News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 5 so far |
Wed 24 Sep 2025· 91 articles
-
AI vs. AI: Detecting an AI-obfuscated phishing campaign
According to Microsoft Threat Intelligence, Microsoft Threat Intelligence recently detected and blocked a credential phishing campaign that likely used AI-generated code to obfuscate its payload and evade traditional defenses, with the activity appearing to…
Microsoft -
How One Bad Password Ended a 158-Year-Old Business
KNP Logistics Group, formerly Knights of Old, had operated for 158 years before a single weak password brought the business to its knees in June 2025. According to the report, hackers from the Akira ransomware group gained access by guessing an employee’s…
The Hacker News -
SolarWinds fixed a critical RCE flaw in its Web Help Desk software
SolarWinds has fixed a critical remote code execution flaw in its Web Help Desk software, tracked as CVE-2025-26399 with a CVSS of 9.8, after an anonymous researcher working with the Trend Micro Zero Day Initiative reported the issue. The vulnerability could…
Security Affairs -
Feds Tie ‘Scattered Spider’ Duo to $115M in Ransoms
U.S. prosecutors have charged 19-year-old Thalha Jubair and 18-year-old Owen Flowers in connection with Scattered Spider, a group prosecutors say extorted at least $115 million in ransom payments from victims. The charges emerged as Jubair and Flowers…
Krebs on SecurityScattered Spider -
OnePlus OxygenOS Vulnerability Lets Apps Access SMS Data Without User Permission
A newly disclosed flaw in OnePlus OxygenOS lets any app on a device read SMS and MMS messages without asking the user, tracked as CVE-2025-10184. The issue stems from a permission bypass in the Telephony content provider (com.android.providers[.]telephony),…
gbhackers.com -
Attackers Exploit BMC Firmware Vulnerabilities to Bypass Signature Verification
Attackers are exploiting weaknesses in Supermicro’s Baseboard Management Controller (BMC) firmware validation logic to bypass signature verification and reflash the BMC SPI chip. The report notes that CVE-2024-10237 allowed malicious firmware images to…
gbhackers.com -
New YiBackdoor Malware Shares Major Code Overlaps with IcedID and Latrodectus
Cybersecurity researchers have disclosed a new malware family dubbed YiBackdoor, which shares significant source code overlaps with IcedID and Latrodectus. The researchers say YiBackdoor first appeared in June 2025 and may serve as a precursor to follow-on…
The Hacker News -
Supermicro server motherboards can be infected with unremovable malware
On 24 September 2025, Ars Technica reports that Supermicro server motherboards can be infected with unremovable malware via high‑severity vulnerabilities in baseboard management controllers (BMCs) that allow remote installation of malicious firmware running…
Ars Technica -
iframe Security Exposed: The Blind Spot Fueling Payment Skimmer Attacks
Payment iframes are being actively exploited by attackers who use overlays to skim credit card data, bypassing traditional protections such as CSP and X-Frame-Options, as highlighted by the Stripe iframe skimmer campaign that has already compromised dozens…
The Hacker News -
Salesforce CLI Installer Flaw Lets Attackers Run Code and Gain SYSTEM-Level Access
A serious security flaw in the Salesforce CLI installer (sf-x64[.]exe) has been assigned CVE-2025-9844, allowing attackers to execute arbitrary code with SYSTEM-level privileges on Windows machines. The issue arises from improper handling of file paths…
gbhackers.com -
Banking Trojans Targeting Android Users Disguise as Government and Trusted Payment Apps
Since August 2024, a financially motivated threat group has been targeting Android users in Indonesia and Vietnam with banking trojans disguised as official government identity and payment applications. The operators use elaborate download mechanisms,…
gbhackers.com -
CISA Reveals Hackers Breached U.S. Federal Agency via GeoServer RCE Flaw
CISA has disclosed that attackers exploited a remote code execution vulnerability in GeoServer to breach a U.S. federal civilian executive branch agency. On 11 July 2024, they used CVE-2024-36401, an “eval injection” weakness, to execute commands on a…
gbhackers.com -
Critical DNN Platform Vulnerability Let Attackers Execute Malicious Scripts
A severe Stored Cross-Site Scripting (XSS) vulnerability in the Prompt module of the DNN Platform allows low-privilege, authenticated attackers to inject and execute arbitrary scripts in the context of privileged users, as described in the GitHub advisory…
gbhackers.com -
GitHub Boosting Security in Response to NPM Supply Chain Attacks
