News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Tue 7 Oct 2025· 66 articles
-
Responding to Cloud Incidents A Step-by-Step Guide from the 2025 Unit 42 Global Incident Response Report
Cloud incidents, including ransomware, distributed denial-of-service attacks and account compromise, can halt operations and jeopardise costs, reputation and customer trust. According to Unit 42 2025 Global Incident Response Report, 29% of incident…
unit42.paloaltonetworks.com -
ShinyHunters Wage Broad Corporate Extortion Spree
A cybercriminal group known as ShinyHunters has launched a broad extortion campaign, threatening to publish data stolen from dozens of Fortune 500 firms if victims do not pay, after siphoning what the piece describes as data from Salesforce customers earlier…
Krebs on SecurityShinyHunters -
U.S. CISA adds Synacor Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog
According to Security Affairs, U.S. CISA added Synacor Zimbra Collaboration Suite (ZCS) flaw CVE-2025-27915 to its Known Exploited Vulnerabilities catalog, underscoring the ongoing risks to organisations using Zimbra versions 9.0–10.1 from improper HTML…
Security Affairs -
Attackers Season Spam With a Touch of 'Salt'
Attackers are increasingly using hidden content in emails through Cascading Style Sheets (CSS) to bypass filters and hamper enterprise security tools. The tactic, nicknamed “salting” or “hidden text salting,” adds noise like random characters and invisible…
Dark Reading -
U.K.: Two arrested over cyber attack which stole thousands of nursery children’s data
Two men aged 17 and 22 were arrested in Bishop’s Stortford, Hertfordshire, on suspicion of computer misuse and blackmail, in connection with the Kido nursery chain cyberattack. It was reported that cyberhackers used the pictures and names of about 8,000…
DataBreaches -
GoAnywhere MFT zero-day used by Storm-1175 in Medusa ransomware campaigns
GoAnywhere MFT has a zero-day flaw (CVE-2025-10035) that Storm-1175 has been exploiting in Medusa ransomware campaigns, with active in-the-wild activity dating back to 10 September 2025 and follow-up confirmations from Fortra’s advisory dated 18 September…
Security AffairsStorm-1175 -
Security Concerns Shadow Vibe Coding Adoption
TechTarget and Informa Tech’s Digital Business Combine has published a piece on how readers are using vibe coding in AppDev, with results showing a split between productivity and risk. In a recent online poll, nearly 1,000 responses revealed that 24% of…
Dark Reading -
Top 10 Best Digital Risk Protection (DRP) Platforms in 2025
GBHackers on Security’s Top 10 Best Digital Risk Protection (DRP) Platforms in 2025 presents a ranked guide to enterprise DRP solutions, published on 7 October 2025 by Varshini. The article covers CrowdStrike Falcon Intelligence and Recorded Future…
gbhackers.com -
BatShadow Group Uses New Go-Based 'Vampire Bot' Malware to Hunt Job Seekers
According to Aryaka Threat Research Labs researchers Aditya K Sood and Varadharajan K, a Vietnamese threat actor named BatShadow has launched a new campaign that uses social engineering to lure job seekers and digital marketing professionals into installing…
The Hacker NewsBatShadow -
Disrupting threats targeting Microsoft Teams
The Microsoft Threat Intelligence post explains that Microsoft Teams’ extensive collaboration features and global adoption make it a high‑value target for cyber criminals and state‑sponsored actors, who abuse its messaging, calls and meetings and even…
Microsoft -
Medusa Ransomware Actors Exploit Critical Fortra GoAnywhere Flaw
Threat actors armed with Medusa ransomware are actively exploiting a maximum-severity deserialization flaw in Fortra’s GoAnywhere MFT product (CVE-2025-10035), sparking further questions about the now well-known vulnerability. In a blog post on Monday,…
Dark Reading -
Top 10 Best Cyber Threat Intelligence Companies in 2025
GBHackers’ roundup for 2025 highlights the Top 10 Best Cyber Threat Intelligence Companies, led by Recorded Future with its predictive, AI-powered Threat Intelligence Cloud and strong SIEM/SOAR/EDR integrations. The list also spotlights CrowdStrike for…
gbhackers.com -
California hospitals can escape fines if workers expose patient info
A California state appeals panel has agreed hospitals can’t be sued if one of their employees posts confidential patient health information online so long as there are appropriate policies in place attempting to prevent such an outcome, according to the…
DataBreaches -
New Microsoft Secure Future Initiative (SFI) patterns and practices: Practical guides to strengthen security
