News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 5 so far |
Mon 27 Oct 2025· 75 articles
-
Linux variant of Qilin Ransomware targets Windows via remote management tools and BYOVD
The Qilin ransomware group has developed a Linux variant that targets Windows systems using remote management tools and BYOVD (Bring Your Own Vulnerable Driver) techniques. This cross-platform approach allows attackers to evade endpoint detection and steal…
Security Affairs -
Predatory Sparrow Strikes: Coordinated Cyberattacks Seek to Cripple Critical Infrastructure
A sophisticated cyber-sabotage group known as Predatory Sparrow has emerged as a leading threat to Iran’s critical infrastructure, pursuing highly disruptive campaigns rather than financial gain. The group first drew international attention in July 2021 when…
gbhackers.comPredatory Sparrow -
Ransomware Payments Dropped in Q3 2025: Analysis
Ransomware payments dropped significantly in the third quarter of 2025, an analysis by Coveware shows, with the payment rate falling to a historical low of 23% as cyber extortion’s overall success rate contracts, according to Coveware. The average ransom…
SecurityWeek -
OpenAI is Developing an AI Music Generator with Help from Juilliard
According to The Information, OpenAI is widening its generative repertoire beyond text, image and video to model-driven music creation. The article says the company is developing a tool capable of generating music from text or audio prompts, with Juilliard…
SecurityOnline -
Chrome Zero-Day Exploitation Linked to Hacking Team Spyware
Chrome’s first 2025 zero-day exploit, tracked as CVE-2025-2783, is linked to tools used in Hacking Team’s spyware lineage, with Kaspersky describing the campaign as Operation ForumTroll. According to Kaspersky, the attackers bypass Chrome’s sandbox to run…
SecurityWeek -
Qilin Ransomware Combines Linux Payload With BYOVD Exploit in Hybrid Attack
The article discusses the Qilin ransomware, which employs a hybrid attack strategy by combining a Linux payload with a Bring Your Own Vulnerable Driver (BYOVD) exploit. This approach allows attackers to bypass security measures and execute malicious code on…
The Hacker News -
Wordfence blocks 8.7M attacks exploiting old GutenKit and Hunk Companion flaws
Wordfence blocked 8.7 million attacks in two days against WordPress sites exploiting two outdated plugins, GutenKit and Hunk Companion, according to Wordfence. The flaws were disclosed in September and October 2024 as Arbitrary Plugin Installation…
Security Affairs -
Qilin Ransomware Exploits MSPaint and Notepad to Locate Sensitive Files
Qilin ransomware, which emerged in July 2022, is described as a formidable threat that continues to post details of more than 40 victims per month on its public leak site, with the United States leading in victim count and the UK among enabled nations.…
gbhackers.com -
Critical CoPhish Exploit Uses Copilot Studio to Hijack OAuth Tokens
Security researchers at Datadog have uncovered a sophisticated phishing technique dubbed “CoPhish” that weaponises Microsoft Copilot Studio to exfiltrate OAuth tokens. The attack exploits the ability of Copilot Studio agents to create configurable “topics”…
gbhackers.com -
ChatGPT Atlas Browser Can Be Tricked by Fake URLs into Executing Hidden Commands
OpenAI’s Atlas web browser, released recently, has been shown to be vulnerable to a prompt injection attack that can jailbreak its omnibox by disguising instructions as a seemingly harmless URL. According to NeuralTrust, an attacker can craft a URL-like…
The Hacker News -
A week in security (October 20 – October 26)
A week in security for October 20–26, 2025, highlights a flurry of activity across platforms with multiple notable findings reported by Malwarebytes Labs. On October 22, more than 100 Chrome extensions were found to break WhatsApp’s anti-spam rules by…
Malwarebytes -
Microsoft Adds Wi-Fi-Based Work Location Auto-Detection to Teams
Microsoft is preparing to introduce a Wi‑Fi-based work location auto‑detection feature in Teams, which will automatically identify and update users’ work locations by their connection to organisational Wi‑Fi networks. Scheduled for deployment in December…
