News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Tue 30 Sep 2025· 82 articles
-
Detecting Vendor Compromise and Trusted Relationship Abuse with Darktrace
Vendor Email Compromise refers to attackers breaching a third‑party provider to exploit their access and trusted relationships for malicious purposes, often targeting a company’s existing partners or others it would normally trust. The Darktrace blog notes…
darktrace.com -
Georgia Tech Research Corporation Agrees to Pay $875,000 to Resolve Civil Cyber-Fraud Litigation
Georgia Tech Research Corporation has agreed to pay $875,000 to resolve allegations under the False Claims Act and federal common law that it failed to meet cybersecurity requirements in connection with Air Force and DARPA contracts. The settlement resolves…
DataBreaches -
New China APT Strikes With Precision and Persistence
A previously undocumented Chinese nation-state actor is targeting government agencies, embassies, military operations and other entities across Africa, the Middle East and Asia in a cyber-espionage operation described as highly sophisticated, with the group…
Dark Reading -
Darktrace Announces Unified OT Security
Darktrace has announced a new OT security release that introduces dedicated workflows for OT engineers, segmentation-aware risk modelling, and NEXT-Generation Endpoint Visibility for industrial teams. The update adds a dashboard called Operational Overview…
darktrace.com -
'Klopatra' Trojan Makes Bank Transfers While You Sleep
Klopatra is described as an evasive new Android banking Trojan that can covertly drain victims’ money while they sleep. The malware is not a complete overhaul of the traditional banking Trojan model, but it is described as devilishly effective, with a remote…
Dark Reading -
Intel and AMD trusted enclaves, the backbone of network security, fall to physical attacks
In Ars Technica’s report published on 30 September 2025, researchers detail two attacks, Battering RAM and Wiretap, that compromise Intel SGX and AMD SEV-SNP trusted execution environments (TEEs) by placing an interposer between the CPU and memory. The…
Ars Technica -
China Exploited New VMware Bug for Nearly a Year
A newly disclosed VMware vulnerability has potentially been exploited by threat actors for nearly a year, with Broadcom on 29 September revealing three flaws: CVE-2025-41244, CVE-2025-41245 and CVE-2025-41246, affecting VMware Aria Operations and VMware…
Dark Reading -
$50 Battering RAM Attack Breaks Intel and AMD Cloud Security Protections
A group of academics from KU Leuven and the University of Birmingham has demonstrated a vulnerability called Battering RAM to bypass the latest protections on Intel and AMD cloud processors. They built a simple, $50 interposer that sits quietly in the memory…
The Hacker News -
CL-STA-00432 articles this day · gbhackers.com first
Phantom Taurus: New China-Linked Hacker Group Hits Governments With Stealth Malware · New Chinese Nexus APT Group Targeting Organizations to Deploy NET-STAR Malware Suite
2 outlets-
Phantom Taurus: New China-Linked Hacker Group Hits Governments With Stealth Malware
Phantom Taurus is a China-aligned nation-state actor described by Unit 42 as targeting governments and telecommunications organisations across Africa, the Middle East and Asia with stealth malware. The group’s main focus includes ministries of foreign…
The Hacker News -
New Chinese Nexus APT Group Targeting Organizations to Deploy NET-STAR Malware Suite
Phantom Taurus, a China-linked advanced persistent threat (APT) group, has intensified espionage operations across Africa, the Middle East and Asia, deploying a newly discovered .NET malware suite named NET-STAR. First tracked by Unit 42 in June 2023 as…
gbhackers.com
-
-
Payload on Workers: a full-fledged CMS, running entirely on Cloudflare’s stack
Payload on Workers presents a full-fledged CMS running on Cloudflare’s stack, with a new template that lets you deploy Payload to Cloudflare in a single click, binding to Cloudflare D1 and R2. The Payload project has over 35,000 stars on GitHub and was…
Cloudflare -
Tile trackers plagued by weak security, researchers warn
Researchers from Georgia Institute of Technology scrutinised the security of Tile trackers and warned that they are vulnerable to persistent tracking. The article notes that about 88 million Tile trackers are in use worldwide, and the main flaw is that Tile…
Malwarebytes -
Call for Presentations Open for 2025 CISO Forum Virtual Summit
The official Call for Presentations for SecurityWeek’s 2025 CISO Forum Virtual Summit is now open, with the event being held on 12–13 November 2025 and the CFP open through 10 October 2025, according to SecurityWeek News. The two‑day online summit will…
