News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Mon 17 Nov 2025· 45 articles
-
Google Patches Actively Exploited Chrome Zero-Day Flaw (CVE-2025-13223) in Emergency Update
Google has issued an urgent, out-of-band update for the Chrome Stable channel to address two V8 engine vulnerabilities, with the most serious being CVE-2025-13223, a zero-day flaw that is already being actively exploited in the wild. According to Google’s…
SecurityOnline -
5 plead guilty to laptop farm and ID theft scheme to land North Koreans US IT jobs
Five men pleaded guilty to running laptop farms and assisting North Koreans to obtain remote IT work at US companies, with prosecutors saying the offences violated US law and involved the APT38 Lazarus group. According to US Justice Department, the schemes…
Ars Technica -
Critical Fortinet FortiWeb WAF Bug Exploited in the Wild
A critical Fortinet FortiWeb vulnerability capable of remote code execution has been exploited in the wild, affecting FortiWeb versions ranging from 8.0.0 to 8.0.1, 7.6.0 to 7.6.4, 7.4.0 to 7.4.9, 7.2.0 to 7.2.11, and 7.0.0 to 7.0.11. Fortinet disclosed…
Dark Reading -
US Citizens Plead Guilty to Aiding North Korean IT Worker Campaigns
US citizens have pled guilty to aiding North Korean IT worker campaigns, with the US Department of Justice confirming five individuals admitted to facilitating schemes by providing false identities and remote access to employer laptops. The DoJ also…
Dark Reading -
Microsoft mitigated the largest cloud DDoS ever recorded, 15.7 Tbps
Microsoft says the Aisuru botnet launched a 15.7 Tbps DDoS on Azure from 500k IPs, using massive UDP floods peaking at 3.6 B pps. On October 24, 2025, Azure DDoS Protection detected and mitigated a massive multi-vector attack that peaked at 15.72 Tbps and…
Security Affairs -
The price of ChatGPT’s erotic chat? $20/month and your identity
Malwarebytes reports that ChatGPT will soon offer erotica—but only for verified adults, a move that could require uploading government identification to a company already tracking your searches and conversations. The piece notes that the price of access is…
Malwarebytes -
Collaborative research by Microsoft and NVIDIA on real-time immunity
Microsoft and NVIDIA report a collaborative push to real-time immunity for AI-driven threat detection, arguing that adversarial learning can outpace evolving cyber threats when paired with ultra-low latency inference.
techcommunity.microsoft.com -
New EVALUSION ClickFix Campaign Delivers Amatera Stealer and NetSupport RAT
According to eSentire, cybersecurity researchers have spotted a new EVALUSION campaign using the ClickFix social-engineering lure to deliver Amatera Stealer and NetSupport RAT. The activity was observed this month and tracked by eSentire under the moniker…
The Hacker News -
Your coworker is tired of AI “workslop” (Lock and Code S06E23)
This week’s Lock and Code episode delves into AI “workslop” and the costs of handing routine tasks to machines. The show notes that in September a study by Stanford University and BetterUp Labs published findings on how AI-produced work affects recipients,…
Malwarebytes -
Cursor Issue Paves Way for Credential-Stealing Attacks
Researchers from cybersecurity vendor Knostic have detailed an attack that uses MCP servers to hijack Cursor’s internal browser, enabling credential-stealing attacks by injecting arbitrary code and delivering a malicious page to harvest logins. The flaw…
Dark Reading -
Jaguar Land Rover confirms major disruption and £196M cost from September cyberattack
Jaguar Land Rover says the September 2025 cyberattack halted production, disrupted retail operations and, in mid-September, led to a data breach without disclosing details. The disruptions meant production at the Solihull plant and broader UK dealer networks…
Security Affairs -
Iranian Hackers Target Defense and Government Officials in Ongoing Campaign
The Iranian state‑sponsored hacking group APT42, also known as SpearSpecter, is reportedly conducting an ongoing, sophisticated espionage campaign targeting senior defence and government officials, according to INDA, the Israel National Digital Agency. The…
SecurityWeek -
9,000 Open-Source Projects Now Secured by Harden-Runner
StepSecurity’s Harden-Runner now protects over 9,000 open-source repositories, delivering real-time CI/CD runtime security and defending pipelines against modern supply chain attacks. The platform monitors more than 12 million jobs per week across workflows…
StepSecurity -
Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem
Written by: Mohamed El-Banna, Daniel Lee, Mike Stokkel, Josh Goddard Overview Last year, Mandiant published a blog post highlighting suspected Iran-nexus espionage activity targeting the aerospace, aviation, and defense industries in the Middle East. In this…
Google Cloud -
Scammers are sending bogus copyright warnings to steal your X login
