News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 13 so far |
Thu 9 Oct 2025· 79 articles
-
BreachForums Seized — Again!
BreachForums was seized, with the splash page now bearing the message “This Domain Has Been Seized” and four shields displayed: Department of Justice, FBI, BL2C, and JUNALCO. According to the exact name, this action followed days of heightened activity as…
DataBreaches -
When AI Remembers Too Much – Persistent Behaviors in Agents’ Memory
The Unit 42 article presents a PoC showing how indirect prompt injection can silently poison the long-term memory of an AI agent, demonstrated using Amazon Bedrock Agents with memory retention enabled. It explains that malicious instructions can be inserted…
unit42.paloaltonetworks.com -
SonicWall Says All Firewall Backups Were Accessed by Hackers
According to HackRead, SonicWall disclosed in September 2025 a data breach of its cloud backup service, with fewer than 5% of customers affected at the time. The situation escalated when SonicWall and incident response firm Mandiant confirmed that attackers…
DataBreaches -
ClayRat campaign uses Telegram and phishing sites to distribute Android spyware
ClayRat Android spyware targets Russian users via fake Telegram channels and phishing sites posing as popular apps like Google Photos, WhatsApp, TikTok and YouTube. Zimperium named the spyware ClayRat after its C2 server, and researchers observed over 600…
Security Affairs -
GitHub Copilot 'CamoLeak' AI Attack Exfiltrates Data
According to Legit Security, researchers have demonstrated a proof-of-concept attack dubbed “CamoLeak” that uses GitHub Copilot to exfiltrate private data. The PoC, created by Legit Security’s Colleagues including Omer Mayraz, shows how a victim’s Copilot…
Dark Reading -
SonicWall: 100% of Firewall Backups Were Breached
SonicWall says a breach of its cloud backup service has grown far worse, now affecting 100% of firewall backups after previously being estimated at fewer than 5% of its firewall install base. The incident was first disclosed on 17 September 2025 as a “cloud…
Dark Reading -
Fake VPN and streaming app drops malware that drains your bank account
Security researchers are warning Android users to delete a fake VPN and streaming app that can let criminals take over their phones and drain their bank accounts, with the app Mobdro Pro IP TV + VPN identified as malicious sideloaded software. Their…
Malwarebytes -
Discord says hackers stole government IDs of 70,000 users
According to Dan Goodin, Discord says hackers stole images of government IDs from roughly 70,000 users who had provided them to support age-related reviews. The breach involved a third-party customer service provider entrusted by Discord to manage the data,…
Ars Technica -
From HealthKick to GOVERSHELL: The Evolution of UTA0388's Espionage Malware
According to Volexity, a China-aligned threat actor codenamed UTA0388 has been attributed to spear-phishing campaigns aimed at North America, Asia and Europe to deliver a Go-based implant known as GOVERSHELL. The group’s activity is described as “highly…
The Hacker NewsUTA0388 -
Inside a Crypto Scam Nexus
Inside a Crypto Scam Nexus maps a coordinated fraud operation centred on a single hosting IP, 8.221.100[.]222, used to host multiple domains including medaigenesis[.]cc, novacrypt[.]net and zzztd[.]com. The investigation, according to DomainTools…
dti.domaintools.com -
Securing agentic AI: Your guide to the Microsoft Ignite sessions catalog
Security professionals are invited to Microsoft Ignite 2025 in San Francisco from 17 to 21 November, with online access available from 18 to 20 November, and the event will showcase an AI-first, end-to-end security platform for protecting identities,…
Microsoft -
Fastly CISO: Using Major Incidents as Career Catalysts
According to Dark Reading, Marshall Erwin, Fastly’s chief information security officer, describes a circuitous path from the CIA’s cyber unit in 2004 to the US Congress, then Mozilla, and finally Fastly about two years ago. He argues that major security…
Dark Reading -
New ClayRat Spyware Targets Android Users via Fake WhatsApp and TikTok Apps
A rapidly evolving Android spyware campaign called ClayRat has targeted users in Russia, using Telegram channels and lookalike phishing websites that impersonate popular apps such as WhatsApp, Google Photos, TikTok and YouTube as lures to install the…
The Hacker News -
Investigating targeted “payroll pirate” attacks affecting US universities
