News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Wed 17 Sep 2025· 77 articles
-
Palo Alto Networks and Microsoft Featured in MITRE ATT&CK Evaluations 2026
Two cybersecurity industry leaders have announced their participation in the upcoming MITRE ATT&CK Evaluations, signalling a shift in how vendors validate security performance. Palo Alto Networks, a six-year veteran of the ATT&CK Evaluations, announced its…
gbhackers.com -
Microsoft Takes Down 300+ Websites Behind RaccoonO365 Phishing Scheme
According to Microsoft’s Digital Crimes Unit (DCU), its action seized control of 338 websites facilitating RaccoonO365, a phishing-as-a-service platform used to harvest Microsoft 365 credentials. Acting under a court order from the Southern District of New…
gbhackers.com -
Shai-Hulud Supply Chain Attack: Worm Used to Steal Secrets, 180+ NPM Packages Hit
SecurityWeek reports that the Shai-Hulud supply chain attack hit more than 180 NPM packages, using a self-replicating worm to harvest secrets, publish them to GitHub, and push private repositories into public view. The intrusion began on 14 September 2025,…
SecurityWeek -
World’s Biggest Hacker Forum Admin Gets Resentenced to Serve Three More Years
Conor Brian Fitzpatrick, the founder and operator of BreachForums, has been resentenced to three more years in prison after a federal appeals court vacated his earlier light sentence. According to The Justice Department, he created and ran one of the world’s…
gbhackers.com -
YouTube Unveils AI-Powered Creator Tools to Revolutionize Content Creation
At a creator-focused launch event, YouTube officially unveiled a suite of AI-driven features designed to streamline content production and boost audience engagement. One highlight is an AI-powered tool that can automatically edit raw footage into a “draft…
SecurityOnline -
Scattered Spider Resurfaces With Financial Sector Attacks Despite Retirement Claims
Cybersecurity researchers have tied a fresh round of attacks on the financial sector to the Scattered Spider group, casting doubt on their retirement claims. According to ReliaQuest, there are indications the threat actor has shifted focus to financial…
The Hacker NewsScattered Spider -
Firefox Password Manager: Stronger Security With New Encryption
Firefox’s password manager now uses server-side cloud synchronization protected by AES-256-GCM, with data in the cloud encrypted by Mozilla Foundation, according to Mozilla Foundation. For local use, data must still be transmitted to the device for…
SecurityOnline -
RaccoonO365 Phishing Service Disrupted, Leader Identified
RaccoonO365 Phishing Service Disrupted, Leader Identified reports that Microsoft and Cloudflare teamed up to dismantle the RaccoonO365 operation, a phishing service used to steal thousands of users’ credentials. The service has been rented on a…
SecurityWeek -
Adtech Abused by Threat Actors to Spread Malicious Advertisements
Malicious advertising campaigns have surged in sophistication, with cybercriminals exploiting and even operating adtech firms to deliver malware, credential stealers and phishing schemes directly through mainstream ad networks. A cluster of interconnected…
gbhackers.com -
Kubernetes C# Client Flaw Exposes API Server to MiTM Attacks
A recently disclosed vulnerability in the Kubernetes C# client library allows attackers to carry out man-in-the-middle (MiTM) attacks against the API server. The flaw arises from improper certificate validation when using custom certificate authorities…
gbhackers.com -
PureHVNC RAT Developers Exploit GitHub to Spread Pure Malware Source Code
The PureHVNC RAT developers have been found using GitHub repositories to host critical components and plugin source code for their Pure malware family, according to Check Point Research. In an eight-day ClickFix intrusion campaign, the RAT’s…
gbhackers.com -
Python-Based “XillenStealer” Campaign Targets Windows Users’ Sensitive Data
A Python-based information stealer named XillenStealer has emerged as a significant threat to Windows users, designed to harvest sensitive system data, browser credentials and cryptocurrency wallet information. It operates through a builder framework called…
gbhackers.com -
DOJ Resentences BreachForums Founder to 3 Years for Cybercrime and Possession of CSAM
