News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 13 so far |
Thu 23 Oct 2025· 72 articles
-
Pwn2Own Day 2: Organizers paid $792K for 56 0-days
Pwn2Own Ireland 2025 Day Two concluded with participants earning $792,750 for 56 zero–days. The Summoning Team led the results after a Samsung Galaxy exploit, racking up a total of 18 points and $167,500 across the first two days. Ken Gannon / 伊藤 剣 of Mobile…
Security Affairs -
Fear the 'SessionReaper': Adobe Commerce Flaw Under Attack
CVE-2025-54236 is a critical input-validation flaw in Adobe Commerce (formerly Magento) that can allow attackers to remotely take over sessions on the platform, with exploitation disclosed on 9 Sept 2025 and an emergency update subsequently patching both…
Dark Reading -
Tired of Unpaid Toll Texts? Blame the 'Smishing Triad'
According to Palo Alto Networks' Unit42, the Smishing Triad has expanded from niche iMessage scams to broader global campaigns that impersonate government agencies and toll services. A large-scale smishing operation has been impersonating international…
Dark ReadingSmishing Triad -
Lazarus targets European defense firms in UAV-themed Operation DreamJob
Lazarus, the North Korea-linked APT group, has targeted three European defence firms through Operation DreamJob, using fake recruiter profiles to lure UAV technology staff and gain access to sensitive information. The operation, active since at least 2020,…
Security Affairs -
Thousands of online stores at risk as SessionReaper attacks spread
Thousands of online stores are at risk as SessionReaper attacks spread, with Magento and its commercial counterpart Adobe Commerce affected by a remote code execution flaw tracked as CVE-2025-54236. The vulnerability lets attackers hijack live customer…
Malwarebytes -
Harden your identity defense with improved protection, deeper correlation, and richer context
According to Microsoft Security Blog, identities have become the new corporate security perimeter, with hybrid work and cloud-first strategies expanding the identity landscape and increasing complexity. The piece notes more than 7,000 password attacks every…
Microsoft -
North Korean Hackers Lure Defense Engineers With Fake Jobs to Steal Drone Secrets
Threat actors tied to North Korea have been attributed with a new wave of attacks on European defence-industry firms, using fake job offers to lure defence engineers and steal drone secrets as part of Operation Dream Job. The campaign, observed by ESET…
The Hacker News -
Russian Government Now Actively Managing Cybercrime Groups: Security Firm
SecurityWeek reports that Russian cybercriminals are no longer merely tolerated but are being actively managed by the state, according to Recorded Future’s third Dark Covenant report published on 23 October 2025. The research describes a shift since 2023 in…
SecurityWeek -
Help Wanted: Vietnamese Actors Using Fake Job Posting Campaigns to Deliver Malware and Steal Credentials
According to the provided content, the endpoint in question is not supported. This terse note indicates that whatever functionality or interface was expected from that endpoint cannot be relied upon or accessed. The material does not reveal any background,…
Google Cloud -
Caminho Malware Loader Conceals .NET Payloads inside Images via LSB Steganography
Caminho is a Brazilian Loader-as-a-Service (LaaS) that conceals .NET payloads inside images using Least Significant Bit steganography, turning ordinary JPG or PNG files into carriers for malware. Active since March 2025 and evolving rapidly by June, the…
gbhackers.com -
Vulnerability in Perplexity’s Comet Browser Screenshot Feature Allows Malicious Prompt Injection
Researchers have identified a critical vulnerability in Perplexity’s Comet AI browser that could let attackers inject malicious prompts via hidden text in screenshots. The flaw, disclosed on 21 October 2025, works by concealing instructions in images through…
gbhackers.com -
CISA Adds Lanscope Endpoint Manager Zero-Day (CVE-2025-61932) to Known Exploited Vulnerabilities
CISA has added Lanscope Endpoint Manager zero-day CVE-2025-61932 to its Known Exploited Vulnerabilities (KEV) catalog, with exploitation suspected in some customer environments and notices of unauthorized external packets reaching affected systems. The flaw…
SOCRadar -
AI Sidebar Spoofing Puts ChatGPT Atlas, Perplexity Comet and Other Browsers at Risk
SquareX researchers have demonstrated how malicious browser extensions can impersonate AI sidebar interfaces to carry out phishing and other attacks, in a method they call AI Sidebar Spoofing. The demonstrations targeted Perplexity’s Comet and ChatGPT Atlas,…
