News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 5 so far |
Fri 31 Oct 2025· 64 articles
-
Two Windows vulnerabilities, one a 0-day, are under active exploitation
Two Windows vulnerabilities, one a zero-day known to attackers since 2017 and the other a critical flaw Microsoft recently attempted to patch, are being exploited in wide-scale operations, researchers say. The zero-day, tracked as ZDI-CAN-25373 and later…
Ars Technica -
FCC dumps plan for telecom security rules that Internet providers don’t like
The FCC intends to vote in November to repeal a ruling that required telecom providers to secure their networks, acting on a request from major ISP lobby groups. According to Jon Brodkin, FCC Chairman Brendan Carr said the ruling “exceeded the agency’s…
Ars Technica -
UNC6384 Targets European Diplomatic Entities With Windows Exploit
UNC6384, a China-linked threat actor, has targeted European diplomatic entities with a Windows exploit in a cyber-espionage campaign running since September and centred on Hungary and Belgium. The group has incorporated CVE-2025-9491, a high-severity Windows…
Dark ReadingMUSTANG PANDA -
Ribbon Communications Breach Marks Latest Telecom Attack
Ribbon Communications disclosed in its quarterly filing that its network was breached and that cyberattackers had lurked in its environment for almost a year, with initial access possibly occurring as far back as December 2024. The company said it first…
Dark Reading -
Old Linux Kernel flaw CVE-2024-1086 resurfaces in ransomware attacks
According to SecurityAffairs, CISA has warned that ransomware gangs are exploiting CVE-2024-1086, a high-severity Linux kernel flaw in netfilter: nf_tables that was introduced in 2014 and patched in January 2024. The article notes that CISA did not name the…
Security Affairs -
OpenAI Unveils Aardvark: GPT-5 Agent That Finds and Fixes Code Flaws Automatically
OpenAI has announced Aardvark, an “agentic security researcher” powered by GPT‑5 that can scan, understand, and patch code to flag and fix security vulnerabilities at scale. The private‑beta autonomous agent embeds itself into software development pipelines,…
The Hacker News -
Nation-State Hackers Deploy New Airstalk Malware in Suspected Supply Chain Attack
A suspected nation‑state threat actor has been linked to a new malware called Airstalk, described by Palo Alto Networks Unit 42 as part of a likely supply chain attack and tracked under the moniker CL-STA-1009. According to Palo Alto Networks Unit 42, the…
The Hacker News -
BGP zombies and excessive path hunting
Cloudflare explains that BGP zombies are undesirable routes that linger in the Default-Free Zone, causing packets to be misrouted or arrive via longer paths. The piece outlines path hunting as the process routers use to seek the best path after a…
Cloudflare -
In Other News: WhatsApp Passkey-Encrypted Backups, Russia Targets Meduza Malware, New Mastercard Solution
WhatsApp has announced that on both Android and iOS devices users can now encrypt chat backups using passkeys, with a lockscreen code, face, or fingerprint replacing the need to memorise a password or encryption key. The feature will be rolled out gradually…
SecurityWeek -
Landmark civil penalty of AU$5.8 million issued under Australia’s Privacy Act
According to Hogan Lovells, on 9 October 2025 the Federal Court of Australia imposed a civil penalty of AU$5.8 million on Australian Clinical Labs Limited, one of the country’s largest private hospital pathology service providers, for systemic failures that…
DataBreaches -
How many courts have had sealed and sensitive files exposed by one vendor’s error?