gbhackers.com -
North Korean Chollima Actors Added BeaverTail and OtterCookie to its Arsenal
North Korean Chollima Actors have expanded their toolkit by merging BeaverTail and OtterCookie into more capable infostealers aimed at credential theft and cryptocurrency targeting, according to gbhackers. A recent campaign used a trojanized Node[.]js…
gbhackers.comAPT45 -
706,000+ BIND 9 DNS Resolvers Exposed to Cache Poisoning – PoC Released
A critical vulnerability affecting more than 706,000 BIND 9 DNS resolvers worldwide has been disclosed, with proof-of-concept exploit code now publicly available. The flaw enables cache poisoning by allowing forged DNS records to be injected into vulnerable…
gbhackers.com -
WhatsApp 0-Click Exploit Disclosed to Meta at Pwn2Own Security Event
Cybersecurity researchers from Team Z3 withdrew their planned demonstration of a zero-click remote code execution vulnerability in WhatsApp at the Pwn2Own Ireland 2025 hacking competition, choosing private coordinated disclosure to Meta instead. The exploit…
gbhackers.com -
Instant Slides: Google Gemini Canvas Can Now Auto-Generate Presentations
Google has introduced a feature in Canvas, the free interactive workspace built into its Gemini AI assistant, that can automatically generate presentation slides through AI. The update marks a significant expansion of Canvas’s capabilities, enabling…
SecurityOnline -
Next-Gen Power: iPad Pro Gets Vapor Chamber Cooling for M6 Chip
According to reports, as processor performance advances, Apple is planning to integrate vapor chamber cooling into the next-generation iPad Pro powered by the M6 processor. The vapor chamber cooling system is intended to more effectively mitigate thermal…
SecurityOnline -
Future of Logistics: Amazon Unveils Blue Jay Robot and Eluna AI Assistant
Amazon has unveiled two innovations for its operations network: the Blue Jay multi-arm robotic collaboration system and Project Eluna, an agent-based AI model, both aimed at reducing repetitive tasks, improving safety, boosting productivity, and accelerating…
SecurityOnline -
The Next Billboard: Apple Maps is Set to Launch Search Ads in 2026
In his latest Power On newsletter, Bloomberg journalist Mark Gurman revealed that Apple’s plans to expand its iOS advertising business are “making progress,” with the next likely target being the built-in Apple Maps app. According to Gurman, users could see…
SecurityOnline -
EU Charges Meta and TikTok with Widespread DSA Violations
The European Commission has formally accused Meta (parent company of Facebook and Instagram) and TikTok of violating key provisions of the Digital Services Act, saying both firms have failed to address illegal content, hindered researchers’ access to…
SecurityOnline -
Mem3nt0 mori – The Hacking Team is back!
Kaspersky researchers described a wave of infections in March 2025 where victims clicked personalised phishing links that opened in Chromium-based browsers, with the attackers using a zero-day exploit to escape Chrome’s sandbox. The campaign, dubbed…
securelist.comOperation ForumTroll -
Beyond Chatbots: Microsoft Edge Unveils New AI Features for Automated Browsing
Microsoft Edge is set to gain two new AI features in Copilot mode, named Copilot Actions and Journeys, according to Microsoft. Copilot Actions lets users issue complex commands in natural language—via voice or text—to automatically open web pages, attempt…
SecurityOnline -
AI Arms Race: Anthropic Seals Multibillion-Dollar Deal for 1 Million Google TPUs
Anthropic has announced a multibillion-dollar expansion of its strategic partnership with Google Cloud, sealed through a deal that involves extensive use of Google’s Tensor Processing Unit accelerators. Under the agreement, Anthropic will deploy up to one…
SecurityOnline -
CISA Warns: Critical Veeder-Root TLS4B RCE (CVE-2025-58428) Exposes Tank Gauge Systems to Command Injection
According to The Cybersecurity and Infrastructure Security Agency (CISA), two high-severity vulnerabilities affect the Veeder-Root TLS4B Automatic Tank Gauge (ATG) System, potentially allowing remote attackers to gain command execution and disrupt critical…
