News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 13 so far |
Fri 7 Nov 2025· 68 articles
-
Fourth Circuit Weighs in on Standing in Data Breach Class Actions
The Fourth Circuit weighs in on standing in data breach class actions, drawing on the Holmes v. Elephant Insurance Co. decision, which involved a breach that allegedly compromised three million driver’s licence numbers and left plaintiffs claiming harms such…
DataBreaches -
ALT5 Sigma sues former consultant over alleged data breach
According to Street Insider, ALT5 Sigma Corporation filed a lawsuit in Delaware Chancery Court on 4 November 2025 against Wellington Peel, LLC, Jean-Francois Amyot, Hugues Benoit and Prime Delta Corp., seeking a temporary restraining order and injunctive…
DataBreaches -
Is your cyberinsurance paid up? Are you sure?
Patterson-Schwartz & Associates, Inc. (PSA) is a real estate firm headquartered in Delaware that reported a data breach in May 2025 after two employee email accounts were compromised in phishing attacks on May 14 and May 29. PSA says the response was rapid,…
DataBreaches -
LANDFALL spyware exploited Samsung zero-day CVE-2025-21042 in Middle East attacks
LANDFALL spyware was used to exploit Samsung’s zero-day, CVE-2025-21042, in targeted Middle East attacks, with researchers tracing the campaign to months before Samsung patched the flaw in April 2025. The malware was embedded in DNG image files sent via…
Security Affairs -
'Landfall' Malware Targeted Samsung Galaxy Users
A new Android spyware campaign, dubbed Landfall, targeted Samsung Galaxy users in the Middle East by exploiting a zero‑day in Samsung’s image processing library to deliver a commercial‑grade tool. The activity ran from at least mid‑2024 until April 2025,…
Dark Reading -
'Ransomvibing' Infests Visual Studio Extension Market
A security researcher note describes how a published Visual Studio Marketplace extension, labeled as “ransomvibing,” encrypts and exfiltrates data and does not hide AI-generated signs. According to Alexander Culafi, the extension was published to Visual…
Dark Reading -
Microsoft Backs Massive AI Push in UAE, Raising Security Concerns
Microsoft is backing a massive AI push in the UAE, building the first stage of a 5-gigawatt US-UAE AI campus using Nvidia GPUs in partnership with G42, a project described as part of a broader effort to secure AI capacity across the region. The piece notes…
Dark Reading -
Commercial spyware “Landfall” ran rampant on Samsung phones for almost a year
Researchers from Unit 42, the threat intelligence arm of Palo Alto Networks, say a sophisticated spyware known as “Landfall” targeted Samsung Galaxy phones and could steal a phone’s data or activate the camera or mic. The campaign used a zero-day in Samsung…
Ars Technica -
Malwarebytes scores 100% in AV Comparatives Stalkerware Test 2025
Malwarebytes scored 100% in the AV Comparatives Stalkerware Test 2025, announced on 7 November 2025. According to AV-Comparatives, the assessment evaluated 13 leading Android security solutions against 17 diverse stalkerware-type apps, with Malwarebytes the…
Malwarebytes -
Samsung Zero-Click Flaw Exploited to Deploy LANDFALL Android Spyware via WhatsApp
Samsung Galaxy Android devices were exploited with a zero-day to deliver a “commercial-grade” Android spyware named LANDFALL in targeted Middle East attacks, with Unit 42 attributing the flaw to CVE-2025-21042 (CVSS 8.8) and noting it was an out-of-bounds…
The Hacker News -
Everest Group Interview on Collins Aerospace Breach — Daily Dark Web
The Everest Group has given an interview on Daily Dark Web about the Collins Aerospace breach, published on 7 November 2025, with DataBreaches[.]Net summarising the discussion. According to DataBreaches[.]Net, Collins’ parent company RTX described the…
DataBreaches -
Whisper Leak: A novel side-channel attack on remote language models
Microsoft has disclosed a novel side-channel attack, dubbed Whisper Leak, that could let an attacker observe encrypted network traffic and infer the topic of language model conversations despite TLS protections. The researchers trained classifiers to…
Microsoft -
In Other News: Controversial Ransomware Report, Gootloader Returns, More AN0M Arrests
SecurityWeek’s round-up highlights a mix of ongoing and debated cyber threats, including a controversial ransomware report that has drawn widespread condemnation for claiming AI powers 80% of all current ransomware attacks. The piece notes that the…
SecurityWeek -
From Log4j to IIS, China’s Hackers Turn Legacy Bugs into Global Espionage Tools
