News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Wed 29 Oct 2025· 88 articles
-
US company with access to biggest telecom firms uncovers breach by nation-state hackers
According to Reuters, a US company with access to the biggest telecom firms, Ribbon Communications, said hackers working for an unnamed nation-state breached its networks and remained within the company for nearly a year without detection. Ribbon…
DataBreaches -
Canada says hacktivists breached water and energy facilities
According to The Canadian Centre for Cyber Security, hacktivists have breached critical infrastructure systems across Canada on multiple occasions, enabling modifications to industrial controls that could have produced dangerous conditions. The alert…
DataBreaches -
UK: FCA fines former employee of Virgin Media O2 for data protection breach
Taunton-based Luke Coleman, aged 30, has pleaded guilty to unlawfully obtaining and the subsequent disclosure of personal data in breach of the Data Protection Act, following a prosecution by the UK Financial Conduct Authority, according to FX News Group.…
DataBreaches -
Former General Manager for U.S. Defense Contractor Pleads Guilty to Selling Stolen Trade Secrets to Russian Broker
Peter Williams, 39, an Australian national, pleaded guilty in U.S. District Court to two counts of theft of trade secrets, in connection with stealing national-security–focused software from his U.S. defence contractor employer and selling it to a Russian…
DataBreaches -
NPM flooded with malicious packages downloaded more than 86,000 times
According to Koi, attackers have exploited NPM’s Remote Dynamic Dependencies to flood the repository with 126 malicious packages that have been downloaded more than 86,000 times, with around 80 still available as of Wednesday morning. The campaign, tracked…
Ars Technica -
Hacktivists breach Canada’s critical infrastructure, cyber Agency warns
Hacktivists have breached Canada’s critical infrastructure, with the Canadian Centre for Cyber Security warning that several internet-connected industrial control systems were targeted to gain attention and disrupt public safety. According to the Canadian…
Security Affairs -
Malicious NPM Packages Disguised With 'Invisible' Dependencies
Malicious NPM packages are being deployed with invisible dependencies through the PhantomRaven campaign, which Koi Security detailed in a blog post published this month. In total, 126 malicious packages were released, amassing more than 86,000 downloads and…
Dark Reading -
Dentsu Subsidiary Breached, Employee Data Stolen
A Dentsu subsidiary, Merkle, was breached by an unidentified threat actor, with Dentsu reporting that files containing information about current and former employees were stolen from Merkle’s network. According to Dentsu's disclosure, the stolen data is said…
Dark Reading -
Darktrace’s Analysis of Post-Exploitation Activities on CVE-2025-59287
Darktrace’s analysis of CVE-2025-59287, disclosed by Microsoft on 14 October 2025, details two US-based cases of exploitation involving Windows Server Update Services (WSUS). According to Darktrace, the attackers’ activity began with internet-facing WSUS…
darktrace.com -
Microsoft Security Change for Azure VMs Creates Pitfalls
Microsoft has delayed implementing a planned change that would switch Azure virtual networks to private subnets by default, a move intended to improve the security of cloud workloads but which could disrupt apps that expect public outbound access. The change…
Dark Reading -
Microsoft DNS Outage Disrupts Azure and Microsoft 365 Services Worldwide
Microsoft experienced a widespread DNS outage on 29 October 2025 that disrupted Azure and Microsoft 365 services worldwide. The disruption began around 16:00 UTC and was attributed to DNS configuration issues that crippled connectivity across Microsoft’s…
gbhackers.com -
Sweet Security Brings Runtime-CNAPP Power to Windows
Sweet Security has extended its Runtime CNAPP sensor to Windows, bringing the same deep visibility, real-time detection, risk prioritisation, and automated investigation from Linux to one of the most widely used enterprise operating systems. The Windows…
gbhackers.com -
Botnets Step Up Cloud Attacks Via Flaws, Misconfigurations
A wave of known botnets including Mirai, Gafgyt and Mozi is ramping up attacks on Web-exposed assets such as PHP servers, IoT devices and cloud gateways by exploiting misconfigurations and known vulnerabilities to take control of systems. The report notes…
Dark Reading -
Sweet Security Brings Runtime-CNAPP Power to Windows
