News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Fri 5 Sep 2025· 72 articles
-
How Has IoT Security Changed Over the Past 5 Years?
IoT security has shown subtle improvements over the past five years, with new laws and applied best practices, but experts say progress remains insufficient. While IoT usage has expanded across industries to boost efficiency, the technology remains…
Dark Reading -
Critical SAP S/4HANA Vulnerability Under Attack, Patch Now
A critical code injection vulnerability in SAP S/4HANA, tracked as CVE-2025-42957, is now under exploitation in the wild, with SAP previously disclosing and patching the flaw. The vulnerability, which carries a 9.9 CVSS score, can allow attackers with…
Dark Reading -
Critical SAP S/4HANA flaw CVE-2025-42957 under active exploitation
Experts warn of a critical command injection flaw in SAP S/4HANA, tracked as CVE-2025-42957, that is currently under active exploitation. The vulnerability can be exploited from a low-privileged account to fully compromise SAP systems, allowing arbitrary…
Security Affairs -
Anyone Using Agentic AI Needs to Understand Toxic Flows
Today's business elite are chasing agentic AI potential, but security researchers warn that the biggest vulnerabilities may lie at the boundaries where AI agents connect with enterprise systems. Toxic flows are an emerging risk class, comprising flows…
Dark Reading -
9/5/25, 7:27 PM
Researchers from Cado Security Labs (now part of Darktrace) identified Migo, a Redis-focused cryptojacking campaign that uses novel system-weakening techniques for initial access and then deploys a Golang ELF binary to mine cryptocurrency on Linux hosts.…
darktrace.com -
Idaho man who threatened his hacking victims appeals his sentence in Georgia
Robert Purbeck, a Meridian, Idaho man who used the aliases “Lifelock” or “Studemaster,” pleaded guilty in March 2024 to two counts arising from hacking medical practices, exfiltrating data and sending threats to victims and their families during 2016–2018.…
DataBreaches -
GrayBravo3 articles this day · gbhackers.com first
Secretive MaaS Group 'TAG-150' Develops Novel 'CastleRAT' · TAG-150 Develops CastleRAT in Python and C, Expanding CastleLoader Malware Operations
3 outlets-
Secretive MaaS Group 'TAG-150' Develops Novel 'CastleRAT'
A young malware-as-a-service (MaaS) operation known as TAG-150 has rolled out a new remote access trojan family called CastleRAT, with variants in C and Python, after linking CastleLoader and CastleBot in its ecosystem. Researchers traced CastleLoader back…
Dark Reading -
TAG-150 Develops CastleRAT in Python and C, Expanding CastleLoader Malware Operations
According to The Hacker News, TAG-150—the threat actor behind the MaaS framework CastleLoader—has developed a new remote access trojan named CastleRAT, available in both Python and C variants. The core capabilities include collecting system information,…
The Hacker News -
TAG-150 Hackers Escalate Attacks with Proprietary Malware Families
According to Recorded Future’s Insikt Group, TAG-150 is a sophisticated threat actor active since at least March 2025, known for rapid malware development and a sprawling four-tier infrastructure. The group has deployed self-developed families including…
gbhackers.com
-
-
GhostAction Campaign: Over 3,000 Secrets Stolen Through Malicious GitHub Workflows
According to GitGuardian, the GhostAction campaign is a massive supply chain attack that affected 327 GitHub users across 817 repositories, with malicious workflows exfiltrating 3,325 secrets such as PyPI, npm, and DockerHub tokens to an attacker-controlled…
StepSecurity -
Nexar dashcam video database hacked
A hacker cracked into a database of video recordings taken from Nexar-branded dashcams, exposing more than 130 TB of data stored in an improperly secured Amazon Web Services bucket, according to Malwarebytes. The breach was attributed to a Nexar camera that…
Malwarebytes -
Microsoft Tapped China Engineers for SharePoint Support
A new investigation has revealed that Microsoft relied on China-based engineers to provide technical support and bug fixes for SharePoint, the same software that was recently exploited by Chinese state-sponsored hackers in a massive cyberattack affecting…
gbhackers.com -
Over 143,000 Malware Files Target Android and iOS Users in Q2 2025
In the second quarter of 2025, Android and iOS users faced sustained threat activity, with Kaspersky Security Network reporting nearly 143,000 malicious installation packages detected across its mobile security products. According to Kaspersky Security…
gbhackers.com -
