News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 5 so far |
Thu 6 Nov 2025· 76 articles
-
State-Sponsored Hackers Stole SonicWall Cloud Backups in Recent Attack
SecurityWeek reports that SonicWall disclosed a September breach in which a state-sponsored threat actor stole firewall configuration files from its cloud backup service. Initially, the company said exfiltration affected less than 5% of customers, but in an…
SecurityWeek -
Curly COMrades2 articles this day · SecurityOnline first
Alleged Russia-linked Curly COMrades exploit Windows Hyper-V to evade EDRs · Curly COMrades APT Bypasses EDR by Hiding Linux Backdoor Inside Covert Hyper-V VM
2 outlets-
Alleged Russia-linked Curly COMrades exploit Windows Hyper-V to evade EDRs
Bitdefender researchers, aided by Georgia’s CERT, say Curly COMrades—a group linked to Russian interests— exploited Windows Hyper-V to hide Alpine Linux virtual machines and evade endpoint detection and response tools. The attackers created hidden VMs (120MB…
Security Affairs -
Curly COMrades APT Bypasses EDR by Hiding Linux Backdoor Inside Covert Hyper-V VM
According to Bitdefender, in collaboration with the Georgian CERT, researchers uncovered a new wave of cyber-espionage activity by a Russian-aligned threat group known as Curly COMrades that uses Microsoft Hyper-V to establish stealthy, persistent access…
SecurityOnline
-
-
Multiple Django Flaws Could Allow SQL Injection and Denial-of-Service Attacks
The Django development team released patches on 5 November 2025 for two significant vulnerabilities that could impact Django applications, including high-risk SQL injection in QuerySet operations and a moderate DoS flaw on Windows. According to Django’s…
gbhackers.com -
ValleyRAT Campaign Targets Windows via WeChat and DingTalk
A sophisticated Windows remote‑access trojan known as ValleyRAT has emerged as a high‑confidence indicator of targeted intrusions against Chinese‑language users and organisations. Its operation rests on a four‑component delivery chain—the downloader, loader,…
gbhackers.com -
Critical Dell CloudLink Flaws Allow User to Escape Shell and Gain Full System Control
According to SecurityOnline[.]info, the Daily CyberSecurity article titled Critical Dell CloudLink Flaws Allow User to Escape Shell and Gain Full System Control was published on 6 November 2025. The piece notes that access to the vulnerability report…
SecurityOnline -
EndClient RAT Leverages Compromised Code-Signing to Slip Past Antivirus
A sophisticated Remote Access Trojan called EndClient RAT is targeting North Korean human rights defenders and uses a stolen code-signing certificate to bypass antivirus detection, according to PSCORE. The disclosure is the result of a collaborative…
gbhackers.com -
Authorities Dismantle Large-Scale Credit Card Fraud Scheme Affecting 4.3 Million Users
Authorities across nine countries executed a coordinated crackdown on one of the largest credit card fraud networks ever dismantled. Operation Chargeback, led by German prosecutors and the Bundeskriminalamt, brought down criminal organisations responsible…
gbhackers.com -
Hackers Weaponize Windows Hyper-V to Hide Linux VM and Evade EDR Detection
According to Bitdefender, the threat actor known as Curly COMrades has been observed exploiting virtualization technologies to bypass security solutions and run custom malware. The group enabled the Hyper-V role on selected victim systems to deploy a minimal…
The Hacker News -
Google Warns of PROMPTFLUX Malware That Uses Gemini API for Self-Rewriting Attacks
Google has warned of PROMPTFLUX, an experimental VBScript dropper that uses Google Gemini API for self-rewriting attacks, marking a notable shift in how AI is used in malware. According to Google Threat Intelligence Group (GTIG), PROMPTFLUX is the first…
gbhackers.com -
Hyundai AutoEver Confirms Data Breach Exposing Personal Data, Including SSNs and License Info
Hyundai AutoEver America, LLC has formally confirmed a data breach that exposed customers’ personal data, including Social Security numbers and driver’s license information. The incident began on 22 February 2025 and attackers maintained access for about…
gbhackers.com -
Google Issues Emergency Chrome Update to Fix Critical RCE Flaw
Google has issued an emergency security update for Chrome across all platforms, rolling out version 142.0.7444.134 and 142.0.7444.135 to address five critical and medium-severity vulnerabilities. The update targets urgent security concerns in the browser’s…
