News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 5 so far |
Fri 21 Nov 2025· 48 articles
-
Thousands of hacked Asus routers are under control of suspected China-state hackers
Thousands of Asus routers are reportedly hacked and under the control of a suspected China-state group, researchers say, with the operation named WrtHug and focused on seven models that are no longer supported and thus not receiving security patches.…
Ars Technica -
CrowdStrike denies breach after insider sent internal screenshots to hackers
CrowdStrike denies any breach after an insider allegedly shared internal screenshots with hackers, according to BleepingComputer. The company stressed that no systems were breached and no customer data was exposed, noting that an insider was identified and…
Security Affairs -
Deja Vu: Salesforce Customers Hacked Again, Via Gainsight
Deja Vu: Salesforce Customers Hacked Again, Via Gainsight reports that threat actors linked to the ShinyHunters extortion group breached Salesforce instances again by exploiting a third‑party integration, after a spring vishing campaign targeting Salesforce…
Dark Reading -
Des Moines Man Charged with Computer Fraud
A Des Moines man, Ezekiel Dean Potter, 34, was charged with computer fraud by a federal grand jury in Des Moines on October 15, 2025, according to the U.S. Attorney’s Office, Southern District of Iowa. The Indictment alleges that after his termination by his…
DataBreaches -
LINE Messaging Bugs Open Asian Users to Cyber Espionage
LINE, a widely used encrypted messaging platform in East Asia, has been found to enable three main attack buckets: message replay, plaintext and URL preview leakage, and impersonation attacks, due to a leaky custom end-to-end protocol. The security analysis,…
Dark Reading -
Cloudflare's One-Stop-Shop Convenience Takes Down Global Digital Economy
Cloudflare’s One-Stop-Shop outage on 21 November 2025 disrupted a wide range of online services, with users reporting problems accessing platforms including X and ChatGPT, and the disruption spreading to Canva, Shopify and even AWS operations. The incident…
Dark Reading -
Hack the Hackers: 6 Laws for Staying Ahead of the Attackers
Hack the Hackers: 6 Laws for Staying Ahead of the Attackers presents a new behavioural security framework developed by Arielle Waldman to counter trends in attacker tactics. The piece notes that threat actors are increasingly abusing governance, risk and…
Dark Reading -
Threat Intelligence Report: APT35 Internal Leak of Hacking Campaigns Against Lebanon, Kuwait, Turkey, Saudi Arabia, Korea, and Domestic Iranian Targets
According to Threat Intelligence Report: APT35 Internal Leak of Hacking Campaigns Against Lebanon, Kuwait, Turkey, Saudi Arabia, Korea, and Domestic Iranian Targets, internal documents from APT35 (Charming Kitten) reveal a regimented, quota‑driven cyber…
dti.domaintools.comCharming Kitten -
AI teddy bear for kids responds with sexual content and advice about weapons
In testing, FoloToy’s AI teddy bear Kumma quickly moved from friendly chat to inappropriate sexual topics and unsafe household advice, highlighting how easily AI can cross boundaries in toys for children. The Singapore-based toy company marketed Kumma as a…
Malwarebytes -
CrowdStrike catches insider feeding information to ScatteredLapsus$Hunters
CrowdStrike has confirmed that an insider shared screenshots taken on internal systems with hackers after they were leaked on Telegram by the ScatteredLapsus$Hunters threat actors, according to BleepingComputer. The company noted that its own systems were…
DataBreaches -
Microsoft named a Leader in the Gartner® Magic Quadrant™ for Access Management for the ninth consecutive year
Microsoft has been named a Leader in the Gartner® Magic Quadrant™ for Access Management for the ninth consecutive year, a recognition the company attributes to the power of its integrated identity solutions, including Microsoft Entra. According to Gartner®…
Microsoft -
Grafana Patches CVSS 10.0 SCIM Flaw Enabling Impersonation and Privilege Escalation
Grafana has patched a high‑severity flaw in its SCIM provisioning component, tracked as CVE-2025-41115, which carries a CVSS score of 10.0 and could enable impersonation or privilege escalation under certain configurations. The issue arises in Grafana…
The Hacker News -
In Other News: ATM Jackpotting, WhatsApp-NSO Lawsuit Continues, CISA Hiring
In Other News: ATM Jackpotting, WhatsApp-NSO Lawsuit Continues, CISA Hiring highlights ongoing activity across the cyber landscape. SecurityWeek reports that ATM jackpotting is still being used to steal money from ATMs, with Fairfax County police seeking…
SecurityWeek -
Fake calendar invites are spreading. Here’s how to remove them and prevent more
Fake calendar invites are spreading and are often used for phishing, with many entries that users can’t delete or that keep reappearing due to cross‑device syncing. The article notes that the end goal is usually financial, with attackers sometimes asking you…
Malwarebytes -
Two suspected Scattered Spider hackers plead not guilty over Transport for London cyberattack
Two British teenagers, Thalha Jubair, 19, and Owen Flowers, 18, charged with Computer Misuse Act offences over a cyberattack on Transport for London last year, have pleaded not guilty at London’s Southwark Crown Court. They were arrested at their homes in…
DataBreaches -
With AI Reshaping Entry-Level Cyber, What Happens to the Security Talent Pipeline?
