News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 5 so far |
Mon 13 Oct 2025· 70 articles
-
Apple Discontinues Clips Video App, Removing It from App Store After Eight Years
Apple has quietly confirmed on its official support page that it has formally discontinued updates and removed its short-form video editing app, Clips, from the App Store, eight years after its 2017 launch as a lightweight tool for social video creation. The…
SecurityOnline -
Microsoft Offers Windows 10 ESU Free for One Year, Mandating Microsoft Account and OneDrive Backup
Microsoft has announced an Extended Security Updates (ESU) programme for Windows 10 that grants an extra year of security updates, with free access in select markets such as the United States. According to Microsoft’s announcement, Windows 10 will remain…
SecurityOnline -
Stealit Malware spreads via fake game & VPN installers on Mediafire and Discord
Stealit is now spreading via fake game and VPN installers hosted on MediaFire and Discord, with Fortinet FortiGuard Labs researchers noting the campaign abuses Node[.]js Single Executable Application (SEA) and sometimes Electron to disguise the payload.…
Security Affairs -
WhatsApp Worm Targets Users with Banking Malware, Steals Login Information
Cybersecurity researchers have uncovered a self-propagating WhatsApp worm campaign targeting users in Brazil with malware designed to steal banking credentials and cryptocurrency exchange login information. The attack was first detected on 29 September 2025…
gbhackers.com -
A week in security (October 6 – October 12)
A week in security (October 6 – October 12) rounds up several notable Malwarebytes Labs stories from early October 2025, with the piece posted on 13 October 2025. It highlights multiple items from 10 October, including Apple voices concerns over age-check…
Malwarebytes -
Astaroth Banking Trojan Abuses GitHub to Remain Operational After Takedowns
Astaroth, a banking Trojan, is being observed abusing GitHub as a backbone to stay operational after takedowns, with McAfee noting that attackers host malware configurations on GitHub so the Trojan can fetch fresh C2 configurations when primary…
The Hacker News -
Spanish Authorities Dismantle Advanced AI Phishing Operation GoogleXcoder
Spanish law enforcement recently dismantled an advanced AI-driven phishing network and arrested the mastermind developer known as “GoogleXcoder.” The operation targeted banks and government agencies and followed a Crime as a Service model, with the…
gbhackers.com -
Hackers Claim Massive Salesforce Breach: 1 Billion Records Stolen
A cybercrime group, Scattered Lapsus$ Hunters (also known as SP1D3R HUNTERS or SLSH), has claimed responsibility for massive data breaches targeting Salesforce customer tenants, with the operation reportedly stealing over one billion Salesforce records…
gbhackers.comScattered Lapsus Hunters -
SonicWall SSLVPN Targeted After Hackers Breach All Customer Firewall Backups
Cybersecurity researchers say a widespread campaign targeted SonicWall SSL VPN devices, with over 100 accounts compromised since early October and attacks observed starting on 4 October 2025 across 16 customer networks, according to Huntress. The intrusions…
gbhackers.com -
Oracle E-Business Suite Flaw Enables Remote Code Execution and Data Theft
Oracle has flagged a critical flaw in its E-Business Suite that could allow remote code execution and data theft without authentication, identified as CVE-2025-61884. The vulnerability is in the Oracle Configurator Runtime UI and affects Oracle E-Business…
gbhackers.com -
Astaroth Banking Malware Exploits GitHub for Hosting Configuration Files
Astaroth Banking Malware exploits GitHub for hosting configuration files, with McAfee researchers identifying that the latest variant abandons traditional C2 server dependencies in favour of GitHub repositories to maintain operation. The campaign uses…
gbhackers.com -
New Rust-Based Malware "ChaosBot" Uses Discord Channels to Control Victims' PCs
ChaosBot is a Rust-based backdoor disclosed by cybersecurity researchers, capable of reconnaissance and remote command execution on compromised Windows hosts. According to eSentire, threat actors leveraged compromised credentials mapped to both Cisco VPN and…
The Hacker News -
Attackers Exploit Defender for Endpoint Cloud API to Bypass Authentication and Disrupt Incident Response
Attackers can exploit Defender for Endpoint’s cloud API to bypass authentication, intercept commands, and spoof results, potentially derailing incident response and misleading analysts, according to Infoguard’s research cited in the piece. The analysis shows…
gbhackers.com -
Firefox Begins Testing In-Browser VPN Feature to Enhance IP Protection for Paid Users
Firefox has been testing an in-browser VPN feature, expanding the earlier IP Protection initiative into a premium service for paid subscribers, with the aim of encrypting all in-browser connections through a VPN tunnel and concealing the user’s real IP…
SecurityOnline -
LineageOS 23.0 Released on Android 16: New Camera App, Catapult TV Launcher, and Virtualization Support
LineageOS 23.0 has been released on Android 16, with the project noting that the update is based on Android 16 QPR0 rather than 16 QPR1 due to Google’s patch cadence. The release introduces a rewritten Camera app offering features such as JPEG Ultra HDR,…
SecurityOnline -
Oracle Warns of Unauthenticated Vulnerability in E-Business Suite (CVE-2025-61884)