CISA Orders Immediate Patch of Critical Sitecore Vulnerability Under Active Exploitation
According to The Hacker News article summarising a CISA alert, federal agencies are being advised to update their Sitecore instances by 25 September 2025 after the discovery of a security flaw now under active exploitation in the wild. The vulnerability,…
The Hacker News -
Scammers Are Using Grok to Spread Malicious Links on X
Scammers are using a tactic called “grokking” to spread malicious links on X, bypassing the platform’s ban on links in promoted posts. According to Guardio Labs, grokking lets them reach hundreds of thousands to millions of users by prompting Grok, X’s…
Dark Reading -
How to Close the AI Governance Gap in Software Development
Widespread adoption of AI coding tools accelerates software development but also opens up new vulnerabilities that demand stronger governance and oversight. To close the AI governance gap, the article recommends three core components: Observability,…
SecurityWeek -
Azure mandatory multifactor authentication: Phase 2 starting in October 2025
According to Microsoft Azure Blog, Microsoft Azure is announcing the start of Phase 2 multifactor authentication enforcement at the Azure Resource Manager layer, beginning 1 October 2025. The move follows Phase 1, which saw MFA enforcement on Azure Portal,…
azure.microsoft.com -
CVE-2025-53690: Sitecore Deployments Targeted via WEEPSTEEL Malware
CVE-2025-53690 affects Sitecore deployments, with attackers exploiting a ViewState deserialization flaw tied to the reuse of a legacy ASP[.]NET machine key to achieve remote code execution. The vulnerability is active in older Sitecore products such as…
SOCRadar -
Embracing the Next Generation of Cybersecurity Talent
There is an acute shortage of cybersecurity talent worldwide, with the National Institute of Standards and Technology (NIST) citing a 3.4 million shortfall globally. Programs like student-run security operations centres offer a practical path to expand the…
Dark Reading -
Academics Build AI-Powered Android Vulnerability Discovery and Validation Tool
Two academic researchers from Nanjing University and the University of Sydney have built a framework called A2 that uses AI to discover and validate vulnerabilities in Android applications. The system mimics human analysis by first reasoning about an app’s…
SecurityWeek -
SafePay Ransomware Hits 73 Organizations in Just One Month
SafePay, an emerging ransomware group, has risen rapidly in 2025, with its June 2025 attacks on 73 organizations topping Bitdefender Threat Debrief rankings for the month, and July adding 42 victims to its tally. To date this year the group claims more than…
gbhackers.com -
FireCompass Raises $20 Million for Offensive Security Platform
FireCompass has announced a $20 million strategic funding round to push its AI-powered automated penetration testing and red-teaming platform, aimed at accelerating research and development, hiring, and global go-to-market expansion. Founded in 2019 in…
SecurityWeek -
In Other News: Scammers Abuse Grok, US Manufacturing Attacks, Gmail Security Claims Debunked
Scammers have exploited X’s generative AI chatbot Grok to lure users to their websites. According to Guardio, Nati Tal reported that scammers bypass X’s ban on links in promoted posts by including the links in a post’s From field. The scammers then reply to…
SecurityWeek -
Cyber Assessment Framework v4.0 | Key Updates for Security Teams
The Darktrace post explains that the Cyber Assessment Framework v4.0 (CAF v4.0) introduces substantial updates to threat detection, response and proactive security posture, reflecting a shifting threat landscape. On 6 August 2025, the UK National Cyber…
darktrace.com -
Threat Actors Exploit ScreenConnect Installers for Initial Access
Threat Actors are increasingly abusing ConnectWise ScreenConnect installers to gain initial access, with a marked escalation since March 2025 and US-based businesses bearing the brunt, according to Acronis TRU. Adversaries now deploy lightweight ClickOnce…
gbhackers.com -
U.S. CISA adds Sitecore, Android, and Linux flaws to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three flaws to its Known Exploited Vulnerabilities (KEV) catalog, covering Sitecore, Android and Linux products, according to CISA’s KEV update. The entries are CVE-2025-38352, a…
Security Affairs -
10 Best Attack Surface Management (ASM) Companies in 2025
The article, dated 5 September 2025 and written by Kaaviya, ranks 10 ASM vendors for 2025, with Randori highlighted as now part of IBM Security. It describes Attack Surface Management as a proactive discipline that discovers, maps, and continuously monitors…