Sweet Security has expanded its Runtime CNAPP sensor to Windows, enabling organisations to secure Windows workloads and applications in the cloud, with the Windows sensor developed in Rust to minimise resource usage. The new capability maintains the same…
SecurityOnline -
Experts Reports Sharp Increase in Automated Botnet Attacks Targeting PHP Servers and IoT Devices
Cybersecurity researchers have flagged a sharp rise in automated botnet attacks targeting PHP servers, IoT devices, and cloud gateways, driven by botnets such as Mirai, Gafgyt, and Mozi, according to Qualys Threat Research Unit in a report shared with The…
The Hacker News -
New AI-Targeted Cloaking Attack Tricks AI Crawlers Into Citing Fake Info as Verified Facts
Cybersecurity researchers have flagged a new security issue in agentic web browsers that could expose underlying AI models to context poisoning attacks. Devised by AI security company SPLX, the attack, codenamed AI-targeted cloaking, can have bad actors set…
The Hacker News -
Russian hackers, likely linked to Sandworm, exploit legitimate tools against Ukrainian targets
Russian hackers, likely linked to Sandworm, targeted Ukrainian organisations by using living-off-the-land techniques and dual-use tools to harvest data and stay hidden, according to Symantec Threat Hunter Team and Carbon Black. The report notes intrusions…
Security AffairsSandworm -
The 4TB time bomb: when EY’s cloud went public (and what it taught us)
The 4TB time bomb article recounts the discovery of a 4 TB SQL backup exposed to the public internet, which, according to Neo Security, contained every secret stored in the database, including API keys, session tokens and user credentials. Neo Security…
DataBreaches -
OpenAI’s Atlas browser leaves the door wide open to prompt injection
OpenAI’s Atlas browser has been shown to be vulnerable to prompt injection through its Omnibox, where a specially crafted link pasted into the combined search and prompt bar can cause Atlas to treat input as a trusted user prompt rather than a URL. This can…
Malwarebytes -
New physical attacks are quickly diluting secure enclave defenses from Nvidia, AMD, and Intel
New physical attacks are eroding confidence in secure enclaves from Nvidia, AMD and Intel, as researchers show that TEEs such as Nvidia Confidential Compute, AMD SEV-SNP, and Intel SGX/TDX can be defeated by inexpensive hardware placed between memory and the…
Ars Technica -
Massive 4TB EY Database Backup Found Publicly Accessible on Azure
A complete 4-terabyte SQL Server backup belonging to Ernst & Young (EY) was found publicly accessible on Microsoft Azure, a vulnerability identified by security researchers during routine internet mapping and subsequently remediated following responsible…
gbhackers.com -
Russian Hackers Target Government with Stealthy “Living-Off-the-Land” Tactics
Russian-linked attackers have intensified their targeting of Ukrainian organisations using living-off-the-land tactics rather than heavy malware, according to GBHackers on Security. The two campaigns identified by the Threat Hunter Team included a two‑month…
gbhackers.com -
MITRE Unveils ATT&CK v18 With Updates to Detections, Mobile, ICS
MITRE has unveiled ATT&CK v18, announced on 29 October 2025, with substantial changes across detections, mobile, and ICS coverage. According to SecurityWeek, the update introduces two new detection objects—Detection Strategies and Analytics—aimed at defining…
SecurityWeek -
China Amends Cybersecurity Law and Incident Reporting Regime to Address AI and Infrastructure Risks
China is updating its cybersecurity framework to sharpen AI safety controls and clarify incident reporting obligations for onshore infrastructure, with formal amendments to the Cybersecurity Law released in October 2025 by the Standing Committee of the…
DataBreaches -
Alan Turing institute launches new mission to protect UK from cyber-attacks
Britain’s leading AI institute has announced a new mission to help protect the nation from cyber-attacks on infrastructure, including energy, transport and utilities, after it was embroiled in allegations of toxic work culture and the chief executive…
DataBreaches -
Google Publishes New Guide to Help Defenders Monitor Privileged Accounts
Google has published comprehensive guidance to help defenders monitor privileged accounts, emphasising that stolen credentials are a leading attack vector for modern organisations. The guidance notes that attackers increasingly exploit these “keys to the…
gbhackers.com -
PureHVNC RAT Distributed via Weaponized Judicial Documents