Oracle has issued an emergency Security Alert Advisory for CVE-2025-61884 affecting Oracle E-Business Suite versions 12.2.3 through 12.2.14, a widely deployed ERP platform. The flaw is remotely exploitable without authentication, meaning attackers can…
SecurityOnline -
New Stealit Infostealer Abuses Node.js SEA Feature and Telegram C2 in Malware-as-a-Service Campaign
FortiGuard Labs has identified a new Stealit malware campaign that abuses the Node[.]js SEA feature to package and distribute its payloads, representing an evolution from its earlier Electron-based variants. The SEA approach lets Node-based applications run…
SecurityOnline -
Pro-Russian Hacktivist Group TwoNet Exposed for Fabricating Critical Infrastructure Attacks to Boost Reputation
Forescout Research has uncovered that the pro-Russian hacktivist group TwoNet fabricated real-world critical infrastructure attacks to inflate its reputation, beginning activity in September 2025 after launching a Telegram channel. According to Forescout,…
SecurityOnline -
Critical Cherry Studio Flaw CVE-2025-61929 (CVSS 9.7) Allows One-Click RCE via Custom URL Protocol
A critical vulnerability tracked as CVE-2025-61929 (CVSS 9.7) has been disclosed in Cherry Studio, a cross‑platform desktop client that supports multiple large language model providers. The flaw allows attackers to execute arbitrary commands with a single…
SecurityOnline -
Payroll Piracy: Hackers Storm-2657 Exploit MFA Flaws to Hijack University Salary Payments via Workday
Microsoft Threat Intelligence has issued a warning about a financially motivated campaign conducted by a threat actor tracked as Storm-2657, dubbed by researchers as a “payroll pirate.” The group has been compromising employee accounts at U.S. universities…
SecurityOnlineStorm-2657 -
Critical Auth Bypass (CVE-2025-61928) in Better Auth Allows Hackers to Steal User API Keys
A critical authentication bypass, CVE-2025-61928, has been discovered in Better Auth, a TypeScript authentication library, with the flaw rated CVSSv4 9.3 (Critical) and affecting Better Auth versions 1.3.25 and earlier. According to the article,…
SecurityOnline -
Axis Communications Leaks Azure Credentials in Autodesk Plugin Via Hardcoded SAS Tokens
Axis Communications’ Autodesk Revit plugin exposure stemmed from a signed AzureBlobRestAPI[.]dll containing hard-coded Azure credentials that granted access to two storage accounts, axisfiles and axiscontentfiles, within Axis’s cloud storage. According to…
SecurityOnline -
Homebrew Spoofing: Fake Installer Sites Use Clipboard Injection to Compromise macOS Developers
In October 2025, Kandji Threat Intelligence reported a malware campaign targeting macOS users via spoofed Homebrew installer sites that mirror brew[.]sh. The fake pages replace the normal copy-paste installation with a single “Copy” button, enabling…
SecurityOnline -
Massive RDP Botnet Unleashed: 100,000+ IPs in Coordinated Global Scanning Campaign Targeting US
According to GreyNoise Intelligence, a massive coordinated botnet operation targeting Remote Desktop Protocol (RDP) services across the United States has been observed, with more than 100,000 unique IP addresses involved since 8 October 2025. The campaign…
SecurityOnline -
New Rust Backdoor ChaosBot Uses Discord as Covert C2 Channel to Target Financial Services
The eSentire Threat Response Unit (TRU) identified a new Rust-based backdoor named ChaosBot deployed inside a financial services organisation’s environment, using Discord as a covert full C2 channel. According to eSentire, the malware’s operators hide behind…
SecurityOnline -
Cryptocurrency Drain Conspiracy: Single Alibaba Server Hosts Multi-Vector Scams, Hijacking Wallets via Fake Trust Wallet and MobileConfig
DomainTools Threat Intelligence has exposed a sprawling cybercrime operation that uses a single infrastructure to power multiple cryptocurrency theft schemes, hosted on an Alibaba Cloud server in Asia. The investigation ties websites medaigenesis[.]cc,…
SecurityOnline -
Akira Ransomware Revives SonicWall Flaw CVE-2024-40766, Uses ‘UnPAC the Hash’ to Breach Networks
Between July and August 2025, Akira ransomware incidents resurfaced, targeting organisations via SonicWall SSL VPN appliances and reviving interest in CVE-2024-40766. According to Darktrace’s Threat Research Team, the campaigns exploit unpatched or…
SecurityOnlineStorm-1567 -
Apple Ups Bounty to $5 Million for Zero-Click Spyware Exploits Bypassing Lockdown Mode
Apple has announced a substantial overhaul of its Security Bounty programme, set to take effect this November, with rewards for zero-click, mercenary-grade spyware capable of remote intrusion without user interaction rising to as much as $5 million per case.…
SecurityOnline -
UK CMA Designates Google with Strategic Market Status Over 90% Search Dominance
The UK Competition and Markets Authority (CMA) has formally designated Google as holding a “Strategic Market Status” (SMS) in the fields of search and search advertising services, making it one of the first tech giants to come under heightened scrutiny under…
SecurityOnline -
CVE-2025-61927 (CVSS 9.4): Critical RCE Flaw Discovered in Happy DOM, Over 2.7 Million Weekly Downloads Impacted
CVE-2025-61927 (CVSS 9.4) is a critical RCE flaw discovered in Happy DOM, a JavaScript library used to emulate web browsers for testing, scraping and SSR. The advisory notes that Happy DOM v19 and lower contain a vulnerability that could put the owner system…
SecurityOnline