SecurityWeek -
Global SMS Phishing Campaign Traced to China Targets Users Worldwide
A recent global SMS phishing campaign, traced back to a group known as the Smishing Triad in China, poses a significant threat to users worldwide. Since January 2024, over 194,000 malicious domains have been identified, primarily targeting U.S. residents…
gbhackers.com -
Dissecting YouTube’s Malware Distribution Network
The YouTube Ghost Network is a coordinated group of malicious accounts on YouTube that promotes phishing pages and malware, relying on likes, comments and trust to push dangerous content, according to Check Point Research. The investigation identified more…
Check Point -
AI Sidebar Spoofing Attack: SquareX Uncovers Malicious Extensions that Impersonate AI Browser Sidebars
According to CyberNewsWire, SquareX has released research detailing a new class of attack that targets AI browsers, using malicious browser extensions to impersonate trusted AI sidebar interfaces and trick users into executing dangerous commands. The AI…
SecurityOnline -
Cybercriminals Impersonate Aid Agencies to Lure Victims with Fake Financial Offers
Scammers are impersonating aid agencies across major social media platforms to entice victims with fraudulent financial assistance offers, GBHackers reports. The operations form a coordinated, international fraud ecosystem that targets individuals online,…
gbhackers.com -
Stealthy Malware Leveraging Variable Functions and Cookies for Evasion
Cybersecurity researchers at Wordfence Threat Intelligence and their Care and Response teams have observed a persistent trend in new malware that relies on heavy obfuscation through variable functions and cookie manipulation to evade detection, a tactic the…
gbhackers.com -
Active Exploits Target Magento and Adobe Commerce RCE, Attackers Inject Webshells
Unauthenticated attackers are actively exploiting a critical vulnerability affecting Adobe Commerce and Magento platforms worldwide, tracked as CVE-2025-54236 and dubbed SessionReaper. The flaw enables remote code execution and customer account takeover and…
gbhackers.com -
Darktrace delivers the next evolution of unified and proactive NDR
Darktrace unveils the next evolution of unified and proactive network detection and response, branding its solution as Darktrace Network Endpoint eXtended Telemetry (NEXT), the industry’s first mixed-telemetry agent powered by Self-Learning AI. The approach…
darktrace.com -
Darktrace Announces Extended Visibility Between Confirmed Assets and Leaked Credentials from the Deep and Dark Web
Darktrace’s latest blog outlines how Continuous Threat Exposure Management (CTEM) is evolving with extended visibility between confirmed assets and leaked credentials from the deep and dark web, enabled by new Darktrace / Attack Surface Management…
darktrace.com -
Patch Smarter, Not Harder: Now Empowering Security Teams with Business-Aligned Threat Context Agents
Darktrace’s latest release for Proactive Exposure Management combines endpoint context with financial insight to sharpen vulnerability prioritisation and speed up patching decisions. It introduces a No-Telemetry Endpoint that inventories installed software…
darktrace.com -
Secure AI at Scale and Speed — Learn the Framework in this Free Webinar
The Hacker News is promoting a free webinar on secure AI at scale and speed, promising a practical framework to help teams gain visibility and stay ahead of risk. The session, titled “Turning Controls into Accelerators of AI Adoption,” aims to show how…
The Hacker News -
Jira Vulnerability Lets Attackers Alter Files Accessible to the Jira JVM Process
Atlassian has disclosed a critical path traversal vulnerability affecting Jira Software Data Center and Server that could allow authenticated attackers to modify files accessible to the Jira Java Virtual Machine process, tracked as CVE-2025-22167. The flaw…
gbhackers.com -
TransparentTribe Targets Linux Systems in Indian Military to Deploy DeskRAT
In July 2025, cybersecurity firm CYFIRMA uncovered an active phishing campaign targeting Linux-based operating systems used by Indian government and military organisations, attributed to TransparentTribe, also known as APT36 or Operation C-Major. The…
gbhackers.com -
ThreatsDay Bulletin: $176M Crypto Fine, Hacking Formula 1, Chromium Vulns, AI Hijack & More
ThreatsDay’s 23 October 2025 bulletin highlights a range of credentialable weak points being exploited, from misconfigurations to chain attacks. It notes Lumma Stealer’s activity declined after a doxxing campaign exposed core members, with Trend Micro saying…
The Hacker News -
Apple may have to open its walled garden to outside app stores