Two courts had sealed filings and court records exposed due to a vendor error, with researchers previously reporting that two courts were affected. According to DataBreaches[.]Net, the vendor responsible is Software Unlimited Corp (SUCO) in Tupelo,…
DataBreaches -
ClickFix & FileFix: How a Copy-Paste Trick Became 2025’s Top Social Engineering Threat
ClickFix, also known as ClearFix, is a modern evolution of phishing that surfaced in October 2023 and had detections surge by more than 500% over six months, making it one of the fastest-growing social engineering threats by 2025. A newer offshoot, FileFix,…
SOCRadar -
China-Linked Hackers Exploit Windows Shortcut Flaw to Target European Diplomats
A China-affiliated threat actor known as UNC6384 has been linked to a fresh wave of attacks between September and October 2025 that exploit an unpatched Windows shortcut vulnerability to target European diplomatic and government entities. The activity…
The Hacker News -
Ukrainian Conti Ransomware Suspect Extradited to US from Ireland
A Ukrainian national accused of helping run Conti, one of the world’s most damaging ransomware operations, is now in US custody after being extradited from Ireland. Oleksii Oleksiyovych Lytvynenko, 43, made his first court appearance in the Middle District…
DataBreaches -
Legal Aid Agency chief admits difficulties understanding impact of cyberattack
The Legal Aid Agency chief told MPs that the organisation is still working out the extent of a cyberattack detected in the spring, with a team of analysts examining how much compromised data can be pieced back together. Jane Harbottle said the work could…
DataBreaches -
Attackers Exploit Windows Server Update Services Flaw to Steal Sensitive Organizational Data
Sophos researchers have identified real‑world exploitation of a newly disclosed vulnerability in Windows Server Update Services (WSUS), tracked as CVE-2025-59287, which is being used to harvest sensitive organisational data. According to Sophos, patches were…
gbhackers.com -
Tick2 articles this day · gbhackers.com first
China-Linked Tick Group Exploits Lanscope Zero-Day to Hijack Corporate Systems · Threat Actors Exploit LANSCOPE Endpoint Manager Zero-Day Vulnerability to Steal Confidential Data
2 outlets-
China-Linked Tick Group Exploits Lanscope Zero-Day to Hijack Corporate Systems
The Hacker News reports that the China-linked Tick group has exploited a Lanscope zero‑day to hijack corporate systems, using CVE-2025-61932, which Sophos CTU says allows remote code execution with SYSTEM privileges on on‑premise Lanscope EndPoint Manager…
The Hacker News -
Threat Actors Exploit LANSCOPE Endpoint Manager Zero-Day Vulnerability to Steal Confidential Data
According to Secureworks Counter Threat Unit (CTU) researchers, BRONZE BUTLER, described as a Chinese state‑sponsored threat actor, exploited a critical zero‑day in Motex LANSCOPE Endpoint Manager to gain unauthorized access to corporate networks and…
gbhackers.com
-
-
Ukrainian Man Extradited From Ireland to US Over Conti Ransomware Charges
Oleksii Oleksiyovych Lytvynenko, a Ukrainian national who fled to Ireland after the Russian invasion, has been extradited to the United States to face charges linked to Conti ransomware. The 43-year-old, who was granted temporary protection in Ireland in…
SecurityWeek -
Google Launches New AI Security Features on Android to Block Mobile Scams
Google has announced enhanced artificial intelligence protections designed to combat the rising tide of mobile scams affecting billions of users worldwide, with claims that fraudsters stole over $400 billion globally in the past year using AI-powered…
gbhackers.com -
Herodotus: The Android Trojan That Types Like You
The SOCRadar analysis describes Herodotus as an advanced Android banking trojan that blends dropper apps masquerading as legitimate banking or security tools with fraud-detection evasion. It first appeared in campaigns in Italy and Brazil and has since…
SOCRadar -
Go and enhance your calm: demolishing an HTTP/2 interop problem
According to Cloudflare, HTTP/2 can be powerful yet easy to misuse, with mitigations that close connections when abnormal client behaviour is detected and the ENHANCE_YOUR_CALM error is used.
Cloudflare -
Stolen Credentials Drive the Rise of Financially Motivated Cyberattacks
The article, published on 31 October 2025, reports that throughout the first half of 2025, the FortiGuard Incident Response team investigated dozens of breaches across multiple industries driven by financially motivated threat actors. It notes a shift away…
gbhackers.com -
Open VSX Downplays Impact From GlassWorm Campaign
Open VSX says the GlassWorm campaign that infected VS Code extensions in its marketplace has been fully contained, with the threat not behaving as a self-replicating worm in the traditional sense. Maintained by the Eclipse Foundation, Open VSX noted that the…
SecurityWeek -
Beware of Fake ChatGPT Apps That Spy on Users and Steal Sensitive Data
Security researchers warn that mobile stores are flooded with lookalike ChatGPT, DALL·E and other AI apps that can be harmless wrappers, adware monetisers or spyware capable of full device surveillance and credential theft. The analysis highlights a…
