News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 5 so far |
Thu 30 Oct 2025· 68 articles
-
New Malware Infects WooCommerce Sites Through Fake Plugins to Steal Credit Card Data
A sophisticated malware campaign is actively targeting WordPress e-commerce websites using the WooCommerce plugin, according to Wordfence Threat Intelligence Team. The campaign disguises itself as a legitimate WordPress plugin with randomly generated names…
gbhackers.com -
Chrome 142 Update Patches 20 Security Flaws Enabling Code Execution
Google has released Chrome version 142 to the stable channel, addressing 20 security flaws that could allow attackers to execute malicious code on affected systems. The update, rolling out to Windows, Mac, and Linux users, includes seven high-severity…
gbhackers.com -
Dentsu’s US subsidiary Merkle hit by cyberattack, staff and client data exposed
According to Dentsu, its U.S.-based subsidiary Merkle suffered a cyberattack that exposed staff and client data and prompted parts of its network to be taken offline as a precaution. The firm says it detected abnormal activity, initiated incident response…
Security Affairs -
12 Malicious Extensions in VSCode Marketplace Steal Source Code and Exfiltrate Login Credentials
The VSCode extension marketplace has been identified as a critical vulnerability in the software supply chain, with 12 malicious extensions detected in the Microsoft VSCode Marketplace and OpenVSX, four of which remain active. The extensions are capable of…
gbhackers.com -
Data Leak Outs Students of Iran's MOIS Training Academy
Data leak outs students of Iran’s MOIS training academy Ravin Academy, a sanctioned school tied to the government’s APT34 (MuddyWater). On 22 October 2025, British-Iranian activist Nariman Gharib published a list of more than 1,000 people associated with…
Dark Reading -
PhantomRaven Attack Discovered in 126 Malicious npm Packages, Exceeding 86,000 Downloads
PhantomRaven is a sprawling campaign uncovered to involve 126 malicious npm packages that have amassed more than 86,000 downloads. In October 2025, according to Koi Security’s behavioral risk engine, Wings, a surge of external network requests from these…
gbhackers.com -
CISA Alerts on Active Exploitation of WSUS Vulnerability
According to CISA, the Cybersecurity and Infrastructure Security Agency, there is active exploitation of a critical vulnerability affecting Windows Server Update Service (WSUS), now addressed by an out-of-band update. The flaw, CVE-2025-59287, is a remote…
gbhackers.com -
WordPress Plugin Vulnerability Lets Attackers Read Any Server File
A critical security flaw has been discovered in the Anti-Malware Security and Brute-Force Firewall WordPress plugin, identified as CVE-2025-11705, which allows authenticated attackers with basic subscriber-level access to read arbitrary files on the server,…
gbhackers.com -
PolarEdge Botnet Hits 25K IoT Devices in Major Cyber Campaign
According to XLab’s Cyber Threat Insight and Analysis System, the PolarEdge botnet has compromised over 25,000 Internet of Things devices and established 140 command-and-control servers through systematic exploitation of vulnerable edge devices. The…
gbhackers.com -
OpenAI Releases GPT-OSS-SafeGuard Models for Customizable AI Safety
OpenAI has released a new safety-focused family of open-source models, GPT-OSS-SafeGuard-20B and GPT-OSS-SafeGuard-120B, designed for security classification tasks and enabling developers to define their own safety boundaries. Building on earlier open-source…
SecurityOnline -
AI vs. Authenticity: Cameo Sues OpenAI Over Sora’s ‘Cameo’ Deepfake Feature
Cameo has filed a trademark lawsuit against OpenAI over its Sora “Cameo” deepfake feature, arguing that OpenAI’s use of the name infringes its federally registered trademark. According to Reuters, Cameo claims OpenAI “willfully misappropriating an…
SecurityOnline -
Microsoft 365 Gets iOS ‘Liquid Glass’ Makeover and Floating Navigation
Microsoft’s Design Team has unveiled a new set of icons for Microsoft 365, now available across both desktop and mobile platforms. The latest iOS version introduces a refined aesthetic inspired by Apple’s Liquid Glass design language, emphasising…
SecurityOnline -
Grammarly is Now Superhuman, Unifying Mail and AI in New Productivity Suite
Grammarly has announced a major rebranding to be known as Superhuman, marking a step that follows its acquisitions of the email platform Superhuman Mail and the AI-driven productivity suite Coda, both completed earlier in 2025, and coming as of 30 October…
SecurityOnline -
Finally Fixed: Windows 11 “Update and Shut Down” Bug Patched After 2 Years
Microsoft has rolled out a fix for the long-standing Windows 11 “Update and Shut Down” bug in an Insider build, addressing a problem where the button previously initiated both update stages and then booted to the desktop instead of updating during shutdown…
SecurityOnline -
Jenkins Faces Wave of Plugin Flaws, Including SAML Authentication Bypass (CVE-2025-64131)
