News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 13 so far |
Mon 10 Nov 2025· 65 articles
-
OWASP Highlights Supply Chain Risks in New Top 10
OWASP has updated its Top 10 software vulnerabilities, emphasising supply chain risks and systemic design weaknesses rather than just coding errors. The Nov. 6 release marks OWASP’s first major Top 10 update since 2021 and places greater focus on supply…
Dark Reading -
GlassWorm Returns, Slices Back into VS Code Extensions
GlassWorm, a self-propagating malware targeting Visual Studio Code extensions on the Open VSX marketplace, has apparently continued its spread despite earlier containment claims. Researchers at Koi Security reported their discovery last month, noting the…
Dark Reading -
Hackers Exploiting Triofox Flaw to Install Remote Access Tools via Antivirus Feature
According to Mandiant Threat Defense, Google’s threat researchers discovered a now-patched flaw in Gladinet’s Triofox file-sharing and remote access platform, tracked as CVE-2025-12480, with a CVSS score of 9.1 that allows an attacker to bypass…
The Hacker News -
Konni Hackers Turn Google’s Find Hub into a Remote Data-Wiping Weapon
According to Genians Security Center (GSC), the North Korea-affiliated threat actor Konni (also known as Earth Imp, Opal Sleet, Osmium, TA406, and Vedalia) has launched a new set of attacks on Android and Windows devices for data theft and remote control.…
The Hacker NewsOpal Sleet -
GlassWorm malware has resurfaced on the Open VSX registry
GlassWorm malware has resurfaced on the Open VSX registry and has newly appeared in GitHub repositories, infecting three more VS Code extensions weeks after its removal from the official marketplace, according to Koi Security researchers. In mid-October,…
Security Affairs -
Short-term renewal of cyber information sharing law appears in bill to end shutdown
A deal to reopen the U.S. government would also renew an expired cybersecurity information sharing law until the end of January. The Senate on Sunday advanced legislation to end a weeks-long shutdown stalemate that includes a provision to reauthorize the…
DataBreaches -
Securing our future: November 2025 progress report on Microsoft’s Secure Future Initiative
Securing our future: November 2025 progress report on Microsoft’s Secure Future Initiative outlines steady progress across all engineering pillars, with Charlie Bell, Executive Vice President, Microsoft Security, highlighting how the initiative has improved…
Microsoft -
Many Forbes AI 50 Companies Leak Secrets on GitHub
Cloud security firm Wiz analysed GitHub repositories linked to Forbes AI 50 firms and found that 65% of the companies with a GitHub footprint had leaked secrets, including API keys, tokens and credentials tied to services such as Google API, Weights &…
SecurityWeek -
ClickFix Campaign Targets Hotels, Spurs Secondary Customer Attacks
Researchers have uncovered a broad ClickFix campaign that targets hotels with infostealing and RAT malware, and then uses stolen data to mount secondary attacks against customers, with the aim of banking fraud. According to Sekoia[.]io, the activity began…
Dark Reading -
Denmark and Norway investigate Yutong bus security flaw amid rising tech fears
Denmark and Norway are investigating a security flaw in Chinese-made Yutong buses, amid rising Western tech fears, according to NBC News. NBC News reports that Yutong electric buses can receive remote updates and diagnostics, which could allow interference…
Security Affairs -
Incident Response Team (ShieldForce) Partners with AccuKnox for Zero Trust CNAPP in Latin America
According to CyberNewswire, AccuKnox is partnering with Incident Response Team SA DE CV (ShieldForce) and DeepRoot Technologies to bring Zero Trust CNAPP capabilities to Latin America, focusing on Mexico and surrounding regions. The collaboration aims to…
gbhackers.com -
Runc Vulnerabilities Can Be Exploited to Escape Containers
Several vulnerabilities in the Runc container runtime, tracked as CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881, can be exploited to escape containers and gain root access to the host system. Runc is the low-level tool used for creating and running…
SecurityWeek -
Incident Response Team (ShieldForce) Partners with AccuKnox for Zero Trust CNAPP in Latin America
According to CyberNewsWire, AccuKnox, a leader in Zero Trust Cloud-Native Application Protection Platforms (CNAPP), announced a strategic partnership with ShieldForce and DeepRoot Technologies to accelerate Zero Trust adoption and AI security innovation…
SecurityOnline -
