News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 13 so far |
Fri 31 Oct 2025· 64 articles
-
Researchers Develop Linux Rootkit That Evades Elastic EDR Protections
Security researchers have unveiled a sophisticated Linux rootkit, named Singularity, capable of bypassing Elastic Security’s advanced detection mechanisms, illustrating critical gaps in endpoint detection and response systems. The researchers report that…
gbhackers.com -
Eclipse Foundation Revokes Leaked Open VSX Tokens Following Wiz Discovery
Eclipse Foundation said it has revoked a small number of leaked Open VSX tokens found in Visual Studio Code extensions published in the marketplace, following a Wiz report earlier this month about exposed access tokens in public repositories. According to…
The Hacker News -
Japan Issues OT Security Guidance for Semiconductor Factories
Japan’s Ministry of Economy, Trade and Industry has published a new OT security guidance for semiconductor factories, a 130-page document available in Japanese and English. The guidance, issued on 31 October 2025, draws on Japan’s CPSF and the…
SecurityWeek -
CISA Alerts on Active Exploitation of VMware Tools and Aria Operations 0-Day
According to CISA, there is active exploitation of a critical privilege escalation vulnerability affecting Broadcom’s VMware Tools and VMware Aria Operations, tracked as CVE-2025-41244. The 0‑day flaw could let a malicious actor with local, standard user…
gbhackers.com -
Kimsuky and Lazarus Hackers Deploy New Backdoor Tools for Remote Access Attacks
North Korean state-sponsored threat actors have escalated their cyber operations with the deployment of new backdoor tools for remote access attacks, according to GBHackers News. The report identifies two distinct toolsets from DPRK-aligned groups: Kimsuky’s…
gbhackers.comLazarus Group -
CISA Flags VMware Zero-Day Exploited by China-Linked Hackers in Active Attacks
According to CISA, a high-severity vulnerability in Broadcom VMware Tools and VMware Aria Operations, CVE-2025-41244 (CVSS 7.8), has been added to the Known Exploited Vulnerabilities (KEV) catalogue after reports of active exploitation in the wild. The flaw…
The Hacker News -
Massive Great Firewall Leak Exposes 500GB of Censorship Data
In a historic breach of China’s censorship infrastructure, over 500 gigabytes of internal data were leaked from Chinese infrastructure firms associated with the Great Firewall (GFW) in September 2025. Researchers now estimate the full dump is closer to…
gbhackers.com -
New Agent-Aware Cloaking Technique Uses ChatGPT Atlas Browser to Feed Fake Content
Security researchers have uncovered an advanced attack vector dubbed “agent-aware cloaking,” which exploits how AI search tools and autonomous agents retrieve web content, feeding them fabricated material while showing genuine pages to human visitors. The…
gbhackers.com -
CISA Publishes New Guidance to Strengthen Microsoft Exchange Server Security
According to CISA, working alongside the National Security Agency and international cybersecurity partners, a new comprehensive security guidance has been released to harden Microsoft Exchange servers against evolving threats. The Microsoft Exchange Server…
gbhackers.com -
Malicious Multilingual ZIP Files Strike Banks and Government Offices
A sophisticated phishing campaign using multilingual ZIP files has emerged across East and Southeast Asia, targeting government institutions and financial organisations with unprecedented coordination, according to GBHackers. Security researchers identified…
gbhackers.com -
A New Security Layer for macOS Takes Aim at Admin Errors Before Hackers Do
ThreatLocker has released DAC for macOS, following its August 2025 Windows DAC rollout, to give organisations visibility over configuration gaps before they become incidents. The macOS beta uses the existing ThreatLocker agent to scan Macs up to four times…
The Hacker News -
Chinese APT BRONZE BUTLER Exploits LANSCOPE Zero-Day for SYSTEM Control
According to Sophos Counter Threat Unit (CTU) researchers, the Chinese state‑sponsored BRONZE BUTLER group (also known as Tick) has run a sophisticated campaign exploiting a zero‑day in Motex LANSCOPE Endpoint Manager, tracked as CVE‑2025‑61932, to breach…
SecurityOnlineTick -
