News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Tue 23 Sep 2025· 86 articles
-
ShadowV2 Botnet Exploits Misconfigured AWS Docker Containers for DDoS-for-Hire Service
ShadowV2 is a rental-style botnet described by Darktrace as targeting misconfigured Docker containers on AWS cloud servers to deploy a Go-based malware that turns infected systems into attack nodes for a larger DDoS-for-hire operation. The researchers said…
The Hacker News -
Top 25 MCP Vulnerabilities Reveal How AI Agents Can Be Exploited
SecurityWeek reports a new ranking of Model Context Protocol (MCP) weaknesses, highlighting risks from prompt injection to command injection and outlining a practical security framework for agentic AI. Developed by Anthropic and released as an open standard…
SecurityWeek -
ShadowV2 DDoS Service Lets Customers Self-Manage Attacks
ShadowV2 is a DDoS botnet that subdivides the traditional model by letting customers self-manage attacks through access to an infected Docker container network. The operators use a Python-based C&C platform hosted on GitHub CodeSpaces, with infection chains…
SecurityWeek -
Rethinking Cloud Investigations
Cloud breaches are surging as cloud adoption grows, with 82% of breaches now involving cloud-stored data, according to IBM Cost of a Data Breach, 2023. The piece notes that 65% of organisations experienced a cloud-related incident in the past year, and of…
darktrace.com -
Zloader Malware Used as Gateway for Ransomware Deployment in Corporate Networks
Zloader, a Zeus-based modular trojan, first emerged in 2015 and has transformed from a banking-focused threat into a tool for initial access and ransomware deployment in corporate networks. After a near two-year hiatus, it reappeared in September 2023 with…
gbhackers.com -
ShadowV2: An emerging DDoS for hire botnet
According to Darktrace, ShadowV2 is a DDoS-for-hire platform that combines a Python-based C2 framework hosted on GitHub Codespaces with a Go-based RAT and a multi-stage Docker deployment, all wrapped in a full operator UI and a modular API. The malware…
darktrace.com -
Beware of Fake Online Speedtest Apps with Hidden JavaScript Code
A GBHackers News report warns of fake online speedtest apps that disguise themselves with hidden JavaScript code and payloads designed to compromise systems and privacy. The infection begins when a user downloads what looks like a standard speedtest tool;…
gbhackers.com -
SolarWinds Web Help Desk Vulnerability Enables Privilege Escalation
A critical vulnerability in SolarWinds Web Help Desk (WHD) could allow unauthenticated attackers to escalate privileges and execute remote code on affected systems, with the flaw residing in the AjaxProxy deserialization mechanism. The issue is tracked as…
gbhackers.com -
Hackers Abuse IMDS Service for Cloud Initial Access
Hackers are increasingly abusing the Instance Metadata Service (IMDS) to gain initial access to cloud environments, a practice highlighted in a piece published on 23 September 2025. The article notes that IMDS provides temporary credentials and configuration…
gbhackers.com -
$150K awarded for L1TF Reloaded exploit that bypasses cloud mitigations
Researchers from Vrije Universiteit Amsterdam earned $150K for “L1TF Reloaded,” a flaw that combines L1TF (Foreshadow) and half-Spectre to leak VM memory from public clouds despite mitigations. The attack bypasses prior mitigations and can leak data from…
Security Affairs -
Scattered Spider Suspect Arrested in US
A juvenile suspected of being involved in cyberattacks against multiple Las Vegas casinos was arrested on 17 September 2025, and was booked on identity theft, extortion, and computer intrusion charges, according to the Las Vegas Metropolitan Police…
SecurityWeekScattered Spider -
GitHub Introduces npm Security with Stronger Authentication and Trusted Publishing
GitHub has announced significant npm security updates aimed at tightening authentication methods, introducing short‑lived tokens and trusted publishing to safeguard the software supply chain. In mid-September 2025, a self‑replicating worm known as the…
gbhackers.com -
Russia Leveraging Cyber-Attacks as a Strategic Weapon Against Key Industries in Major Nations
In a piece published on 23 September 2025, GBHackers reports that Russia is leveraging cyber-attacks as a strategic weapon to ease economic sanctions and bolster war-fighting capabilities by targeting key industries in major nations. The article notes that…
gbhackers.com -
GitHub Mandates 2FA and Short-Lived Tokens to Strengthen npm Supply Chain Security
