News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 5 so far |
Thu 30 Oct 2025· 68 articles
-
U.S. CISA adds XWiki Platform, and Broadcom VMware Aria Operations and VMware Tools flaws to its Known Exploited Vulnerabilities catalog
According to U.S. CISA, XWiki Platform and Broadcom VMware Aria Operations and VMware Tools flaws have been added to the Known Exploited Vulnerabilities catalog. The entries include CVE-2025-24893 for XWiki Platform Eval Injection Vulnerability (CVSS 9.8)…
Security Affairs -
Beyond IP lists: a registry format for bots and agents
Cloudflare outlines a registry format for bots and agents as a scalable way to discover cryptographically signed requests, expanding beyond traditional IP lists and robots[.]txt.
Cloudflare -
Claroty Patches Authentication Bypass Flaw
Claroty has patched CVE-2025-54603, a authentication bypass flaw in its on‑premises OpenID Connect (OIDC) feature of Claroty Secure Remote Access (SRA) that could let attackers create unauthorized users, impersonate existing OIDC users, and gain full admin…
Dark Reading -
LotL Attack Hides Malware in Windows Native AI Stack
According to Dark Reading, a researcher has demonstrated that Windows’ native artificial intelligence stack can act as a vector for malware delivery, revealing a living-off-the-land (LotL) technique that utilises trusted ONNX files. The proof-of-concept,…
Dark Reading -
Inside the Great Firewall Part 1: The Dump
A public Deep Dive reports a historic breach of China’s censorship infrastructure, leaking over 500GB of internal data from Great Firewall infrastructure in September 2025, with researchers noting the full dump is closer to ~600GB and a single archive around…
dti.domaintools.com -
Brush exploit can cause any Chromium browser to collapse in 15-60 seconds
A security researcher has revealed a flaw in Chromium’s Blink rendering engine, dubbed Brash, which can crash many Chromium-based browsers within 15-60 seconds via a single malicious URL. According to SecurityAffairs, Brash exploits the lack of rate limiting…
Security Affairs -
The 5 generative AI security threats you need to know about detailed in new e-book
Generative AI is reshaping security work, accelerating threat detection and enabling scalable defence, even as attackers adopt similar tricks to outpace traditional safeguards. In Microsoft’s coverage, the top threats include poisoning attacks that skew AI…
Microsoft -
Revealed: Afghan data breach after MoD official left laptop open on train
An Afghan data breach has been revealed after a Ministry of Defence official left a laptop open on a train, exposing confidential information, according to The Independent. The report notes that an officially sensitive personal email relating to Afghans…
DataBreaches -
Snowflake Loses Two More Bids to Dismiss Data Breach Plaintiffs
Snowflake Loses Two More Bids to Dismiss Data Breach Plaintiffs, published on 30 October 2025, reports that the cloud company’s data breach litigation woes worsened as two bids to dismiss education and financial institutional plaintiffs largely failed to…
DataBreaches -
Google's Built-In AI Defenses on Android Now Block 10 Billion Scam Messages a Month
Google says the built‑in AI protections on Android now shield users from more than 10 billion suspected malicious calls and messages each month, with over 100 million suspicious numbers blocked from using Rich Communication Services to prevent scams before…
The Hacker News -
Russian Ransomware Gangs Weaponize Open-Source AdaptixC2 for Advanced Attacks
AdaptixC2 is an open-source command-and-control framework that is being used by an increasing number of threat actors, including groups tied to Russian ransomware operations. The framework, designed for post-exploitation and adversarial emulation, features…
The Hacker News -
How scammers use your data to create personalized tricks that work
Think of your digital footprint as your online shadow, revealing a public portrait of your interests, connections, and routine that scammers can exploit. The piece explains your active footprint includes everything you choose to share—photos, reviews, and…
Malwarebytes -
Ransomware gang claims Conduent breach: what you should watch for next
A ransomware group, SafePay, reportedly claimed responsibility for the Conduent breach and listed the company on its leak site. Conduent says an unauthorized third party had access to its systems from 21 October 2024 until the intrusion was stopped on…
Malwarebytes -
Spektrum Labs Emerges From Stealth to Help Companies Prove Resilience
