News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Wed 15 Oct 2025· 75 articles
-
Two New Windows Zero-Days Exploited in the Wild — One Affects Every Version Ever Shipped
Microsoft has released fixes for 183 security flaws across its products, including two Windows zero-days that have come under active exploitation in the wild. The two Windows zero-days are CVE-2025-24990, a Windows Agere Modem Driver ("ltmdm64[.]sys")…
The Hacker News -
TigerJack Hackers Target Developer Marketplaces with 11 Malicious VS Code Extensions
TigerJack Hackers have targeted developer marketplaces with 11 malicious Visual Studio Code extensions, infiltrating the accounts of three publishers (ab-498, 498, and 498-00) and compromising more than 17,000 developers worldwide. The two most successful…
gbhackers.com -
FortiOS CLI Bypass Flaw Lets Attackers Run Arbitrary System Commands
Fortinet has disclosed a security vulnerability in its FortiOS operating system that could let attackers with administrative privileges run arbitrary system commands by bypassing CLI restrictions, tracked as CVE-2025-58325. The flaw, discovered internally by…
gbhackers.com -
GhostBat RAT Android Malware Poses as Fake RTO Apps to Steal Banking Data from Indian Users
GhostBat RAT Android malware campaigns pose as fake Regional Transport Office (RTO) apps to steal banking data, with observations dating from July 2024 when CRIL first documented Android malware masquerading as RTO applications designed to steal contacts and…
gbhackers.com -
Africa Remains Top Global Target, Even as Attacks Decline
African organisations remained the top global targets of cyberattacks in September, suffering more than 3,000 attacks per week during the past two months, despite declines in cyberthreat detections. The downward trend continued into early October and may…
Dark Reading -
Unencrypted satellites expose global communications
Researchers from UC San Diego and the University of Maryland found that nearly half of geostationary satellites transmit unencrypted data, exposing consumer, corporate and military communications to interception, using an $800 satellite receiver for three…
Security Affairs -
High-Severity Vulnerabilities Patched by Fortinet and Ivanti
SecurityWeek reports that Fortinet and Ivanti have announced their October 2025 Patch Tuesday updates, patching a range of vulnerabilities across their products. Fortinet published 29 new advisories covering more than 30 flaws, several of which are rated…
SecurityWeek -
Flax Typhoon2 articles this day · gbhackers.com first
Flax Typhoon APT exploited ArcGIS server for over a year as a backdoor · Chinese Hackers Use Geo-Mapping Tool for Year-Long Persistence
2 outlets-
Flax Typhoon APT exploited ArcGIS server for over a year as a backdoor
China-linked APT group Flax Typhoon compromised an ArcGIS system for over a year, turning a legitimate ArcGIS Server extension into a web shell and using it as a backdoor for hands-on-keyboard activity, credential harvesting, and lateral movement. ReliaQuest…
Security Affairs -
Chinese Hackers Use Geo-Mapping Tool for Year-Long Persistence
The China-backed advanced persistent threat group Flax Typhoon maintained year-long access to an ArcGIS system by turning trusted software into a persistent backdoor, an attack so unique it prompted the vendor to update its documentation. The attackers…
gbhackers.com
-
-
Two CVSS 10.0 Bugs in Red Lion RTUs Could Hand Hackers Full Industrial Control
Cybersecurity researchers have disclosed two CVSS 10.0 vulnerabilities in Red Lion Sixnet RTUs, CVE-2023-40151 and CVE-2023-42770, which could allow an unauthenticated attacker to gain remote code execution with root privileges. The flaws affect Red Lion’s…
The Hacker News -
Hackers Target ICTBroadcast Servers via Cookie Exploit to Gain Remote Shell Access
Cybersecurity researchers have disclosed a critical security flaw in ICTBroadcast, an autodialer from ICT Innovations, that is being actively exploited in the wild. The vulnerability, CVE-2025-2611 with a CVSS of 9.3, stems from improper input validation…
The Hacker News -
End of Support for Windows 10 Sparks Security Fears Among Millions of Users
