News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Mon 8 Sep 2025· 72 articles
-
Microsoft Is Discontinuing Outlook Lite: What to Do Next
According to Microsoft, the company has decided to cease development of the lightweight mail client Outlook Lite as of October 6, 2025, and from that date forward users will no longer be able to install it on their devices, with existing users able to…
SecurityOnline -
Apache Jackrabbit Vulnerability Exposes Systems to Remote Code Execution Attacks
A new security flaw has been discovered in Apache Jackrabbit, a widely used content repository system, potentially exposing thousands of applications to remote code execution risks. The vulnerability, tracked as CVE-2025-58782, affects both Apache Jackrabbit…
gbhackers.com -
The End of an Era? Nova Launcher’s Future Is Now in Doubt
According to Daily CyberSecurity, Nova Launcher’s future has become uncertain following a series of corporate upheavals at Branch, which acquired the launcher in 2022 along with its 12‑member development team. During the 2024 layoffs, the entire Nova…
SecurityOnline -
Tenable Data Breach Confirmed -Customer Contact Details Compromised
Tenable Data Breach Confirmed, with customer contact details compromised, according to Tenable. The attack targeted Salesforce and Salesloft Drift integrations, and Tenable was one of the organisations caught up in the incident. The breach involved…
gbhackers.com -
A week in security (September 1 – September 7)
According to Malwarebytes, a week in security for 1–7 September 2025 highlights several notable incidents and updates. The roundup includes Nexar dashcam video database hacked, published on 5 September 2025. It also notes Roblox introducing age checks to use…
Malwarebytes -
Lazarus APT Deploys ClickFix Technique to Exfiltrate Sensitive Intelligence Data
The Lazarus APT group has evolved its attack methods by incorporating the ClickFix social engineering technique into its cyber espionage operations, according to GBHackers. The article notes that ClickFix involves fake system faults presented to victims who…
gbhackers.com -
Hackers Exploit Fake Microsoft Teams Site to Spread Odyssey macOS Stealer
Hackers have set up a fraudulent Microsoft Teams download site, hosted at teamsonsoft[.]com, to distribute the Odyssey macOS stealer, a campaign that researchers say uses a “clickfix” approach to exploit user trust in legitimate software. The campaign first…
gbhackers.com -
GPUGate Malware Leverages Legitimate Platforms to Deliver Advanced Payloads
A malware campaign dubbed GPUGate is exploiting trusted platforms and hardware-dependent evasion to deliver its payload across Western Europe, with researchers noting the attackers use Google Ads and GitHub infrastructure to spread it. Arctic Wolf’s…
gbhackers.com -
CISA Alerts on WhatsApp 0-Day Vulnerability Actively Exploited in Attacks
CISA has issued an urgent warning about a newly discovered zero-day vulnerability in WhatsApp, tracked as CVE-2025-55177, which is already being exploited in active attacks. The flaw, due to an incorrect authorization check in WhatsApp’s linked device…
gbhackers.com -
New GhostAction Attack Compromises 327 GitHub Users and 817 Repositories
Security researchers uncovered a campaign now identified as GhostAction that compromised secrets belonging to 327 GitHub users and affected 817 repositories. The attack began with a malicious workflow embedded in the FastUUID project and was first spotted…
gbhackers.com -
Critical Argo CD API Flaw Exposes Repository Credentials to Attackers
A major security flaw has been discovered in Argo CD, a popular open‑source tool for Kubernetes GitOps deployments, which allows project‑level API tokens to expose repository credentials to attackers. The vulnerability, tracked as CVE-2025-55190 with a CVSS…
gbhackers.com -
Mozilla Keeps Extending Firefox Support for Windows 7
Since 2023, the Mozilla Foundation has been gradually phasing out support for legacy operating systems, including Windows 7, Windows 8, Windows 8.1, macOS 10.12, macOS 10.13 and macOS 10.14, and at the time relied on Firefox ESR version 115 to extend…
SecurityOnline -
PgAdmin Flaw Exposes Accounts to OAuth Hijacking Attacks
SecurityOnline -
CVE-2025-57807: A Critical Flaw in ImageMagick Could Lead to RCE, PoC Available
CVE-2025-57807 is a critical flaw in ImageMagick that could lead to remote code execution, with a proof-of-concept exploit already released. Security researcher Lumina Mescuwa disclosed the heap out-of-bounds write arising from a contract mismatch between…
SecurityOnline -
Azure to Enforce MFA for All Resource Management Operations
Microsoft is extending its MFA rollout, with starting 1 October 2025 mandatory MFA for all resource management operations across Azure, including Azure CLI, PowerShell, SDKs, REST APIs and IaC tools. Phase 1 rolled out earlier for Azure Portal, Microsoft…
SecurityOnline -
A New Threat to Artists: Hackers Threaten to Feed Stolen Art to AI
Hackers have begun using stolen artwork from Artists&Clients as leverage for extortion, following an August 30 infiltration of the platform that connects artists with clients and manages commissions. In a threatening message, they claimed all files were…
SecurityOnline -
Microsoft Access 2016/2019 Is Nearing End-of-Life