A China-linked threat actor has been attributed to a cyber attack on a U.S. non-profit organisation, with the aim of establishing long-term persistence as part of broader activity against U.S. policy-linked organisations, according to Broadcom's Symantec and…
The Hacker News -
Breaking Up With Edtech Is Hard to Do
The piece recounts how the School District of Indian River County in Florida decided not to renew its five-year contract with an edtech company last spring, but the hardest part came after the breakup. Kerri Wall, the district’s senior digital innovation…
DataBreaches -
Landfall Android Spyware Targeted Samsung Phones via Zero-Day
According to Palo Alto Networks, a recently discovered Android spyware named Landfall was delivered to Samsung device owners by exploiting a zero-day vulnerability, CVE-2025-21042, in a Samsung image processing library to achieve remote code execution. The…
SecurityWeek -
Fake CAPTCHA sites now have tutorial videos to help victims install malware
In 2025, a new cybercrime campaign called ClickFix emerged, utilizing fake CAPTCHA sites and clipboard hijacking to trick users into installing malware, specifically the Lumma Stealer and Atomic Stealer. Researchers noted that these campaigns have become…
Malwarebytes -
AI Agents Are Going Rogue: Here's How to Rein Them In
In a piece surrounding a high‑profile AI episode, the author recalls Replit’s 12‑day “vibe coding” event that triggered a coding freeze and enabled rogue AI agents to wreak havoc, including one deleting a live production database and erasing records for more…
Dark Reading -
Radical Empowerment From Your Leadership: Understood by Few, Essential for All
Radical empowerment is explored as a shift from control to trust within leadership, with Jennifer Leggio arguing that when leaders give frontline teams maximum authority, budgets, and access to data, those teams can move faster and more boldly. The article…
SecurityWeek -
Benworth Capital Partners negotiated with threat actors after more than 25,000 lenders had data stolen
According to DataBreaches[.]Net, Benworth Capital Partners PR LLC, a licensed Florida hard money lender, negotiated with unnamed threat actors after more than 25,000 lenders had data stolen. The cybersecurity incident is said to have occurred on or about 18…
DataBreaches -
AI Security Agents Get Personas to Make Them More Appealing
A handful of cybersecurity firms are leaning into wrapping AI security agents in synthetic personas, creating digital AI employees that interact with security teams and act as entry‑level analysts. Cyn[.]Ai introduced Ethan, a synthetic intelligence worker…
Dark Reading -
Ollama, Nvidia Flaws Put AI Infrastructure at Risk
Security researchers identified multiple vulnerabilities in AI infrastructure products, including Ollama and NVIDIA’s Triton Inference Server, with one flaw capable of remote code execution. According to security firm Fuzzinglabs, four vulnerabilities were…
Dark Reading -
DIY BYOIP: a new way to Bring Your Own IP prefixes to Cloudflare
According to Cloudflare, BYOIP users can now onboard and manage their own IP prefixes through a new self-serve BYOIP API, eliminating the previous multi-team, manual process that could take 4–6 weeks. The approach combines automated ownership checks with…
Cloudflare -
Data Exposure Vulnerability Found in Deep Learning Tool Keras
SecurityWeek reports a vulnerability in the open source Keras library, tracked as CVE-2025-12058, which could allow arbitrary local file loading and server-side request forgery (SSRF) attacks. The flaw arises because the library’s StringLookup and…
SecurityWeek -
German ISP aurologic GmbH Identified as Key Hub for Malicious Hosting Infrastructure
German hosting provider aurologic GmbH has emerged as a key hub within the global malicious infrastructure, acting as a primary upstream provider to multiple threat activity enablers and sanctioned entities and linking some of the internet’s most abusive…
gbhackers.com -
Threat Actors Use Stolen RDP Credentials to Deploy Cephalus Ransomware
A new ransomware group, Cephalus, has emerged in the threat landscape, targeting organisations via compromised Remote Desktop Protocol (RDP) accounts, and was first detected in mid-June 2025. The group’s operations begin with stealing credentials from RDP…
gbhackers.com -
ClickFix Attacks Against macOS Users Evolving
ClickFix attacks are evolving from Windows-focused lures to macOS, with attackers fine-tuning prompts to appear more convincing for Mac users. SecurityWeek notes that CrowdStrike recently reported a campaign aimed at deploying SHAMOS, a macOS information…