Spektrum Labs has emerged from stealth with a seed round of $10 million to back its cyber resilience platform. The company says its Spektrum Fusion platform uses AI agents to verify whether security controls are active and effective, and whether backups are…
SecurityWeek -
New "Brash" Exploit Crashes Chromium Browsers Instantly with a Single Malicious URL
A severe vulnerability in Chromium’s Blink rendering engine, codenamed Brash by security researcher Jose Pino, can crash many Chromium-based browsers within seconds, according to The Hacker News. The attack hinges on an architectural flaw in how certain DOM…
The Hacker News -
Threat Actors Abuse AzureHound Tool to Enumerate Azure and Entra ID Environments
Threat Actors Abuse AzureHound Tool to Enumerate Azure and Entra ID Environments discusses how AzureHound, a data-collection tool built into the BloodHound suite, is being weaponised by threat actors to enumerate Azure and Microsoft Entra ID environments by…
gbhackers.com -
Lampion Stealer Resurfaces with ClickFix Attack to Steal User Credentials Stealthily
Lampion Stealer has resurfaced with a ClickFix-driven campaign aimed at stealing credentials, with researchers noting the operation has run continuously since at least June 2024 after its 2019 initial discovery. The campaign targets Portuguese banks and uses…
gbhackers.com -
Reflectiz Raises $22 Million for Website Security Solution
Reflectiz has announced a $22 million Series B funding round, bringing its total raised to $28 million, with the round led by Fulcrum Equity Partners and including support from AFG Partners, Capri Ventures, YYM Ventures, and other investors. The company,…
SecurityWeek -
Fake PayPal invoice from Geek Squad is a tech support scam
A Malwarebytes article warns about a tech support scam masquerading as a PayPal invoice, sent to a wide audience from a Gmail address. The piece notes PayPal does not use Gmail for invoices and official communications do not include recipients in the blind…
Malwarebytes -
Critical Blink Vulnerability Lets Attackers Crash Chromium Browsers in Seconds
Security researchers have disclosed a critical Blink vulnerability, dubbed Brash, that exposes more than 3 billion users of Chromium-based browsers to denial-of-service attacks. The flaw enables attackers to crash Chrome, Edge, Brave, Opera and others within…
gbhackers.com -
Millions Impacted by Conduent Data Breach
According to SecurityWeek, business services provider Conduent is notifying millions of people that personal information was stolen in a January 2025 data breach, with initial disclosure of system disruptions affecting government agencies in multiple US…
SecurityWeek -
Aembit Introduces Identity and Access Management for Agentic AI
Aembit has launched Identity and Access Management for Agentic AI, a set of capabilities that help organisations safely provide and enforce access policies for AI agents as they move into production. The offering extends the Aembit Workload IAM Platform with…
gbhackers.com -
Jenkins Flaws Expose SAML Authentication Bypass and MCP Server Plugin Weaknesses
Jenkins users face a set of 14 distinct vulnerabilities across multiple plugins, including a critical SAML authentication bypass tracked as CVE-2025-64131 with a high CVSS score of 8.4, caused by the plugin’s lack of a replay cache in versions…
gbhackers.com -
Major US Telecom Backbone Firm Hacked by Nation-State Actors
Ribbon Communications, a US company that provides backbone technology for communications networks, revealed that hackers gained unauthorized access to its IT network, with the incident disclosed in a quarterly report submitted recently to the SEC. The firm…
SecurityWeek -
Airstalk Malware: Multi-Threaded C2 Steals Windows Logins
Cybersecurity researchers have uncovered Airstalk, a Windows malware family available in PowerShell and .NET variants that uses a legitimate mobile device management infrastructure to establish covert command-and-control communications and exfiltrate browser…
gbhackers.com -
Aembit Introduces Identity and Access Management for Agentic AI
According to CyberNewsWire, Aembit has launched Identity and Access Management (IAM) for Agentic AI, extending its Workload IAM Platform with capabilities designed to securely govern how AI agents identify themselves and access sensitive systems. The release…
SecurityOnline -
The Death of the Security Checkbox: BAS Is the Power Behind Real Defense
The Death of the Security Checkbox argues that BAS has become the engine rather than a compliance checkbox, powering real defence through continuous, live testing of how quickly and effectively organisations respond to threats. At the Picus Security summit,…
