News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Fri 12 Sep 2025· 61 articles
-
Trusted Connections, Hidden Risks: Token Management in the Third-Party Supply Chain
Trusted Connections, Hidden Risks: Token Management in the Third-Party Supply Chain highlights how OAuth tokens and other credentials have become high‑value targets in cloud‑based integrations, with a recent high‑severity scenario involving a third‑party…
unit42.paloaltonetworks.com -
French Advisory Sheds Light on Apple Spyware Activity
According to CERT-FR, France’s national cybersecurity agency, a recent advisory shed more light on spyware attacks against Apple users, noting four Apple security notifications this year, the latest issued on 3 September. The advisory comes after Apple…
Dark Reading -
AI browsers or agentic browsers: a look at the future of web surfing
The article discusses a new generation of AI-powered or “agentic” browsers that embed AI agents directly into the browsing experience, acting as personal assistants rather than simply adding plugins. It highlights several examples, including the Dia browser,…
Malwarebytes -
From Fitbit to financial despair: How one woman lost her life savings and more to a scammer
Posted on 12 September 2025, the Malwarebytes feature recounts Karen’s long-running box scam, which began on 1 January 2020 after a man named Charles Hillary connected with her on the Fitbit app. According to the FBI, Karen filed a police report at her local…
Malwarebytes -
Samsung Fixes Critical Zero-Day CVE-2025-21043 Exploited in Android Attacks
Samsung has released its monthly Android security updates, including a fix for CVE-2025-21043, a high-severity out-of-bounds write that could allow remote code execution. The vulnerability, which carries a CVSS score of 8.8, affects the…
The Hacker News -
Apple Warns French Users of Fourth Spyware Campaign in 2025, CERT-FR Confirms
According to CERT-FR, Apple has notified users in France of a spyware campaign targeting their devices, marking the fourth time this year that Apple has alerted citizens that an iCloud-linked device may have been compromised in highly-targeted attacks. The…
The Hacker News -
In Other News: $900k for XSS Bugs, HybridPetya Malware, Burger King Censors Research
In this week’s round-up, SecurityWeek reports that Burger King’s parent, Restaurant Brands International, used a DMCA complaint to censor security research detailing vulnerabilities in RBI systems. Noteworthy vulnerabilities were reported with RBI’s systems,…
SecurityWeek -
Cisco fixes high-severity IOS XR flaws enabling image bypass and DoS
Cisco has addressed multiple high-severity IOS XR vulnerabilities as part of its semiannual Software Security Advisory Bundled Publication published on 10 September 2025, which cover ARP-related issues, image verification bypasses and management-interface…
Security Affairs -
Without Federal Help, Cyber Defense Is Up to the Rest of Us
Without Federal Help, Cyber Defense Is Up to the Rest of Us argues that the future of US cyber defences hinges on ongoing federal support, as key agency activities are being scaled back. The piece notes that the Cybersecurity and Infrastructure Security…
Dark Reading -
HybridPetya Exploits UEFI Vulnerability to Bypass Secure Boot on Legacy Systems
According to ESET Research, a ransomware variant named HybridPetya has been uncovered that exploits a UEFI vulnerability to bypass Secure Boot on legacy systems, using CVE-2024-7344 to defeat protections. The malware installs a malicious EFI application…
gbhackers.com -
Undocumented Radios Found in Solar-Powered Devices
The US Department of Transportation’s Federal Highway Department has warned highway agencies and infrastructure firms to scan solar-powered highway infrastructure for undocumented radios hidden inside batteries and inverters, a concern highlighted in a 10…
Dark Reading -
DELMIA Factory Software Vulnerability Exploited in Attacks
Threat actors are exploiting a critical-severity vulnerability in DELMIA Apriso factory software, according to CISA. Tracked as CVE-2025-5086, the flaw has a CVSS score of 9.0 and stems from a deserialization of untrusted data, affecting DELMIA Apriso…
SecurityWeek -
Yurei & The Ghost of Open Source Ransomware
Yurei, a newly emerged ransomware group, was first observed on 5 September and listed a Sri Lankan food manufacturing company as its initial leaked victim, operating under a double-extortion model that encrypts files and exfiltrates data before demanding…
Check Point -
Microsoft Windows Defender Firewall Vulnerabilities Allow Privilege Escalation
