News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Thu 23 Oct 2025· 72 articles
-
Over 250 attacks hit Adobe Commerce and Magento via critical CVE-2025-54236 flaw
According to Sansec, researchers warn that threat actors are exploiting a critical flaw in Adobe Commerce and Magento, tracked as CVE-2025-54236, to hijack customer accounts via the REST API. The watchdogs observed over 250 attacks in 24 hours, with Sansec…
Security Affairs -
Mobile Security: Verizon Says Attacks Soar, AI-Powered Threats Raise Alarm
Verizon’s 2025 Mobile Security Index, published on 23 October 2025, finds that 85% of organisations report a surge in mobile device attacks, a trend that crosses size, location and industry boundaries. The survey indicates that more than three-quarters of…
SecurityWeek -
SideWinder Leverages ClickOnce Installer to Deliver StealerBot Malware
The content discusses a 'Request Timeout' error, indicating that a server request has taken too long to process and has been terminated. It suggests that if the timeout is inappropriate, users should contact the website administrator to request an increase…
gbhackers.comRAZOR TIGER -
“Jingle Thief” Hackers Exploit Cloud Infrastructure to Steal Millions in Gift Cards
The Jingle Thief group has been observed targeting cloud environments used by retailers and consumer services firms to fraudulently issue gift cards, with phishing and smishing used to steal credentials and access organisational systems. According to Palo…
The Hacker News -
Cyberattack on Jaguar Land Rover inflicts $2.5B loss on UK economy
The security blog reports that Jaguar Land Rover’s cyberattack cost the UK economy $2.5 billion, with the incident described as the most economically damaging cyber event to date in the UK. In early September, JLR shut down systems to mitigate the attack,…
Security Affairs -
BIND 9 Vulnerabilities Expose DNS Servers to Cache Poisoning and DoS
On October 22, 2025, the Internet Systems Consortium (ISC) disclosed three critical vulnerabilities in BIND 9, a widely used DNS software. These vulnerabilities, which affect DNS resolvers, could lead to cache poisoning and denial-of-service (DoS) attacks,…
gbhackers.com -
TARmageddon Security Flaw in Rust Library Could Lead to Config Tampering and RCE
The article discusses a critical vulnerability named TARmageddon found in the async-tar Rust library and its forks, including tokio-tar. This vulnerability, assigned CVE-2025-62518, has a CVSS score of 8.1 and allows attackers to execute remote code by…
gbhackers.com -
MuddyWater2 articles this day · SecurityOnline first
New Malware Toolkit from MuddyWater Delivers Phoenix Backdoor to Global Targets · Iran-Linked MuddyWater Deploys Phoenix v4 Backdoor via Compromised Emails and NordVPN Exit Node
2 outlets-
New Malware Toolkit from MuddyWater Delivers Phoenix Backdoor to Global Targets
On October 23, 2025, Group-IB Threat Intelligence reported a sophisticated phishing campaign by the Iran-linked APT group MuddyWater, targeting global organizations to gather intelligence. The campaign involved accessing a compromised mailbox via NordVPN to…
gbhackers.com -
Iran-Linked MuddyWater Deploys Phoenix v4 Backdoor via Compromised Emails and NordVPN Exit Node
According to Group-IB Threat Intelligence, the Iran-linked MuddyWater threat actor is deploying Phoenix backdoor version 4 alongside a FakeUpdate injector and a custom credential stealer disguised as a calculator, using compromised email accounts and…
SecurityOnline
-
-
PhantomCaptcha RAT Uses Weaponized PDFs and “ClickFix” Cloudflare CAPTCHA Pages to Deliver Malware
On October 23, 2025, GBHackers reported on the PhantomCaptcha RAT campaign, which targeted humanitarian organizations involved in Ukrainian war relief. The campaign utilized weaponized PDFs and fake Cloudflare CAPTCHA pages to deliver a custom remote access…
gbhackers.com -
Critical Argument Injection Flaw in AI Agents Enables Remote Code Execution
