News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 13 so far |
Wed 3 Sep 2025· 99 articles
-
9/3/25, 10:22 PM
Cado Security Labs (now part of Darktrace) identified a Docusign spearphishing campaign targeting tech executives, using compromised Japanese business emails and malicious links that redirect to credential‑stealing sites. The campaign leverages obfuscated…
darktrace.com -
Threat actors abuse X’s Grok AI to spread malicious links
Threat actors are using Grok, X's built-in AI assistant, to bypass link posting restrictions that the platform introduced to reduce malicious advertising, according to Guardio Labs' researcher Nati Tal. They hide the malicious link in the small “From:”…
BleepingComputer -
9/3/25, 9:58 PM
According to Darktrace, researchers from Cado Security Labs (now part of Darktrace) identified a Python Remote Access Tool named Triton RAT, an open‑source tool controlled via Telegram that targets Roblox credentials. The malware’s features include…
darktrace.com -
Salesloft Drift Breach Rolls Up Cloudflare, Palo Alto, Zscaler, and Others
The Salesloft Drift breach has widened to include Cloudflare, Palto Alto Networks, and Zscaler, according to Dissent’s report dated 3 September 2025. The incident involves the UNC6395 threat group exploiting a vulnerability in Salesloft Drift OAuth…
DataBreaches -
9/3/25, 9:24 PM
According to Cado Security Labs (now part of Darktrace), a malware campaign targeting the Royal Thai Police has been attributed to the Chinese APT group Mustang Panda, with activity documented in February 2025. The campaign uses seemingly legitimate…
darktrace.com -
Update your Android! Google patches 111 vulnerabilities, 2 are critical
Google has patched 111 vulnerabilities in Android, including two critical flaws, in its September 2025 Android Security Bulletin. The updates cover Android 13, 14, 15, and 16, with vendors notified at least a month before publication, though patches may not…
Malwarebytes -
Texas sues PowerSchool over breach compromising info of over 880,000 students, teachers
Texas Attorney General Ken Paxton has filed a lawsuit against PowerSchool, a California-based provider of cloud-based services for K-12 schools, after a breach exposed the personal identifying information and protected health information of more than 880,000…
DataBreaches -
Russia's APT28 Targets Microsoft Outlook With 'NotDoor' Malware
APT28, the state-sponsored threat group tied to Russian intelligence, is described as weaponising Microsoft Outlook through a backdoor researchers call “NotDoor.” NotDoor is a VBA macro for Outlook that monitors incoming emails for a trigger word, enabling…
Dark ReadingAPT28 -
Cloudflare Holds Back the Tide on 11.5Tbps DDoS Attack
Cloudflare has been mitigating hundreds of DDoS attacks, with one peak reaching 11.5 Tbps in a 35-second UDP flood that drew traffic from multiple IoT and cloud providers, including Google Cloud as a data source and others not disclosed. According to…
Dark Reading -
9/3/25, 8:30 PM
Researchers from Cado Security (now part of Darktrace) report that Cloudflare’s WARP service, a free VPN, has been abused in opportunistic attacks to target vulnerable internet-facing services, with WARP traffic often bypassing firewalls due to its trusted…
darktrace.com -
Malicious npm Packages Exploit Ethereum Smart Contracts to Target Crypto Developers
Cybersecurity researchers have detected two malicious npm packages, colortoolsv2 and mimelib2, uploaded to npm in July 2025 and no longer available for download. The packages abuse Ethereum smart contracts to stage the URLs hosting the payload, enabling a…
The Hacker News -
9/3/25, 7:48 PM
From Dormant to Dangerous: P2Pinfect Evolves to Deploy New Ransomware and Cryptominer reports that P2Pinfect, a Rust-based malware, has progressed from a dormant botnet into a threat that actively deploys ransomware and a cryptominer, mainly targeting Redis…
darktrace.com -
Crooks turn HexStrike AI into a weapon for fresh vulnerabilities
Threat actors are abusing HexStrike AI, a security tool marketed for red teaming and bug bounties, to exploit fresh Citrix NetScaler vulnerabilities, according to Check Point researchers. HexStrike AI combines professional security tools with autonomous AI…
Security Affairs -
US offers $10 million bounty for info on Russian FSB hackers
The U.S. Department of State is offering a reward of up to $10 million for information on three Russian FSB officers involved in cyberattacks against U.S. critical infrastructure, on behalf of the Russian government. The individuals, Marat Valeryevich…
