News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 16 so far |
Tue 2 Sep 2025· 84 articles
-
Bail for 2 Hong Kong doctors accused of leaking data to implicate surgeon
Two public hospital doctors in Hong Kong have been granted bail after being arrested on suspicion of leaking a cancer patient’s medical data to highlight alleged shortcomings by her operating surgeon. The 35-year-old associate consultant and the 57-year-old…
DataBreaches -
Threat Brief: Salesloft Drift Integration Used To Compromise Salesforce Instances
Threat researchers report activity consistent with a threat actor campaign that leveraged the Salesloft Drift integration to compromise customer Salesforce instances. According to Salesloft, from 8 to 18 August 2025 a threat actor used compromised OAuth…
unit42.paloaltonetworks.com -
Prompt Injection Attacks Can Exploit AI-Powered Cybersecurity Tools
The article discusses the risks associated with prompt injection attacks on AI-powered cybersecurity tools. Researchers have shown that these attacks can exploit vulnerabilities in large language model (LLM)-based security systems, turning them into vectors…
gbhackers.com -
Threat Hunting Guide Designed for SOC Analysts and MSSPs
Proactive threat hunting has become an essential discipline for Security Operations Center (SOC) analysts and Managed Security Service Providers (MSSPs), the article explains. It notes that traditional detection methods often miss novel or sophisticated…
gbhackers.com -
Ukrainian Network FDN3 Launches Massive Brute-Force Attacks on SSL VPN and RDP Devices
Cybersecurity researchers have flagged a Ukraine-based IP network, FDN3, for engaging in massive brute-force and password spraying campaigns targeting SSL VPN and RDP devices between June and July 2025. The activity originated from AS211736, the…
The Hacker News -
Ukrainian Hackers Ramp Up Brute-Force and Password-Spraying Attacks on VPN and RDP Systems
In mid-2025, a coalition of Ukraine-based autonomous systems conducted unprecedented brute-force and password-spraying campaigns against exposed SSL VPN and Remote Desktop Protocol services, overwhelming security defences. Over a three-day window in July…
gbhackers.com -
Cookies and how to bake them: what they are for, associated risks, and what session hijacking has to do with it
Cookies and session hijacking are explored in depth, with 2 September 2025 cited as the publication date. The piece explains that cookies can store a range of data, including a Session ID, which is the main target of session hijacking attacks that aim to…
securelist.com -
The Largest DDoS Attack in History: Cloudflare Fights Back
Earlier this year, in mid-May, Cloudflare announced that it had successfully mitigated a record-breaking 7.3 Tbps distributed denial-of-service attack. Now, only months later, the company has revealed a new milestone: a massive assault peaking at 11.5 Tbps…
SecurityOnline -
New WhatsApp Scam Poses Serious Risk: Hackers Can Hijack Your Chats
A new WhatsApp scam is targeting users with a deceptive message that leads victims to a counterfeit Facebook login page, enabling cybercriminals to hijack accounts via WhatsApp’s device linking feature. According to Report, attackers obtain full remote…
gbhackers.com -
Microsoft to Retire Popular Editor Extensions on Edge and Chrome
Microsoft has announced that its AI-powered Editor browser extensions for Microsoft Edge and Google Chrome will be retired, with the change taking effect on 31 October 2025, according to GBHackers On Security. The core capabilities will be embedded directly…
gbhackers.com -
MobSF Vulnerability Allows Attackers to Upload Malicious Files
Critical security flaws in Mobile Security Framework MobSF version 4.4.0 allow authenticated users to exploit path traversal and arbitrary file write vulnerabilities, potentially compromising system integrity and exposing sensitive data. The flaws, tracked…
gbhackers.com -
Silver Fox Exploits Microsoft-Signed WatchDog Driver to Deploy ValleyRAT Malware
The threat actor known as Silver Fox has been attributed to abusing a previously unknown vulnerable driver linked to WatchDog Anti-malware as part of a Bring Your Own Vulnerable Driver attack aimed at disarming security tools on compromised hosts. The…
The Hacker NewsVoid Arachne -
CVE-2025-6507 (CVSS 9.8): Critical H2O-3 Vulnerability Puts Machine Learning at Risk
CVE-2025-6507 (CVSS 9.8) is a critical H2O-3 vulnerability that could allow remote code execution and unauthorized file access, affecting version 3.47.0.99999 and prompting a patch in 3.46.0[.]8, according to CVE. The flaw arises from unsafe deserialization…