No Place Like Localhost: Unauthenticated Remote Access via Triofox Vulnerability CVE-2025-12480
Written by: Stallone D'Souza, Praveeth DSouza, Bill Glynn, Kevin O'Flynn, Yash Gupta Welcome to the Frontline Bulletin Series Straight from Mandiant Threat Defense, the "Frontline Bulletin" series brings you the latest on the threats we are seeing in the…
Google Cloud -
Yanluowang ransomware IAB pleads guilty
A Russian man has pleaded guilty to hacking US companies and selling access to ransomware groups, Aleksei Olegovich Volkov, who operated online under the hacker name chubaka[.]kor, and worked as an initial access broker for the Yanluowang ransomware.…
DataBreaches -
Android Users Hit by Malware Disguised as Relaxation Programs
A sophisticated Android attack targeting devices in South Korea has been revealed, using Google Find Hub to remoterly wipe data and track victims. Threat actors disguised as psychological counsellors and North Korean human rights activists distributed…
gbhackers.com -
Lawsuit Alleges Ex-Intel Employee Hid 18,000 Sensitive Documents Prior to Leaving the Company
A lawsuit filed in Washington federal court alleges that an ex-Intel software engineer downloaded and hid around 18,000 sensitive documents before leaving the company. The former employee, Jinfeng Luo, had worked as a software developer at Intel since 2014…
DataBreaches -
HIPAA, but for non-Covered Entities?
On 10 November 2025, DataBreaches[.]Net reported a new bill proposed by Bill Cassidy (R-LA), Chair of the Senate Health, Education, Labour and Pensions Committee, which would apply HIPAA’s privacy and security practices to entities that process non protected…
DataBreaches -
Fantasy Hub is spyware for rent—complete with fake app kits and support
Fantasy Hub is described as spyware for rent, sold as Malware-as-a-Service on Russian-language cybercrime forums, with a full subscription model and accompanying documentation and video tutorials that simplify its use for less experienced attackers.…
Malwarebytes -
Two New Web Application Risk Categories Added to OWASP Top 10
OWASP has released a revised 2025 Top 10 list for web application risks, adding two new categories and reshuffling the order. The updated ranking keeps Broken Access Control in the lead, with server-side request forgery now incorporated into that category.…
SecurityWeek -
NuGet Supply-Chain Exploit Uses Timed Destructive Payloads Against ICS
A sophisticated supply-chain attack has compromised critical industrial control systems through nine malicious NuGet packages designed to inject time-delayed destructive payloads into database operations and manufacturing environments. Socket’s Threat…
gbhackers.com -
MAD-CAT “Meow” Tool Sparks Real-World Data Corruption Attacks
MAD-CAT, a Meow Attack Data Corruption Automation Tool, is described as a custom-built adversarial simulation that shows how attackers can corrupt data across multiple database platforms at once. Researchers note that MAD-CAT can operate across six…
gbhackers.com -
⚡ Weekly Recap: Hyper-V Malware, Malicious AI Bots, RDP Exploits, WhatsApp Lockdown and More
In the weekly recap, The Hacker News highlights that Curly COMrades, a threat actor aligned with Russia’s geopolitical aims, was observed abusing Microsoft’s Hyper-V hypervisor to hide an Alpine Linux VM and deploy payloads, a technique first noted in July…
The Hacker News -
GlassWorm Malware Returns to Open VSX, Emerges on GitHub
The GlassWorm malware has reappeared in the Open VSX registry, two weeks after being removed from the Visual Studio Code extensions marketplace, according to Koi Security. After landing in Open VSX earlier, three more infected VS Code extensions were…
SecurityWeek -
Popular npm Library Used in AI and NLP Projects Exposes Systems to RCE
A critical remote code execution vulnerability has been found in the popular JavaScript library expr-eval, affecting thousands of AI and NLP projects that rely on it for mathematical expression evaluation and natural language processing. The flaw, tracked as…
gbhackers.com -
Agentic AI in Cybersecurity: Beyond Triage to Strategic Threat Hunting
With a global shortfall of around 4 million cybersecurity workers, agentic AI is edging SOCs beyond triage into proactive threat hunting, enabling security teams to operate at a maturity level once deemed impossible. The piece notes that triage bottlenecks…
Security Affairs -
New Browser Security Report Reveals Emerging Threats for Enterprises
According to the Browser Security Report 2025, security leaders are recognising that identity, SaaS and AI risks converge in the user’s browser, with traditional controls such as DLP, EDR and SSE operating one layer too low. The report highlights a parallel…