The article discusses a critical vulnerability known as 'Critical Argument Injection Flaw' in AI agents that allows attackers to execute remote code (RCE). This flaw arises when user-controlled input is not properly validated, enabling malicious commands to…
gbhackers.com -
Mideast, African Hackers Target Gov'ts, Banks, Small Retailers
Dark Reading reports that in the Middle East and Africa, hackers targeting governments, finance, and small retailers are part of a broader MEA threat landscape exposed by SOCRadar. Between September 2024 and September 2025, the public sector was the most…
Dark Reading -
Over 250 Magento Stores Hit Overnight as Hackers Exploit New Adobe Commerce Flaw
Over 250 Magento stores were hit overnight as attackers exploit a recently disclosed Adobe Commerce and Magento Open Source flaw, according to Sansec. The vulnerability, CVE-2025-54236, a critical improper input validation flaw also known as SessionReaper,…
The Hacker News -
Critical MCP Server Flaw Exposes Over 3,000 Servers and Thousands of API Keys
A critical vulnerability in Smithery[.]ai, a Model Context Protocol (MCP) server hosting service, exposed over 3,000 AI servers and thousands of API keys to potential attackers, according to GBHackers. Security researchers found a simple path traversal flaw…
gbhackers.com -
Critical Lanscope Endpoint Manager Bug Exploited in Ongoing Cyberattacks, CISA Confirms
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical vulnerability in Motex Lanscope Endpoint Manager to its Known Exploited Vulnerabilities catalogue, with the flaw tracked as CVE-2025-61932 and a CVSS v4 score of 9.3. The…
The Hacker News -
Lazarus Group Hunts European Drone Manufacturing Data
North Korea’s Lazarus Group is again targeting European drone manufacturers to steal proprietary information and manufacturing know-how, according to the report. ESET researchers have identified at least three organisations in Central and Southeastern Europe…
Dark ReadingLazarus Group -
Reddit Sues Perplexity and Data Brokers for ‘Industrial-Scale’ Scraping
Reddit has filed legal action against Perplexity, SerApi, OxyLabs and AWMProxy, accusing them of unauthorised data scraping and the illicit use of Reddit content to train AI systems, following an earlier suit against Anthropic over Reddit data. The company…
SecurityOnline -
iPhone Air Flops: Apple to Slash Production by Over 80% After Weak Sales
According to Ming-Chi Kuo, sales of Apple's ultra-thin iPhone Air have collapsed, with suppliers expected to reduce production by over 80% between now and Q1 2026 and some long-lead components set to be discontinued by late 2025. Reports from Mizuho…
SecurityOnline -
Security First: Windows 11 Disables File Previews for Web Downloads
Security First explains that in a Windows 11 cumulative update, Microsoft changed File Explorer to disable previews for files downloaded from the internet. For security reasons, the preview pane will no longer display content from such files, so, for…
SecurityOnline -
Full-Scale War: Apple Challenges EU’s Digital Markets Act in Court
The dispute between Apple and the European Union over the Digital Markets Act has escalated into a full-scale legal battle before the EU General Court in Luxembourg, with the case proceeding as the European Commission conducts its first formal review of the…
SecurityOnline -
Deepfake Defense: YouTube Rolls Out AI Tool to Protect Creator Likeness
YouTube has begun rolling out its Likeness Detection Tool to a limited group of creators to help combat unauthorized deepfake content. In its initial phase, the feature will be available exclusively to members of the YouTube Partner Program, with monetised…
SecurityOnline -
ISC Patches Multiple High-Severity BIND Vulnerabilities Enabling Cache Poisoning and Denial of Service Attacks