SecurityOnline -
HashiCorp Vault Vulnerability Allows Attackers to Crash Servers
A critical vulnerability in HashiCorp Vault, tracked as CVE-2025-6203 (HCSEC-2025-24), has been disclosed that allows malicious actors to submit specially crafted payloads capable of exhausting server resources and rendering Vault instances unresponsive,…
gbhackers.com -
Why Antivirus Software Flags Your Linux ISO as Malware
The article explains that Linux newcomers sometimes find Linux ISO images flagged as malware by third-party antivirus software after downloading on Windows. Such false positives are common, with Windows security tools sometimes classifying Linux ISO files as…
SecurityOnline -
Von der Leyen’s plane hit by suspected Russian GPS Jamming in Bulgaria, landed Safely
The EU confirmed that Ursula von der Leyen’s plane experienced GPS jamming while flying to Bulgaria, with officials suspecting Russian interference, though the aircraft landed safely. Bulgarian authorities reported that GPS signals were neutralised and that…
Security Affairs -
Apple Is Forcing Its Suppliers to Embrace Full Automation
Reports suggest that Apple is restructuring its global supply chain by demanding full-scale automation from its partners, not just shifting production away from China. According to industry sources, Apple has made robotic arms and intelligent manufacturing…
SecurityOnline -
Early Adopters Report ‘Snow Screen’ on Google Pixel 10
The article reports that the Google Pixel 10 is already facing display issues described as snow screens or random coloured stripes, a problem previously seen on earlier Pixel models. In severe cases, the display can become saturated with coloured lines,…
SecurityOnline -
Azure AD Vulnerability Leaks Credentials, Lets Attackers Deploy Malicious Apps
During a cybersecurity assessment, according to Resecurity’s HUNTER Team, researchers found a publicly accessible appsettings[.]json file in an ASP[.]NET Core app that exposed the ClientId and ClientSecret of an Azure AD application. This misconfiguration…
gbhackers.com -
Threat Actors Exploit Windows Search in AnyDesk ClickFix Attack to Spread MetaStealer
In GBHackers on Security, Mayura Kathir reports a novel ClickFix-style campaign that uses the Windows search-ms URI protocol to trigger an infection chain and drop MetaStealer, a credential-harvesting infostealer. The attack starts after a target searches…
gbhackers.com -
JetBrains Makes Its Language Server Protocol API Free
JetBrains has announced that its Language Server Protocol (LSP) API will be available free of charge, with changes that align the IDE’s distribution model across editions. In July 2025, JetBrains revealed a shift that combines the paid IntelliJ IDEA edition…
SecurityOnline -
Lazarus Hackers Exploit 0-Day to Deploy Three Remote Access Trojans
According to Fox-IT and NCC Group, Lazarus hackers have been tracked as a sophisticated subgroup targeting financial and cryptocurrency firms, overlapping with campaigns such as AppleJeus, Citrine Sleet, UNC4736 and Gleaming Pisces. The group leverages three…
gbhackers.com -
Microsoft to Require Multi-Factor Authentication on Azure Portal Logins
Microsoft has announced a mandatory multi-factor authentication (MFA) requirement for all sign-in attempts to the Azure portal and other administrative interfaces, as part of a two-phase rollout. Phase 1 targets Portal and Admin Interfaces, beginning in…
gbhackers.com -
Wireshark 4.4.9 Released With Critical Bug Fixes and Protocol Updates
The Wireshark Foundation today announced the release of Wireshark 4.4.9, a maintenance update that brings critical stability improvements and updates to its protocol dissectors, published on 2 September 2025. According to Wireshark, the update fixes a…
gbhackers.com -
New TinkyWinkey Trojan Targets Windows Systems With Sophisticated Keylogging
A sophisticated new keylogger malware dubbed “TinkyWinkey” is targeting Windows systems with advanced stealth and data exfiltration features, first observed in late June 2025. It operates with a dual-component architecture: a Tinky Service that handles…
gbhackers.com -
Zscaler Discloses Data Breach Following Salesforce Instance Compromise
Zscaler disclosed a data breach following compromise of a Salesforce instance, information revealed on 2 September 2025. Cybercriminals gained access to the Salesforce database through compromised third‑party application credentials, affecting customer…
gbhackers.com -