gbhackers.com -
Gootloader Returns with a New ZIP File Tactic to Conceal Malicious Payloads
Cybersecurity researchers have uncovered a revived Gootloader campaign that uses a novel ZIP file manipulation tactic to conceal malicious payloads. The archive behaves differently depending on the extraction tool: Windows Explorer extracts a malicious…
gbhackers.com -
HackedGPT: New Vulnerabilities in GPT Models Allow Attackers to Launch 0-Click Attacks
Cybersecurity researchers have uncovered seven critical vulnerabilities in OpenAI’s GPT models, including a zero-click attack that can be triggered by asking an innocuous question and a safety-mechanism bypass that uses Bing tracking links. The flaws affect…
gbhackers.com -
SonicWall Confirms State-Sponsored Hackers Behind September Cloud Backup Breach
SonicWall has formally implicated state-sponsored threat actors behind the September security breach that exposed firewall configuration backup files. According to SonicWall, the malicious activity was isolated to the unauthorized access of cloud backup…
The Hacker News -
Beyond the App Store: iOS 26.2 Beta Teases Sideloading Support for Japan
Apple’s iOS 26.2 beta for developers reportedly includes indications that users in Japan may soon be able to install third‑party app stores and download apps through them. According to @Tzzlala, after installing the beta in Japan, users can experiment with…
SecurityOnline -
The $1 Billion Secret: Apple to Use Google Gemini AI to Power Next-Gen Siri
According to Bloomberg, Apple is preparing to launch a far more advanced version of Siri in 2026, with a customised Google Gemini model driving its core functionality and licensing fees of around $1 billion a year. The report says Siri will still use some of…
SecurityOnline -
Regulatory Friction: Apple to Disable Automatic Wi-Fi Sync on Apple Watch in the EU
Regulatory Friction: Apple will disable the automatic Wi‑Fi sync on Apple Watch devices used in the European Union, with the change slated to accompany iOS 26.2, expected to be officially released in December 2025. Beginning then, Apple Watch devices sold in…
SecurityOnline -
One-Click Setup: Microsoft Store Adds Multi-App Batch Installation for New PCs
Published on 6 November 2025, the article reports that Microsoft has introduced a multi-app batch installation option in its Microsoft Store to ease setting up new PCs. Previously, both the Microsoft Store client and web versions allowed users to download…
SecurityOnline -
Your New Co-Pilot: Google Maps Replaces Assistant with Gemini AI for Conversational Driving
According to Google, the latest update to Google Maps replaces Google Assistant with Gemini AI for a more conversational driving experience. The Gemini integration lets users issue complex, colloquial commands and hold follow-up questions during navigation,…
SecurityOnline -
Antitrust Truce: Google & Epic Games Reach Settlement to Open Up Google Play Store
Google and Epic Games have jointly announced a settlement in their long-running antitrust battle over the Google Play Store, submitting a revised proposal to the U.S. District Court in San Francisco for approval by Judge James Donato. If approved, the deal…
SecurityOnline -
AI Browser War: Amazon Demands Perplexity’s Comet AI Stop Automated Purchasing
According to Bloomberg, Amazon has issued a formal notice to AI startup Perplexity demanding that its Comet browser stop automated purchasing on Amazon’s e-commerce platform through AI-driven agents. The move sparked a backlash from Perplexity, which called…
SecurityOnline -
Locked Out: Windows Update Bug Forces Users Into BitLocker Recovery Mode After Reboot
Locked Out: Windows Update Bug Forces Users Into BitLocker Recovery Mode After Reboot reports that a recurring issue is resurfacing after the latest Windows 10/11 updates, which causes some systems to boot directly into BitLocker Recovery Mode. According to…
SecurityOnline -
The Restartless Update: Microsoft Tests Unusual Windows 11 Build That Installs Without a Reboot
Microsoft has released a new test build for the Windows Insider Preview Program—Windows 11 Dev Build 26220.7052 and Windows 11 Beta Build 26220.7052—described as unusual because they can be installed and fully upgraded without requiring a system restart,…
SecurityOnline -
