News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Fri 26 Sep 2025· 73 articles
-
New XCSSET macOS Malware Variant Hijacks Cryptocurrency Transactions
According to Microsoft, a new variant of the XCSSET macOS malware now monitors the system clipboard to hijack cryptocurrency transactions, adding a four-stage infection chain, an extra persistence mechanism and updated browser targeting. The fourth stage…
SecurityWeek -
Researchers Map Links Between Major Hacker Groups: LAPSUS$, Scattered Spider, ShinyHunters
Researchers map links between LAPSUS$, Scattered Spider and ShinyHunters, describing a loosely connected cybercrime supergroup that uses shared tactics, overlapping membership and public channels to coordinate extortion and data leaks. From 2023 through 2025…
gbhackers.comScattered Spider -
Fortra GoAnywhere CVSS 10 Flaw Exploited as 0-Day a Week Before Public Disclosure
According to watchTowr, credible evidence exists of active exploitation of the CVSS 10.0 flaw in Fortra GoAnywhere MFT as early as 10 September 2025, a full week before public disclosure. The vulnerability, CVE-2025-10035, is described as a deserialization…
The Hacker News -
New macOS XCSSET Variant Targets Firefox with Clipper and Persistence Module
Cybersecurity researchers have spotted an updated variant of the Apple macOS malware XCSSET, observed in limited attacks since 26 September 2025. According to a Microsoft Threat Intelligence report, the new variant alters browser targeting, introduces a…
The Hacker News -
Hackers Breach Active Directory, Steal NTDS.dit for Full Domain Compromise
Threat actors infiltrated a corporate environment and dumped the AD database file NTDS[.]dit, enabling near-full domain control after breaching Active Directory. The breach began with a phishing email that granted administrative privileges on a workstation…
gbhackers.com -
Recent Fortra GoAnywhere MFT Vulnerability Exploited as Zero-Day
Eight days before patches were issued, a threat actor exploited CVE-2025-10035 in Fortra GoAnywhere MFT as a zero-day to create a backdoor admin account, SecurityWeek reports. The vulnerability, described as a deserialization flaw in the license servlet,…
SecurityWeek -
Unveiling LummaStealer’s Technical Details Through ML-Based Detection Approach
In early 2025, LummaStealer was in widespread use by cybercriminals across multiple industries, and a May law enforcement operation brought it to a halt before new variants re-emerged. According to Netskope Threat Labs, a fresh LummaStealer sample (hash:…
gbhackers.com -
Cisco ASA 0-Day RCE Flaw Actively Exploited in the Wild
A critical zero-day vulnerability in Cisco Secure Firewall ASA and FTD software is being actively exploited in the wild, tracked as CVE-2025-20333 and enabling an authenticated attacker to execute arbitrary code as root on affected devices. Cisco published…
gbhackers.com -
Rack Security Update: High-Severity Flaw Bypasses Parameter Limit, Exposing Apps to DoS Attacks
The Rack project has released a security update for a high-severity flaw in its query parameter parsing logic that affects Rack versions prior to 2.2.18. The vulnerability, tracked as CVE-2025-59830 with a CVSS score of 7.5 (High), could allow a…
SecurityOnline -
Hackers Exploit Cisco ASA 0-Day to Deploy RayInitiator and LINE VIPER Malware
Security researchers have warned that attackers are exploiting a newly disclosed zero-day in Cisco Secure Firewall Adaptive Security Appliance (ASA) 5500-X Series to deploy RayInitiator and LINE VIPER malware, potentially giving them full control of affected…
gbhackers.com -
Apple Blames EU’s DMA for Delayed iPhone Features, Citing New Security and Privacy Risks
Apple has claimed that the EU’s Digital Markets Act is delaying the rollout of newly developed features in Europe, with concerns centred on AI capabilities and iPhone Mirroring, alongside worries about third‑party app stores distributing malicious content…