SecurityWeek -
Google Patches Gemini AI Hacks Involving Poisoned Logs, Search Results
Google has patched three Gemini AI vulnerabilities that could have let attackers trick the assistant into aiding data theft, an issue Tenable dubbed The Gemini Trifecta. According to Tenable, the first attack used indirect prompt injection targeting Gemini…
SecurityWeek -
Patchwork APT: Leveraging PowerShell to Create Scheduled Tasks and Deploy Final Payload
Patchwork, the advanced persistent threat actor also known as Dropping Elephant, Monsoon, and Hangover Group, has been observed deploying a new PowerShell-based loader that abuses Windows Scheduled Tasks to execute its final payload. Active since at least…
gbhackers.comQUILTED TIGER -
Broadcom patches VMware Zero-Day actively exploited by UNC5174
Broadcom has released patches for six VMware flaws, including the high-severity CVE-2025-41244, which has been exploited in the wild as a zero-day since mid-October 2024 by the China-linked threat actor UNC5174, according to Broadcom advisory notes. The…
Security AffairsUNC5174 -
Cybercrime Observations from the Frontlines: UNC6040 Proactive Hardening Recommendations
Written by: Omar ElAhdan, Matthew McWhirt, Michael Rudden, Aswad Robinson, Bhavesh Dhake, Laith Al Background Protecting software-as-a-service (SaaS) platforms and applications requires a comprehensive security strategy. Drawing from analysis of UNC6040’s…
Google Cloud -
Can Shadow AI Risks Be Stopped?
Enterprises are increasingly granting nonhuman identities broad, sensitive access as the AI agent landscape expands, exposing fresh security blind spots around shadow AI and shadow agents. Entro Security has expanded its platform with an AI agents discovery…
Dark Reading -
Hackers Posing as Google Careers Recruiter to Steal Gmail Login Details
Hackers are conducting an emerging phishing campaign that pretends to recruit for Google Careers, sending seemingly legitimate emails that lead victims to malicious sites designed to harvest Gmail credentials. Security researchers have uncovered a…
gbhackers.com -
UK convicts Chinese national in £5.5B crypto fraud, marks world’s largest Bitcoin seizure
A Chinese national, Zhimin Qian (47), also known as Yadi Zhang, was convicted in the UK for a £5.5 billion crypto fraud, described as the world’s largest Bitcoin seizure. Police seized £5.5 billion in cryptocurrency, totalling 61,000 Bitcoin, after raiding…
Security Affairs -
Researchers Disclose Google Gemini AI Flaws Allowing Prompt Injection and Cloud Exploits
Cybersecurity researchers have disclosed three now-patched vulnerabilities in Google's Gemini AI assistant, collectively dubbed the Gemini Trifecta, which could have exposed users to privacy risks and data theft. The flaws include a prompt injection in…
The Hacker News -
Hackers Use Cellular Router API to Send Malicious SMS with Weaponized Links
Hackers are abusing the API of Milesight industrial cellular routers to push smishing campaigns that deliver phishing URLs via malicious SMS messages. According to Sekoia[.]io’s Threat Detection & Research (TDR) team, suspicious traces appeared on 22 July…
gbhackers.com -
Microsoft Expands Sentinel Into Agentic Security Platform With Unified Data Lake
Microsoft has expanded its Sentinel SIEM into a unified agentic platform with the general availability of a Sentinel data lake, unveiled alongside a public preview of Sentinel Graph and Sentinel Model Context Protocol server. The move aims to give defenders…
The Hacker News -
Empowering defenders in the era of agentic AI with Microsoft Sentinel
Microsoft is presenting Sentinel as the security platform for an agentic era, combining data, context, automation and intelligent agents to defend at AI speed. The blog notes that Sentinel began as cloud-native SIEM and has since added a unified security…
Microsoft -
Windows 11 KB5065789 update released with 41 changes and fixes
Microsoft has released the KB5065789 preview cumulative update for Windows 11 24H2, delivering 41 improvements, including new AI actions in File Explorer and bug fixes for Windows Update and Windows Sandbox. The update is part of the optional non-security…
BleepingComputer -
Beer Maker Asahi Shuts Down Production Due to Cyberattack
Asahi Group Holdings has halted production at its domestic factories in Japan after a cyberattack struck on Monday, forcing the beer and beverage giant to halt operations across its 30 plants. The company, known for brands such as Asahi Super Dry Beer, Nikka…
gbhackers.com -
New Android Banking Trojan Uses Hidden VNC for Full Remote Control of Devices
