News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 13 so far |
Tue 2 Sep 2025· 84 articles
-
Why Threat Intelligence: A Conversation With Unit 42 Interns
Unit 42’s interns Gabrielle Calderon and Sakthi Vinayak share how the 12‑week programme broadens practical threat intelligence skills, from automated data workflows to hands‑on reverse engineering. Sakthi, a Threat Research Intern, describes automating data…
unit42.paloaltonetworks.com -
Hackers breach fintech firm in attempted $130M bank heist
Hackers breached Evertec’s Brazilian subsidiary Sinqia S.A. in an attempt to steal $130 million from its Pix instant payments environment, after gaining unauthorized access to the system. According to the SEC filing, the breach was detected on 29 August…
BleepingComputer -
9/2/25, 9:40 PM
Darktrace’s Inside the SOC blog reports that researchers at Cado Security Labs (now part of Darktrace) detected a typosquatting domain that closely resembled Cadosecurity[.]com and redirected visitors to the legitimate site, with an accompanying fake X…
darktrace.com -
Top 10 Best API Penetration Companies In 2025
GBHackers’ Top 10 Best API Penetration Testing Companies in 2025 profiles a range of providers offering both human-led testing and automated capabilities. The list highlights Salt Security as an AI-driven platform that delivers continuous API traffic…
gbhackers.com -
9/2/25, 9:02 PM
A new P2Pinfect variant compiled for the Microprocessor without Interlocked Pipelined Stages (MIPS) architecture has been discovered, according to a Darktrace blog post published on 12 April 2023. Researchers note the MIPS variant targets embedded devices…
darktrace.com -
Amazon Stymies APT29 Credential Theft Campaign
Cybersecurity researchers have exposed a sophisticated credential theft campaign attributed to APT29, a group the US government has formally tied to Russia's foreign intelligence service (SVR). The operation compromised legitimate websites to inject…
Dark ReadingAPT29 -
Hackers Threaten to Submit Artists’ Data to AI Models If Art Site Doesn’t Pay Up
Matthew Gault reports that an old school ransomware attack has a new twist: threatening to feed data to AI companies so it’ll be added to LLM datasets. Around August 30, a message appeared on Artists&Clients attributed to the ransomware group LunaLock,…
DataBreaches -
Cloudflare hit by data breach in Salesloft Drift supply chain attack
Cloudflare has been affected by a data breach in the Salesloft Drift supply chain attack, with attackers gaining access to a Salesforce instance used for internal customer case management that contained 104 Cloudflare API tokens. Cloudflare was notified of…
BleepingComputer -
Sangoma Patches Critical Zero-Day Exploited to Hack FreePBX Servers
Sangoma has issued emergency patches for a zero-day vulnerability that was exploited to hack FreePBX servers, tracked as CVE-2025-57819 with a CVSS score of 10/10. The flaw stems from insufficient sanitization of user-supplied data, and successful…
SecurityWeek -
Cloudflare blocked a record 11.5 Tbps DDoS attack
Cloudflare blocked what it called the largest ever DDoS attack, peaking at 11.5 Tbps, described as a UDP flood that mainly originated from Google Cloud and occurred during weeks-long assault waves. According to Cloudflare, the defence systems automatically…
Security Affairs -
Zscaler, Palo Alto Networks Breached via Salesloft Drift
Two major security firms were affected through a large-scale supply chain attack involving Salesforce’s Salesloft Drift, with UNC6395 identified as the threat actor behind the campaign began early last month. From Aug. 8 to 18, a threat actor used OAuth…
Dark Reading -
The impact of the Salesloft Drift breach on Cloudflare and our customers
According to The Cloudflare Blog, Cloudflare and hundreds of other organisations were affected by a breach that exposed text fields within Salesforce cases in Cloudflare’s Salesforce tenant between 9 August 2025 and 17 August 2025, with the attacker known as…
Cloudflare -
Jaguar Land Rover Shuts Down in Scramble to Secure 'Cyber Incident'
Jaguar Land Rover says it shut down part of its systems after a cyber incident, with retail and production activities severely disrupted as it works to secure its global IT environment. The company states there is no evidence that customer data has been…
Dark Reading -
Lazarus Group Expands Malware Arsenal With PondRAT, ThemeForestRAT, and RemotePE
