News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Fri 10 Oct 2025· 66 articles
-
RondoDox Botnet Targets Over 50 Vulnerabilities to Compromise Routers, CCTV Systems, and Web Servers
RondoDox Botnet targets more than 50 vulnerabilities to infiltrate routers, CCTV systems, and web servers, using an exploit shotgun approach that spans over 30 vendors. The campaign began with an intrusion detected on 15 June 2025, reusing a…
gbhackers.com -
U.S. CISA adds Grafana flaw to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Grafana flaw to its Known Exploited Vulnerabilities (KEV) catalog, tracked as CVE-2021-43798 with a CVSS score of 7.5. The vulnerability is a directory traversal issue affecting…
Security Affairs -
ClayRat Android Malware Masquerades as WhatsApp & Google Photos
ClayRat is an Android spyware campaign that has surged in activity over the past three months, with zLabs researchers observing more than 600 unique samples and 50 distinct droppers. It mainly targets Russian users and masquerades as popular apps such as…
gbhackers.com -
Gladinet CentreStack and Triofox 0-Day Flaw Under Active Attack
Gladinet CentreStack and Triofox have come under active attack, with threat actors exploiting an unauthenticated local file inclusion flaw tracked as CVE-2025-11371. The flaw lets attackers read sensitive files without logging in, enabling them to fetch the…
gbhackers.com -
Sophisticated Malware Deployed in Oracle EBS Zero-Day Attacks
Google Threat Intelligence Group (GTIG) and Mandiant have continued to analyse the Oracle E-Business Suite (EBS) extortion campaign, identifying multiple pieces of malware deployed in the attacks. Exploitation may have begun as early as July 10, with…
SecurityWeek -
RondoDox Botnet targets 56 flaws across 30+ device types worldwide
Trend Micro researchers report that the RondoDox botnet is exploiting 56 known flaws across more than 30 device types, including DVRs, NVRs, CCTV systems and web servers, and has been active globally since June. The campaign is described as an “exploit…
Security Affairs -
Snake Keylogger Uses Weaponized Emails and PowerShell to Steal Sensitive Data
A newly observed information-stealing campaign is deploying a stealthy variant of the SnakeKeylogger malware via weaponised e-mails that masquerade as legitimate remittance advice from CPA Global and Clarivate. According to GenThreatLabs, the infection…
gbhackers.com -
Authorities Dismantle BreachForums’ Reemerged Clearnet Marketplace
In a coordinated action, international law enforcement agencies seized the clearnet domain breachforums.[.]hn, effectively shutting down another incarnation of the BreachForums marketplace. The seizure notice on the domain appeared alongside the U.S.…
gbhackers.com -
CL0P-Linked Hackers Breach Dozens of Organizations Through Oracle Software Flaw
According to Google Threat Intelligence Group (GTIG) and Mandiant in a new report, dozens of organisations may have been impacted by a zero-day flaw in Oracle’s E-Business Suite (EBS) that was exploited from 9 August 2025, with patches subsequently issued by…
The Hacker News -
Hackers Exploit Microsoft Employee Accounts in Salary Theft Scheme
Microsoft Threat Intelligence is sounding the alarm about a surge of payroll theft attacks in which financially motivated adversaries hijack employee accounts to reroute salary payments to attacker‑controlled bank accounts. In the first half of 2025, the…
gbhackers.com -
Credit Card Payment Terminal Exploited for Remote Access
A security researcher has uncovered a significant vulnerability in the Worldline Yomani XR payment terminal that could allow attackers to gain full control of the device in under a minute. The terminals are deployed in grocery stores, cafes, repair shops and…
gbhackers.com -
Google Issues Alert on CL0P Ransomware Actively Exploiting Oracle E-Business Suite Zero-Day
According to Google Threat Intelligence Group (GTIG) and Mandiant, a massive email campaign began targeting executives from 29 September 2025, attempting to exfiltrate data from Oracle E-Business Suite environments and using compromised third‑party accounts…
gbhackers.com -
KFC Venezuela Suffers Alleged Data Breach Exposing 1 Million Customer Records
A threat actor is claiming responsibility for a data breach at KFC Venezuela’s operations, offering for sale a database containing the personal and order information of more than one million customers. The sale was advertised on a dark web forum on 8 October…
