News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 13 so far |
Wed 22 Oct 2025· 71 articles
-
BIND warns of bugs that could bring DNS cache attack back from the dead
The makers of BIND warn of two vulnerabilities that could let attackers poison caches of DNS results and steer users to malicious sites, with CVE-2025-40778 and CVE-2025-40780 each carrying a severity of 8.6. Patches for all three issues—two in BIND and a…
Ars Technica -
Protected health information of 462,000 members of Blue Cross Blue Shield of Montana involved in Conduent data breach
According to WVNews, protected health information for 462,000 Montanans who are customers of Blue Cross Blue Shield of Montana was involved in a Conduent data breach, which ran from October 2024 to January 2025 and was first disclosed in April 2025. The…
DataBreaches -
It Takes Only 250 Documents to Poison Any AI Model
Researchers fromAnthropic, the UK AI Security Institute, and the Alan Turing Institute found that they could backdoor AI models of different sizes using just 250 poisoned documents, upending the idea that attackers must control large proportions of training…
Dark Reading -
PhantomCaptcha targets Ukraine relief groups with WebSocket RAT in October 2025
The article reports that PhantomCaptcha targets Ukraine relief groups with a WebSocket RAT in October 2025. According to the piece, the operation is carried out by PhantomCaptcha and involves a WebSocket-based remote access tool described as RAT, aimed at…
Security Affairs -
TP-Link urges immediate updates for Omada Gateways after critical flaws discovery
TP-Link has issued urgent guidance after uncovering critical flaws in Omada gateways across ER, G and FR models, with the company stating that firmware updates should be installed immediately to stay secure. According to TP-Link, the most severe issue is…
Security Affairs -
WhatsApp Secures Ban on NSO Group After 6-Year Legal Battle
In the latest ruling in a lengthy legal battle, NSO Group was barred from targeting WhatsApp users after hacking into and installing spyware on thousands of devices, with the company ordered to pay $4 million in damages and a permanent injunction preventing…
Dark Reading -
Canada Fines Cybercrime Friendly Cryptomus $176M
According to FINTRAC, Canada fined Cryptomus, the digital payments platform operated by Xeltox Enterprises Ltd, $176,960,190 for violations of anti-money-laundering laws. On 16 October 2025, FINTRAC imposed the penalty, noting that Cryptomus failed to submit…
Krebs on Security -
MuddyWater2 articles this day · Dark Reading first
Iran-Linked MuddyWater Targets 100+ Organisations in Global Espionage Campaign · MuddyWater Targets 100+ Gov Entities in MEA With Phoenix Backdoor
2 outlets-
Iran-Linked MuddyWater Targets 100+ Organisations in Global Espionage Campaign
The Iranian nation-state group MuddyWater has been attributed a global espionage campaign that targets more than 100 organisations, including embassies, diplomatic missions and foreign affairs bodies in the Middle East and North Africa. Security researchers…
The Hacker News -
MuddyWater Targets 100+ Gov Entities in MEA With Phoenix Backdoor
The Iran-backed threat group MuddyWater is targeting more than 100 government-related organisations and other entities across the Middle East and Africa in a cyberespionage campaign that delivers a Phoenix backdoor through phishing emails, according to…
Dark Reading
-
-
Ukraine Aid Groups Targeted Through Fake Zoom Meetings and Weaponized PDF Files
The article discusses the targeting of Ukraine aid groups through deceptive Zoom meetings and malicious PDF files. It highlights the tactics used by cybercriminals to exploit vulnerabilities in communication tools and documents, posing significant risks to…
The Hacker News -
Resource: NY DFS Issues New Cybersecurity Guidance to Address Risks Associated with the Use of Third-Party Service Providers
According to NY DFS, Acting Superintendent Kaitlin Asrow today issued new cybersecurity guidance addressing the risks associated with entities becoming increasingly reliant on third-party service providers (TPSPs). The guidance, which DFS says builds on its…
DataBreaches -
The CISO imperative: Building resilience in an era of accelerated cyberthreats
According to Microsoft Digital Defense Report 2025, the cyberthreat landscape is in flux, with a surge in financially driven attacks and persistent nation-state risks that demand urgent action from CISOs. The piece notes that AI has accelerated attack speed…
Microsoft -
Over 100 Chrome extensions break WhatsApp’s anti-spam rules
According to Socket’s Threat Research Team, a coordinated campaign has flooded the Chrome Web Store with 131 spamware extensions that hijack WhatsApp Web to automate bulk messages and bypass anti-spam controls. The extensions inject code directly into the…