CISA Warns of Active Exploitation in XWiki and VMware Vulnerabilities
According to The U.S. Cybersecurity and Infrastructure Security Agency (CISA), two new flaws have been added to the Known Exploited Vulnerabilities (KEV) Catalog: CVE-2025-24893 in XWiki Platform and CVE-2025-41244 in Broadcom VMware Aria Operations and…
SecurityOnline -
Netflix Experiments with Vertical Video and Podcasts, Redefining Mobile Entertainment
Netflix is exploring vertical video formats and podcasts as part of its push to broaden mobile entertainment, according to the article. During a public appearance, Netflix Chief Technology Officer Elizabeth Stone revealed that the company is actively…
SecurityOnline -
Brash Attack: Critical Chromium Flaw Allows DoS via Simple Code Injection
A newly disclosed flaw in Google’s ChromiumBlink rendering engine can enable a denial-of-service attack by forcing browsers to consume excessive memory. The PoC, named Brash, demonstrates that updates to document[.]title are not rate-limited, allowing…
SecurityOnline -
Samsung Internet Arrives on Windows, Pushing Forward Ambient AI Vision
Samsung has officially announced the launch of its Samsung Internet web browser for Windows 10 and Windows 11, extending its mobile browsing experience to desktop users. The Windows version supports cross‑platform synchronization for bookmarks, browsing…
SecurityOnline -
Court Mandate: Google Play Opens to External Payments in the US
Court Mandate: Google Play Opens to External Payments in the US notes that both Apple’s App Store and Google’s Play Store previously prohibited directing users to external payments, a rule underpinned by their commissions on in‑app purchases. In response to…
SecurityOnline -
CVE-2025-64095: Critical CVSS 10.0 Flaw in DNN Platform Allows Unauthenticated Website Overwrite
CVE-2025-64095 is described as a critical CVSS 10.0 flaw in the DNN Platform that allows an unauthenticated user to overwrite files on the server, potentially leading to full site compromise. According to the report, the vulnerability resides in the default…
SecurityOnline -
Magecart SMILODON Skimmer Infiltrates WooCommerce Via Rogue Plugin Hiding Payload in Fake PNG Image
The Wordfence Threat Intelligence Team has disclosed a sophisticated malware campaign targeting WordPress e-commerce sites using the WooCommerce plugin, where attackers deploy a rogue plugin that hides malicious payloads inside fake images and evades…
SecurityOnlineMageCart -
PhantomRaven: 126 Malicious npm Packages Steal Developer Tokens and Secrets Using Hidden Dependencies
SecurityOnline[.]info reports on PhantomRaven, a supply-chain campaign that injected 126 malicious npm packages, collectively downloaded more than 86,000 times, to steal developer tokens and secrets. The campaign, active since August 2025, concealed its…
SecurityOnline -
XLab Unveils RPX_Client, the First Confirmed Relay Node in PolarEdge IoT ORB Network
XLab has unveiled RPX_Client as the first confirmed relay node in the PolarEdge IoT ORB network, a move that XLab asserts marks a key advancement in the threat’s operational model. The researchers describe RPX_Client as a malware component that onboards…
SecurityOnline -
Nation-State Espionage: Airstalk Malware Hijacks VMware AirWatch (MDM) API for Covert C2 Channel
Palo Alto Networks’ Unit 42 Threat Intelligence team has uncovered Airstalk, a Windows-based malware family that hijacks VMware AirWatch (Workspace ONE) MDM APIs to create a covert C2 channel. According to Unit 42, the Airstalk toolkit is available in…
SecurityOnline -
Russian APTs Exploit LotL Techniques in Ukraine Cyber Attacks, Deploying Sandworm-Linked Webshell and Credential Dumping
The Symantec Threat Hunter Team uncovered two major cyber intrusions in Ukraine attributed to Russian-aligned threat actors, conducted between late June and August 2025 with aims of data theft and persistence across business and government networks. The…
SecurityOnline -
Progress Patches High-Severity Vulnerability in MOVEit Transfer AS2 Module (CVE-2025-10932)
Progress Software Corporation has issued a security advisory warning of a high-severity vulnerability in MOVEit Transfer’s AS2 module, tracked as CVE-2025-10932 and rated CVSS 8.2. The flaw, described as an Uncontrolled Resource Consumption issue, affects…
SecurityOnline