According to Microsoft Threat Intelligence, a financially motivated threat actor tracked as Storm-2657 has been compromising employee accounts to access HR SaaS platforms like Workday and divert salary payments, a campaign described as payroll fraud…
MicrosoftStorm-2657 -
CVE-2025-5947: WordPress Plugin flaw lets hackers access Admin accounts
According to Wordfence, CVE-2025-5947 is a critical vulnerability in the Service Finder WordPress theme’s Bookings plugin, with versions up to and including 6.0 suffering an authentication bypass that lets attackers log in as any user, including admins, due…
Security Affairs -
Microsoft Azure Experiences Global Outage Disrupting Cloud Services Worldwide
Microsoft Azure suffered a significant, globally felt outage that began around 07:40 UTC when Azure Front Door, the platform’s CDN, lost about 30 percent of its capacity, according to CSN. The disruption left many customers unable to reach cloud resources,…
gbhackers.com -
SonicWall Confirms Breach Exposing All Customer Firewall Configuration Backups
SonicWall confirms that an unknown party gained access to all firewall configuration backup files for customers using the MySonicWall cloud backup feature, following a cloud backup security incident. The files contain encoded configuration settings and…
gbhackers.com -
Take Note: Cyber-Risks With AI Notetakers
Transcription applications are joining your online meetings, and the piece notes they bring risks to security, operations, reputation and even strategy, whether the tools are official company apps or not. It highlights that notetakers running outside…
Dark Reading -
Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign
Written by: Peter Ukhanov, Genevieve Stark, Zander Work, Ashley Pearson, Josh Murchie, Austin Larsen Introduction Beginning Sept. 29, 2025, Google Threat Intelligence Group (GTIG) and Mandiant began tracking a new, large-scale extortion campaign by a threat…
Google Cloud -
SquareX Shows AI Browsers Fall Prey to OAuth Attacks, Malware Downloads and Malicious Link Distribution
According to CyberNewswire, SquareX has released security research revealing that AI browsers are vulnerable to OAuth attacks, malware downloads and malicious link distribution as they gain traction in enterprise environments. The findings describe attackers…
gbhackers.com -
Hackers Access SonicWall Cloud Firewall Backups, Spark Urgent Security Checks
According to SonicWall, on 9 October 2025 an unauthorized party accessed firewall configuration backup files for all customers that used the cloud backup service. The company said the files contain encrypted credentials and configuration data, and while…
The Hacker News -
Lightship Security and the OpenSSL Corporation Submit OpenSSL 3.5.4 for FIPS 140-3 Validation
Lightship Security and the OpenSSL Corporation have jointly submitted OpenSSL version 3.5.4 to the Cryptographic Module Validation Program (CMVP) for FIPS 140-3 validation, marking a milestone in delivering validated cryptographic solutions. The submission…
gbhackers.com -
Missing Risk Analysis Cost NY CPA Firm $175K—But Not the Big Group Whose Data Was Breached in 2019
The DataBreaches[.]net piece reports that the U.S. Department of Health and Human Services’ Office for Civil Rights imposed a $175,000 HIPAA enforcement action, notable for focusing on a business associate rather than a covered entity. According to HHS…
DataBreaches -
Threat Actors Exploit DFIR Tool Velociraptor in Ransomware Attacks
According to Cisco Talos, threat actors have begun exploiting Velociraptor, an open-source DFIR tool, to gain stealthy, persistent access and deploy multiple ransomware variants against enterprise environments, marking the first definitive linkage between…
gbhackers.com -
SquareX Shows AI Browsers Fall Prey to OAuth Attacks, Malware Downloads and Malicious Link Distribution
According to CyberNewsWire, SquareX has released security research showing that AI Browsers can be exploited to exfiltrate data, distribute malware and gain unauthorised access to enterprise SaaS apps. In one example, Comet fell prey to an OAuth attack,…
SecurityOnline -
New QR Code-Based Quishing Attack Targets Microsoft Users
A new QR code-based quishing campaign has been uncovered that specifically targets Microsoft users, deploying seemingly innocent document review prompts to lure victims. Attackers bypass traditional antivirus and PDF-scanning defenses by splitting the QR…
gbhackers.com -
ThreatsDay Bulletin: MS Teams Hack, MFA Hijacking, $2B Crypto Heist, Apple Siri Probe & More