Microsoft officially ended support for Windows 10 on 14 October 2025, leaving millions of users worldwide facing critical security concerns. The move ends regular technical assistance, feature updates, and security patches for one of the most widely used…
gbhackers.com -
UEFI Shell Flaws Let Hackers Disable Secure Boot on Over 200,000 Laptops
Security researchers have found critical vulnerabilities in signed UEFI shells that allow attackers to bypass Secure Boot protections on approximately 200,000 Framework laptops and desktops. The flaws hinge on the mm command in many UEFI shells, which…
gbhackers.com -
New SAP NetWeaver Bug Lets Attackers Take Over Servers Without Login
SAP has released security fixes for 13 new issues, including a maximum-severity vulnerability in SAP NetWeaver AS Java that could lead to arbitrary command execution via insecure deserialization. The flaw, tracked as CVE-2025-42944, carries a CVSS score of…
The Hacker News -
Pixnapping Attack Hijacks Google Authenticator 2FA Codes in Under 30 Seconds
Security researchers have unveiled a technique dubbed Pixnapping that can extract Google Authenticator and other sensitive app codes in under 30 seconds by exploiting Android’s graphics rendering and overlay capabilities. The attack uses Android intents to…
gbhackers.com -
Hackers Exploit Windows Remote Access Connection Manager 0-Day in Ongoing Attacks
According to Microsoft Threat Intelligence Center and Microsoft Security Response Center, active exploitation of a critical zero-day vulnerability affecting the Windows Remote Access Connection Manager has been detected in real‑world attacks, designated as…
gbhackers.com -
Adobe Patches Critical Vulnerability in Connect Collaboration Suite
Adobe has issued patches addressing more than 35 vulnerabilities across its products, including a critical flaw in the Connect collaboration suite tracked as CVE-2025-49553 with a CVSS score of 9.3, described as a cross-site scripting issue that could allow…
SecurityWeek -
Telegram Becomes the Nerve Center for Modern Hacktivist Operations
Telegram has solidified its position as the primary coordination hub for modern hacktivist operations, according to research analysing over 11,000 posts from more than 120 politically motivated threat actor groups. The study found that planning and…
gbhackers.com -
Microsoft Patches 173 Vulnerabilities, Including Exploited Windows Flaws
Microsoft has rolled out patches for 173 unique CVEs across its products, including two flaws that have been exploited in the wild, as part of its October 2025 update cycle dated 15 October 2025. The first exploited issue, CVE-2025-24990, is an untrusted…
SecurityWeek -
NCSC Issues Warning as UK Sees Four Cyber Attacks a Week
NCSC Issues Warning as UK Sees Four Cyber Attacks a Week reports an alarming rise in cyber threats, with an average of four major attacks targeting UK interests weekly. The warning notes that the NCSC handled 429 incidents in the reporting period, of which…
gbhackers.com -
Pro-Russian Hacktivists Target Government, Finance and E-Commerce Sites
The piece centers on the pro-Russian hacktivist collective NoName057(16), which has emerged as a participant in a coordinated wave of cyberattacks targeting Israeli government portals, financial institutions and e-commerce sites during the October 7…
gbhackers.comNoName057(16) -
Samsung Sets Oct 21 Event to Unveil “Project Moohan,” Its Android XR Headset Rival to Vision Pro
Samsung has announced it will host a product unveiling on 21 October 2025 at 10 p.m. Eastern Time, signalling a push into the augmented reality space with a new Android XR device. The device, developed in collaboration with Google and Qualcomm, is widely…
SecurityOnline -
Critical Siemens Flaw CVE-2025-40771 (CVSS 9.8) Allows Unauthenticated Remote Access to SIMATIC CP Config
Siemens has disclosed a critical vulnerability, CVE-2025-40771 (CVSS 9.8), that could allow an unauthenticated remote attacker to access configuration data on SIMATIC CP devices. The flaw affects SIMATIC ET 200SP communication processors, specifically CP…
SecurityOnline -
Apple SVP Joswiak Teases “Five M’s”: M5 MacBook Pro, iPad Pro, and Vision Pro Launch Expected This Week
Apple’s Senior Vice President of Worldwide Marketing, Greg Joswiak, hinted at the arrival of a new generation of MacBook Pro through a post on his personal X account, with the teaser featuring the phrase “Five M’s” and a laptop silhouette. Amid growing…