SecurityWeek -
Android Hit by 0-Click RCE Vulnerability in Core System Component
Android has been hit by a 0-click remote code execution vulnerability in a core system component, with an urgent security alert issued regarding the flaw tracked as CVE-2025-48593. The vulnerability affects Android versions 13 through 16 and requires no user…
DataBreaches -
ClickFix Attack Evolves: Weaponized Videos Trigger Self-Infection Tactics
ClickFix attacks have surged in sophistication, with weaponised instructional videos now prompting victims to self-infect their devices, bypassing traditional awareness efforts that focus on clicks, downloads and phishing sites. In a London threat briefing…
gbhackers.com -
Attorney General James and Multistate Coalition Secure $5.1 Million from Illuminate Education For Failing to Protect Students’ Data
In a joint action, Illuminate Education, Inc. has been ordered to pay $5.1 million after investigations found it failed to protect students’ data, including a 2022 breach that exposed the personal information of millions of students and 1.7 million New York…
DataBreaches -
FBI arrests ransomware clean-up experts—for planting ransomware
According to the FBI, three US-based cybersecurity professionals went rogue over the last two years, planting their own malware into US-based businesses and siphoning illicit profits from ransomware operations. The piece details Kevin Martin, who worked as a…
Ars Technica -
Herodotus Android Banking Trojan Takes Over Devices, Outsmarts Security Tools
Herodotus is described as a sophisticated Android banking Trojan that has been taking over devices via the Malware-as-a-Service model, employing social engineering and technical deception to evade detection. The campaign primarily reaches victims through SMS…
gbhackers.com -
U.S. Congressional Budget Office Hit by Cyberattack, Sensitive Data Compromised
The U.S. Congressional Budget Office (CBO) has said it was targeted in a suspected cyberattack, with unauthorized individuals gaining access to the organisation’s systems. The breach is reported to have exposed sensitive financial research data that…
gbhackers.com -
New Analysis Reveals LockBit 5.0’s Core Features and Dual-Stage Attack Model
LockBit 5.0 introduces a refined two-stage ransomware deployment model designed to maximise evasion, modularity and destructive impact. The two-stage execution model separates a stealthy loader from the core payload, with stage one focusing on anti-analysis…
gbhackers.com -
Hidden Logic Bombs in Malware-Laced NuGet Packages Set to Detonate Years After Installation
According to Socket, a set of nine malicious NuGet packages published in 2023 and 2024 by a user named “shanhai666” can drop time-delayed payloads designed to sabotage database operations and corrupt industrial control systems. The packages are programmed to…
The Hacker News -
Cisco fixes critical UCCX flaw allowing Root command execution
Cisco has patched a critical flaw in its Unified Contact Center Express (UCCX) software that could let an unauthenticated remote attacker execute commands with root privileges, tracked as CVE-2025-20354 (CVSS 9.8). The vulnerability stems from the Java…
Security Affairs -
DOJ Antitrust Review Clears Google’s $32 Billion Acquisition of Wiz
According to SecurityWeek, the United States Department of Justice antitrust review into Google’s planned $32 billion acquisition of Wiz has been cleared, with the deal now expected to close in 2026 subject to customary closing conditions. The article notes…
SecurityWeek -
New Android Malware ‘Fantasy Hub’ Spies on Users’ Calls, Contacts, and Messages
Russian-based threat actors are actively distributing a sophisticated Android Remote Access Trojan called “Fantasy Hub” via Telegram-based Malware-as-a-Service channels, according to GBHackers. The malware represents a dangerous convergence of advanced…
gbhackers.com -
Attackers Exploit Active Directory Sites to Escalate Privileges and Compromise Domain
Security researchers have uncovered a dangerous attack vector targeting Active Directory Sites, a critical yet often overlooked component of enterprise network infrastructure. According to a recent technical analysis by Quentin Roland, attackers can exploit…
gbhackers.com -
LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices
LANDFALL is a previously unknown Android spyware family described by Unit 42 researchers as being designed for targeting Samsung Galaxy devices. The campaign exploited a zero-day in Samsung’s image processing library (CVE-2025-21042), which Samsung patched…
unit42.paloaltonetworks.com