BleepingComputer -
US Cybersecurity Agency Flags Wi-Fi Range Extender Vulnerability Under Active Attack
The US cybersecurity agency CISA has issued a fresh warning that a missing authentication vulnerability in TP-Link TL-WA855RE Wi-Fi range extender products has been exploited in attacks. Tracked as CVE-2020-24363 (CVSS 8.8), the flaw allows an attacker on…
SecurityWeek -
9/3/25, 6:08 PM
Cerber ransomware’s Linux variant is active in exploiting CVE-2023-22518 in Confluence servers, as reported in a Darktrace blog published on 17 April 2024. It comprises three highly obfuscated C++ payloads packed with UPX, deployed as a 64-bit ELF,…
darktrace.com -
Hackers use new HexStrike-AI tool to rapidly exploit n-day flaws
Hackers are increasingly using a new AI-powered offensive security framework called HexStrike-AI in real attacks to exploit newly disclosed n-day flaws, according to CheckPoint Research. The tool, created by cybersecurity researcher Muhammad Osama, is…
BleepingComputer -
US sues robot toy maker for exposing children's data to Chinese devs
According to the U.S. Department of Justice, the agency has sued Apitor Technology over claims it allowed a Chinese third party to collect children’s geolocation data without parental knowledge or consent. The complaint, filed after a notification from the…
BleepingComputer -
Google addressed two Android flaws actively exploited in targeted attacks
Google has issued security updates to address 120 Android vulnerabilities as part of Android Security Bulletin – September 2025, noting that two of these flaws were exploited in targeted attacks. The advisory identifies CVE-2025-38352, a privilege escalation…
Security Affairs -
9/3/25, 4:57 PM
Darktrace’s blog reports that researchers from Cado Security Labs (now part of Darktrace) identified a novel cryptomining campaign that exploits exposed Jupyter Notebooks on Windows and Linux to deliver a cryptominer. The campaign uses UPX-packed binaries to…
darktrace.com -
Hacked Routers Linger on the Internet for Years, Data Shows
According to Censys, Emily Austin, a principal security researcher, identified several hundred Ubiquiti network routers with hacked banners while trawling Internet scan data, showing these were not new compromises but devices that had been compromised at…
Dark Reading -
Jaguar Land Rover production impacted by cyberattack; Scattered Spider/ShinyHunters claims responsibility
Jaguar Land Rover production has been severely disrupted by a cyber-attack, with the company saying it took immediate action to shut down systems and is working to restart operations, while noting there is no evidence that customer data has been stolen.…
DataBreachesScattered Spider -
Google Patches High-Severity Chrome Vulnerability in Latest Update
Google has released Chrome 140 to the stable channel, fixing six vulnerabilities, including a four reported by external researchers. The most severe flaw is CVE-2025-9864, a high-severity use-after-free in the V8 JavaScript engine reported by the Yandex…
SecurityWeek -
Why you should upgrade to Windows 11 now, and how to do it
According to Malwarebytes Labs, the time to upgrade to Windows 11 is closing in, with Windows 10 support ending on 14 October 2025, after which only Windows 11 will receive updates. The piece explains that running an out-of-date Windows version leaves you…
Malwarebytes -
Google fixes actively exploited Android flaws in September update
Google has released the September 2025 Android security update, addressing a total of 84 vulnerabilities, including two that were actively exploited in zero-day attacks. These two flaws are CVE-2025-38352, an elevation of privilege in the Android kernel, and…
BleepingComputer -
Disney to pay $10M to settle claims it collected kids’ data on YouTube
Disney will pay $10 million to settle claims by the U.S. Federal Trade Commission that it mislabeled videos for children on YouTube, allowing the collection of kids’ personal information without their parents’ consent or notification. The complaint says…
BleepingComputer -
They know where you are: Cybersecurity and the shadow world of geolocation
Geolocation has emerged as a powerful yet perilous tool in cyberspace, with every smartphone ping, app check‑in, and IP lookup generating a geolocation signature that threat actors can weaponise. The piece notes that criminals use location data to execute…