SecurityOnline -
Google Plans EU Search Overhaul to Avoid DMA Fines, Will Display Rivals “Equally” to Google Flights/Hotels
Google plans an EU search overhaul to avoid DMA fines by revamping its search display to allow third-party services to appear on equal footing with Google Flights and Google Hotels, according to Reuters. Regulators had accused Google in March 2025 of…
SecurityOnline -
OpenAI Forms AI Well-Being Council to Address Mental Health Risks of Future Models
OpenAI has announced the formation of a new advisory body, the Council on Well-Being and AI, aimed at ensuring future AI developments give greater consideration to users’ psychological welfare. The council is composed of eight scholars and experts working at…
SecurityOnline -
Critical Rockwell NAT Router Flaw (CVE-2025-7328, CVSS 10.0) Allows Unauthenticated Admin Takeover
On 15 October 2025, Rockwell Automation warned about three vulnerabilities affecting its 1783-NATR NAT router, including a critical authentication bypass that could allow full administrative takeover. The flaws are tracked as CVE-2025-7328, CVE-2025-7329,…
SecurityOnline -
Critical RCE Flaws CVE-2025-48983 & CVE-2025-48984 (CVSS 9.9) Found in Veeam Backup & Replication
According to Veeam’s advisory, two critical Remote Code Execution flaws, CVE-2025-48983 and CVE-2025-48984, carry a CVSS score of 9.9 and affect Veeam Backup & Replication. The issues allow an authenticated domain user to execute arbitrary code on vulnerable…
SecurityOnline -
DOJ Files Record $15 Billion Bitcoin Seizure Against Prince Group Chairman Over Pig Butchering Scams
The U.S. Department of Justice has unsealed an indictment against Chen Zhi, also known as Vincent, a 37-year-old UK and Cambodian national and the founder and chairman of Prince Holding Group. Zhi is charged with wire fraud conspiracy and money laundering…
SecurityOnline -
GhostBat RAT Android Malware Targets Indian Users with Fake RTO Apps and Telegram Bot C2
GhostBat RAT is an Android malware campaign uncovered by Cyble Research and Intelligence Labs (CRIL) that targets Indian users by impersonating official RTO apps and using phishing, Telegram bot C2, and cryptocurrency mining modules to exfiltrate financial…
SecurityOnline -
Chrome Fix: New Use-After-Free Flaw (CVE-2025-11756) in Safe Browsing Component Poses High Risk
Google has released a Stable Channel Update for Desktop to fix a high‑severity use‑after‑free flaw in Chrome’s Safe Browsing component (CVE-2025-11756), with the fixed version rolling out to Windows, macOS, and Linux over the coming days and weeks. The…
SecurityOnline -
October Patch Tuesday: Microsoft Fixes 6 Zero-Days, Including 4 Actively Exploited Flaws, as Windows 10 Reaches End-of-Life
October Patch Tuesday delivered one of the year’s largest updates, with 193 vulnerabilities patched across Windows components, including six zero-days, four of which are being actively exploited in the wild. According to Microsoft’s security bulletin, the…
SecurityOnline -
Sekoia Exposes PolarEdge Backdoor: Custom mbedTLS C2 Compromising Cisco, QNAP, and Synology Devices
According to Sekoia Threat Detection & Response (TDR) researchers, PolarEdge is a stealthy backdoor deployed through exploitation of CVE-2023-20118, a remote code execution flaw affecting Cisco routers, with the initial botnet later seen spreading to Asus,…
SecurityOnline -
Fully Autonomous Cybercrime: TA585 Uses ClickFix Phishing and Own Infrastructure to Deploy Premium MonsterV2 RAT
Proofpoint has identified a new cybercriminal threat actor, TA585, which operates with a high degree of independence across its attack chain, from infrastructure and delivery to payload deployment. The group was first detected in February 2025, using…
SecurityOnline -
Rockwell Automation Patches Privilege Escalation and Denial-of-Service Flaws Across FactoryTalk and ArmorStart Systems
Rockwell Automation has released a series of advisories addressing vulnerabilities across FactoryTalk and ArmorStart products, discovered through internal testing, which could allow attackers to gain SYSTEM-level privileges, delete critical files, or trigger…
SecurityOnline