SecurityOnline -
LAMEHUG: An LLM-Driven Malware for Dynamic Reconnaissance and Data Exfiltration
LAMEHUG is described as an LLM-driven malware designed for dynamic reconnaissance and data exfiltration, rather than relying on static payloads. It queries a Qwen 2.5-Coder-32B-Instruct model via the Hugging Face API to generate Windows command-shell…
gbhackers.com -
Critical Cisco Flaw Lets Remote Attackers Execute Code on Firewalls and Routers
Cisco has disclosed a critical flaw affecting multiple platforms that handle HTTP-based management, tracked as CVE-2025-20363. According to Cisco Security Advisory cisco-sa-http-code-exec-WmfP3h3O, the vulnerability stems from improper validation of…
gbhackers.com -
Cisco Firewall Zero-Days Exploited in China-Linked ArcaneDoor Attacks
Cisco Firewall Zero-Days Exploited in China-Linked ArcaneDoor Attacks describe how two flaws in the VPN web server of ASA 5500-X series devices were exploited as zero-days in attacks linked to the ArcaneDoor espionage campaign. According to Cisco, the…
SecurityWeekArcaneDoor -
Google warns of Brickstorm backdoor targeting U.S. legal and tech sectors
Google Threat Intelligence Group observed the Go-based BRICKSTORM backdoor being used to maintain persistence in U.S. organisations since March 2025, with targets including legal firms, SaaS providers, BPOs, and Technology firms, according to Google Threat…
Security Affairs -
New XCSSET Malware Variant Targets macOS App Developers
Security researchers have identified an advanced variant of XCSSET that targets macOS app developers by infecting Xcode projects during build, introducing new modules and evasion techniques. The variant expands data exfiltration to include Firefox browser…
gbhackers.com -
Cisco ASA Firewall Zero-Day Exploits Deploy RayInitiator and LINE VIPER Malware
The UK’s National Cyber Security Centre (NCSC) has said threat actors exploited recently disclosed Cisco ASA firewall flaws in zero-day attacks to deploy undocumented malware families named RayInitiator and LINE VIPER. Cisco reported that attacks on multiple…
The Hacker News -
Salesforce AI Agent Vulnerability Lets Attackers Steal Sensitive Data
Cybersecurity researchers at Noma Labs have disclosed a critical vulnerability in Salesforce’s Agentforce AI platform, dubbed ForcedLeak, which could let attackers steal sensitive customer data through sophisticated prompt injection techniques. The flaw…
gbhackers.com -
LockBit 5.0 Ransomware Targets Windows, Linux, and VMware ESXi Systems
Cybersecurity researchers at Trend Micro have identified a new variant of LockBit ransomware, LockBit 5.0, which targets Windows, Linux and VMware ESXi systems and uses advanced obfuscation and cross‑platform capabilities. The Windows variant loads its…
gbhackers.com -
Microsoft Makes Windows 10 Extended Security Updates FREE in Europe Due to Regulatory Pressure
In Europe, Microsoft has announced that Windows 10 Extended Security Updates (ESU) will be provided free of charge for consumer users in the European Economic Area (EEA) as regulators press for continued security updates. Enrollment for ESU is set to begin…
SecurityOnline -
Microsoft Disables Azure and AI Services Used by Israeli Military for Mass Surveillance in Gaza
The Guardian recently reported that a division of Israel’s Ministry of Defense had been using Microsoft Azure and AI services to conduct mass surveillance on residents of Gaza, deploying measures across network and communications layers to collect call…
SecurityOnline -
Two Linux Kernel Vulnerabilities Expose HID Subsystem to Exploitation, PoC Published
Two Linux kernel vulnerabilities have been reported that expose the HID Subsystem to potential exploitation, with a proof‑of‑concept (PoC) published. The article, published on 26 September 2025, notes that the vulnerabilities affect the HID Subsystem and…
SecurityOnline -