According to U.S. Attorney Erik S. Siebert for the Eastern District of Virginia, the U.S. Department of Justice has resentenced Conor Brian Fitzpatrick (aka Pompompurin), the former administrator of BreachForums, to three years in prison for his role in…
The Hacker News -
New FileFix Steganography Campaign Spreads StealC Malware
A new FileFix Steganography campaign is incrementally maturing, representing the first documented real‑world deployment of FileFix attacks beyond proof‑of‑concept demonstrations, according to Acronis’ Threat Research Unit. The attack delivers StealC, a…
gbhackers.com -
Supply Chain Attack “Shai-Halud” Targets 477 NPM Packages
A major supply chain attack dubbed “Shai-Halud” has targeted the JavaScript ecosystem by affecting over 477 NPM packages, according to GBhackers on Security. The campaign was first detected by security researchers who identified suspicious activity linked to…
gbhackers.com -
Wave of 40,000+ Cyberattacks Target API Environments
The GBHackers piece reports a dramatic surge in API-targeted activity, with security researchers documenting over 40,000 API incidents across more than 4,000 monitored environments in the first half of 2025. It notes that APIs have become the primary gateway…
gbhackers.com -
Apple backports fix for actively exploited CVE-2025-43300
Apple has backported patches for a recently addressed actively exploited vulnerability tracked as CVE-2025-43300, which affects iOS, iPadOS and macOS. In August 2025, Apple fixed an out-of-bounds write flaw in the ImageIO framework after reports that it was…
Security Affairs -
BitPixie Windows Boot Manager Flaw Lets Hackers Escalate Privileges
BitPixie is a vulnerability nicknamed in Windows Boot Manager that allows attackers to bypass BitLocker drive encryption and escalate privileges, security researchers have revealed. The flaw stems from a weakness in the PXE soft reboot feature, which fails…
gbhackers.com -
Linux Kernel KSMBD Flaw Lets Remote Attackers Drain Server Resources
A critical vulnerability in the Linux kernel’s KSMBD implementation has been revealed, allowing remote attackers to exhaust server connection resources through a simple denial-of-service attack. The flaw, tracked as CVE-2025-38501 and dubbed “KSMBDrain,” can…
gbhackers.com -
RaccoonO365 Phishing Network Shut Down After Microsoft and Cloudflare Disrupt 338 Domains
RaccoonO365, a phishing-as-a-service toolkit, was dismantled after Microsoft’s Digital Crimes Unit teamed up with Cloudflare to seize 338 domains tied to the operation. Microsoft said the takedown disrupted the group’s infrastructure, cutting off criminals’…
The Hacker News -
NVIDIA Patches Critical RCE Flaw (CVE-2025-23316, CVSS 9.8) in Triton Inference Server
NVIDIA has released a software update addressing multiple high- and critical-severity vulnerabilities in its Triton Inference Server, a platform widely used for deploying AI models in production. The most severe issue, CVE-2025-23316 (CVSS 9.8 – Critical),…
SecurityOnline -
Multiple High-Severity Vulnerabilities Found in HPE Aruba Networking EdgeConnect SD-WAN Gateways
According to HPE Aruba Networking, patches addressing multiple high- and medium-severity vulnerabilities have been released for its EdgeConnect SD-WAN Gateways, with successful exploitation potentially leading to privilege escalation, unauthorized access,…
SecurityOnline -
A New Crisis for CrowdStrike: A Self-Replicating Worm Has Compromised Its NPM Packages
According to Brian Krebs, approximately 25 CrowdStrike-maintained NPM packages were compromised by a malware strain named Shai-Hulud, described as a self-replicating worm. The malware’s infection chain allows it to scan developers’ machines for access tokens…
SecurityOnline -
A New Way to Pay: Apple Wallet Is Getting a New Security Feature
In iOS 26, Apple has introduced a feature in the Wallet app that lets users securely store the full details of their physical bank cards, including the cardholder’s name, card number, expiration date, and security code. According to Apple, your full card…
SecurityOnline -
A Legal Breakthrough: Internet Archive Settles Copyright Lawsuit with Record Labels
The article reports that Sony Music, Universal Music Group (UMG) and several other record labels sued the Internet Archive in 2023 over the Great 78 Project, but the case has now reached a settlement. Documents were submitted to the court confirming that a…