Malwarebytes -
TARmageddon Flaw in Popular Rust Library Leads to RCE
A high-severity vulnerability in the popular Rust library Async-tar could allow attackers to smuggle archive entries and execute arbitrary code remotely, tracked as CVE-2025-62518 with a CVSS score of 8.1, and dubbed TARmageddon. The flaw is a…
SecurityWeek -
TX: Kaufman County Faces Cybersecurity Attack: Courthouse Computer Operations Disrupted
Kaufman County officials confirmed a security incident on 20 October that disrupted access to certain courthouse computer systems and employee files, according to InForney. Some computers at the courthouse are infected, and some employees are currently…
DataBreaches -
Hotel and Casino near Las Vegas Strip suffers data breach, documents say
OYO Hotel & Casino Las Vegas, located near the Las Vegas Strip on Tropical Avenue, was hit by a cyberattack sometime in early January, allegedly exposing the personal information of more than 4,700 people. The breach occurred between 8 January and 11 January…
DataBreaches -
Russia Pivots, Cracks Down on Low-Level Hackers
According to Dark Reading, Russia is recalibrating its approach to cybercrime, cracking down on low-level hackers while preserving assets valuable to the state. The piece notes that Western law enforcement and improving cybersecurity across sectors have…
Dark Reading -
131 Malicious Chrome Extensions Abused WhatsApp Web in a Massive Spam Campaign
In early 2025, researchers uncovered a massive spam campaign that abused WhatsApp Web via 131 malicious Chrome extensions, which were marketed as business coming-together tools but secretly automated bulk messaging. The extensions shared identical backend…
SOCRadar -
Critical Vulnerabilities Patched in TP-Link’s Omada Gateways
TP-Link has warned that several vulnerabilities affect Omada gateway devices, with more than a dozen ER, G and FR series models impacted and patches released for each. The most serious flaw is CVE-2025-6542, which carries a CVSS score of 9.3 and can allow a…
SecurityWeek -
Jaguar Land Rover struggling 8 weeks after most expensive UK cyberattack
Jaguar Land Rover faced a crippling cyberattack that is estimated to carry a price tag of $2.5 billion, with the incident described as likely the most economically damaging cyber event in UK history. The attack triggered a month-long shutdown of internal…
Ars Technica -
Threat Actors Advancing Email Phishing Attacks to Bypass Security Filters
Cybercriminals are evolving their email phishing arsenals to slip past automated filters and human scrutiny, with the latest tactics layering on novel evasion techniques. The piece notes that in 2025 attackers continued to employ password-protected…
gbhackers.com -
TARmageddon flaw in Async-Tar Rust library allows to smuggle extra archives when the library is processing nested TAR files
According to CVE-2025-62518 (CVSS score: 8.1), TARmageddon is a flaw in the Rust async-tar library and forks like tokio-tar that could allow a remote attacker to achieve code execution. The vulnerability stems from a desynchronisation bug in how PAX and…
Security Affairs -
Fileless Remcos Attacks: Injecting Malicious Code into RMClient to Evade EDR
CyberProof researchers detected a significant surge in Remcos campaigns—Remote Control & Surveillance Software—through September and October 2025, using highly obfuscated PowerShell scripts and process hollowing into Microsoft’s RMClient[.]exe to achieve…
gbhackers.com -
Chinese Threat Actors Exploit ToolShell SharePoint Flaw Weeks After Microsoft's July Patch
Threat actors with ties to China exploited the ToolShell vulnerability in Microsoft SharePoint to breach a Middle Eastern telecoms operator, according to Broadcom's Symantec Threat Hunter Team, weeks after the July 2025 patch. The activity has been linked to…
The Hacker News -
Threat Actors Exploiting Azure Blob Storage to Breach Organizational Repositories
Threat actors are increasingly targeting Azure Blob Storage to infiltrate organisational repositories and disrupt critical workloads. The campaigns exploit misconfigurations, leaked credentials, and weak access controls to breach Blob Storage accounts, with…
gbhackers.com -
Bombay High Count Orders Department of Telecommunications to Block Medusa Accounts After Generali Insurance Data Breach
The Bombay High Court granted urgent ad-interim relief to Generali Central Life Insurance Company after the insurer reportedly suffered a ransomware attack by an anonymous hacker group identifying itself as “Medusa.” The court ordered the Union of India and…
DataBreaches -
Keycard Emerges From Stealth Mode With $38 Million in Funding