The Hacker News -
Nearly 30 Alleged Victims of Oracle EBS Hack Named on Cl0p Ransomware Site
Cybercriminals have named nearly 30 organizations allegedly impacted by the recent Oracle EBS hack, with the Cl0p leak site listing twenty-nine alleged victims to date. The campaign, which involved extortion emails to executives in late September, is…
SecurityWeek -
Watch out for Walmart gift card scams
According to Malwarebytes, Walmart gift card scams lure you with a bright, urgent message claiming you’ve qualified for a $750 or $1000 gift card, inviting you to answer a few questions. The so‑called survey is actually a lead‑generation and affiliate…
Malwarebytes -
Threat Actors Attacking Outlook and Google Bypassing Traditional Email Defenses
Threat actors are increasingly targeting Outlook and Google, with VIPRE’s Q3 2025 Email Threat Report noting that over 90% of phishing attacks specifically target these two ecosystems. The report also highlights that 32% of observed spam in Q3 came from free…
gbhackers.com -
QNAP Patches Vulnerabilities Exploited at Pwn2Own Ireland
QNAP has issued patches for two dozen vulnerabilities across its product range, including seven flaws demonstrated at Pwn2Own Ireland 2025, with remote code execution, information disclosure and DoS risks cited. CVE-2025-62840 and CVE-2025-62842 were…
SecurityWeek -
Australia Sanctions Hackers Supporting North Korea’s Weapons Program
Australia announced sanctions against four entities and an individual believed to be involved in cybercriminal activities supporting North Korea’s weapons programs, with the action taken alongside the United States to apply pressure on North Korea’s illicit…
SecurityWeek -
HackGPT Launches as AI-Driven Penetration Testing Suite Using GPT-4 and Other Models
HackGPT Enterprise has officially launched as a production-ready, cloud-native AI-powered penetration testing platform designed specifically for enterprise security teams, according to GBHackers on Security. Created by Yashab Alam, founder and CEO of…
gbhackers.com -
Ransomware Operators Exploit RMM Tools to Deploy Medusa and DragonForce
Cybersecurity researchers have exposed a supply-chain style campaign where trusted RMM infrastructure was abused to deploy Medusa and DragonForce ransomware across multiple UK organisations in early 2025. The investigation, according to Zensec, shows two…
gbhackers.comDragonForce -
Florida Government Data, Binance Checker, and Legal Organization Leak Surface on Dark Web
According to SOCRadar Dark Web Team, multiple new listings appeared on hacker forums this week, including alleged databases tied to government and legal organisations, unauthorized FTP access, and illicit cybercrime tools. The report highlights an alleged…
SOCRadar -
Nine NuGet packages disrupt DBs and industrial systems with time-delayed payloads
Nine NuGet packages published between 2023 and 2024 by “shanhai666” can deploy time-delayed payloads to disrupt databases and industrial control systems, according to Socket. The packages, including Sharp7Extend, target SQL Server, PostgreSQL and SQLite, and…
Security Affairs -
Large-Scale ClickFix Phishing Attacks Target Hotel Systems with PureRAT Malware
Cybersecurity researchers have flagged a large-scale phishing campaign aimed at the hospitality sector that lures hotel managers to ClickFix-style pages and harvest credentials by deploying PureRAT malware. The attackers reportedly use a compromised email…
The Hacker News -
GlassWorm Malware Discovered in Three VS Code Extensions with Thousands of Installs
GlassWorm has reappeared in three VS Code extensions, all still available for download, in what researchers describe as a continued campaign to weaponise the VS Code ecosystem. The extensions cited are ai-driven-dev with 3,402 downloads,…
The Hacker News -
Hackers Exploit Websites to Inject Malicious Links for SEO Manipulation
A GBHackers News report published on 10 November 2025 describes a rising trend of hackers exploiting websites to inject malicious links for SEO manipulation, with the activity mainly targeting online gambling sites. The attackers hijack high‑traffic pages on…
gbhackers.com -
A week in security (November 3 – November 9)
According to Malwarebytes Labs, A week in security (November 3 – November 9) covers a busy period of malware and security news in early November 2025. The piece highlights several items, including Malwarebytes scoring 100% in AV-Comparatives Stalkerware Test…
Malwarebytes