Scammers are sending bogus copyright warnings to steal your X login, claiming to be from X and warning that DMCA notices have been received. The article notes that the messages often push you to act within 24 hours and resemble an X login page, but the…
Malwarebytes -
Frentree Partners with AccuKnox to Expand Zero Trust CNAPP Security in South Korea
Frentree has partnered with AccuKnox to expand Zero Trust CNAPP security across South Korea, a move described as bringing together Frentree’s regional strength with AccuKnox’s Zero Trust capabilities. The announcement, issued from Menlo Park, California, on…
SecurityOnline -
IndonesianFoods Spam Campaign: What Security Teams Need To Know
A large-scale spam campaign in the npm ecosystem, known as IndonesianFoods, used full automation to push thousands of packages into the registry at very short intervals, and by mid November 2025 it had become fully visible to the security community.…
SOCRadar -
DoorDash Says Personal Information Stolen in Data Breach
DoorDash says a recent data breach was caused by a social engineering attack against one employee, discovered on 25 October 2025. The attackers accessed personal information such as names, addresses, email addresses, and phone numbers across customers,…
SecurityWeek -
5 Plead Guilty in US to Helping North Korean IT Workers
Five individuals have pleaded guilty in US courts to helping North Korean IT workers obtain employment at more than 130 companies. Audricus Phagnasay, Jason Salazar, Alexander Paul Travis, Erick Ntekereze Prince, and Oleksandr Didenko were involved in a…
SecurityWeek -
DDoSia Targets Denmark: A Clear Look at the Threat
Between 4 November and 13 November 2025, Denmark was included in a focused campaign by the pro-Russian hacktivist groups targeting the DDoSia project, which published target lists that contained 136 Danish targets across government services and critical…
SOCRadar -
⚡ Weekly Recap: Fortinet Exploited, China's AI Hacks, PhaaS Empire Falls & More
The weekly recap highlights a Fortinet FortiWeb flaw, CVE-2025-64446, which has been exploited in the wild since early October 2025 to create malicious administrative accounts; Fortinet had issued a patch and the flaw carries a CVSS score of 9.1. The article…
The Hacker News -
5 Reasons Why Attackers Are Phishing Over LinkedIn
LinkedIn has become a hotbed for phishing as attackers run sophisticated spear-phishing campaigns against company executives, with targets seen in financial services and technology verticals. According to Push Security, 1 in 3 phishing attacks now occur over…
The Hacker News -
Dragon Breath Uses RONINGLOADER to Disable Security Tools and Deploy Gh0st RAT
The threat actor known as Dragon Breath has been observed using a multi-stage loader codenamed RONINGLOADER to deliver a modified Gh0st RAT payload, targeting Chinese-speaking users. Elastic Security Labs says the campaign relies on trojanised NSIS…
The Hacker News -
Logitech Confirms Data Breach Following Designation as Oracle Hack Victim
Logitech disclosed a data breach on 17 November 2025, shortly after being named as a victim of the Oracle EBS hack campaign by Cl0p. The company said an ongoing investigation found data exfiltration from its internal IT system, with a zero-day vulnerability…
SecurityWeek -
Widespread Exploitation of XWiki Vulnerability Observed
SecurityWeek reports that exploitation of the critical XWiki vulnerability, tracked as CVE-2025-24893 (CVSS 9.8), expanded from reconnaissance to botnets, cryptocurrency miners, scanners, and custom tools within two weeks of the bug being publicly exploited…
SecurityWeek -
Contagious Interview2 articles this day · SecurityOnline first
North Korean threat actors use JSON sites to deliver malware via trojanized code · North Korea’s Contagious Interview APT Uses JSON Keeper and GitLab to Deliver BeaverTail Spyware
2 outlets-
North Korean threat actors use JSON sites to deliver malware via trojanized code
North Korea-linked actors behind the Contagious Interview campaign have updated their tactics to host and deliver malware from trojanised code projects using legitimate JSON storage services such as JSON Keeper, JSON Silo, and npoint[.]io. According to…
Security Affairs -
North Korea’s Contagious Interview APT Uses JSON Keeper and GitLab to Deliver BeaverTail Spyware
According to NVISO, North Korea’s Contagious Interview APT has evolved to host and deliver malware from trojanised code projects by using JSON storage services such as JSON Keeper, JSONsilo, and npoint[.]io, alongside GitLab and GitHub to blend into…
SecurityOnline
-
-
Eurofiber Data Claims, BMW Employee Leak, and FortiWeb Exploit Surface Online
SOCRadar’s Dark Web Team this week flagged multiple high‑profile listings, including an alleged Eurofiber data sale tied to GLPI system records, a Fortinet CVE-2025-64446 exploit advertisement, and claimed leaks involving the Mexico City Auxiliary Police.