Microsoft has disclosed four newly discovered vulnerabilities in its Windows Defender Firewall Service that could enable privilege escalation on affected Windows systems. The flaws, tracked as CVE-2025-53808, CVE-2025-54104, CVE-2025-54109, and…
gbhackers.com -
EvilAI: Leveraging AI to Steal Browser Data and Evade Detection
EvilAI is a new malware family tracked by Trend™ Research that has emerged in recent weeks, disguising itself as legitimate AI-driven utilities. According to Trend™ Research, they began tracking EvilAI on August 29 and observed a global wave of infections…
gbhackers.com -
Top 10 Best Breach and Attack Simulation (BAS) Tools in 2025
The 2025 round-up of Top 10 Best Breach and Attack Simulation (BAS) Tools highlights a shift toward continuous, data‑driven validation of security controls. The list includes Cymulate, AttackIQ, SafeBreach, Picus Security, XM Cyber, Scythe, Randori (IBM…
gbhackers.com -
Apple Sends Fresh Wave of Spyware Notifications to French Users
Apple has, this year, sent at least four rounds of notifications to French users potentially targeted by commercial spyware, with September marking the latest wave. According to CERT-FR, the French national Computer Emergency Response Team, the alert records…
SecurityWeek -
New HybridPetya Ransomware Bypasses UEFI Secure Boot With CVE-2024-7344 Exploit
Cybersecurity researchers have identified a new ransomware variant called HybridPetya that mirrors Petya/NotPetya while adding the ability to bypass UEFI Secure Boot using CVE-2024-7344, a vulnerability now patched by Microsoft’s January 2025 updates.…
The Hacker News -
New Malware Abuses Azure Functions to Host Command and Control Infrastructure
A malicious ISO image named Servicenow-BNM-Verify[.]iso was uploaded to VirusTotal from Malaysia, according to VirusTotal. The image contains four files, with a visible Windows shortcut, servicenow-bnm-verify[.]lnk, which launches PanGpHip[.]exe, a Palo Alto…
gbhackers.com -
Samsung fixed actively exploited zero-day
Samsung fixed the remote code execution flaw CVE-2025-21043, which was exploited in zero-day attacks against Android devices. The flaw is an out-of-bounds write in libimagecodec.quram[.]so prior to SMR Sep-2025 Release 1, and a remote attacker can exploit it…
Security Affairs -
U.S. Senator accuses Microsoft of “gross cybersecurity negligence”
U.S. Senator Ron Wyden has sent a letter to the Federal Trade Commission requesting an investigation into Microsoft for failing to provide adequate security in its products, which allegedly led to ransomware attacks against healthcare organisations,…
DataBreaches -
New Malvertising Campaign Exploits GitHub Repositories to Distribute Malware
A sophisticated malvertising campaign has been uncovered that targets unsuspecting users through dangling commits in legitimate GitHub repositories, injecting promotional content for a counterfeit GitHub Desktop installer into popular development and…
gbhackers.com -
F5 to Acquire CalypsoAI for $180 Million
According to SecurityWeek, F5 is acquiring CalypsoAI for $180 million, mainly in cash, to bolster its adaptive AI inference security capabilities. CalypsoAI has developed a platform that provides adaptive protection against prompt injection and jailbreaks,…
SecurityWeek -
Critical CVE-2025-5086 in DELMIA Apriso Actively Exploited, CISA Issues Warning
The Hacker News reports that CVE-2025-5086 in Dassault Systèmes DELMIA Apriso Manufacturing Operations Management software is now classified as critical and actively exploited, leading to its addition to the Known Exploited Vulnerabilities catalog by CISA,…
The Hacker News -
CISA: CVE Program to Focus on Vulnerability Data Quality
According to CISA, the CVE Program should move into a new era focused on trust, responsiveness and vulnerability data quality, with expanded partnerships and transparency as its core aims. The programme, which turned 25 last year, has seen CNAs grow to over…
SecurityWeek -
VMScape: Academics Break Cloud Isolation With New Spectre Attack
VMScape is a Spectre-BTI based attack developed by academic researchers from ETH Zurich to break cloud isolation by leaking arbitrary memory from the host, including cryptographic keys, through the host–guest boundary. The PoC targets virtualization…
SecurityWeek -
Buterat Backdoor Campaigns Targeting Enterprise Endpoint Control
Buterat backdoor campaigns are targeting enterprise endpoint control, with the threat described as a covert, persistent backdoor designed to provide remote access and enable lateral movement. The article notes it was first identified in targeted attacks…