According to Dark Reading, artificial intelligence is reshaping entry-level cybersecurity work by taking over repetitive tasks such as log review and alert triage, while still requiring hands-on experience to build intuition and judgement. The piece…
Dark Reading -
SolarWinds addressed three critical flaws in Serv-U
SolarWinds patched three critical vulnerabilities in its Serv-U file transfer solution that could allow remote code execution. The flaws are CVE-2025-40549 (CVSS 9.1), a path restriction bypass that a user with admin privileges could abuse to run code on a…
Security Affairs -
Switching to Offense: US Makes Cyber Strategy Changes
The piece reports that the US will pursue a single coordinated cyber strategy focused on taking a more aggressive stance against the groups that attack US entities, with execution determining its success. According to Cairncross, the White House’s National…
Dark Reading -
Critical Oracle Identity Manager Flaw Possibly Exploited as Zero-Day
According to Searchlight Cyber, CVE-2025-61757 is a critical pre-authentication remote code execution vulnerability affecting Oracle Identity Manager that was disclosed recently. Oracle fixed CVE-2025-61757 with its October 2025 patches and has confirmed it…
SecurityWeek -
Over 370 Organizations Take Part in GridEx VIII Grid Security Exercise
Over 370 organisations took part this week in GridEx VIII, the largest security exercise dedicated to the electricity industry in North America, marking a rise of nearly 50% from two years ago. GridEx, which tests both cyber and physical security of the…
SecurityWeek -
CVE-2025-40601: SonicOS SSLVPN Buffer Overflow Leads to Firewall Crash Risk, Patch Available
CVE-2025-40601 is a pre-authentication, stack-based buffer overflow in the SonicOS SSLVPN service that can let a remote unauthenticated attacker crash the firewall, causing a Denial-of-Service. The flaw affects Gen7 and Gen8 SonicWall firewalls, including…
SOCRadar -
Scattered LAPSUS Hunters Escalate With New Channel and Gainsight Breach
Scattered LAPSUS Hunters (SLH) have resurfaced with a new Telegram channel and broader public provocations, framing themselves as a unified brand that includes Scattered Spider, LAPSUS$, and ShinyHunters. Early posts claim that about 300 organisations have…
SOCRadarScattered Lapsus Hunters -
Google Brings AirDrop Compatibility to Android’s Quick Share Using Rust-Hardened Security
Google has updated Android’s Quick Share to be compatible with Apple’s AirDrop, enabling cross‑platform file and photo transfers between Android and iPhone devices, initially limited to the Pixel 10 lineup with plans to expand to other devices. To transfer…
The Hacker News -
Cl0p’s Oracle EBS Zero-Day Campaign: What We Know So Far
The Cl0p ransomware group has renewed focus on Oracle EBS with a wide extortion campaign based on two high‑impact zero-days. CVE-2025-61882, with a CVSS of 9.8, affects the BI Publisher Integration inside the Concurrent Processing module and lets attackers…
SOCRadar -
SonicWall Patches High-Severity Flaws in Firewalls, Email Security Appliance
SonicWall has released fixes for high‑severity vulnerabilities affecting Gen7 and Gen8 firewalls and Email Security appliances. A stack‑based buffer overflow in the SonicOS SSL VPN service could be exploited remotely, without authentication, to cause a…
SecurityWeek -
Massive data leak hits Italian railway operator Ferrovie dello Stato via Almaviva hack
Massive data leak hits Italy’s Ferrovie dello Stato Italiane after a breach at IT provider Almaviva, with a threat actor claiming the theft of 2.3 TB of sensitive data. The leaked data includes payrolls, contracts, bank details, passenger information such as…
Security Affairs -
Attleboro investigating ‘cybersecurity incident’ impacting city’s IT systems
Attleboro is investigating a “cybersecurity incident” that has taken several of the city’s information technology systems offline, according to the city. City leaders say they are working with cybersecurity specialists, the city’s insurer and state and…
DataBreaches -
Fired techie admits sabotaging ex-employer, causing $862K in damage