gbhackers.com -
7-Zip Vulnerabilities Allowing Remote Code Execution
Two critical vulnerabilities in 7-Zip’s handling of ZIP archives have emerged, enabling remote attackers to execute arbitrary code by exploiting directory traversal flaws, with both issues stemming from improper processing of symbolic links within ZIP files.…
gbhackers.com -
-
Gemini Nano Block: Google Locks On-Device AI Access for Smartphones with Unlocked Bootloaders
Gemini Nano Block is Google’s lightweight on‑device AI intended to run locally on smartphones, using the device’s GPU/NPU to avoid uploading user data to the cloud. The article notes that unlocking an Android device grants elevated privileges but can disrupt…
SecurityOnline -
CL0P Extortion: Google/Mandiant Expose Zero-Day RCE in Oracle E-Business Suite (CVE-2025-61882)
According to Google Threat Intelligence Group (GTIG) and Mandiant, an extensive data theft and extortion campaign targeting Oracle E-Business Suite environments has been disclosed, with threat actors claiming affiliation to the CL0P extortion brand. The…
SecurityOnline -
Exploited Zero-Day: Gladinet/Triofox Flaw CVE-2025-11371 Allows RCE via LFI
Huntress has sounded the alarm over in-the-wild exploitation of a newly discovered Local File Inclusion vulnerability, tracked as CVE-2025-11371, in Gladinet CentreStack and Triofox products, which allows unauthenticated attackers to retrieve sensitive files…
SecurityOnline -
NVIDIA GPU Driver Patches Multiple High-Severity Flaws Risking RCE and Privilege Escalation
NVIDIA has released an important security update for its GPU Display Driver to fix multiple high-severity vulnerabilities that could lead to code execution, privilege escalation, data tampering or denial of service across Windows, Linux, vGPU and cloud…
SecurityOnline -
RondoDox Botnet Unleashed: New Malware Uses ‘Exploit Shotgun’ to Target 50+ Router and IoT Flaws
Trend Micro has uncovered a rapidly expanding botnet campaign dubbed RondoDox, which targets a broad range of internet‑exposed devices from routers to CCTV systems and industrial networking gear, using over 50 distinct exploits across more than 30 vendors.…
SecurityOnline -
DFIR Tool Hijacked: Ransomware Group Storm-2603 Abuses Velociraptor for Stealthy LockBit/Babuk Attacks
Cisco Talos has confirmed that ransomware operators are now abusing Velociraptor, an open-source DFIR tool, in live campaigns, with the August 2025 operation tying together Warlock, LockBit and Babuk in a single assault. Velociraptor was deployed in an…
SecurityOnlineStorm-2603 -
MediaTek Issues October 2025 Security Bulletin Addressing Multiple High-Severity Vulnerabilities Across Wi-Fi and GNSS Chipsets
MediaTek has published its October 2025 Product Security Bulletin, detailing multiple high-severity and medium-severity flaws across WLAN and GNSS chipsets. Highlights include high-severity issues in WLAN components such as CVE-2025-20712, CVE-2025-20709,…
SecurityOnline -
Zero-Download Malware: New Cache Smuggling Phishing Attack Delivers Payload via Browser Cache
SecurityOnline[.]info reports that Expel researchers have uncovered a new phishing campaign that blends social engineering with browser cache manipulation to install malware without downloading any files, impersonating a Fortinet VPN Compliance Checker. The…
SecurityOnline -
ClickFix Phishing: New Automated Kits Trick Users Into Manually Running Malware and Stealers
Researchers from Palo Alto Networks Unit 42 have uncovered a commoditized phishing ecosystem built around an automated tool called the IUAM ClickFix Generator, which lets threat actors of any skill level create realistic pages that mimic browser verification…
SecurityOnline -
TP-Link Router Flaw CVE-2023-28760 Allows Root RCE via LAN, PoC Available
Security researchers have highlighted a critical flaw in the TP-Link AX1800 family (Archer AX21/AX20) that could allow unauthenticated attackers on the LAN to achieve remote code execution as root via the MiniDLNA service, tracked as CVE-2023-28760 and rated…
SecurityOnline -
Huntress Uncovers Log Poisoning Campaign Linking Nezha and Ghost RAT in Widespread Asian Cyber Intrusions
Huntress researchers have unveiled a new intrusion technique that combines log poisoning, AntSword web shell control, and the Nezha monitoring tool to deliver Ghost RAT malware across more than 100 victim systems. Beginning in August 2025, according to…
SecurityOnline