The Microsoft Security blog outlines the New Microsoft Secure Future Initiative (SFI) patterns and practices, the second instalment building on the initial launch to make security guidance practical and scalable for practitioners. It presents six patterns…
Microsoft -
Don’t connect your wallet: Best Wallet cryptocurrency scam is making the rounds
Don’t connect your wallet: Best Wallet cryptocurrency scam is making the rounds, according to Malwarebytes. The scammers impersonated Best Wallet, a service that lets people store, send, and receive cryptocurrencies directly on their own device, with the aim…
Malwarebytes -
INE Security Releases Industry Benchmark Report: “Wired Together: The Case for Cross-Training in Networking and Cybersecurity”
INE Security released the Industry Benchmark Report, titled “Wired Together: The Case for Cross-Training in Networking and Cybersecurity,” on 7 October 2025, with findings drawn from nearly 1,000 IT and cybersecurity professionals worldwide. The study shows…
gbhackers.com -
Google's New AI Doesn't Just Find Vulnerabilities — It Rewrites Code to Patch Them
Google’s DeepMind division unveiled an AI-powered agent called CodeMender that not only detects vulnerabilities but automatically patches and rewrites vulnerable code to stop future exploits. Since its development began, CodeMender has upstreamed 72 security…
The Hacker News -
INE Security Releases Industry Benchmark Report: “Wired Together: The Case for Cross-Training in Networking and Cybersecurity”
INE Security has released the Industry Benchmark Report titled “Wired Together: The Case for Cross-Training in Networking and Cybersecurity,” based on insights from nearly 1,000 IT and cybersecurity professionals worldwide. According to CyberNewsWire, the…
SecurityOnline -
Hackers Stole Data From Public Safety Comms Firm BK Technologies
BK Technologies, the Florida-based public safety communications equipment maker, disclosed in a regulatory filing that it detected an intrusion on 20 September 2025 and launched an investigation to remove the attacker from its systems. The company said the…
SecurityWeek -
CISA Alerts on Oracle E-Business Suite 0-Day Actively Exploited for Ransomware Attacks
According to CISA, a critical zero-day vulnerability in Oracle E-Business Suite, tracked as CVE-2025-61882, is being actively exploited to deploy ransomware worldwide. The flaw affects the BI Publisher Integration component and allows unauthenticated…
gbhackers.com -
Kibana CrowdStrike Connector Flaw Exposes Sensitive Credentials
A security issue in the Kibana CrowdStrike Connector allows attackers to access stored CrowdStrike credentials, with the flaw tracked as CVE-2025-37728. The vulnerability arises from insufficient protection of credentials in the CrowdStrike Connector, and…
gbhackers.com -
Cybersecurity M&A Roundup: 40 Deals Announced in September 2025
Forty cybersecurity merger and acquisition deals were announced in September 2025, according to SecurityWeek. Significant highlights include Accenture acquiring IAMConcepts to expand its identity and access management footprint in Canada, and Cato Networks…
SecurityWeek -
Harris Health discloses insider-wrongdoing breach that went on for a decade
Harris Health disclosed an insider wrongdoing breach that persisted for a decade, with more than 5,000 patients notified after the system identified the issue. The employee responsible was fired and referred to law enforcement when the wrongdoing came to…
DataBreaches -
Red Hat Breach Impacts 5,000+ High-Value Enterprise Customers, Data at Risk
Red Hat Consulting’s breach impacted more than 5,000 high-value enterprise customers and put data at risk, with Red Hat confirming the incident and beginning to notify affected clients by 13 September 2025. Early evidence suggests the attackers exfiltrated…
gbhackers.comCrimson Collective -
Cavalry Werewolf APT Targets Russian Organizations Using FoalShell and Telegram C2
Cavalry Werewolf, a Russian-focused APT cluster, has intensified its offensive operations by targeting Russian organisations with FoalShell and StallionRAT, and by using Telegram-based C2. The group has conducted phishing campaigns impersonating Kyrgyz…
gbhackers.comYoroTrooper -
Filigran Raises $58 Million in Series C Funding
French cybersecurity startup Filigran has raised $58 million in Series C funding, bringing total raised to over $100 million. The round was led by Eurazeo’s Growth team, with additional support from Deutsche Telekom (T[.]Capital) and previous investors Accel…
SecurityWeek -
Troops and veterans’ personal information leaked in CPAP Medical data breach