The Internet Systems Consortium (ISC) has issued patches for three high-severity BIND 9 vulnerabilities, two of which could enable cache poisoning and one that can cause CPU exhaustion, with all three being remotely exploitable and primarily affecting…
SecurityOnline -
Jira Path Traversal Flaw (CVE-2025-22167) Allows Arbitrary File Write on Server/Data Center
Atlassian has released patches addressing a high-severity Path Traversal vulnerability, CVE-2025-22167, affecting Jira Software Data Center and Server as well as Jira Service Management Data Center and Server. The flaw, rated CVSS 8.7, allows attackers to…
SecurityOnline -
Symantec Exposes Chinese APT Overlap: Zingdoor, ShadowPad, and KrustyLoader Used in Global Espionage
Symantec’s investigation reveals an intertwined web of Chinese espionage operations, with Zingdoor, ShadowPad, and KrustyLoader deployed across multiple victims and previously linked to Glowworm (also known as Earth Estries, FamousSparrow) and UNC5221. The…
SecurityOnlineUTA0178 -
Socket Uncovers Malicious NuGet Typosquat “Netherеum.All” Exfiltrating Wallet Keys via Solana-Themed C2
According to Socket’s Threat Research Team, researchers uncovered an active homoglyph typosquat on NuGet impersonating the Nethereum project, a widely used .NET library for Ethereum. The malicious package, Netherеum[.]All, swapped a Latin “e” for a Cyrillic…
SecurityOnline -
Critical WSUS Flaw (CVE-2025-59287, CVSS 9.8) Allows Unauthenticated RCE via Unsafe Cookie Deserialization, PoC Available
SecurityOnline[.]info reports a critical remote code execution vulnerability in Microsoft Windows Server Update Services (WSUS), tracked as CVE-2025-59287 with a CVSS of 9.8, enabling unauthenticated attackers to execute arbitrary code with SYSTEM…
SecurityOnline -
Chinese Hackers Exploit Exposed ASP.NET Keys to Deploy TOLLBOOTH IIS Backdoor and Kernel Rootkit
Researchers from Elastic Security Labs, in collaboration with Texas A&M University System (TAMUS) Cybersecurity, have uncovered a Chinese-speaking threat actor running a widespread campaign against misconfigured Microsoft IIS servers. The attackers deployed…
SecurityOnline -
Critical NeuVector RCE Flaw (CVE-2025-54469, CVSS 10.0) Allows Command Injection via Unsanitized Environment Variables
A critical command-injection and buffer-overflow vulnerability in NeuVector, tracked as CVE-2025-54469 with a CVSS of 10.0, can be exploited via unsanitised environment variables. According to SUSE Rancher Security, the enforcer’s monitor process used…
SecurityOnline -
Major Threat: Vidar Stealer v2.0 Bypasses Chrome AppBound Encryption with Multithreaded Memory Injection
Researchers at Trend Micro have released an in-depth analysis of Vidar Stealer v2.0, a major overhaul rewritten entirely in C that introduces multithreaded data theft, anti-analysis features, and a memory injection technique designed to bypass Google…
SecurityOnline -
CISA Warns: Critical Raisecom Router Flaw (CVE-2025-11534, CVSS 9.8) Allows Unauthenticated Root SSH Access
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert about a critical authentication bypass affecting Raisecom RAX701-GC routers used in industrial and telecom environments, tracked as CVE-2025-11534 with a CVSS v3.1 base score of…
SecurityOnline -
Hacking Formula 1: Accessing Max Verstappen’s passport and PII through FIA bugs
According to DataBreaches[.]Net, a group including Gal Nagli, Ian Carroll and Sam Curry demonstrated how they could access Max Verstappen’s passport, driver’s licence, and personal information, along with that of other Formula 1 drivers. They stated it took…
DataBreaches -
Lumma Infostealer MaaS Campaign Uses NSIS/AutoIt and MEGA Cloud to Steal Credentials via Pirated Software
Lumma Infostealer has evolved into a MaaS-capable threat, with researchers from the Genians Security Center (GSC) identifying an active campaign that uses NSIS installers, AutoIt modules, and MEGA cloud infrastructure to distribute credential-stealing…
SecurityOnline
