News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 13 so far |
Fri 10 Oct 2025· 66 articles
-
Apple doubles maximum bug bounty to $2M for zero-click RCEs
Apple has doubled its bug bounty rewards, now offering up to $2 million for zero-click remote code execution flaws, according to Apple. Since 2020, it has paid $35 million to 800 researchers. The company says bonuses for Lockdown Mode bypasses and beta bugs…
Security Affairs -
Watsonville Community Hospital had a data breach — or two. It would be helpful to know which.
Watsonville Community Hospital in California has faced multiple disclosures about a cyber incident spanning late 2024 and 2025, with a November 29 event referenced as the initial attack and a December 2024 substitute notice outlining potentially exposed…
DataBreaches -
1Password Addresses Critical AI Browser Agent Security Gap
1Password has unveiled a new integration to address security gaps in AI-enabled browser agents, aiming to prevent credential leakage as organisations increasingly deploy agentised browsers. The feature, named Secure Agentic Autofill, is a collaboration with…
Dark Reading -
Telstra Denies Scattered Spider Data Breach Claims Amid Ransom Threats
Telstra has denied claims by the hacker group Scattered Spider that it suffered a massive data breach affecting nearly 19 million personal records, stating that its internal systems remain secure and that the data in question were scraped from publicly…
DataBreachesScattered Spider -
The Golden Scale: Bling Libra and the Evolving Extortion Economy
According to Unit 42, Scattered Lapsus$ Hunters (aka SP1D3R HUNTERS, SLSH) have claimed responsibility for attacks on Salesforce tenants as part of a broader extortion campaign, with the group described as a potential Trinity of Chaos linking Muddled Libra,…
unit42.paloaltonetworks.comSp1d3r -
RondoDox Botnet: an 'Exploit Shotgun' for Edge Vulns
RondoDox Botnet is described as an “Exploit Shotgun” that targets dozens of known vulnerabilities in hard-to-patch edge devices worldwide, taking a hit-and-run, shotgun approach to exploitation. It began making the rounds in May, according to Trend Micro,…
Dark Reading -
The Fight Against Ransomware Heats Up on the Factory Floor
Ransomware gangs continue to target manufacturing, with the sector repeatedly identified as a top vulnerability as the landscape evolves, including a rise in data-extortion tactics alongside encryption. The manufacturing sector accounted for 22% of all…
Dark Reading -
“Payroll Pirate” phishing scam that takes over Workday accounts steals paychecks
Microsoft is warning of an active scam dubbed “Payroll Pirate” that takes over Workday or other cloud-based HR accounts and diverts paychecks to attacker-controlled accounts after first compromising the victims’ profiles. The attackers bypass multi-factor…
Ars Technica -
Feds Shutter ShinyHunters Salesforce Extortion Site
The FBI, in coordination with law enforcement in France, seized the latest BreachForums underground forum domain, which had been converted into an extortion site used by Scattered Lapsus$ Hunters, the group behind the recent Salesforce data heists. The…
Dark ReadingScattered Lapsus Hunters -
DDoS Botnet Aisuru Blankets US ISPs in Record DDoS
The Krebs on Security report details Aisuru, a DDoS botnet that has shifted its heavy weaponry onto compromised IoT devices hosted by U.S. Internet providers such as AT&T, Comcast and Verizon, with researchers noting a concentration of infected devices…
Krebs on Security -
Chinese Hackers Use Velociraptor IR Tool in Ransomware Attacks
Storm-2603, a China-based threat group, has added Velociraptor, a DFIR tool, to its ransomware workflow, using it to maintain stealthy, persistent access as part of attacks that deployed Warlock ransomware alongside other family members. Cisco Talos notes…
Dark Reading -
Apple voices concerns over age-check law that could put user privacy at risk
Apple has raised concerns about Texas SB 2420, a law that introduces age assurance requirements for app stores and developers, with Apple stating that it “impacts the privacy of users by requiring the collection of sensitive, personally identifiable…
Malwarebytes -
Microsoft Adds Agentic AI Capabilities to Sentinel
Microsoft has previewed Agentic AI capabilities for its Sentinel SIEM, expanding Sentinel into a broader security operations and management platform with new graph capabilities and a Model Context Protocol (MCP) server. The new graph tools will allow…
Dark Reading -
Your passwords don’t need so many fiddly characters, NIST says