gbhackers.com -
CISA Issues Advisory on XWiki Flaw Allowing Remote Code Execution
According to CISA, a critical vulnerability affecting XWiki Platform has been added to its Known Exploited Vulnerabilities catalog, describing an eval injection flaw that could let any guest user execute arbitrary remote code without authentication. The…
gbhackers.com -
Update Chrome now: 20 security fixes just landed
Google has released an update for its Chrome browser that includes 20 security fixes, several of which are high severity, most of which were found in Chrome’s V8 engine. According to Google, the update raises Chrome to 142.0.7444.59/60 for Windows,…
Malwarebytes -
The MSP Cybersecurity Readiness Guide: Turning Security into Growth
According to The Hacker News, MSPs are facing rising client expectations for strong cybersecurity and compliance outcomes as threats grow more complex and regulatory demands evolve, while clients want comprehensive protection without the burden of managing…
The Hacker News -
CISA Adds Exploited XWiki, VMware Flaws to KEV Catalog
According to CISA, the Known Exploited Vulnerabilities (KEV) catalog was expanded on 31 October 2025 to include two defects affecting XWiki and VMware products. The XWiki flaw, CVE-2025-24893 (CVSS 9.8), involves improper sanitization of search parameters…
SecurityWeek -
EY Exposes 4TB SQL Server Backup Publicly on Microsoft Azure
A massive 4TB SQL Server backup belonging to Ernst & Young (EY) was publicly accessible on Microsoft Azure, according to SecurityAffairs. The exposed file, a .BAK backup, was discovered by Neo Security during a routine scan and was described as potentially…
Security Affairs -
Jamf to Go Private Following $2.2 Billion Acquisition by Francisco Partners
Jamf is set to go private after private equity firm Francisco Partners agreed to acquire the outstanding Jamf common stock in an all-cash deal, with the price per share listed as $13.05 in the agreement and described as a 50% premium to the stock’s 90-day…
SecurityWeek -
Chinese APT Exploits Unpatched Windows Flaw in Recent Attacks
According to Arctic Wolf, a Chinese threat actor linked to the Mustang Panda APT has been exploiting an unpatched Windows shortcut vulnerability, tracked as CVE-2025-9491 (CVSS 7.0), in attacks targeting European diplomats. The campaigns use spear-phishing…
SecurityWeek -
WhatsApp Implements Passkey System to Boost Backup Privacy
WhatsApp has announced a security upgrade that introduces passkey-encrypted backups, removing the need to manage complex passwords or long encryption keys. Users can now protect their backups using their device’s biometric or security features—fingerprint,…
gbhackers.com -
When AI Agents Go Rogue: Agent Session Smuggling Attack in A2A Systems
Unit 42’s threat analysis introduces a new attack vector dubbed agent session smuggling, targeting stateful cross‑agent communication in Agent2Agent systems. The technique exploits ongoing sessions to inject hidden instructions between a client request and…
unit42.paloaltonetworks.com -
Threat Actors Exploiting Open-Source C2 Frameworks to Deploy Malicious Payloads
Threat intelligence researchers have uncovered a growing campaign in which cybercriminals weaponise AdaptixC2, an open-source Command and Control framework initially designed for authorised penetration testers. The investigation links the framework’s…
gbhackers.com -
Cyber's Role in the Rapid Rise of Digital Authoritarianism
According to Dark Reading Confidential, the podcast marks the 10th anniversary of the Pegasus spyware case and examines how commercial surveillance tools have fuelled digital authoritarianism, with Ron Deibert of Citizen Lab and David Green of the EFF…
Dark Reading -
Suspected Chinese actors compromise U.S. Telecom firm Ribbon Communications
Ribbon Communications, a U.S.-based technology company providing telecommunications and networking, employs approximately 3,052 people as of 31 December 2024 and reported annual revenue of US$834 million in 2024. The company disclosed a cyberattack likely…
Security Affairs -
CISA and NSA Issue Urgent Guidance to Secure WSUS and Microsoft Exchange Servers
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and National Security Agency (NSA), with international partners from Australia and Canada, have issued guidance to harden on-premise Microsoft Exchange Server instances from potential…
The Hacker News -
Progress Releases Patch for MOVEit Transfer Resource Consumption Flaw
Progress Software has issued security patches for MOVEit Transfer to fix a high-severity vulnerability in the AS2 module that was discovered on 29 October 2025. The flaw, tracked as CVE-2025-10932 and rated 8.2 on the CVSS scale, enables an attacker to cause…
gbhackers.com -
Windows LNK UI Spoofing Vulnerability Weaponized for Remote Code Execution
A sophisticated cyber espionage campaign targeting European diplomatic institutions has been uncovered, signalling a strategic escalation by UNC6384. Central to the operation is the Windows shortcut (LNK) UI misrepresentation vulnerability—ZDI-CAN-25373,…
gbhackers.comUNC6384