The Hacker News -
Canada Says Hackers Tampered With ICS at Water Facility, Oil and Gas Firm
The SecurityWeek report, dated 30 October 2025, highlights that the Canadian Centre for Cyber Security has warned CISOs that hacktivists are increasingly targeting internet-exposed industrial control systems. According to the Canadian Centre for Cyber…
SecurityWeek -
NFC Relay Attack: 700+ Android Apps Harvest Banking Login Details
Researchers at zLabs identified over 760 malicious Android applications designed to steal banking credentials and enable fraudulent transactions, a campaign described as a sophisticated NFC-based crime wave that has exploded across multiple continents. What…
gbhackers.com -
136 NPM Packages Delivering Infostealers Downloaded 100,000 Times
136 NPM packages delivering infostealers have been identified, with the collective downloads totalling about 100,000 over the past four months, SecurityWeek reports. The campaigns comprise two operations active since July and August, respectively, and a…
SecurityWeek -
ThreatsDay Bulletin: DNS Poisoning Flaw, Supply-Chain Heist, Rust Malware Trick and New RATs Rising
ThreatsDay’s latest briefing shows the threat landscape tightening, with a critical flaw in BIND 9—CVE-2025-40778—affecting thousands of DNS servers. As many as 5,912 instances have been found vulnerable, with a CVSS score of 8.6, enabling an off-path…
The Hacker News -
Ex-Defense contractor exec pleads guilty to selling cyber exploits to Russia
Ex-US defence contractor Peter Williams pleaded guilty to stealing US defence trade secrets and selling cyber exploits to a Russian broker, according to the DOJ. The Australian national, aged 39, admits taking software and at least eight sensitive exploit…
Security Affairs -
Critical RediShell RCE Vulnerability Threatens 8,500+ Redis Deployments Worldwide
A critical security vulnerability known as RediShell RCE has left thousands of Redis deployments exposed to remote code execution via Redis’s Lua scripting engine. The flaw, tracked as CVE-2025-49844, was publicly disclosed in early October 2025 by cloud…
gbhackers.com -
PhantomRaven Malware Found in 126 npm Packages Stealing GitHub Tokens From Devs
PhantomRaven has been identified as a software supply chain attack targeting the npm registry, with security researchers naming the campaign PhantomRaven and attributing it to a threat actor tracked by Koi Security. The activity began in August 2025 and has…
The Hacker News -
New Attack Chains Ghost SPNs and Kerberos Reflection to Elevate SMB Privileges
Ghost SPNs and Kerberos reflection are described as a new attack chain that enables a domain user to achieve SYSTEM-level access on a Windows domain joined machine, even where prior Kerberos mitigations exist. The issue, tracked as CVE-2025-58726, is a SMB…
gbhackers.com -
Former US Defense Contractor Executive Admits to Selling Exploits to Russia
An Australian national, Peter Williams, pleaded guilty in a US court to stealing trade secrets from a US defence contractor and selling them to a Russian broker of cyber exploits, according to the US Department of Justice. Williams allegedly stole at least…
SecurityWeek -
Privilege Escalation Exploit Targets Windows Cloud Files Minifilter
Microsoft has addressed a critical race condition vulnerability in its Windows Cloud Files Minifilter driver, tracked as CVE-2025-55680, with patches issued in October 2025. The flaw, originally discovered in March 2024, affects the cldflt[.]sys component…
gbhackers.com -
Microsoft Q1 Earnings: Azure & AI Propel Revenue to $77.7B
Microsoft reported its Q1 FY2026 results show revenue of $77.7 billion, up 18% year on year, with operating income of $38 billion, up 24%. It noted a $3.1 billion loss tied to its OpenAI investment, even as net income rose by 12%. Using equity accounting,…
SecurityOnline -
Cloud Chaos: Azure Outage Hits Microsoft 365 and Xbox Just Days After AWS Failure
Cloud Chaos: Azure Outage Hits Microsoft 365 and Xbox Just Days After AWS Failure reports that Microsoft’s Azure cloud platform experienced a widespread disruption shortly after last week’s AWS outage, affecting Microsoft 365, Xbox, and Minecraft. The…
SecurityOnline -
OpenAI Launches Sora App in Asia, Featuring Viral ‘Cameos’ and New Safety Rules
OpenAI has officially announced the expansion of its AI video creation platform, Sora App, into the Asian market, debuting first in Taiwan, Thailand, and Vietnam. The Sora App is now available for download via the Apple App Store in Thailand and other…
SecurityOnline