GitHub has announced tighter authentication and publishing rules in response to recent NPM supply chain attacks, including local publishing with mandatory 2FA, granular tokens that expire after seven days, and trusted publishing. The Shai-Hulud…
SecurityWeek -
How threat actors breached a U.S. federal civilian agency by exploiting a GeoServer flaw
US CISA revealed that threat actors exploited an unpatched vulnerability in GeoServer to breach a U.S. federal civilian agency’s network, tracked as CVE-2024-36401 (CVSS 9.8), a critical remote code execution issue. The flaw was disclosed on 30 June 2024,…
Security Affairs -
Record-Breaking DDoS Attack Peaks at 22 Tbps and 10 Bpps
According to Cloudflare, security company, a record-breaking distributed denial-of-service (DDoS) attack peaked at 22.2 terabits per second and 10.6 billion packets per second, lasting only 40 seconds. The attack was aimed at a single IP address belonging to…
SecurityWeek -
RainyDay, Turian and Naikon Malwares Abuse DLL Search Order to Execute Malicious Loaders
Cisco Talos has uncovered a long-running operation active since 2022 in which the RainyDay, Turian and Naikon malwares abuse DLL search order hijacking to deliver a novel PlugX variant. The campaign targets telecommunications and manufacturing organisations…
gbhackers.comNaikon -
Qualcomm’s AI Revolution: The Future of the “AI as the UI” and 6G Connectivity
At the Snapdragon Summit 2025 in Hawaii, Cristiano Amon declared that AI will emerge as the next-generation “user interface,” with Agentic AI poised to become the dominant form of application. According to Qualcomm’s vision, future computing platforms will…
SecurityOnline -
Intel Shifts Gears: What a New Driver Policy Means for Gamers
According to Intel, the company has split driver support into two channels: Core Ultra processors will continue to receive monthly updates with day-one game support, while 11th through 14th Gen processors will move to a legacy model with quarterly security…
SecurityOnline -
SonicWall Updates SMA 100 Appliances to Remove Overstep Malware
SonicWall has released a fresh software update for its SMA 100 appliances to help users remove the Overstep malware deployed in a recent campaign, with the update introducing additional file checks and the capability to remove the known rootkit present on…
SecurityWeek -
North Korean IT Worker Gains Access to Organization’s Network Through Innocent Job Application
A North Korean IT worker infiltrated a U.S. healthcare provider’s network by posing as a legitimate remote IT professional during the hiring process, a scheme that Trellix researchers recently uncovered and described as part of a malware-less intrusion…
gbhackers.com -
Libraesva Email Security Gateway Vulnerability Exploited by Nation-State Hackers
Libraesva has addressed a vulnerability in its integrated email security platform that has been exploited in the wild, tracked as CVE-2025-59689, with a CVSS score of 6.1. The flaw is described as a command injection issue that could allow arbitrary commands…
SecurityWeek -
Kali Linux 2025.3 Launches With Fresh Features and 10 New Pentesting Tools
Kali Linux 2025.3 has arrived, bringing improvements across core workflows, extended wireless capabilities, and a suite of ten new pentesting tools. The release builds on the June 2025.2 update and refines how virtual machines are built, with revamped Packer…
gbhackers.com -
Hackers Exploit Pandoc CVE-2025-51591 to Target AWS IMDS and Steal EC2 IAM Credentials
Cloud security company Wiz revealed in-the-wild exploitation of a Linux utility flaw in Pandoc, tracked as CVE-2025-51591 (CVSS 6.5), used to target AWS Instance Metadata Service (IMDS) and steal EC2 IAM credentials. The vulnerability allows SSRF via crafted…
The Hacker News -
CISA Issues Alert on Actively Exploited Google Chrome 0-Day Vulnerability
According to CISA, the Cybersecurity and Infrastructure Security Agency, an urgent security alert has been issued regarding an actively exploited zero-day vulnerability in Google Chrome, designated CVE-2025-10585. The flaw is in Chrome’s V8 JavaScript and…
gbhackers.com -
SonicWall Issues Emergency Patch to Remove ‘OVERSTEP’ Rootkit Malware on SMA Devices
SonicWall has issued an emergency patch for its Secure Mobile Access SMA 100 Series appliances to remove a rootkit known as OVERSTEP, a threat noted for its persistence on older SMA firmware. The new build, 10.2.2[.]2-92sv, adds enhanced file checking to…
gbhackers.com -
State-Sponsored Hackers Exploiting Libraesva Email Security Gateway Vulnerability