CRITICAL Cisco Zero-Day (CVE-2025-20333, CVSS 9.9) Under Active Attack: VPN Flaw Allows Root RCE
Cisco has disclosed a zero-day vulnerability affecting its Secure Firewall ASA and Threat Defense software, tracked as CVE-2025-20333 with a CVSS score of 9.9, which could allow remote attackers with valid VPN credentials to fully compromise affected…
SecurityOnline -
Cisco Warns of Critical RCE Flaw (CVE-2025-20363) Affecting Firewall and Router Software
Cisco has disclosed a critical vulnerability tracked as CVE-2025-20363 that affects multiple Cisco product lines, including Secure Firewall ASA, Secure Firewall Threat Defense (FTD), IOS, IOS XE, and IOS XR Software, with NX-OS not affected. The flaw, which…
SecurityOnline -
Supply Chain Attack: Malicious Rust Crates Steal Solana and Ethereum Private Keys
Socket’s Threat Research Team uncovered a supply chain attack involving two malicious Rust crates—faster_log and async_println—that impersonated the legitimate fast_log library. The impostor packages were downloaded more than 8,400 times before being removed…
SecurityOnline -
Cisco Zero-Day CVE-2025-20362 Under Attack: VPN Flaw in ASA/FTD Exposes Restricted Resources
Cisco has released software updates addressing a zero-day vulnerability in the VPN web server of its Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software, tracked as CVE-2025-20362 and rated CVSS 6.5 (Medium-High). The flaw could allow…
SecurityOnline -
CVE-2025-54831: Apache Airflow Bug Exposes Sensitive Connection Passwords to Read-Only Users
CVE-2025-54831 concerns a bug in Apache Airflow 3.0.3 that allowed users with READ permissions to view sensitive connection details via both the API and the UI, undermining the intended write-only model for sensitive values. According to the advisory, the…
SecurityOnline -
BRICKSTORM Malware: China-Linked Hackers Stealthily Target US Tech and Legal Firms for 393 Days
BRICKSTORM is a backdoor malware campaign linked to suspected China-nexus threat clusters, active since at least March 2025 and targeting a broad range of United States industries including legal services, SaaS providers, business process outsourcers and…
SecurityOnlineUTA0178 -
GitLab Fixes High-Severity DoS Flaws: Unauthenticated Attackers Could Crash Instances
GitLab has released security updates for versions 18.4.1, 18.3.3, and 18.2.7 of its Community Edition and Enterprise Edition, after warning that the fixes close several high-severity vulnerabilities that could expose instances to denial of service and…
SecurityOnline -
NVIDIA Patches High-Severity Code Injection Flaws in Megatron-LM AI Framework
Nvidia has issued an important security update addressing multiple high-severity vulnerabilities in its Megatron-LM AI framework, a large language model project widely used in AI research and enterprise environments. The update covers four CVEs, each with a…
SecurityOnline -
AI vs. AI: Microsoft Blocks Phishing Attack Using LLM-Generated Obfuscated Code
Microsoft Threat Intelligence reported a credential phishing campaign utilizing AI-generated code for obfuscation, which was ultimately blocked. The attackers used SVG files disguised as PDFs to hide malicious scripts, employing business terminology to…
SecurityOnline -
New Lone None Stealer Malware Hijacks Crypto Wallets via Fake Copyright Takedown Notices
Cofense Intelligence has uncovered an evolving phishing campaign that uses copyright takedown notices as its primary lure, with the Lone None threat actor group deploying both the well-known Pure Logs Stealer and a newly identified strain dubbed Lone None…
SecurityOnline -
LNK Stomping: Attackers Bypass Windows Security by Stripping the ‘Mark of the Web’
LNK Stomping is a technique disclosed in 2024 by Elastic Security Labs and later detailed by AhnLab researchers, which abuses Windows Explorer’s path normalisation to bypass the Mark of the Web (MoTW) and its protections. The vulnerability, tracked as…
SecurityOnline