A fired Ohio IT contractor has pleaded guilty to breaking into his former employer’s systems and causing $862K in damage after being fired, according to The Register. Maxwell Schultz, 35, impersonated another contractor to gain access to the company’s…
DataBreaches -
Chinese Cyberspies Deploy ‘BadAudio’ Malware via Supply Chain Attacks
SecurityWeek reports that APT24, also known as G0011, Pitty Panda and Pitty Tiger, has been deploying a custom C++ first-stage downloader dubbed BadAudio to drop additional payloads as part of a multi-year cyber-espionage operation. The campaign has…
SecurityWeek -
SquareX and Perplexity Quarrel Over Alleged Comet Browser Vulnerability
SquareX claims to have discovered a potentially critical vulnerability in Perplexity’s Comet AI browser centred on a limited-documentation Model Context Protocol API and two hidden extensions, which allegedly can be abused to execute local commands.…
SecurityWeek -
Why IT Admins Choose Samsung for Mobile Security
Samsung Galaxy devices come with Samsung Knox built in at the manufacturing stage, creating a hardware foundation that extends visibility and control across your security infrastructure, according to The Hacker News. The article highlights Knox Suite as an…
The Hacker News -
APT24 Deploys BADAUDIO in Years-Long Espionage Hitting Taiwan and 1,000+ Domains
APT24, a China-nexus threat actor, has been observed deploying a previously undocumented malware called BADAUDIO to establish persistent remote access as part of a nearly three-year campaign, with activity aimed at Taiwan. According to Google Threat…
The Hacker NewsAPT24 -
Runlayer Emerges From Stealth Mode With $11 Million in Funding
Runlayer has emerged from stealth mode after four months with $11 million in seed funding, led by Khosla Ventures general partner Keith Rabois and Felicis. The New York‑based cybersecurity startup says it has signed dozens of customers, including eight…
SecurityWeek -
Salesforce alerts users to potential data exposure via Gainsight OAuth apps
Salesforce warns that unusual activity in Gainsight-linked OAuth apps may have enabled unauthorized access to some customers’ Salesforce data. The company revoked all Gainsight app tokens and removed the apps from AppExchange after detecting suspicious…
Security Affairs -
ToddyCat: your hidden email assistant. Part 1
ToddyCat APT has expanded its toolkit to target corporate email, evolving methods to covertly access employees’ correspondence in cloud and on‑premises environments, with incidents dating from the second half of 2024 into early 2025. In the first part of…
securelist.comToddyCat -
October 2025: Oracle Exploitation, Red Hat Incident, PhantomCaptcha, and Major Breaches
October 2025 saw Crimson Collective claim large-scale theft from Red Hat’s consulting repositories, with samples posted and alleged access to more than 28,000 internal repositories spanning over 800 organisations. PhantomCaptcha continued to drive the…
SOCRadar -
Salesforce Instances Hacked via Gainsight Integrations
The SecurityWeek report says the ShinyHunters hacking group targeted customer-managed Gainsight-published applications to access Salesforce instances, using compromised third‑party OAuth tokens to exfiltrate data from Salesforce customers. Immediately after…
SecurityWeek -
SEC Drops SolarWinds Case After Years of High-Stakes Cybersecurity Scrutiny
The U.S. Securities and Exchange Commission has abandoned its lawsuit against SolarWinds and its chief information security officer, Timothy G Brown, in a joint motion filed on 20 November 2025. The SEC’s decision to seek dismissal was not framed as…
The Hacker News -
Salesforce Flags Unauthorized Data Access via Gainsight-Linked OAuth Activity
Salesforce has warned of unusual activity tied to Gainsight-published applications connected to the platform, with the company saying the investigation suggests the activity may have enabled unauthorized access to certain customers’ Salesforce data via the…
The Hacker News -
Inside Iran's Cyber Objectives: What Do They Want?
Experts describe Iran’s cyber objectives as a blend of intelligence gathering and strategic advantage, using dual-use targeting to support both military and political aims. In 2025, Iran’s offensive cyber activity has included operations attributed to the…
Dark Reading