ThreatsDay Bulletin reports that threat actors abuse Microsoft Teams for extortion, social engineering and financial theft, including after gaining control of MFA through password-reset social engineering to sign in to Teams and access sensitive information.…
The Hacker News -
Lightship Security and the OpenSSL Corporation Submit OpenSSL 3.5.4 for FIPS 140-3 Validation
Lightship Security and the OpenSSL Corporation have submitted OpenSSL version 3.5.4 to the Cryptographic Module Validation Program for FIPS 140-3 validation, according to Jason Lawlor, President of Lightship Security, and Tim Hudson, President of the OpenSSL…
SecurityOnline -
Realm.Security Raises $15 Million in Series A Funding
Realm[.]Security has announced a $15 million Series A funding round, bringing its total raised to $20 million, as SecurityWeek reports. The investment was led by Jump Capital, with seed investors Accomplice and Glasswing Ventures also participating,…
SecurityWeek -
Discord Confirms 70,000 Government IDs Exposed in Third-Party Breach
According to Discord, approximately 70,000 users had government-ID photos exposed in a September 20, 2025 incident, caused by a breach of a third-party customer service provider rather than Discord itself. The data involved included government-issued ID…
DataBreaches -
VirusTotal Introduces Simplified Platform Access and New Contributor Model
VirusTotal has announced a major update to simplify platform access and introduce a new Contributor Tier to recognise researchers who contribute detections and rules. According to the article, the changes aim to make the platform easier to use for…
gbhackers.com -
SaaS Breaches Start with Tokens - What Security Teams Must Watch
Token theft is identified as a leading cause of SaaS breaches, with attackers abusing OAuth access tokens, API keys and session tokens to access systems without triggering MFA. The piece notes that just one stolen token can bypass security measures and that…
The Hacker News -
California Sets 30 Day Deadline for Data Breach Notifications
California’s breach notification obligations are tightening, with Governor Gavin Newsom signing SB 446 to set clear timelines. Under the new rules, businesses must notify affected individuals within 30 calendar days of discovering or being notified of a data…
DataBreaches -
Vn: Major hospitals hit by cyberattacks, patient data sold on hacker forums
According to Thuy, in the first six months of 2025 there was a surge in ransomware attacks targeting energy, healthcare, government agencies, and recently even press and information agencies. The piece notes that VietnamNet’s article names some larger…
DataBreaches -
California’s New Delete Request Tool Impacts Data Brokers and Residents
According to Hunton Andrews Kurth, California’s Privacy Protection Agency adopted regulations on September 26, 2025 governing the Delete Request and Opt-Out Platform (DROP), a tool designed to enable consumers to request deletion of all non-exempt personal…
DataBreaches -
PoC Released for Nothing Phone Code-Execution Vulnerability
A proof-of-concept exploit has been published for a critical flaw in the secure boot process of the Nothing Phone (2a) and CMF Phone 1. The PoC, named fenrir, patches the function sec_get_vfy_policy() in bl2_ext to always return zero, bypassing the…
gbhackers.com -
Cybercriminals Impersonate HR Departments to Harvest Your Gmail Login Details
Cybercriminals are impersonating HR departments to harvest Gmail login details by exploiting trusted Zoom document sharing. A recent incident saw an email titled “HR application” arriving from a valid Zoom Docs address, which led victims through a gate that…
gbhackers.com -
Shad White’s office finds nearly a third of Mississippi’s state agencies fail cybersecurity requirements
According to Mississippi State Auditor Shad White, a third of state offices are at risk of cybercrimes because they have not met cybersecurity assessment requirements, in a report released yesterday, Tuesday, 7 October. The review, conducted by analysts at…
DataBreaches -
California just put people back in control of their data
California’s 2025 legislative session closed with 14 new privacy and AI-related bills, several of which were signed into law to give consumers more control over their data. Governor Gavin Newsom signed AB 656, which requires social media companies to make…
Malwarebytes -
Akira SonicWall Campaign Uncovered
Starting in July 2025, Akira ransomware activity targeting SonicWall SSL VPN devices surged globally, with SonicWall CVE-2024-40766 linked to the campaign after an initial belief in a zero‑day vulnerability. On 20 August 2025, Darktrace observed unusual…
darktrace.comStorm-1567