The UK’s Competition and Markets Authority (CMA) has ruled that both Google and Apple hold a “strategic market status,” effectively granting them a monopoly over their mobile platforms, which could force Apple to allow rival app stores on iPhones. If the…
Malwarebytes -
Jingle Thief Hackers Exploit the Festive Season with Weaponized Gift Card Scams
Jingle Thief is a campaign identified by security researchers as targeting global retail and consumer services organisations through credential theft and gift card fraud, with threat actors operating from Morocco and active since 2021. According to Unit 42,…
gbhackers.com -
Vibe Coding’s Real Problem Isn’t Bugs—It’s Judgment
Vibe Coding’s Real Problem Isn’t Bugs—It’s Judgment argues that AI-generated code is not inherently more vulnerable than human-made code, but that the speed and volume of output outpace traditional review processes. According to OX Research, vulnerabilities…
SecurityWeek -
Kaufman County’s data breach was their second one in three weeks
Kaufman County, Texas confirmed that an October 20 cyberattack was their second data breach in October, marking the second computer security incident that month. A letter dated 1 October 2025 from County Judge Jakie Allen acknowledged that personal…
DataBreaches -
Exploitation of Critical Adobe Commerce Flaw Puts Many eCommerce Sites at Risk
According to Sansec, hackers have started exploiting a critical Adobe Commerce and Magento Open Source flaw tracked as CVE-2025-54236 (CVSS 9.1), an improper input validation issue that can bypass a security feature. Adobe released hotfixes on 9 September…
SecurityWeek -
Why Organizations Are Abandoning Static Secrets for Managed Identities
As machine identities proliferate across cloud environments, organisations report dramatic productivity gains from eliminating static credentials, with the Business Case for Change highlighting a 95% reduction in time spent managing credentials per…
The Hacker News -
U.S. CISA adds Motex LANSCOPE flaw to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Motex LANSCOPE flaw to its Known Exploited Vulnerabilities catalog, tracked as CVE-2025-61932 with a CVSS v4 score of 9.3. The vulnerability concerns an improper verification of the…
Security Affairs -
Meta boosts scam protection on WhatsApp and Messenger
Meta has announced expanded scam protection for WhatsApp and Messenger, aiming to shield vulnerable users, especially the elderly. The update adds a warning on WhatsApp that appears when screens are shared during video calls with unknown contacts, and on…
Malwarebytes -
Warlock Ransomware Exploits SharePoint ToolShell Zero-Day in New Attack Campaign
The article discusses the emergence of the Warlock ransomware, linked to Chinese threat actors, exploiting a critical zero-day vulnerability in Microsoft SharePoint (CVE-2025-53770). This ransomware operation, first identified in June 2025, gained attention…
gbhackers.com -
OpenAI Faces DHS Request to Disclose User’s ChatGPT Prompts in Investigation
On October 23, 2025, it was reported that Homeland Security Investigations (HSI) requested user data from OpenAI related to a child exploitation investigation, marking the first instance of law enforcement seeking AI-generated chat logs as evidence. The…
gbhackers.com -
BIND Updates Address High-Severity Cache Poisoning Flaws
The Internet Systems Consortium (ISC) has released BIND 9 updates to fix three high-severity vulnerabilities that could enable cache poisoning. The flaws include a PRNG weakness that could let an attacker predict the source port and query ID used by BIND,…
SecurityWeek -
The Smishing Deluge: China-Based Campaign Flooding Global Text Messages
Palo Alto Networks' Unit 42 reports on a significant smishing campaign attributed to the Smishing Triad, targeting global residents with fraudulent messages about toll violations and package misdeliveries. The campaign, ongoing since April 2024, has evolved…
unit42.paloaltonetworks.com -
Lanscope Endpoint Manager Zero-Day Exploited in the Wild
Lanscope Endpoint Manager has a zero-day vulnerability that has been exploited in the wild, tracked as CVE-2025-61932 with a CVSS score of 9.8. Motex says the flaw is caused by improper verification of the source of a communication channel, enabling remote…
SecurityWeek -
New Python-Based RAT Disguised as Minecraft App Steals Sensitive User Data
On October 23, 2025, GBHackers reported the discovery of a new Remote Access Trojan (RAT) named "Nursultan Client," which is disguised as a legitimate Minecraft application. Developed in Python, this malware uses the Telegram Bot API for command-and-control…
gbhackers.com