The Jenkins project has issued a major security advisory addressing a wave of vulnerabilities, including a high-severity flaw in the SAML Plugin (CVE-2025-64131) that could allow session hijacking for Jenkins servers using SAML SSO. The advisory notes 14…
SecurityOnline -
ISC Patches High-Severity Kea DHCPv4 DoS (CVE-2025-11232) Flaw, Allows Crash via Malformed Hostname
The Internet Systems Consortium (ISC) has issued a security advisory warning of a high-severity denial-of-service flaw in Kea DHCPv4, tracked as CVE-2025-11232 and rated CVSS 7.5. According to ISC’s advisory, three configuration parameters must have specific…
SecurityOnline -
Wordfence Warns of Active Exploits Targeting Critical Privilege Escalation Flaw in WP Freeio (CVE-2025-11533)
According to Wordfence, a critical privilege escalation vulnerability (CVE-2025-11533) in the WP Freeio plugin allows unauthenticated attackers to create administrator accounts by manipulating the user-role field during registration, with a CVSS of 9.8. The…
SecurityOnline -
Google Rolls Out Chrome 142 Patching 20 Security Flaws
Google has rolled out Chrome 142 to the stable channel for Windows, Mac, and Linux, bringing the browser up to 142.0.7444.59 (Linux), 142.0.7444.59/60 (Windows), and 142.0.7444.60 (Mac) with a total of 20 security fixes. A significant portion of the fixes…
SecurityOnline -
npm Typosquat Campaign: 10 Malicious Packages Deliver PyInstaller Infostealer via Fake CAPTCHA
The Socket Threat Research Team has identified a significant supply chain attack within the npm ecosystem, involving 10 malicious packages that masquerade as legitimate developer tools. These packages, published on July 4, 2025, utilized typosquatting…
SecurityOnline -
Researcher Details Critical Authentication Bypasses in WSO2 API Manager and Identity Server
SecurityOnline[.]info reports that security researcher Crnkovic disclosed three critical vulnerabilities—CVE-2025-9152, CVE-2025-10611, and CVE-2025-9804—in WSO2 API Manager and WSO2 Identity Server, each scoring 9.8 on the CVSS scale. The flaws stem from…
SecurityOnline -
TEE.fail: Researchers Break Intel SGX/TDX and AMD SEV-SNP with Sub-$1,000 DDR5 Memory Bus Attack
Researchers from Georgia Tech and Purdue University have demonstrated that even current server-grade TEEs, including Intel SGX, TDX and AMD SEV-SNP, can be compromised via a DDR5 memory bus interposition attack conducted with a sub-£1,000 hardware setup. In…
SecurityOnline -
Trigona Ransomware Attacks MS-SQL Servers Using Rust Scanner and BCP Utility to Deploy Payloads
The ASEC has published a report revealing that the Trigona ransomware threat actors are still targeting Microsoft SQL servers, expanding their toolkit with Rust-based scanners, remote access tools, and privilege escalation utilities. According to AhnLab…
SecurityOnline -
Stealthy Dual Malware Loader Uncovered: Executes TorNet & PureHVNC Simultaneously, Cloaked by MurmurHash2
Researchers from the Internet Initiative Japan (IIJ) have analysed a previously unknown malware loader that can simultaneously execute two distinct malware families—TorNet and PureHVNC— while using uncommon obfuscation and hashing techniques. According to…
SecurityOnline -
Midnight Ransomware Decryption Flaw: Babuk Successor’s RSA Implementation Mistake Allows Free File Recovery
A new ransomware family called Midnight has emerged, borrowing heavily from the Babuk ransomware framework but with a critical mistake that allows victims to recover encrypted data without paying the ransom. According to Gen researchers, Midnight blends…
SecurityOnline -
VSCode Supply Chain Compromise: 12 Malicious Extensions Steal Source Code and Open Remote Shells
The HelixGuard Threat Intelligence Team has uncovered a widespread supply chain compromise in the Visual Studio Code extension marketplace, identifying at least 12 malicious plugins, four of which remained live at discovery. These extensions were found to…
SecurityOnline -
Major Shift: Chrome 154 Will Default to “Always Use Secure Connections,” Warning Users Before Insecure HTTP Sites
Google has announced that from Chrome 154, due to release in October 2026, the browser will automatically enable “Always Use Secure Connections” by default and will warn users before the first access to any public site without HTTPS. According to Google’s…
SecurityOnline -
Researcher Details Windows Cloud Files Mini Filter Driver Elevation of Privilege Flaw (CVE-2025-55680)
Researchers from Exodus Intelligence, led by Michele Campa, have disclosed a privilege-escalation vulnerability in Microsoft’s Cloud Files Minifilter driver (cldflt[.]sys) that affects all versions of Windows prior to October 2025, assigned CVE-2025-55680…
SecurityOnline -
Lampion Banking Trojan Evolves: 700MB Bloatware DLL and ClickFix VBS Script Target Brazilian Users
Researchers at BitSight have uncovered a long-running spam campaign operated by a Brazilian threat group behind the Lampion banking Trojan, an information-stealing malware family active since 2019. The latest report reveals an updated infection chain, new…
SecurityOnline