Libraesva has released a security update for its Email Security Gateway (ESG) after state-sponsored threat actors exploited a vulnerability tracked as CVE-2025-59689, which has a CVSS score of 6.1 (medium). According to Libraesva, the flaw is a command…
The Hacker News -
ShadowV2 Botnet Infects AWS Docker Containers to Launch DDoS Campaign
ShadowV2 is described as a botnet-as-a-service campaign that infects AWS Docker containers to power a DDoS operation. Darktrace’s latest investigation identifies a Python-based C2 framework hosted on GitHub Codespaces, paired with a Go-based RAT that handles…
gbhackers.com -
New “YiBackdoor” Malware Lets Hackers Run Commands and Steal Data
Cybersecurity researchers at Zscaler ThreatLabz have identified YiBackdoor, a sophisticated new malware strain first detected in June 2025, which shares substantial code similarities with IcedID and Latrodectus. The backdoor is designed to give attackers…
gbhackers.com -
Cloudflare mitigates largest-ever DDoS attack at 22.2 Tbps
Cloudflare has disclosed that it blocked a new record-breaking distributed denial-of-service attack, peaking at 22.2 Tbps and 10.6 billion packets per second. The organisation noted it has not shared further technical details about the attack. According to…
Security Affairs -
Jaguar Land Rover Factory Reopening Delayed After Cyber Attack
Jaguar Land Rover has confirmed a further delay to the reopening of its production lines following a sophisticated cyber attack, with the pause extended until Wednesday 1 October 2025. The company says the extended downtime will allow forensic analysis, the…
gbhackers.com -
Chrome High-severity Flaws Expose Sensitive Data, Trigger System Crashes
Google has released an urgent security update for its Chrome browser, addressing three high-severity vulnerabilities in the V8 engine that could leak sensitive data or crash the browser. The fixes cover CVE-2025-10890, a side-channel information leakage…
gbhackers.com -
ClaimPix Data Exposure: 10TB of Insurance Records, Vehicle Data, and Legal Documents Left Unprotected
Cybersecurity researcher Jeremiah Fowler uncovered a massive unprotected database containing sensitive insurance and vehicle records linked to Illinois-based ClaimPix. The exposed dataset comprised over 5,170,256 files and images, totalling 10TB, including…
SecurityOnline -
CISA adds Chrome zero-day CVE-2025-10585 to KEV after public exploit appears
CISA this week added CVE-2025-10585, a high-severity type-confusion flaw in Google’s V8 JavaScript engine, to its Known Exploited Vulnerabilities catalog after evidence of active exploitation was observed. Google disclosed the issue in an emergency advisory…
SecurityOnline -
OpenSSF Warns: Open Source Software Is Not a Free Service
OpenSSF Warns: Open Source Software Is Not a Free Service reports that OpenSSF, together with several prominent open‑source and software foundations, has issued a joint statement saying it can no longer serve as the unpaid gatekeeper of the global software…
SecurityOnline -
CVE-2025-9844: Salesforce CLI Installer Vulnerability Could Lead to SYSTEM-Level Compromise
CVE-2025-9844 concerns Salesforce’s CLI installer (sf-x64[.]exe), rated high severity with a CVSS score of 8.8, which could allow arbitrary code execution, privilege escalation, and SYSTEM-level access on affected systems. The flaw arises from improper…
SecurityOnline -
CVE-2025-10184: Unpatched OnePlus Flaw Exposes SMS Data & Breaks MFA, PoC Available
CVE-2025-10184 is a critical permission bypass in OnePlus OxygenOS that lets any installed app read SMS/MMS messages and metadata without permission, user interaction, or consent, according to Rapid7. The flaw, introduced with OxygenOS 12 in 2021, could…
SecurityOnline -
Microsoft to Pay Publishers for AI Content in New Pilot Program
According to Axios, Microsoft is negotiating with several U.S. publishers on a pilot programme to create a bilateral marketplace where AI firms would provide financial compensation in exchange for content rights, beginning with Microsoft Copilot as the first…
SecurityOnline -
iOS 26 Digital ID: Your Passport Is Coming to Apple Wallet
According to Apple, iOS 26’s Digital ID feature will support adding passports, allowing users to store their passports directly within the Wallet app, with rollout expected in late 2025. The iOS 26 feature page notes the release will come “later this year”…
SecurityOnline -
CVE-2025-59545: Critical XSS Flaw in DNN Software Puts 750,000 Websites at Risk
CVE-2025-59545 is a critical stored cross-site scripting (XSS) flaw in DNN Software’s Prompts module that could allow attackers to inject scripts into DNN content and have them execute in a user’s browser, potentially hijacking administrator sessions or…
SecurityOnline