The Lazarus Group has been attributed to a social engineering campaign that distributes three cross-platform malware families—PondRAT, ThemeForestRAT, and RemotePE. The attack, observed by NCC Group’s Fox-IT in 2024, targeted a DeFi organisation, ultimately…
The Hacker NewsLazarus Group -
Cloudflare blocks largest recorded DDoS attack peaking at 11.5 Tbps
Cloudflare has said it recently blocked the largest recorded volumetric DDoS attack, peaking at 11.5 Tbps, with the incident lasting around 35 seconds and predominantly sourced from Google Cloud in a UDP flood. According to Cloudflare, the company has been…
BleepingComputer -
Cloudflare Blocks Record-Breaking 11.5 Tbps DDoS Attack
Cloudflare blocked the largest distributed denial-of-service attack on record, reaching 11.5 Tbps, as reported on 2 September 2025. The attack was a UDP flood that mainly originated from Google Cloud infrastructure and lasted about 35 seconds. According to…
SecurityWeek -
No, Google did not warn 2.5 billion Gmail users to reset passwords
According to Google, rumours that it warned 2.5 billion Gmail users to reset passwords are false. The company explained in a Monday blog post that Gmail’s protections are strong and effective, and that claims of a major Gmail security warning are inaccurate.…
BleepingComputer -
Varonis Acquires Email Security Firm SlashNext
Varonis Systems has announced the acquisition of email security provider SlashNext, in a deal valued at up to $150 million including performance-based retention awards, according to SecurityWeek. SlashNext, founded in 2017 by Atif Mushtaq, uses predictive AI…
SecurityWeek -
Researchers Warn of MystRodX Backdoor Using DNS and ICMP Triggers for Stealthy Control
MystRodX, also known as ChronosRAT, is a stealthy backdoor disclosed by cybersecurity researchers that can manage files, forward ports, provide a reverse shell, and handle sockets, with its functions dynamically enabled by configuration. The code is…
The Hacker News -
Jaguar Land Rover says cyberattack ‘severely disrupted’ production
Jaguar Land Rover says a cyberattack forced it to shut down several systems as part of its mitigation, with the incident severely disrupting both production and retail operations. The company, which operates as a single entity under Tata Motors India, said…
BleepingComputer -
How StepSecurity Harden Runner Detected Unexpected Microsoft Defender Installation on GitHub-hosted Ubuntu Runners
Microsoft Defender was unexpectedly installed on multiple GitHub‑hosted Ubuntu workflow runs from mid‑July through mid‑August 2025, causing abnormal network traffic that was detected by StepSecurity Harden Runner within hours. The investigation showed that…
StepSecurity -
ESPHome Vulnerability Allows Unauthorized Access to Smart Devices
A critical authentication bypass flaw in ESPHome’s ESP-IDF web server component allows unauthorized users on the same local network to access and control ESPHome devices without valid credentials, according to the article. The vulnerability, CVE-2025-57808,…
gbhackers.com -
TagNabIt – AWS Cloud Resource Enumeration via Metadata Tags
TagNabIt is an offensive security toolkit described as a way to enumerate AWS cloud resources through metadata tags. Built in Python, it can be installed via a virtual environment and a requirements file, and it does not bypass authentication, instead…
darknet.org.uk -
Hackers Are Sophisticated & Impatient — That Can Be Good
Hackers are described as sophisticated, opportunistic and impatient, with major ransomware gangs operating like highly organised SaaS vendors that include affiliates, customer “support” and dashboards. The article notes that, at the time of its takedown in…
Dark Reading -
Palo Alto Networks Confirms Data Breach via Compromised Salesforce Instances
Palo Alto Networks disclosed that its Salesforce environment was breached via a compromised Salesloft Drift integration, in what is described as a supply-chain-type intrusion affecting customer relationship management platforms. According to Palo Alto…
gbhackers.com -
Google Dismiss Reports of Major Gmail Security Alert
Google has dismissed widespread claims of a global Gmail security alert as entirely false, according to Google. The company emphasised that Gmail protections remain strong and that phishing and malware attempts are blocked from reaching inboxes by more than…
gbhackers.com -
Palo Alto Networks disclose a data breach linked to Salesloft Drift incident
Palo Alto Networks has disclosed a data breach linked to the Salesloft Drift supply-chain incident, which allowed attackers to access its Salesforce account, according to BleepingComputer. The exposed information includes Salesforce data such as Account,…