The Malwarebytes piece reports that the US National Institute of Standards and Technology has published updated password guidelines that shift away from enforcing complex characters and frequent resets. It emphasises that password length now matters more…
Malwarebytes -
Deepfake Awareness High at Orgs, But Cyber Defenses Badly Lag
AI-augmented deepfakes are increasingly present in cyberattacks on businesses and government bodies, with organisations broadly recognising the threat yet failing to match defence investments. On 7 October, OpenAI published research about adversaries using…
Dark Reading -
Stealit Malware Abuses Node.js Single Executable Feature via Game and VPN Installers
Stealit is an active malware campaign that has exploited Node[.]js’ Single Executable Application feature to distribute its payloads, with Fortinet FortiGuard Labs noting that SEA allows Node[.]js apps to run as a standalone executable without a Node[.]js…
The Hacker News -
Nanoprecise partners with AccuKnox to strengthen its Zero Trust Cloud Security and Compliance Posture
Nanoprecise has partnered with AccuKnox to strengthen its Zero Trust Cloud Security and compliance posture, the firms announcing a move to enhance cloud security, governance and compliance across its expanding footprint. According to CyberNewswire,…
gbhackers.com -
In Other News: Gladinet Flaw Exploitation, Attacks on ICS Honeypot, ClayRat Spyware
In Other News: Gladinet Flaw Exploitation, Attacks on ICS Honeypot, ClayRat Spyware notes that a vulnerability affecting Gladinet’s CentreStack and Triofox products has been exploited in the wild, with Huntress warning that exploitation of CVE-2025-11371 has…
SecurityWeek -
Juniper patched nine critical flaws in Junos Space
Juniper Networks released patches addressing nearly 220 vulnerabilities across Junos OS, Junos Space, and Security Director, including nine critical flaws in Junos Space. The Junos Space 24.1R4 Patch V1 package fixes 162 vulnerabilities, among them the nine…
Security Affairs -
Commentary Section Launches New, More Opinionated Era
According to Dark Reading, the Commentary Section launches a new, more opinionated era as part of a reworked approach to sharing expertise with the cybersecurity community. The piece notes that Jim Donahue, the editor who ran the Commentary section, has…
Dark Reading -
Ukraine sees surge in AI-Powered cyberattacks by Russia-linked Threat Actors
According to the State Service for Special Communications and Information Protection (SSSCIP), Russia-linked actors are increasingly using AI to craft phishing and malware attacks against Ukraine, with some samples showing AI-generated code. In H1 2025,…
Security Affairs -
Microsoft Warns of ‘Payroll Pirates’ Hijacking HR SaaS Accounts to Steal Employee Salaries
According to Microsoft Threat Intelligence, a threat actor known as Storm-2657 has been observed hijacking employee accounts to divert salary payments, targeting United States organisations including higher education institutions that use HR SaaS platforms…
The Hacker News -
Nanoprecise partners with AccuKnox to strengthen its Zero Trust Cloud Security and Compliance Posture
Nanoprecise has chosen AccuKnox to bolster its Zero Trust Cloud Native Application Protection Platform (CNAPP) as part of strengthening its cloud security, governance, and compliance framework, according to CyberNewsWire. The partnership follows…
SecurityOnline -
Chaosbot Using CiscoVPN and Active Directory Passwords for Network Commands
According to eSentire’s Threat Response Unit (TRU), suspicious activity was observed when legitimate CiscoVPN logins coincided with anomalous WMI calls to multiple endpoints in a financial services environment, with an Active Directory account named…
gbhackers.com -
Cisco, Fortinet, Palo Alto Networks Devices Targeted in Coordinated Campaign
GreyNoise has discovered that three exploitation campaigns targeting Cisco, Fortinet and Palo Alto Networks devices originate from IPs on the same subnets and share TCP fingerprints, indicating they are operated from the same infrastructure. The threat…
SecurityWeek -
SonicWall SSL VPN Devices Targeted by Threat Actors to Distribute Akira Ransomware
SonicWall SSL VPN devices have been targeted by threat actors to distribute Akira ransomware, with researchers noting a significant uptick in attacks exploiting unpatched appliances between July and August 2025. According to Darktrace, on August 20, 2025,…
gbhackers.comStorm-1567 -
Don’t breathe that sigh of relief just yet: BreachForums is gone, but the Salesforce leak site isn’t
BreachForums has been seized, but the Salesforce leak site associated with it remains online, according to DataBreaches[.]Net.
