claude are increasingly adopted in organisations, but their use can create new data loss risks as prompts, uploaded files and browser plugins bypass traditional security controls. The piece argues…
The Hacker News -
How attackers adapt to built-in macOS protection
macOS hosts a suite of built-in protections, from Keychain’s secure storage of secrets to Gatekeeper’s checks on application signatures and quarantined files. Keychain, introduced long before 2010, stores passwords and credentials and protects them with…
securelist.com -
Microsoft Teams Abused in Cyberattack Delivering PowerShell-Based Remote Access Malware
Microsoft Teams is described as being abused by cybercriminals to deliver PowerShell-based remote access malware, with attackers first impersonating IT support and using social engineering to bypass filters and defenses. The campaign relies on creating or…
gbhackers.com -
Click Studios Patches Passwordstate Authentication Bypass Vulnerability in Emergency Access Page
Click Studios has released Passwordstate 9.9 (Build 9972) to address an authentication bypass vulnerability on the core Emergency Access page, with the fix dated 28 August 2025. The issue, which is yet to be assigned a CVE identifier, was described by the…
The Hacker News