Malicious npm Package nodejs-smtp Mimics Nodemailer, Targets Atomic and Exodus Wallets
A malicious npm package named nodejs-smtp impersonates nodemailer and was uploaded to the npm registry in April 2025, attracting a total of 347 downloads before it was removed. Cybersecurity researchers describe how, on import, the package uses Electron…
The Hacker News -
No, There Was No “Major Gmail Security Breach”
Reports of a so-called “major Gmail security breach” circulated widely, but Google issued a clarification emphasising that these claims were entirely false. According to Google, the reports were confused with a phishing attack that occurred in June, where…
SecurityOnline -
-
CVE-2025-57808: ESPHome Web Server Authentication Bypass Exposes Smart Devices
CVE-2025-57808 affects the ESPHome project, a popular open-source firmware framework for ESP32- and ESP8266-based smart home devices, and is rated CVSS 8.1 (High). The flaw bypasses basic authentication in ESPHome’s web server component, allowing anyone on…
SecurityOnline -
TinkyWinkey: A Stealthy New Keylogger Is Hunting for Credentials on Windows
TinkyWinkey is a stealthy Windows-based keylogger that researchers at CYFIRMA have analysed, first detected on 24–25 June 2025. According to CYFIRMA, the malware comprises two main modules: Tinky Service, a Windows service that manages persistence across…
SecurityOnline -
Beyond the Terminal: Anthropic Launches a Web-Based Editor for Claude Code
Anthropic is developing a web-based edition of Claude Code, a tool already regarded as one of the most highly rated AI coding assistants that can run in the terminal and work with IDEs such as Microsoft Visual Studio Code and Cursor. The new browser-based…
SecurityOnline -
A New Era for AI Coding: OpenAI’s Codex Gets a Major Update
OpenAI has announced a major Codex update, introducing a new Visual Studio Code extension and synchronization across the web and terminal. Subscribers to ChatGPT Plus or ChatGPT Pro can now access Codex for every build, whether via the extension, web, or the…
SecurityOnline -
Lazarus Subgroup Deploys Three Custom RATs in Targeted Crypto Attacks
The Lazarus Group sub‑group continues targeting the financial and cryptocurrency sector, with a detailed joint analysis by Fox-IT and NCC Group revealing three custom RATs: PondRAT, ThemeForestRAT and RemotePE. It notes a multi‑stage infection using social…
SecurityOnlineLazarus Group -
Critical CVE-2025-21483 & CVE-2025-27034 in Qualcomm Modems Score CVSS 9.8
Qualcomm has published its September 2025 Security Bulletin, outlining dozens of fixes across chipsets, connectivity stacks and automotive platforms, including two critical flaws rated CVSS 9.8. The first, CVE-2025-21483, lies in the Data Network Stack &…
SecurityOnline -
The Master Key: Exposed JSON File Gives Attackers Full Control of Azure AD
Resecurity’s HUNTER Team uncovered a severe misconfiguration: sensitive Azure Active Directory credentials were exposed in a publicly accessible appsettings[.]json file. According to Resecurity, with these credentials an attacker can authenticate directly…
SecurityOnline -
CVE-2025-6203: DoS Flaw in HashiCorp Vault Allows Attackers to Crash Servers
HashiCorp has issued a security advisory for CVE-2025-6203, a Denial-of-Service weakness in Vault that could allow a malicious user to crash servers by submitting specially crafted JSON payloads, with the flaw rated CVSS 7.5 (High). The issue stems from…
SecurityOnline -
Operation HanKook Phantom: APT-37 Targets South Korean Institutions with LNK-Based Espionage Campaign
Researchers at Seqrite Lab have uncovered Operation HanKook Phantom, a spear‑phishing campaign attributed to APT‑37 (ScarCruft / InkySquid / Reaper) that uses malicious LNK files embedded in decoy documents to infiltrate South Korean government bodies,…
SecurityOnlineAPT37 -
A Deceptive Ad Campaign Is Stealing Credentials from the Hospitality Industry
The Daily CyberSecurity article published on 2 September 2025 reports Okta Threat Intelligence’s warning about a large-scale phishing campaign impersonating major hospitality and vacation rental providers. The attackers rely heavily on malicious search…
SecurityOnline -
Beyond ClickFix: A New Attack Abuses Windows Search to Deliver MetaStealer
According to Huntress, researchers have observed a widening of ClickFix attacks, with adversaries now abusing the Windows search protocol to deliver MetaStealer alongside disguised lures. The campaign begins with a fake AnyDesk installer hosted at…
SecurityOnline