gbhackers.com -
Critical SAP S/4HANA Vulnerability Actively Exploited, Allowing Full System Takeover
A critical security flaw in SAP S/4HANA, tracked as CVE-2025-42957, is being actively exploited by attackers, according to SecurityBridge. The vulnerability carries a CVSS score of 9.9 out of 10 and allows a low-privileged user to execute code injection and…
gbhackers.com -
CISA Warns: TP-Link Vulnerabilities Under Active Exploitation
According to CISA, urgent warnings have been issued about critical vulnerabilities in popular TP-Link router models that are currently being actively exploited. Two flaws have been added to the Known Exploited Vulnerabilities (KEV) catalog: CVE-2025-9377, an…
gbhackers.com -
New Exploit Bypasses Code Integrity to Backdoor Signal, 1Password, Slack, and More
A new security exploit has been discovered that lets attackers slip unsigned code into widely used Electron-based desktop apps, including Signal, 1Password, Slack, and Google Chrome, by evading built-in code integrity checks. The flaw, tracked as Electron…
gbhackers.com -
SAP S/4HANA Critical Vulnerability CVE-2025-42957 Exploited in the Wild
A critical security vulnerability in SAP S/4HANA, tracked as CVE-2025-42957, is being exploited in the wild. According to the NIST National Vulnerability Database, the command injection flaw affects a function module exposed via RFC, enabling an attacker to…
The Hacker News -
LockBit 5.0 & Ransomware Cartel: What You Need To Know?
LockBit 5.0 marks the latest step in the group’s evolution, described as more modular with faster encryption and improved evasion, following a 2019 rebrand from ABCD to LockBit and a refresh of its affiliate programme. In February 2024, the group suffered a…
SOCRadar -
CISA Issues Alert on Android 0-Day Use-After-Free Vulnerability Under Active Exploitation
According to CISA, a newly discovered zero-day in the Android Runtime component is a use-after-free flaw that could allow attackers to escape the Chrome sandbox and achieve local privilege escalation on affected devices. The agency warns the vulnerability is…
gbhackers.com -
Qantas CEO, top executives lose $522,000 in pay for major cyber breach
Qantas Airways Ltd. Chief Executive Officer Vanessa Hudson and her top leadership team were docked A$800,000 ($522,000) in pay for a cyberbreach that impacted millions of customers, according to the airline’s annual report. Hudson forfeited A$250,000 in…
DataBreaches -
North Korean Hackers Targeted Hundreds in Fake Job Interview Attacks
According to SentinelLabs, at least 230 individuals were targeted in fake cryptocurrency job interview attacks between January and March 2025, with the figure possibly higher. The Contagious Interview campaign, which began in 2022 and was seen employing the…
SecurityWeek -
Introducing the NPM Package Cooldown Check
The NPM Package Cooldown Check is a new GitHub PR check from StepSecurity designed to automatically block pull requests that introduce newly released npm package versions, with the aim of reducing exposure to potentially compromised dependencies. By default…
StepSecurity -
SVG files used in hidden malware campaign impersonating Colombian authorities
VirusTotal researchers uncovered a phishing campaign that uses SVG files with hidden JavaScript to deploy fake Fiscalía General de la Nación login pages in Colombia and spread malware. The researchers note that, although SWF files are outdated, they are…
Security Affairs -
New Malware Exploits Windows Character Map to Evade Defender and Mine Crypto
A sophisticated cryptojacking campaign hijacks Windows’ native Character Map utility (charmap[.]exe) to evade Defender and covertly mine cryptocurrency on compromised machines, first detected in late August 2025. The threat chain starts with a spear-phishing…
gbhackers.com -
Circle to Search Gets an Upgrade: Now It Can Translate as You Scroll
Circle to Search has been upgraded to translate as you scroll, with translations now remaining visible while you skim through content on a smartphone. Google recently announced the update, and the feature also persists when users switch to another app,…
SecurityOnline -
Google Fined €325M by French Regulator for Privacy Violations
Google has been fined €325 million by French regulator CNIL for privacy violations related to tracking cookies and personalised advertising. The regulator said the issue affected an estimated 74 million Gmail users in France and ruled that cookies were a…
SecurityOnline