DataBreaches -
RondoDox Botnet Takes ‘Exploit Shotgun’ Approach
A newly identified botnet, dubbed RondoDox, takes a shotgun approach by packing over 50 exploits targeting unpatched routers, DVRs, NVRs, CCTV systems, servers and other network devices, according to Trend Micro. The campaign began activities in mid-2025 and…
SecurityWeek -
From Detection to Patch: Fortra Reveals Full Timeline of CVE-2025-10035 Exploitation
Fortra has outlined a full timeline showing CVE-2025-10035 being actively exploited in GoAnywhere MFT since at least 11 September 2025, after a customer reported a potential vulnerability and the firm began its investigation that day. The company said it…
The Hacker News -
175 Malicious npm Packages Targeting Tech and Energy Firms, 26,000 Downloads
According to Socket’s Threat Research Team, 175 malicious npm packages have been identified that target tech and energy firms, amassing over 26,000 downloads in a sprawling Beamglea phishing campaign. The packages act as hosting infrastructure, redirecting…
gbhackers.com -
Millions of (very) private chats exposed by two AI companion apps
According to Cybernews, two AI companion apps, Chattee Chat – AI Companion and GiMe Chat – AI Companion, exposed millions of private conversations from more than 400,000 users. The data included 43 million messages and over 600,000 images and videos, with IP…
Malwarebytes -
The AI SOC Stack of 2026: What Sets Top-Tier Platforms Apart?
The AI SOC Stack of 2026 argues that the SOC of the near future will be powered by AI agents rather than a single human-driven system, with platforms moving from co-pilots to mesh agentic architectures that autonomously distribute and learn from tasks across…
The Hacker News -
175 Malicious npm Packages with 26,000 Downloads Used in Credential Phishing Campaign
Cybersecurity researchers have flagged a new set of 175 malicious npm packages that have collectively been downloaded 26,000 times and are being used to support a credential harvesting campaign codenamed Beamglea, targeting more than 135 industrial,…
The Hacker News -
Juniper Networks Patches Critical Junos Space Vulnerabilities
SecurityWeek reports that Juniper Networks has issued patches for nearly 220 vulnerabilities across Junos OS, Junos Space and Security Director, including nine critical-severity flaws in Junos Space. According to SecurityWeek, Junos Space version 24.1R4 was…
SecurityWeek -
LLM-Powered MalTerminal Malware Uses OpenAI GPT-4 to Create Ransomware Code
GBHackers on Security reports on MalTerminal, a Windows-targeting malware named in the researchers’ year-long survey, which uses an OpenAI GPT-4 endpoint to generate ransomware encryption routines or reverse-shell code based on operator input. The…
gbhackers.com -
GitHub Copilot Flaw Allows Attackers to Steal Source Code from Private Repositories
A critical weakness in GitHub Copilot Chat discovered in June 2025 exposed private source code and secrets to attackers, rated CVSS 9.6. According to Legit Security, the vulnerability combined a novel Content Security Policy bypass with remote prompt…
gbhackers.com -
ZDI Drops 13 Unpatched Ivanti Endpoint Manager Vulnerabilities
According to Trend Micro’s Zero Day Initiative (ZDI), this week it published 13 advisories describing unpatched vulnerabilities in Ivanti Endpoint Manager. The disclosures include one local privilege escalation affecting the Endpoint Manager’s AgentPortal…
SecurityWeek -
From LFI to RCE: Active Exploitation Detected in Gladinet and TrioFox Vulnerability
According to Huntress, active in-the-wild exploitation of an unpatched flaw affecting Gladinet CentreStack and TrioFox has been observed, tracked as CVE-2025-11371 with a CVSS score of 6.1. The zero-day flaw is an unauthenticated local file inclusion bug…
The Hacker News -
BreachForums Seized (Yes, Again)
According to ShinyHunters, BreachForums was seized by the FBI and international partners today, with all their domains taken and the era of forums declared over. The seized domain, breachforums[.]hn, had moved from a forum model to a leake and extortion…
SOCRadar -
Apple Bug Bounty Update: Top Payout Now $2 Million, $35 Million Paid to Date
According to SecurityWeek, Apple has updated its bug bounty programme, raising the top payout for a zero-click exploit chain that achieves remote device compromise from $1 million to $2 million, with the potential to reach $5 million including bonuses for…
SecurityWeek
