News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 5 so far |
Tue 11 Nov 2025· 73 articles
-
Critical Zimbra Flaw Fixed: Patch Addresses Multiple Stored XSS and Unauthenticated LFI in Mail Client
Daily CyberSecurity reports that a critical Zimbra flaw has been fixed, with the patch addressing multiple stored XSS and an unauthenticated LFI in the Zimbra mail client. The piece is dated 11 November 2025. The report notes that the vulnerability involved…
SecurityOnline -
Devolutions Server Flaw Allows Attackers to Impersonate Users via Pre-MFA Cookie
Devolutions Server has a critical flaw that lets low-privileged authenticated users impersonate other accounts by replaying pre-MFA cookies, identified as CVE-2025-12485 with a CVSS of 9.4 and affecting all versions up to 2025.3.5. The flaw arises from…
gbhackers.com -
New VanHelsing Ransomware-as-a-Service Hits Windows, Linux, BSD, ARM and ESXi
A sophisticated new ransomware operation dubbed VanHelsing has emerged as a rapidly expanding threat in the cybercriminal landscape, first observed on 7 March 2025. The operation functions as a Ransomware-as-a-Service platform, licensing its capabilities to…
gbhackers.com -
WatchGuard Firebox Flaw Allows Attackers to Gain Unauthorized SSH Access
A security vulnerability has been discovered in WatchGuard Firebox devices that could allow attackers to bypass authentication and gain unauthorized SSH access to affected systems. Tracked as CVE-2025-59396, the flaw affects the SSH access control mechanisms…
gbhackers.com -
U.S. CISA adds Samsung mobile devices flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Samsung mobile devices flaw, tracked as CVE-2025-21042 (CVSS 8.8), to its Known Exploited Vulnerabilities catalog. The flaw was exploited as a zero-day to deploy LANDFALL spyware in…
Security Affairs -
SAP November 2025 Patch Day Fixes 3 Critical Flaws (CVSS 10) — Including Code Injection and Insecure Key Management
SAP released its November 2025 Patch Day, delivering 18 new security notes and two updates to previously released ones, with three flaws rated CVSS 10.0 that affect SQL Anywhere Monitor (Non-GUI), SAP NetWeaver AS Java, and SAP Solution Manager. The first…
SecurityOnline -
Critical Synology BeeStation Zero-Day (CVE-2025-12686) Found at Pwn2Own Allows Remote Code Execution
Synology has released an urgent security update for BeeStation OS to patch a zero-day vulnerability, CVE-2025-12686, that was demonstrated during the Pwn2Own Ireland 2025 hacking competition. The flaw is rated CVSS 9.8 (Critical) and enables remote attackers…
SecurityOnline -
Researchers Expose Deep Connections Between Maverick and Coyote Banking Malware
Security researchers at CyberProof have uncovered strong connections between two Brazilian-targeting banking trojans, Maverick and Coyote, which are active through WhatsApp. The findings followed a suspicious file download incident from WhatsApp that…
gbhackers.com -
Critical Triofox bug exploited to run malicious payloads via AV configuration
According to Google Threat Intelligence Group (GTIG), hackers exploited Triofox flaw CVE-2025-12480 to bypass authentication and install remote access tools via the platform’s antivirus feature, with Mandiant tracking the threat cluster UNC6485 as behind the…
Security Affairs -
65% of Top AI Firms Found Exposing Verified API Keys and Tokens on GitHub
According to Forbes AI 50 list, researchers examined 50 prominent AI companies and found that 65% had leaked verified secrets on GitHub, exposing critical API keys, authentication tokens and other sensitive credentials. The leaks were not confined to…
gbhackers.com -
Beware of Security Alert-Themed Malicious Emails that Steal Your Email Logins
A GBHackers On Security report warns of a sophisticated phishing campaign that uses security alert-themed emails to steal email logins. The messages are designed to resemble legitimate security notifications from email delivery systems and claim that…
gbhackers.com -
CISA Issues Alert on Samsung 0-Day RCE Flaw Actively Exploited in Attacks