According to Cleafy’s Threat Intelligence team, Klopatra is a new, highly sophisticated Android banking trojan and remote access trojan (RAT) that grants attackers full control of compromised devices and enables large-scale financial fraud, with active…
gbhackers.com -
Mondoo Raises $17.5 Million for Vulnerability Management Platform
Mondoo has announced it has raised 17.5 million dollars in a Series A extension, taking its total funding to more than 32 million dollars. The round was led by HV Capital, with participation from T[.]Capital, Atomico, Firstminute Capital and System[.]One.…
SecurityWeek -
CISO Conversations: John ‘Four’ Flynn, VP of Security at Google DeepMind
John Flynn, known as ‘Four’, has been DeepMind’s VP of security since May 2024, after a career that saw him serve as a CISO at Amazon and Uber, and as director of information security at Facebook, with an earlier stint as manager of the security operations…
SecurityWeek -
Hackers Actively Probe Palo Alto PAN-OS GlobalProtect Vulnerability for Exploitation
An uptick in internet-wide scanning indicates that threat actors are actively probing for systems vulnerable to CVE-2024-3400, a critical GlobalProtect flaw in Palo Alto Networks PAN-OS, according to SANS ISC. The researchers observed a single source IP,…
gbhackers.com -
Broadcom fixes high-severity VMware NSX bugs reported by NSA
Broadcom has released security updates to patch two high-severity VMware NSX vulnerabilities reported by the NSA, affecting VMware NSX within VMware Cloud Foundation. The first flaw, CVE-2025-41251, stems from a weakness in the password recovery mechanism…
BleepingComputer -
Warning: Malicious AI Tools Being Distributed as Chrome Extensions by Threat Actors
Cybercriminals are distributing malicious AI tools as Chrome extensions that masquerade as legitimate AI services, with security researchers identifying a growing trend in September 2025. These fake extensions, mimicking platforms such as ChatGPT, Claude,…
gbhackers.com -
New Guidance Calls on OT Operators to Create Continually Updated System Inventory
SecurityWeek reports that cyber agencies from the United States, Canada, Australia, New Zealand, the Netherlands, and Germany, with the United Kingdom, have published updated guidance for OT operators on building and maintaining a definitive view of their…
SecurityWeek -
California Gov. Gavin Newsom Signs Bill Creating AI Safety Measures
California Governor Gavin Newsom has signed the Transparency in Frontier Artificial Intelligence Act (TFAIA), which requires AI companies to implement and disclose publicly safety protocols to prevent their most advanced models from being used to cause major…
SecurityWeek -
High-Severity Vulnerabilities Patched in VMware Aria Operations, NSX, vCenter
According to Broadcom, six vulnerabilities affecting VMware Aria Operations, NSX, vCenter and VMware Tools were patched, including four high-severity flaws. The most serious is a local privilege escalation bug in both Aria Operations and VMware Tools tracked…
SecurityWeek -
Stop Alert Chaos: Context Is the Key to Effective Incident Response
Stop Alert Chaos: Context Is the Key to Effective Incident Response argues that the root of modern SOC strain is not just the volume of alerts but the outdated model that starts with rules and dumps raw signals, leaving attackers room to move. It advocates…
The Hacker News -
CISA Issues Alert on Actively Exploited Libraesva ESG Command Injection Vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert about the active exploitation of a vulnerability in Libraesva ESG, catalogued as CVE-2025-59689, which affects how the Email Security Gateway processes compressed…
gbhackers.com -
Apple fixes critical font processing bug. Update now!
Apple has released important security updates to address a critical vulnerability in FontParser, the component that processes fonts across MacOS, iOS and iPadOS. The flaw, tracked as CVE-2025-43400, is described as an out-of-bounds write issue that could…
Malwarebytes -
Webinar Today: AI and the Trust Dilemma: Balancing Innovation and Risk
Join this live webinar with experts from Ping Identity, according to Ping Identity, where they will share a blueprint for enabling innovation securely. Artificial intelligence is transforming enterprises, but with innovation comes risk, and over half of…
SecurityWeek -
Urgent: China-Linked Hackers Exploit New VMware Zero-Day Since October 2024
A newly patched flaw affecting Broadcom VMware Tools and VMware Aria Operations has been exploited in the wild as a zero-day since mid-October 2024 by a threat actor named UNC5174, according to NVISO Labs. The vulnerability, CVE-2025-41244, carries a CVSS…
The Hacker News