The Vanishing Act: Apple Forces GitHub to Delete 8,270 Repositories of Leaked App Store Code
Apple forced GitHub to delete 8,270 repositories containing leaked App Store front-end source code after a DMCA takedown notice was issued. The company had demanded the removal of more than 100 repositories, and following an extensive scan, GitHub deleted…
SecurityOnline -
Critical Cisco CCX RCE Flaws (CVSS 9.8) Allow Unauthenticated Root Access via Java RMI and CCX Editor
Cisco has released urgent security updates to address two critical vulnerabilities in its Unified Contact Center Express (Unified CCX) that could allow unauthenticated remote attackers to execute arbitrary code or gain administrative control over affected…
SecurityOnline -
Next-Gen Threat: Google Exposes AI-Enabled Malware That Rewrites Its Own Code with Gemini LLM
According to Google Threat Intelligence Group (GTIG), threat actors are embedding large language models into active cyber operations, moving beyond AI for productivity. The GTIG report details a new class of “just-in-time” AI-powered malware capable of…
SecurityOnlineAPT28 -
Django Team Patches High-Severity SQL Injection Flaw (CVE-2025-64459) and DoS Bug (CVE-2025-64458) in Latest Security Update
Django has released security updates addressing two vulnerabilities, CVE-2025-64459, a high-severity SQL injection flaw, and CVE-2025-64458, a moderate Denial-of-Service issue, with patches available in Django 5.2.8, 5.1.14, and 4.2.26, as well as for the…
SecurityOnline -
Cloudflare Scrubs Aisuru Botnet from Top Domains List
Cloudflare has begun redacting Aisuru botnet domain names from its Top Domains list after the domains briefly surged to the top alongside major brands, with Cloudflare saying the top lists include domains with organic activity as well as those with emerging…
Krebs on Security -
APT 'Bronze Butler' Exploits Zero-Day to Root Japan Orgs
APT group Bronze Butler exploited a zero-day vulnerability in Lanscope, a popular endpoint management tool in Japan, to root Japanese organisations. The issue, designated CVE-2025-61932, was disclosed by Lanscope developer Motex on 20 October and was rated…
Dark ReadingTick -
New Iranian-Linked APT UNK_SmudgedSerpent Uses RMM Tools and M365 Spoofing for Espionage
Proofpoint Threat Research has identified a previously unknown Iranian-linked espionage group, UNK_SmudgedSerpent, conducting targeted phishing against academics and foreign policy experts since mid-2025. According to Proofpoint, the campaigns use social…
SecurityOnline -
Chrome Emergency Fix: Three High-Severity Flaws in WebGPU and V8 Engine Risk RCE
According to Google, a Stable Channel Update for Chrome Desktop (version 142.0.7444.134/.135) was released to address five vulnerabilities, including three high-severity flaws that could lead to memory corruption, sandbox escapes, or arbitrary code…
SecurityOnline -
CISA Warns: Critical VizAir Flaws (CVSS 10.0) Expose Airport Weather Systems to Unauthenticated Manipulation
CISA has issued a critical advisory detailing three vulnerabilities in the Radiometrics VizAir aviation weather monitoring system, warning that exploitation could allow attackers to manipulate meteorological data and runway configurations, potentially…
SecurityOnline -
High-Severity NVIDIA App Flaw (CVE-2025-23358) Allows Local Privilege Escalation on Windows
NVIDIA has released a high-severity security update for the NVIDIA App on Windows to address a local privilege escalation vulnerability, CVE-2025-23358. According to NVIDIA’s official bulletin, the issue is in the installer, where a local attacker can cause…
SecurityOnline -
APT-C-60 Targets Japan: New SpyGlace Malware Uses VHDX LNK and GitHub Tasking for Persistent Espionage
According to JPCERT/CC, the Incident Response Group published a detailed report on a renewed wave of APT-C-60 cyber-espionage targeting Japanese organisations between June and August 2025, introducing new downloader variants and an evolved SpyGlace malware.…
SecurityOnlineAPT-C-60 -
CISA Warns: Critical Survision LPR Camera Flaw (CVE-2025-12108, CVSS 9.8) Allows Unauthenticated Takeover
CISA warns of a critical vulnerability in all Survision License Plate Recognition cameras (CVE-2025-12108, CVSS 9.8) that could allow unauthenticated takeover of affected systems. According to CISA’s advisory, successful exploitation could let an attacker…
SecurityOnline