SOCRadar -
Eurofiber Breach Exposes Critical Infrastructure Data Across Europe – What You Need to Know
Eurofiber says a major breach has hit its GLPI IT service management platform, exposing sensitive data from thousands of client environments and potentially creating supply‑chain risks for connected organisations across Europe. The incident stems from claims…
SOCRadar -
RondoDox expands botnet by exploiting XWiki RCE bug left unpatched since February 2025
RondoDox botnet expanded by exploiting the XWiki RCE bug CVE-2025-24893, a flaw with a CVSS score of 9.8 that remains a risk for unpatched XWiki servers, despite fixes released in February 2025. Attacks targeting CVE-2025-24893 surged after the botnet added…
Security Affairs -
A week in security (November 10 – November 16)
According to Malwarebytes Labs, the week of 10–16 November 2025 covered a string of security incidents and warnings, from phishing and scams to privacy concerns. On 13–14 November, reports highlighted Google’s lawsuit against Lighthouse, a Chinese…
Malwarebytes -
Rust Adoption Drives Android Memory Safety Bugs Below 20% for First Time
As The Hacker News reports on 17 November 2025, Google has disclosed that its ongoing adoption of Rust in Android has driven memory safety vulnerability density to below 20% for the first time. According to Google, there is a 1000x reduction in memory safety…
The Hacker News -
Alice Blue Partners with AccuKnox for Regulatory Compliance
Alice Blue has announced a partnership with AccuKnox to bolster regulatory compliance and security across on‑premises and cloud workloads, a move described as leveraging AccuKnox’s Zero Trust CNAPP capabilities. The news, issued from Menlo Park, CA, on 17…
SecurityOnline -
End of an Era: Apple Has Reportedly Cancelled the Mac Pro Lineup
According to Bloomberg, Apple appears to have abandoned the Mac Pro, with its most powerful workstation last refreshed in 2023 with the M2 Ultra chip and unlikely to receive further updates. Gurman notes that Apple has not only scrapped development of the…
SecurityOnline -
Google Ordered to Pay $665 Million in German Antitrust Damages Over Google Shopping
A Berlin court has ruled that Google must pay a total of €572 million in damages to two German price-comparison platforms for abusing its dominant market position. The court ordered Google to compensate Idealo around €465 million and Producto about €107…
SecurityOnline -
iPhone Air 2 Cancelled: Apple Shifts to Split Release Cycle for Foldable iPhone
On 17 November 2025, reports circulating about the iPhone Air 2 suggest the device was never part of Apple’s release schedule for the coming year. According to Mark Gurman, the absence is not due to weak iPhone Air sales nor a six‑month delay, but to a…
SecurityOnline -
Critical pgAdmin Flaws (CVE-2025-12762, CVSS 9.1) Allow Remote Code Execution via PostgreSQL Dump Files
The pgAdmin development team has issued patches addressing four newly disclosed vulnerabilities affecting pgAdmin versions up to 9.9, including a critical Remote Code Execution flaw that could allow attackers to run arbitrary commands on affected servers.…
SecurityOnline -
High-Severity Memos Flaw (CVE-2024-21635) Allows Hackers to Stay Logged In After Password Change
The article reports that CVE-2024-21635 affects Memos, a privacy-first, self-hosted knowledge base, with a CVSS score of 7.1 placing it in the high-severity category. It explains that the flaw lies in how Access Tokens are managed: when a user changes their…
SecurityOnline -
HelloKitty Successor Kraken Ransomware Hits Windows/ESXi, Benchmarks Victim Performance Before Encryption
Cisco Talos has released analysis showing that Kraken ransomware, a successor to the HelloKitty cartel, is rapidly expanding its operations and targeting enterprise systems across Windows, Linux, and VMware ESXi environments. The threat group has already…
SecurityOnline -
Critical IBM AIX RCE (CVE-2025-36250, CVSS 10.0) Flaw Exposes NIM Private Keys and Risks Directory Traversal
IBM has released a security bulletin detailing several high-severity flaws in AIX 7.2, AIX 7.3, and VIOS 3.1/4.1, including a remote code execution flaw in the NIM server component (CVE-2025-36250, CVSS 10.0) that could let a remote attacker execute…
SecurityOnline