SecurityOnline -
NetSupport RAT Campaign Abuses ClickFix to Infect Hosts; 3 Threat Clusters Use RMM for Covert Access
According to eSentire Threat Response Unit (TRU), a major wave of NetSupport RAT campaigns abuses the ClickFix social engineering technique to deliver the remote administration tool and establish three distinct clusters for covert access and data theft. The…
SecurityOnline -
Critical Dell Storage Manager Flaw (CVE-2025-43995, CVSS 9.8) Allows Unauthenticated API Bypass
Dell Technologies has issued a critical advisory about multiple high-severity vulnerabilities in its Storage Center and Storage Manager (DSM) software, including CVE-2025-43995 with a CVSS of 9.8 that could allow an unauthenticated API bypass. According to…
SecurityOnline -
Agenda Ransomware Bypasses EDR by Deploying Linux Binary on Windows via Splashtop; Steals Veeam Credentials
Trend Research has identified a sophisticated ransomware campaign by the Agenda group, also known as Qilin, which utilizes a Linux-based ransomware binary to target Windows systems. This cross-platform attack circumvents traditional endpoint protections by…
SecurityOnline -
Google Exposes UNC6229 “Fake Career” Campaign Hacking Advertising Accounts with Fake Job Lures
27 October 2025. Google’s Threat Intelligence Group (GTIG) has exposed an ongoing social engineering campaign operated by a financially motivated threat cluster known as UNC6229, based in Vietnam. According to GTIG, the attackers post fake career…
SecurityOnline -
Ubiquiti Patches Critical CVSS 10 Flaw in UniFi Access That Exposed Management API Without Authentication
Ubiquiti has patched a critical CVSS 10 flaw in UniFi Access that exposed the management API without authentication. The vulnerability is associated with CVE-2025-52665 and has been described as an authentication bypass. The patch addresses a flaw that…
SecurityOnline -
YouTube Ghost Network Exposed: Coordinated Channels Spread Infostealer Malware via Game/Software Cracks
According to Check Point Research, the YouTube Ghost Network is a sophisticated, coordinated campaign on YouTube that weaponises fake and compromised accounts to spread information-stealing malware and manipulate viewer trust. Active since 2021 but sharply…
SecurityOnline -
Smishing Triad Uncovered: 194,000+ Malicious Domains Power Global Phishing-as-a-Service Campaign
Researchers from Palo Alto Networks’ Unit 42 have uncovered a massive, fast-evolving smishing campaign tied to a threat group known as the Smishing Triad, impersonating postal, banking and government services worldwide. Between January and September 2025,…
SecurityOnlineSmishing Triad -
OpenWrt Patches ubusd RCE Flaw (CVE-2025-62526) and Kernel Memory Leak (CVE-2025-62525) in DSL Driver
OpenWrt has patched two high-severity vulnerabilities, CVE-2025-62526 and CVE-2025-62525, that could allow remote code execution or kernel memory access on affected devices, with fixes in OpenWrt version 24.10.4 and later. The first flaw, CVE-2025-62526,…
SecurityOnline -
China-Aligned APTs Launch “Premier Pass-as-a-Service,” Sharing Access in Coordinated Global Espionage
A new Trend Research report highlights unprecedented collaboration among China-aligned APT groups, describing a model called “Premier Pass-as-a-Service” that sees access brokers such as Earth Estries handing compromised assets to Earth Naga (also known as…
SecurityOnlineEarth Estries -
Python RAT Disguised as Minecraft Client Uses Telegram Bot API for Cross-Platform Command & Control
Researchers from Netskope have uncovered a cross‑platform Python-based Remote Access Trojan (RAT) disguised as a Minecraft client that uses the Telegram Bot API for command and control. According to Netskope, the malware, internally dubbed Nursultan Client,…
SecurityOnline -
HashiCorp Patches Vault Flaws: AWS Auth Bypass and Unauthenticated JSON DoS
Two high-severity vulnerabilities disclosed by HashiCorp could expose Vault deployments to denial-of-service attacks and cross-account authentication bypasses, with urgent patching advised. HashiCorp confirmed Vault and Vault Enterprise are vulnerable to an…
SecurityOnline