CISA has added a critical remote code execution vulnerability affecting Samsung mobile devices to its Known Exploited Vulnerabilities (KEV) catalog, signalling active exploitation in the wild. Tracked as CVE-2025-21042, the zero-day flaw resides in Samsung’s…
gbhackers.com -
Danabot Malware Reemerges with Version 669 After Operation Endgame
Danabot banking malware has reappeared in a new guise with version 669, marking a return after a nearly six‑month hiatus since the Operation Endgame takedown in May 2025. The article notes that threat actors regrouped and rebuilt their command-and-control…
gbhackers.com -
Lazarus Group2 articles this day · SecurityOnline first
Lazarus Group Deploys Weaponized Documents Against Aerospace & Defense · Lazarus Group Attacks Aerospace/Defense with New ChaCha20-Encrypted Comebacker Backdoor
2 outlets-
Lazarus Group Deploys Weaponized Documents Against Aerospace & Defense
Security researchers at ENKI have uncovered a sophisticated espionage campaign in which the Lazarus Group weaponises a new Comebacker backdoor variant to target aerospace and defence organisations, distributing malicious Word documents that prompt macro…
gbhackers.com -
Lazarus Group Attacks Aerospace/Defense with New ChaCha20-Encrypted Comebacker Backdoor
Cybersecurity researchers at ENKI have identified a new variant of the Comebacker backdoor attributed to the Lazarus Group in a targeted espionage campaign against the aerospace and defence sectors. The campaign uses malicious Word documents with VBA macros…
SecurityOnline
-
-
Hackers Exploit Triofox 0-Day to Deploy Malicious Payloads Using Anti-Virus Feature
Cybersecurity researchers from Mandiant Threat Defense have uncovered a critical zero-day in Gladinet’s Triofox file-sharing platform, tracked as CVE-2025-12480, which allowed attackers to bypass authentication and run code with system-level privileges. The…
gbhackers.com -
Threat Report: xHunt Targets Microsoft Exchange and IIS with Custom Backdoors
Threat researchers describe xHunt as an advanced persistent threat group that targets Microsoft Exchange and IIS web servers with custom backdoors, in campaigns that have persisted for years and focused on Kuwait, particularly in the shipping,…
gbhackers.com -
OWASP Top 10 2025 Released: Major Revisions and Two New Security Classes Added
The OWASP Top 10 2025 edition introduces two new security classes and shifts in risk rankings, including Software Supply Chain Failures at position A03 and Mishandling of Exceptional Conditions at position A10. Broken Access Control remains the top threat,…
gbhackers.com -
You Thought It Was Over? Authentication Coercion Keeps Evolving
Authentication coercion is described as forcing a computer to authenticate to an attacker‑controlled system, enabling attackers to steal credentials without tricking users into revealing passwords. The piece highlights a real‑world March 2025 incident in a…
unit42.paloaltonetworks.com -
Windows 11 Version 26H1 is Official—But Only for New ARM Chips like Snapdragon X2
Windows 11 version 26H1 has been officially confirmed, but it will be available exclusively for devices powered by specific ARM chipsets, namely Qualcomm Snapdragon X2 and NVIDIA N1X. The new build, numbered 28000, is being distributed through the Windows…
SecurityOnline -
Meet Kit: Mozilla Unveils New ‘Friendly Fox’ Mascot for the Firefox Brand
According to The Mozilla Foundation, the organisation has unveiled a new mascot for the Firefox brand called Kit, described as a friendly little fox that embodies a private, open digital companion. The move is part of Firefox’s broader brand identity…
SecurityOnline -
Windows 11 Adds Hidden Setting for Haptic Feedback and UI Vibrations
Microsoft is testing a hidden, experimental haptic feedback setting in Windows 11 Build 26220.7070, discovered by users in the preview release. The feature would allow certain users to enable tactile responses for specific UI elements and to adjust the…
SecurityOnline -
EU Spectrum War: Will the Upper 6GHz Band Go to Wi-Fi 7 or 6G Networks?