Security Affairs -
Pennsylvania AG Office says ransomware attack behind recent outage
The Office of the Pennsylvania Attorney General has said a ransomware attack is behind the ongoing two-week outage affecting its services, with the incident first disclosed on 11 August. In an official statement, Attorney General David W. Sunday Jr. said the…
BleepingComputer -
OneDrive Phishing Attack Targets Corporate Executives for Credential Theft
A newly discovered spearphishing campaign is targeting executives and senior leadership across multiple industries by exploiting trusted OneDrive document-sharing notifications. According to Stripe OLT SOC, the attack uses highly tailored emails that…
gbhackers.com -
Tax refund scam targets Californians
The State of California Franchise Tax Board (FTB) recently issued a warning to taxpayers about a text-message scam that impersonates the FTB and directs recipients to fraudulent versions of FTB web pages designed to steal personal and banking information.…
Malwarebytes -
Massive 11.5 Tbps UDP Flood DDoS Attack Originated From Google Cloud
Massive 11.5 Tbps UDP flood DDoS attack originated from Google Cloud, according to Cloudflare. Cloudflare disclosed that its automated defenses intercepted a record-shattering DDoS that peaked at 11.5 terabits per second and lasted 35 seconds. The majority…
gbhackers.com -
Amazon Disrupts Russian Hacking Campaign Targeting Microsoft Users
Amazon has disrupted a Russian watering hole campaign targeting Microsoft users by redirecting visitors via compromised websites to attacker-controlled infrastructure. The operation is attributed to the state-sponsored cyberespionage group known as Midnight…
SecurityWeek -
Palo Alto Networks data breach exposes customer info, support tickets
Palo Alto Networks disclosed that a data breach exposed customer data and support cases after attackers abused compromised OAuth tokens from the Salesloft Drift breach to access its Salesforce instance, a widespread supply-chain attack the firm says affected…
BleepingComputer -
Palo Alto Networks data breach exposes customer info, support cases
Palo Alto Networks disclosed a data breach that exposed customer information and support cases after attackers abused compromised OAuth tokens from the Salesloft Drift breach to access its Salesforce instance, with the incident affecting its Salesforce CRM…
BleepingComputer -
Mapping the Web of Commercial Spyware: Targets and Attack Chains
A comprehensive new report spanning 2010 to 2025 reveals the evolving landscape of commercial spyware vendors (CSVs), exposing how private firms infiltrate devices, who they typically target, and the infection chains that deliver covert implants. The study,…
gbhackers.com -
WhatsApp Zero-Day Exploited in Attacks Targeting Apple Users
WhatsApp has disclosed a zero-day vulnerability, tracked as CVE-2025-55177, that was exploited in highly targeted attacks against Apple users and described as an incomplete authorization of linked device synchronization messages. An attacker could have…
SecurityWeek -
Shadow AI Discovery: A Critical Part of Enterprise AI Governance
Shadow AI is described as a governance imperative, with MIT’s State of AI in Business report noting that while 40% of organisations have purchased enterprise LLM subscriptions, over 90% of employees are actively using AI tools in daily work. The piece argues…
The Hacker News -
Iran-Nexus Hackers Exploit Omani Mailbox to Target Governments
A sophisticated spear-phishing campaign exploited a compromised mailbox belonging to the Ministry of Foreign Affairs of Oman to target governments and diplomatic missions worldwide. The operation, claims to be conducted by an Iranian-aligned group known as…
gbhackers.com -
Prolific Russian ransomware operator living in California enjoys rare leniency awaiting trial
According to CyberScoop, Ianis Aleksandrovich Antropenko is a 36-year-old Russian national living in Southern California who has endured rare leniency while awaiting trial. He was arrested almost a year ago in California for alleged involvement in multiple…
DataBreaches -
Watchdog orders Lotte Card to compensate victims of hack
Watchdog orders Lotte Card to compensate victims of hack, after a cyber breach affecting 9.65 million individual customers was reported. The Korea JoongAng Daily reports that Financial Supervisory Service (FSS) said Gov. Lee Chan-jin instructed executives…
DataBreaches