Microsoft Access 2016/2019 is nearing its end of life, with support for the Access 2016 and 2019 editions set to end on 14 October 2025, the same date that the Office 2016 and 2019 suites reach end of support. The article notes that while users may continue…
SecurityOnline -
Wealthsimple Data Breach – User Information Leaked Online
Wealthsimple disclosed a data security incident on 5 September 2025, revealing that personal information belonging to less than one per cent of its clients was accessed without authorisation. The breach, detected on 30 August, prompted the company to…
gbhackers.com -
CVE-2025-58782: Apache Jackrabbit Vulnerability Exposes Systems to JNDI Injection and RCE
CVE-2025-58782 is a newly disclosed vulnerability in Apache Jackrabbit Core and JCR Commons that introduces a JNDI injection risk for versions 1.0.0 through 2.22.1, potentially enabling remote code execution through deserialization when JNDI URIs are used…
SecurityOnline -
Microsoft Gives U.S. University Students Free Microsoft 365 Personal
Microsoft has announced that it will provide all university students across the United States with a free one-year subscription to Microsoft 365 Personal. The plan includes the full suite of features, offering 1TB of OneDrive storage along with access to…
SecurityOnline -
iPhone 17 Air: A Beautifully Thin Phone, but with Major Compromises
Apple has announced that its autumn keynote will take place on 9 September at 10:00 a.m. Pacific Time, unveiling a new product with a breakthrough design—rumoured to be the long-speculated iPhone 17 Air. According to Bloomberg, the device is expected to have…
SecurityOnline -
Qualcomm CEO: Intel’s Foundry Is Not Ready for Our Chips
Qualcomm CEO Cristiano Amon has said Intel’s chip production technology is not yet sufficient for Qualcomm to consider it a viable manufacturing partner, even though the company would like Intel to eventually become one of its options. Qualcomm continues to…
SecurityOnline -
iOS 26 Finally Unlocks Full-Resolution Screen Recording
iOS 26 finally removes the long-standing limitation on screen recording by allowing higher resolution capture, according to 9to5mac. The article notes that previously, screen recordings were capped at 1920 pixels, a restriction that persisted even with the…
SecurityOnline -
Noisy Bear: A New APT Group Is Spying on Kazakhstan’s Energy Sector
Seqrite’s analysis describes Noisy Bear as a newly discovered threat actor active since April 2025 and targeting Kazakhstan’s oil and gas sector, with initial and ongoing emphasis on KazMunaiGas (KMG). The group uses spear-phishing, PowerShell loaders and…
SecurityOnline -
Progress Patches Remote Command Execution Flaw in OpenEdge AdminServer (CVE-2025-7388)
Progress Software has issued patches for a high-severity OpenEdge AdminServer flaw tracked as CVE-2025-7388 (CVSS 8.4), which enables Remote Command Execution (RCE) via the Java RMI interface in OpenEdge LTS releases 12.2.17, 12.8.8, and earlier versions.…
SecurityOnline -
NightshadeC2: A New Botnet Is Using “UAC Prompt Bombing” to Bypass Windows Defender
NightshadeC2 is a newly identified botnet family identified by the eSentire Threat Response Unit (TRU) and deployed via a loader that combines social engineering, Windows Defender exclusions, and evasion tactics, with a particular focus on “UAC Prompt…
SecurityOnline -
Podman Patches Symlink Traversal Vulnerability in kube play Command (CVE-2025-9566)
The Podman project has issued a security advisory warning of a high-severity vulnerability in the container management tool’s kube play command, tracked as CVE-2025-9566 (CVSS 8.1). According to the advisory, the flaw could allow malicious containers to…
SecurityOnline -
50,000 Emails a Day: How a Cloud Flaw Is Fueling Phishing Campaigns
The Wiz Research team revealed details of a May 2025 phishing campaign that weaponised Amazon Simple Email Service (SES) using compromised AWS keys. The operation stood out for its scale and for its use of previously undocumented attack patterns designed to…
SecurityOnline -
Czech cyber agency NUKIB flags Chinese espionage risks to critical infrastructure
According to Czech cybersecurity agency NUKIB, Chinese-linked technologies pose growing risks to critical sectors such as energy, healthcare, transport and government, with devices including IP cameras, PV inverters, smart meters and other connected…
Security AffairsAPT31 -
CVE-2025-57052: Critical JSON Parsing Flaw in cJSON With CVSS 9.8, PoC Available
CVE-2025-57052 is described as a critical JSON parsing flaw in the cJSON library, tracked with CVSS 9.8 and with a PoC available, disclosed by security researcher Salah Chafai. The issue lies in the decode_array_index_from_pointer function within…
SecurityOnline -
Anthropic to Pay Authors $1.5B in Landmark AI Copyright Settlement
Anthropic has agreed to pay $1.5 billion to settle lawsuits brought by authors and publishers who accused the company of using millions of copyrighted books to train its Claude model. Specifically, Anthropic allegedly downloaded material from free pirated…
SecurityOnline -
Google to Restrict Android Sideloading in New Security Push
Google has announced that, beginning in 2026, application developers will gradually be required to undergo identity verification, with only applications carrying a verified developer signature permitted for sideloading on Android. In other words, the direct…
SecurityOnline