gbhackers.com -
UK train operator LNER (London North Eastern Railway) discloses a data breach
UK train operator LNER (London North Eastern Railway) disclosed a data breach that occurred through a third-party supplier, exposing customer contact details and information about past journeys, according to LNER. The organisation said the breach involved…
Security Affairs -
Malware Campaign Uses SVG Email Attachments to Deploy XWorm and Remcos RAT
Recent threat campaigns are using BAT-based loaders to deliver XWorm and Remcos RATs, starting with a ZIP that mimics legitimate content and is often hosted on ImgKit to entice interaction. According to GBHackers, the ZIP drops a highly obfuscated BAT script…
gbhackers.com -
Payment System Vendor Took Year+ to Patch Infinite Card Top-Up Hack: Security Firm
According to SEC Consult, a cybersecurity consulting firm under Eviden, KioSoft took a long time to address a serious vulnerability affecting some of its NFC-based cards. SEC Consult researchers identified that the stored-value cards used by KioSoft kiosks…
SecurityWeek -
Sidewinder Hackers Exploit LNK Files to Deploy Malicious Scripts
According to 360 Advanced Threat Research Institute, the Sidewinder APT group, also known as APT-C-24 or “Rattlesnake”, has adopted a new delivery method using Windows shortcut (LNK) files to orchestrate multi-stage intrusions across South Asia. Active since…
gbhackers.comRAZOR TIGER -
Axios Vulnerability Enables Attackers to Crash Node.js Applications via Data Handle Abuse
A critical security vulnerability in the Axios HTTP client library allows attackers to crash Node[.]js applications by abusing data URLs, tracked as CVE-2025-58754. The flaw affects all versions before 1.11.0 and has a CVSS 3.1 score of 7.5, marking it as…
gbhackers.com -
Apple issues spyware warnings as CERT-FR confirms attacks
Apple warned customers about a spyware campaign, with France’s cyber agency CERT-FR confirming that iCloud-linked devices may be compromised in targeted attacks. According to CERT-FR, Apple sent spyware alerts on March 5, April 29, June 25, and September 3,…
Security Affairs -
Cloud-Native Security in 2025: Why Runtime Visibility Must Take Center Stage
The Hacker News reports on 12 September 2025 that cloud-native security is evolving rapidly, with containers, Kubernetes and serverless technologies now the default for many organisations, expanding the attack surface beyond traditional security models. It…
The Hacker News -
LAPSUS$ Hunters 4.0 Announce Permanent Shutdown
In a startling development, on 8 September the Telegram channel “scattered LAPSUS$ hunters 4.0” said it would “go dark” after taunting law enforcement for repeated missteps. The group claimed victory over investigations and vowed that no future activity…
gbhackers.comScattered Lapsus Hunters -
Microsoft to Deprecate VBScript in Windows, Urges Developers to Update Projects
Microsoft has announced a phased deprecation of VBScript in Windows, with guidance for VBA developers who rely on VBScript libraries. The plan outlines three phases over coming years: Phase 1 remains active through 2026 or 2027 as an enabled Feature on…
gbhackers.com -
Apple Warns of Mercenary Spyware Attacks Targeting User Devices
Apple has issued urgent warnings about sophisticated mercenary spyware attacks targeting specific users worldwide, including journalists, activists, politicians and diplomats. The attacks cost millions of dollars and target only a small number of individuals…
gbhackers.com -
New K2 Think AI Model Falls to Jailbreak in Record Time
A groundbreaking vulnerability has emerged in the newly released K2 Think AI model from UAE’s Mohamed bin Zayed University of Artificial Intelligence (MBZUAI) in collaboration with G42. Security researchers from Adversa AI’s red teaming platform discovered…
gbhackers.com -
U.S. CISA adds Dassault Systèmes DELMIA Apriso flaw to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Dassault Systèmes DELMIA Apriso to its Known Exploited Vulnerabilities (KEV) catalog, tracked as CVE-2025-5086 with a CVSS score of 9.0. The flaw involves deserialization of untrusted…
Security Affairs -
New ToneShell Variant Uses Task Scheduler COM Service to Maintain Persistence
The latest ToneShell variant uses the Windows Task Scheduler COM service to maintain persistence, a shift from its previous DLL sideloading approach. It establishes a scheduled task named “dokanctl” that runs every minute from a randomly named folder inside…
gbhackers.com