The campaign uses judicial document themes to deliver Hijackloader malware, which then deploys the PureHVNC remote access trojan (RAT). According to IBM X-Force, this is the first observed instance of this delivery chain being used against Spanish-speaking…
gbhackers.com -
So long, and thanks for all the fish: how to escape the Linux networking stack
Cloudflare’s post on 29 October 2025 explains how, to push the Linux networking stack beyond its design, the team built a dedicated egress service called SLATFATF, or “fish”, to proxy IP packets using soft-unicast address space and lease those addresses. The…
Cloudflare -
Defending QUIC from acknowledgement-based DDoS attacks
On 10 April 2025 at 12:10 UTC, a security researcher notified Cloudflare of two vulnerabilities (CVE-2025-4820 and CVE-2025-4821) related to QUIC packet acknowledgement handling in quiche, Cloudflare’s open-source QUIC implementation, affecting Cloudflare…
Cloudflare -
Measuring characteristics of TCP connections at Internet scale
Cloudflare’s measurement paper shares aggregate insights into TCP connections established through its global CDN, describing a 1% passively collected sample of connections to Cloudflare between 7 and 15 October 2025, drawn from data describing about 70% of…
Cloudflare -
One IP address, many users: detecting CGNAT to reduce collateral effects
Cloudflare has published a method to detect large‑scale IP sharing behind CGNAT to reduce collateral damage in security systems that rely on IP reputation. The team built a supervised learning classifier to separate CGNAT and VPN/proxy IPs from…
Cloudflare -
How to build your own VPN, or: the history of WARP
Cloudflare’s post on 29 October 2025 recounts how WARP began as a high-performance VPN built into the Linux networking stack to securely egress arbitrary user packets from edge machines for millions of mobile clients. The initial solution resembled a Layer 3…
Cloudflare -
New ‘Gentlemen’ RaaS Appears on Hacking Forums, Targeting Windows, Linux and ESXi
Threat intelligence researchers have identified a new ransomware-as-a-service operation dubbed The Gentlemen’s RaaS, actively recruited on underground hacking forums by an operator using the handle zeta88. The cross-platform threat offers dedicated…
gbhackers.comThe Gentlemen -
Google Wear OS Flaw Lets Any App Send Texts on Behalf of Users
A critical vulnerability in Google Messages for Wear OS has been identified, allowing any installed app to send text messages on behalf of the user without permissions, confirmation, or user interaction. Identified as CVE-2025-12080, the flaw stems from…
gbhackers.com -
Cybercriminals Launch Flood of Fake Forex Platforms to Harvest Logins
Fraudulent investment platforms impersonating legitimate cryptocurrency and forex exchanges have emerged as the primary financial threat across Asia, with organised crime groups operating at unprecedented scale, according to the GBHackers report. The piece…
gbhackers.com -
Hackers Allegedly Leak HSBC USA Customer and Financial Information
A threat actor claims responsibility for breaching HSBC USA, the American division of the global investment bank and financial services holding company. The cybercriminal posted an extensive database for sale on underground forums, alleging it contains fresh…
gbhackers.com -
AI Security Firm Polygraf Raises $9.5 Million in Seed Funding
According to SecurityWeek, Polygraf AI announced on 29 October 2025 that it has raised $9.5 million in a seed funding round to advance its AI security solutions. The round was led by Allegis Capital, with participation from Alumni Ventures, DataPower VC,…
SecurityWeek -
Gmail breach panic? It’s a misunderstanding, not a hack
Gmail breach panic? It’s a misunderstanding, not a hack, according to Google, which denied that Gmail systems had suffered a breach after media outlets misinterpreted an interview with a security researcher. The article notes reporters claimed the incident…
Malwarebytes -
Preparing for the Digital Battlefield of 2026: Ghost Identities, Poisoned Accounts, & AI Agent Havoc
According to BeyondTrust, the 2026 landscape will be defined by an unmanaged identity debt, with three identity-based threats set to shape the year: Agentic AI Emerges as the Ultimate Attack Vector, where an AI tool granted least privilege can be manipulated…
The Hacker News -
Russian Hackers Target Ukrainian Organizations Using Stealthy Living-Off-the-Land Tactics
According to Symantec and Carbon Black Threat Hunter Team, Russian-origin threat actors targeted Ukrainian organisations, including a large business services company for two months and a local government entity for a week, using stealthy living-off-the-land…
The Hacker News