BleepingComputer -
AI Week 2025: Recap
Cloudflare’s AI Week 2025 wrap-up, published on 3 September 2025, outlines four core areas designed to help organisations secure and deliver AI experiences. The event announced products, partnerships and features built from customer feedback to balance AI…
Cloudflare -
ViewState Deserialization Zero-Day Vulnerability in Sitecore Products (CVE-2025-53690)
Written by: Rommel Joven, Josh Fleischer, Joseph Sciuto, Andi Slok, Choon Kiat Ng In a recent investigation, Mandiant Threat Defense discovered an active ViewState deserialization attack affecting Sitecore deployments leveraging sample machine keys that had…
Google Cloud -
Cato Networks Acquires AI Security Firm Aim Security
Cato Networks has acquired Aim Security, a move described by SecurityWeek as the company’s first-ever acquisition and aimed at turbo-charging the Cato SASE Cloud Platform with AI security capabilities. Aim, founded in 2022 to aid secure deployment of…
SecurityWeek -
WhatsApp Bug Anchors Targeted Zero-Click iPhone Attacks
Attackers are exploiting a WhatsApp security vulnerability affecting iOS in a sophisticated zero-click attack aimed at targeted Apple users, with the campaign also leveraging a previously discovered and patched iOS flaw, CVE-2025-43300. The new bug,…
Dark Reading -
PagerDuty Confirms Data Breach After Salesforce Account Compromise
PagerDuty confirms a data breach following a compromise of its Salesforce account, with the incident first flagged by Salesloft on 20 August 2025 and subsequently linked to Drift’s OAuth integration flow with Salesforce. According to Salesloft, attackers…
gbhackers.com -
Namespace Reuse Vulnerability Exposes AI Platforms to Remote Code Execution
A newly discovered vulnerability in the AI supply chain, termed Model Namespace Reuse, permits attackers to achieve Remote Code Execution across major AI platforms, including Microsoft Azure AI Foundry, Google Vertex AI, and thousands of open-source…
gbhackers.com -
CISA Alerts on TP-Link Authentication Flaw Under Active Exploitation
CISA has issued an alert about a serious security hole in certain TP-Link devices, tracked as CVE-2020-24363, which allows an attacker on the same network to take control without a password and is already under active exploitation. TP-Link TL-WA855RE devices…
gbhackers.com -
September 2025 Android Security Bulletin Highlights Exploited Flaws: CVE-2025-38352 & CVE-2025-48543
According to Google’s bulletin, the September 2025 Android Security Bulletin notes two flaws already under exploitation: CVE‑2025‑38352, a kernel race condition, and CVE‑2025‑48543, a privilege escalation in the Android Runtime. Google confirms that…
SOCRadar -
District of Arizona Clarifies Causes of Action Available for Breach of Health Data
The District of Arizona has clarified the kinds of legal claims that can still proceed after a breach of health data, noting that traditional tort and contract theories are hard to sustain, but consumer-fraud statutes can keep a case alive. In the case…
DataBreaches -
Over 1,100 Ollama AI Servers Found Online, 20% at Risk
Over 1,100 Ollama AI servers were found exposed on the public internet, with approximately 20% hosting vulnerable models, according to Cisco Talos specialists. In a ten-minute sweep, researchers identified 1,140 internet-facing Ollama endpoints, of which…
gbhackers.com -
Threat Actors Weaponize HexStrike AI to Exploit Citrix Flaws Within a Week of Disclosure
Threat actors are attempting to weaponise HexStrike AI, a newly released open‑source AI offensive security tool, to exploit recently disclosed security flaws. HexStrike AI, according to its website, is pitched as an AI‑driven platform to automate…
The Hacker News -
Dire Wolf Ransomware Targets Windows, Wipes Logs and Backups
According to GBHackers On Security, the DireWolf ransomware group emerged in May 2025 and has since infected 16 organisations across 16 regions, including the United States, Thailand, Taiwan, Australia and Italy, demanding multimillion-dollar ransoms in…
gbhackers.com -
U.S. CISA adds WhatsApp, and TP-link flaws to its Known Exploited Vulnerabilities catalog
According to U.S. Cybersecurity and Infrastructure Security Agency (CISA), WhatsApp and TP-Link flaws have been added to its Known Exploited Vulnerabilities catalog. The listed CVEs are CVE-2020-24363 for TP-Link TL-WA855RE Missing Authentication for…
Security Affairs