SecurityOnline -
A Security Engineer’s Mistake Led to a Ransomware Breach
Huntress recently disclosed a security incident in which one of its engineers stored recovery codes for a system account in plain text on a desktop, enabling attackers to steal them when the engineer’s system was compromised. Armed with these codes, the…
SecurityOnlineStorm-1567 -
Avert the Ban: A U.S.-China Deal Will Grant Americans Majority Control Over TikTok
According to The Wall Street Journal, the United States and China have approached a final agreement under which TikTok’s U.S. operations would come under majority American control. US investors would hold roughly 80% of the equity, while Chinese shareholders…
SecurityOnline -
BreachForums Founder Resentenced to Three Years in Prison for Cybercrime
The U.S. Department of Justice announced that Conor Brian Fitzpatrick, 22, of Peekskill, New York, has been resentenced to three years in prison for his role in creating and operating BreachForums, described as one of the world’s largest English-language…
SecurityOnline -
Kubernetes C# Client Flaw Exposes API to MITM Attacks (CVE-2025-9708)
A newly disclosed vulnerability in the Kubernetes C# client has been assigned CVE-2025-9708 with a CVSS score of 6.8 (Medium severity) and stems from improper certificate validation in custom Certificate Authority mode, creating the risk of man-in-the-middle…
SecurityOnline -
RevengeHotels Strikes Back: AI-Generated Phishing and a New RAT Target Hotels
RevengeHotels, also tracked as TA558, has resurfaced with a new campaign targeting hotels and the wider hospitality sector, extending its long-running fraud of stealing card data from guests. The latest campaigns observed in summer 2025 rely on phishing…
SecurityOnlineRevengeHotels -
Shai-Hulud Supply Chain Attack Now Targets CrowdStrike’s npm Packages
The Shai-Hulud supply chain campaign has again struck, this time compromising multiple npm packages published under the CrowdStrike publisher account, according to the Socket Research Team. The incident mirrors earlier attacks against popular packages such…
SecurityOnline -
KSMBDrain (CVE-2025-38501): Linux Kernel Flaw Allows Remote DoS Attacks, PoC Available
KSMBDrain (CVE-2025-38501) is a Linux kernel flaw in the KSMBD subsystem that enables remote denial-of-service by exhausting server resources, with a public PoC available. The vulnerability affects Linux kernels since version 5.3, when KSMBD was first merged…
SecurityOnline -
APT28’s BeardShell Campaign: Steganography, Cloud Abuse, and Persistent Espionage
The article, published on 17 September 2025, reports that the Russian‑linked threat actor APT28, also known as Sofacy, Fancy Bear, Forest Blizzard and TAG-110, has unveiled a new wave of cyber‑espionage in 2025 targeting Ukrainian military administration and…
SecurityOnlineAPT28 -
SmokeLoader Rises From the Ashes with New, Evasive Variants
SmokeLoader has re-emerged with two new variants after being partially dismantled in 2024’s Operation Endgame, with ThreatLabz researchers reporting updates in early 2025 and again in July 2025. According to ThreatLabz, the rebuilt variants—SmokeLoader 2025…
SecurityOnline -
PureHVNC RAT: Inside the HVNC Malware and the PureCoder Ecosystem
A forensic investigation by Check Point Research has shed light on the Pure malware family, a suite developed and sold by a threat actor known as PureCoder, and centres on a ClickFix phishing campaign that resulted in an eight-day intrusion involving a Rust…
SecurityOnline -
AISURU Botnet: From Record-Breaking DDoS to Residential Proxy Empire
The AISURU botnet, first disclosed by XLab in 2024, has rapidly become a major force in the DDoS landscape, with 2025 seeing multiple record-breaking attacks, including an 11.5 Tbps event mitigated by Cloudflare. According to XLab, peak bandwidth for global…
SecurityOnline -
North Korean Group Targets South With Military ID Deepfakes
The North Korea-linked group Kimsuky has begun using ChatGPT and other AI services to generate images for fake identities, aimed at strengthening social engineering and obfuscating code execution, according to Dark Reading. In the latest attack, the group…
Dark Reading