Keycard, a San Francisco-based company that provides identity infrastructure for AI agents, has emerged from stealth mode with $38 million in funding, raised over an $8 million seed round and a $30 million Series A round. The seed round was co-led by…
SecurityWeek -
SharkStealer Adopts EtherHiding Technique for C2 Communication Evasion
SharkStealer, a Golang-based information stealer, has been observed adopting an EtherHiding technique to conceal its command-and-control (C2) communications on the Binance Smart Chain (BSC) Testnet, as of 22 October 2025. According to GBHackers On Security,…
gbhackers.com -
The Hidden Cost of Supply Chain Breaches: 2025 Statistics on Downtime, Disruption, and Financial Loss
Supply chain breaches are escalating across industries, with breaches involving supply chains surging by 68% and now accounting for 15% of all data breaches, according to Deepstrike. In 2024, 35.5% of data breaches were linked to third parties, up from 29%…
SOCRadar -
Russian APT Switches to New Backdoor After Malware Exposed by Researchers
The Russian state-sponsored APT Star Blizzard has shifted to a new backdoor after its LostKeys malware was detailed in a public report in June, according to Google. The group, also tracked as Callisto, ColdRiver, Seaborgium and UNC4057, began using the…
SecurityWeek -
Zero-click Dolby audio bug lets attackers run code on Android and Windows devices
Zero-click Dolby audio bug lets attackers run code on Android and Windows devices, a medium-severity remote code execution vulnerability that affects Android (Samsung and Pixel devices) and Windows systems using Dolby UDC versions 4.5–4.13. Remote code…
Malwarebytes -
Hackers Exploit Microsoft 365 Direct Send to Evade Filters and Steal Data
Cybercriminals are abusing a legitimate Microsoft 365 feature, Exchange Online’s Direct Send, to bypass authentication checks and deliver internal-looking messages for phishing campaigns and business email compromise. According to Cisco Talos, increased…
gbhackers.com -
Bridging the Remediation Gap: Introducing Pentera Resolve
Pentera has unveiled Pentera Resolve, a product intended to close the remediation gap by linking security validation with automated remediation workflows. The piece explains that detection alone leaves gaps because findings are fragmented across tools and…
The Hacker News -
Fake Nethereum NuGet Package Used Homoglyph Trick to Steal Crypto Wallet Keys
Cybersecurity researchers have uncovered a supply-chain attack on the NuGet package manager that uses Typosquats of Nethereum to steal wallet data. The malicious package Netherеum[.]All swaps the last occurrence of the letter “e” with the Cyrillic homoglyph…
The Hacker News -
What Makes a Great Field CXO: Lessons from the Front Lines
What Makes a Great Field CXO: Lessons from the Front Lines outlines a practical, bottom-line guide to recruiting and using Field CXOs such as Field CISO or Field CTO. Written by Joshua Goldfarb, who is currently Field CISO at F5, the piece distills a top 10…
SecurityWeek -
Hackers Use ASP.NET Machine Keys to Break Into IIS, Push Malicious Extensions
According to Elastic Security Labs, in September 2025 Texas A&M University System (TAMUS) Cybersecurity, a managed detection and response provider, in collaboration with Elastic Security Labs, uncovered a sophisticated post‑exploitation campaign by a…
gbhackers.com -
Fencing and Pet Company Jewett-Cameron Hit by Ransomware
Jewett-Cameron Company, an Oregon-based fencing and pet solutions provider, disclosed in a filing with the Securities and Exchange Commission that it detected an intrusion into its IT environment on 15 October 2025 and is investigating ongoing. The company…
SecurityWeek -
Two Critical Oracle Marketing Flaws (CVE-2025-53072, CVE-2025-62481) — Patch Immediately or Risk Full Takeover
According to Oracle, it released its October 2025 Critical Patch Update (CPU), which fixes 374 vulnerabilities and urgently addresses two flaws that could allow unauthenticated attackers to completely compromise and take over the Oracle Marketing application…
SecurityOnline -
Bitter APT Exploits WinRAR Zero-Day Through Malicious Word Files to Steal Sensitive Data
In a newly uncovered campaign, Bitter, also tracked as APT-Q-37, is pursuing high-value targets in government, electric power, and military sectors across China, Pakistan, and other strategic regions, using both malicious Office macros and a WinRAR path…
gbhackers.comHAZY TIGER -
Oracle Releases October 2025 Patches
Oracle released its October 2025 Critical Patch Update, delivering 374 new security patches, including more than 230 fixes for vulnerabilities that are remotely exploitable without authentication. SecurityWeek notes that roughly 180 unique CVEs were…
SecurityWeek