GitHub announced changes aimed at strengthening the npm supply chain, including local publishing with required two-factor authentication (2FA) and granular tokens with a seven-day lifetime, plus trusted publishing that uses OpenID Connect to secure CI/CD…
The Hacker News -
Google Gemini Arrives on Google TV to Transform Your Living Room
Google has officially announced that its generative AI assistant Gemini will be fully integrated into the Google TV platform, debuting first on the TCL QM9K series before expanding to a wider range of smart TVs later this year. The update preserves the…
SecurityOnline -
Scammers are impersonating the FBI to steal your personal data
Scammers are impersonating the FBI’s Internet Crime Complaint Center (IC3) to steal people’s personal data, with spoofed versions of the IC3 website circulating online. The FBI issued an advisory last week warning that cybercriminals are setting up fake…
Malwarebytes -
No Going Back: Apple Disables iOS 26 Downgrades
Apple has rolled out a broad wave of automatic upgrades to iOS 26, and users who have already upgraded cannot undo the transition because Apple has disabled signature verification for iOS 18.6.2, meaning devices on iOS 26 can no longer roll back to 18.6.2. A…
SecurityOnline -
The End of Annoying Cookie Banners? The EU Is Finally Considering a New Law
The End of Annoying Cookie Banners? The EU Is Finally Considering a New Law notes that ten years ago the EU amended its internet regulations under the ePrivacy Directive, requiring explicit banners prompting users to grant or withhold consent for cookies.…
SecurityOnline -
iPhone 17 Users Report Wi-Fi Disconnection Issues
23 September 2025. Numerous reports on Apple’s forums and other online communities describe intermittent Wi‑Fi disconnections affecting the iPhone 17 family, including the iPhone 17, iPhone Air, iPhone 17 Pro and iPhone 17 Pro Max, with Wi‑Fi briefly…
SecurityOnline -
CVE-2025-26399 (CVSS 9.8): SolarWinds Web Help Desk Hit by Critical RCE Vulnerability
SolarWinds has released a hotfix for its Web Help Desk software after the discovery of a critical remote code execution vulnerability tracked as CVE-2025-26399, with a CVSS of 9.8. The flaw stems from an unauthenticated AjaxProxy deserialization issue and,…
SecurityOnline -
Automotive Titan Stellantis Discloses Data Breach
Stellantis has disclosed a data breach affecting a third-party service provider’s platform used in its North American operations. The company said it immediately activated incident response protocols, began a comprehensive investigation, and took action to…
SecurityWeek -
Massive 22.2 Tbps DDoS Attack Sets New World Record
According to Cloudflare, the largest distributed denial-of-service (DDoS) attack ever recorded was successfully mitigated, with a peak of 22.2 terabits per second and 10.6 billion packets per second. The incident, which lasted only about 40 seconds, crushed…
gbhackers.com -
BadIIS Malware Spreads via SEO Poisoning — Redirects Traffic, Plants Web Shells
Cybersecurity researchers have spotlighted an SEO poisoning campaign, dubbed Operation Rewrite, in which a Chinese-speaking threat actor uses a malware named BadIIS to hijack search results and drive traffic to compromised sites in East and Southeast Asia,…
The Hacker News -
Nimbus Manticore Targets Defense and Telecom Industries with New Malware Attack
According to Check Point Research, Nimbus Manticore is an Iranian-aligned threat actor also known as UNC1549, Smoke Sandstorm, and the “Iranian Dream Job” operation, targeting defence manufacturers, telecommunications, and aviation entities aligned with IRGC…
gbhackers.comUNC1549 -
Lectora Desktop and Online XSS Vulnerability Enables JavaScript Injection
On September 23, 2025, a critical cross-site scripting (XSS) vulnerability was disclosed affecting Lectora Desktop and Lectora Online, allowing attackers to inject JavaScript via crafted URL parameters. Discovered by researcher Mohammad Jassim and documented…
gbhackers.com -
European Airport Operations Disrupted by Ransomware
Passengers across Europe are facing ongoing flight delays after a cyber-attack struck the company behind the check-in and boarding software used at many airports, with London Heathrow, Brussels, Dublin and Berlin reported as the worst hit since Friday.…
gbhackers.com -
Canada’s RCMP closes TradeOgre, seizes $40M in country’s largest crypto bust
Canada’s RCMP has shut down the TradeOgre crypto exchange and seized $40 million worth of crypto assets, in what is described as the first crypto exchange closure and the largest asset seizure in Canadian history. According to the RCMP statement, RCMP…