The EU is debating who should use the upper 6GHz wireless spectrum, with mobile operators arguing for designation for 5G and 6G, while Wi‑Fi advocates push for unlicensed use to boost home and commercial internet experiences. The band under consideration…
SecurityOnline -
Critical Triofox Zero-Day (CVE-2025-12480) Under Active Exploit: Host Header Bypass Allows Unauthenticated Admin Takeover
According to Mandiant Threat Defense, part of Google Cloud Security Operations, a critical unauthenticated access flaw in Gladinet’s Triofox file-sharing platform has been actively exploited in the wild by a threat actor tracked as UNC6485, now patched as…
SecurityOnlineUNC6485 -
SuiteCRM SQL Injection Flaws (CVE-2025-64492, CVE-2025-64493) Expose Customer Data
The maintainers of SuiteCRM have issued an urgent security update addressing two SQL injection flaws, CVE-2025-64492 and CVE-2025-64493, that could allow authenticated users to extract sensitive data from backend databases. The flaws affect SuiteCRM versions…
SecurityOnline -
Australia Joins US, Slaps Sanctions on North Korean Cybercriminals for Funding WMD Programs
Australia announced financial sanctions and travel bans on four entities and one individual involved in cybercrime operations that fund North Korea’s weapons of mass destruction and ballistic missile programmes. In a move coordinated with the United States,…
SecurityOnline -
Telegram-Powered Phishing Campaign Targets European Businesses Using HTML Attachments to Steal Credentials
Researchers from Cyble Research and Intelligence Labs (CRIL) have uncovered a massive, multi-brand phishing campaign that uses HTML email attachments to steal credentials, exfiltrating data directly to attacker-controlled Telegram bots. According to CRIL,…
SecurityOnline -
Critical Devolutions Server Flaw (CVE-2025-12485, CVSS 9.4) Allows User Impersonation via Pre-MFA Cookie Hijacking
The article reports that Devolutions Server has two vulnerabilities tracked as CVE-2025-12485 (CVSS 9.4) and CVE-2025-12808, both affecting multiple versions of the self-hosted product. According to Devolutions, CVE-2025-12485 stems from improper privilege…
SecurityOnline -
Critical WatchGuard Firebox Flaw (CVE-2025-59396, CVSS 9.8) Allows Unauthenticated Admin SSH Takeover via Default Credentials
A critical misconfiguration in WatchGuard Firebox devices has been disclosed as CVE-2025-59396 (CVSS 9.8), enabling unauthenticated administrators to take over via SSH using default credentials. The flaw affects Firebox appliances with default settings that…
SecurityOnline -
Critical GE Vernova ICS Flaw (CVE-2025-3222, CVSS 9.3) Allows Authentication Bypass in Smallworld Master File Server
GE Vernova’s Electrification Software division has released a critical advisory for Smallworld Master File Server (SWMFS), detailing a high-severity authentication vulnerability (CVE-2025-3222) with a CVSS v4.0 score of 9.3 that could enable an…
SecurityOnline -
North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices
North Korea’s KONNI APT has been observed using Google Find Hub to remotely wipe and track South Korean Android devices, in a campaign attributed to actors linked to North Korea’s Kimsuky and APT37 groups, according to Genians Security Center (GSC). The…
SecurityOnlineOpal Sleet -
Critical Calibre Flaw (CVE-2025-64486, CVSS 9.3) Allows RCE via Malicious FB2 E-book
Calibre, the cross‑platform e‑book manager, is vulnerable to arbitrary code execution when a specially crafted FictionBook FB2 file is viewed or converted, tracked as CVE-2025-64486 with a CVSS of 9.3 and affecting releases up to 8.13.0, fixed in 8.14.0. The…
SecurityOnline -
DragonForce Ransomware Evolves with BYOVD to Kill EDR and Fixes Encryption Flaws in Conti V3 Codebase
The Acronis Threat Research Unit (TRU) has identified a new DragonForce ransomware variant that shows a dramatic evolution in both technical sophistication and organisational structure, with BYOVD techniques used to disable security software and terminate…
SecurityOnlineDragonForce