In December 2024, CPAP Medical Supplies and Services Inc., a Jacksonville, Florida-based provider of sleep therapy services, experienced a cybersecurity incident that compromised the personal data of over 90,000 patients. An unauthorized actor accessed…
Malwarebytes -
New Research: AI Is Already the #1 Data Exfiltration Channel in the Enterprise
A new LayerX report reveals that AI is already the single largest uncontrolled channel for corporate data exfiltration, surpassing shadow SaaS and unmanaged file sharing. Based on real‑world enterprise browsing telemetry, the study shows sensitive data…
The Hacker News -
XWorm 6.0 Returns with 35+ Plugins and Enhanced Data Theft Capabilities
XWorm 6.0 has reappeared with a modular core and more than 35 DLL payloads that can be loaded into memory via a plugin command, according to Trellix. The analysis notes that XWorm’s plugins include RemoteDesktop[.]dll, WindowsUpdate[.]dll, Stealer[.]dll,…
The Hacker News -
Patch Now: ‘RediShell’ Threatens Cloud Via Redis RCE
A 13-year-old vulnerability in Redis, tracked as CVE-2025-49844 and dubbed RediShell, can allow full remote code execution and post-authentication access to a Redis host, according to Wiz Research. The flaw stems from a use-after-free memory corruption bug…
Dark Reading -
Security Firm Exposes Role of Beijing Research Institute in China’s Cyber Operations
According to Recorded Future, the Beijing Institute of Electronics Technology and Application (BIETA) and its subsidiary Beijing Sanxin Times Technology Co (CIII) research and sell technologies that support China’s intelligence, counterintelligence and…
SecurityWeek -
CrowdStrike Alerts on Oracle E-Business Suite 0-Day Under Mass Exploitation
According to CrowdStrike Intelligence, a novel zero-day vulnerability in Oracle E-Business Suite (CVE-2025-61882) is being actively exploited in a mass data exfiltration campaign, with primary involvement attributed to the GRACEFUL SPIDER threat group and…
gbhackers.com -
Fortra GoAnywhere MFT Zero-Day Exploited in Ransomware Attacks
The Medusa ransomware operators exploited the GoAnywhere MFT vulnerability one week before patches were released, according to SecurityWeek. The flaw, tracked as CVE-2025-10035 with a CVSS score of 10/10, was disclosed on 18 September when Fortra rolled out…
SecurityWeek -
Hackers Exploit Legitimate Commands to Breach Databases
Hackers are increasingly using legitimate database commands to breach systems, rather than deploying new malware. They exploit built‑in queries such as DROP, DELETE or EXPORT after authenticating to misconfigured services, exfiltrating data to…
gbhackers.com -
The Y2K38 Bug Is a Vulnerability, Not Just a Date Problem, Researchers Warn
The Y2K38 bug, also called the Year 2036/2038 problem, is described as a vulnerability rather than a mere date problem, with researchers warning that time manipulation could be exploited today against ICS and consumer devices. They note that billions of…
SecurityWeek -
OpenSSH ProxyCommand Flaw Allows Remote Code Execution – PoC Released
Security researchers have disclosed a critical OpenSSH flaw in ProxyCommand that can enable remote code execution on client systems, tracked as CVE-2025-61984, with the vulnerability detailed by the NVD. The flaw arises from inadequate filtering of control…
gbhackers.com -
CrowdStrike ties Oracle EBS RCE (CVE-2025-61882) to Cl0p attacks began Aug 9, 2025
According to CrowdStrike, researchers linked Oracle E-Business Suite RCE CVE-2025-61882 to Cl0p, with the first known exploitation dating from 9 August 2025 and a CVSS of 9.8. The flaw allows unauthenticated remote code execution and has been used in…
Security Affairs -
Discord warns users after data stolen in third-party breach
Discord warns users after data stolen in third-party breach. The breach occurred on 20 September and involved a third-party customer support provider rather than a direct attack on Discord’s servers. According to Rescana, attackers identified themselves as…
Malwarebytes -
13-Year Redis Flaw Exposed: CVSS 10.0 Vulnerability Lets Attackers Run Code Remotely
Redis has disclosed a maximum-severity vulnerability tracked as CVE-2025-49844 (aka RediShell) that could allow remote code execution under certain conditions, with an authenticated user able to use a specially crafted Lua script to manipulate the garbage…
The Hacker News -
Critical Vulnerability Puts 60,000 Redis Servers at Risk of Exploitation
A critical vulnerability in Redis, tracked as CVE-2025-49844 and rated with a CVSS score of 10/10, could allow authenticated attackers to execute arbitrary code remotely via a use-after-free in the Lua engine. The flaw has left about 60,000 Redis servers…
SecurityWeek