Security Affairs -
Hackers Using SVG Files to Deliver Malicious Payloads
A recent Latin American malware campaign demonstrates how cybercriminals are evolving by weaponising oversized SVG files that carry the entire payload, including a remote-access trojan, without any external downloads. Victims are targeted with emails that…
gbhackers.com -
Hackers Exploit GitHub Notifications to Launch Phishing Attacks
Cybersecurity researchers have uncovered a phishing campaign that exploits GitHub’s official notification system to deliver malicious links and credential-stealing payloads. The attack hinges on messages that mimic GitHub’s standard notification format,…
gbhackers.com -
Libraesva ESG Vulnerability Allows Attackers to Execute Malicious Commands
A critical command injection flaw in Libraesva ESG email security gateways allows attackers to execute arbitrary commands via specially crafted compressed email attachments. The vulnerability, designated CVE-2025-59689, affects Libraesva ESG versions from…
gbhackers.com -
Windows 11 24H2 KB5064081 Update Causes Video Playback Issues
The Windows 11 24H2 update KB5064081, released on 29 August 2025, has disrupted video playback for protected content across several applications, causing black screens, freezes and interruptions, particularly for Digital TV broadcasts and BluRay or DVD…
gbhackers.com -
Threat Actors with Fake Job Lures Attacking Job Seekers to Deploy Advanced Malware
Iranian threat actors are exploiting job seekers’ aspirations through sophisticated fake recruitment campaigns designed to deploy advanced malware across Europe’s critical infrastructure sectors, according to Check Point Research. The operation, led by…
gbhackers.com -
NVIDIA to Invest $100 Billion to Power OpenAI’s AI Future
NVIDIA has announced an investment of up to $100 billion USD to support OpenAI in building AI data centres with a capacity of at least 10 gigawatts, all powered by NVIDIA’s GPU-accelerated systems. The plan specifies that funding will be released…
SecurityOnline -
Trump Confirms Dell & Murdochs Join Oracle in New TikTok Bid
In an interview on Sunday, 23 September 2025, Trump confirmed, according to CNBC, that the list of potential buyers for TikTok’s U.S. operations has been restructured. The consortium now includes Dell founder Michael Dell alongside Oracle founder Larry…
SecurityOnline -
Google DeepMind’s Gemini Developer Joins Elon Musk’s xAI
Dustin Tran, a Senior Researcher at Google DeepMind and a core developer of the Gemini project, has announced his departure after eight years to join Elon Musk’s xAI team, where he will help develop the next generation of Grok models. The move was first…
SecurityOnline -
OpenAI’s $100 Billion Compute Plan to Power the Future of AI
According to a report from The Information, OpenAI has already allocated as much as $16 billion USD for cloud computing resources, burning through tens of millions of dollars each day to keep services such as ChatGPT and GPT-5 operational. It also outlines a…
SecurityOnline -
Operation Rewrite: How a Malicious IIS Module Is Hijacking Websites
According to Unit 42, researchers uncovered a large-scale SEO poisoning campaign tracked as CL-UNK-1037 and dubbed Operation Rewrite, which uses a malicious IIS module named BadIIS to hijack websites and redirect users to scam content. BadIIS integrates…
SecurityOnline -
New Malware Found in npm Package “fezbox” Uses QR Codes to Steal Credentials
The Socket Threat Research Team has uncovered a new malware campaign hidden inside an npm package called fezbox, which pretends to be a JavaScript/TypeScript utility library. According to Socket, fezbox uses multiple layers of obfuscation, including a QR…
SecurityOnline -
CVE-2025-9125: Cross-Site Scripting Flaw in Lectora Courses Puts E-Learning Platforms at Risk
CVE-2025-9125 is a cross-site scripting flaw in Lectora that affects both desktop and cloud-based versions when certain publishing settings are enabled, according to CERT/CC note. The vulnerability arises from improper handling of crafted URL parameters in…
SecurityOnline -
CVE-2025-59689: Libraesva ESG Command Injection Flaw Exploited in the Wild
Libraesva has issued an urgent advisory about a command injection flaw in its Email Security Gateway (ESG), tracked as CVE-2025-59689, affecting ESG versions from 4.5 onwards. The flaw can be exploited by a malicious e-mail containing a specially crafted…
SecurityOnline
