News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 13 so far |
Mon 24 Nov 2025· 55 articles
-
ShadowRay 2.0 Turns AI Clusters into Crypto Botnets
The article discusses the emergence of ShadowRay 2.0, a cyber threat exploiting a vulnerability in the Ray framework to hijack AI infrastructure globally. Attackers, identified as IronErn440, are using this vulnerability to create a self-propagating botnet…
Dark Reading -
Critical Flaw in Oracle Identity Manager Under Exploitation
A critical vulnerability, CVE-2025-61757, in Oracle's Identity Manager has been actively exploited, following a breach of Oracle Cloud earlier this year. This remote code execution (RCE) flaw, rated 9.8 on the CVSS scale, was discovered by AssetNote…
Dark Reading -
Infamous Shai-hulud Worm Resurfaces From the Depths
The article discusses the resurgence of the Shai-hulud worm, a self-replicating malware that targets open source repositories, particularly through NPM packages. This new variant executes malicious code during the preinstall phase, increasing exposure in…
Dark Reading -
Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHub
A new supply-chain attack named Shai-Hulud has compromised hundreds of trojanized versions of popular npm packages, including Zapier, ENS Domains, PostHog, and Postman. These malicious packages were added to the npm registry to steal developer and CI/CD…
DataBreaches -
The hidden costs of illegal streaming and modded Amazon Fire TV Sticks
The article discusses the risks associated with illegal streaming, particularly through modified Amazon Fire TV Sticks. It highlights that these devices can expose users to cybercrime, including identity theft and fraud, with 32% of illegal streamers in the…
Malwarebytes -
Vision Language Models Keep an Eye on Physical Security
The article discusses advancements in Vision Language Models (VLMs) and their applications in enhancing physical security within enterprises. VLMs combine computer vision and natural language processing to interpret images and text, enabling them to address…
Dark Reading -
Harvard reports vishing breach exposing alumni and donor contact data
Harvard University reported a vishing breach affecting its Alumni Affairs and Development systems, exposing personal data such as emails, phone numbers, addresses, and donation information of alumni, donors, and some current students and staff. The breach…
Security Affairs -
Is Your Android TV Streaming Box Part of a Botnet?
The article discusses the Superbox media streaming devices, which offer access to over 2,200 streaming services for a one-time fee of around $400. Security experts warn that these devices require intrusive software that can compromise users' networks,…
Krebs on Security -
Black Friday scammers offer fake gifts from big-name brands to empty bank accounts
The article discusses a widespread Black Friday scam involving malvertising that targets consumers through fake ads on legitimate websites. Research indicates that 40% of people have encountered such scams, with over 10% falling victim. The scam operates by…
Malwarebytes -
Matrix Push C2 abuses browser notifications to deliver phishing and malware
Cybercriminals are exploiting browser push notifications to deliver malware and phishing attacks through a new command-and-control platform called Matrix Push C2. This platform allows attackers to send deceptive notifications that can mimic legitimate alerts…
Malwarebytes -
CISA Confirms Exploitation of Recent Oracle Identity Manager Vulnerability
The cybersecurity agency CISA has confirmed the exploitation of a recently patched Oracle Identity Manager vulnerability, tracked as CVE-2025-61757, which allows unauthenticated attackers to execute remote code. This flaw was reported by Searchlight Cyber,…
SecurityWeek -
CrowdStrike Insider Helped Hackers Falsely Claim System Breach
CrowdStrike, a cybersecurity firm, terminated an insider who sold screenshots of their systems to the hacking group Scattered Lapsus$ Hunters. The leaked images included access to an Okta Single Sign-On panel. The hackers claimed to have accessed…
SecurityWeek -
New Fluent Bit Flaws Expose Cloud to RCE and Stealthy Infrastructure Intrusions
The article discusses newly discovered vulnerabilities in Fluent Bit, a popular open-source log processor and forwarder, which could lead to remote code execution (RCE) and stealthy infrastructure intrusions in cloud environments. These flaws can be…
The Hacker News -
Delta Dental of Virginia data breach impacts 145,918 customers
Delta Dental of Virginia experienced a data breach affecting approximately 146,000 customers due to the compromise of an email account. The breach exposed sensitive personal and health information, including names, Social Security numbers, and health data.…
Security Affairs -
Get better visibility for the WAF with payload logging
The article discusses improvements in Cloudflare's Web Application Firewall (WAF) through the introduction of payload logging, which enhances visibility into the actions taken by the WAF. As web attack surfaces grow, fine-tuning WAF configurations is…
Cloudflare -
DDoSia Shifts Its Focus Toward Sweden: Weekly DDoSia Threat Intelligence
The article discusses the shift in DDoS attack focus by the pro-Russian hacktivist group NoName057(16) towards Sweden during the week of November 17-23, 2025. Key points include: Sweden became the primary target with 1,868 attacks, surpassing Denmark, which…
SOCRadarNoName057(16) -
CVE-2025-61757: Oracle Identity Manager Auth Bypass Flaw Added to CISA’s KEV
CVE-2025-61757 is a critical authentication bypass vulnerability in Oracle Identity Manager, recently added to CISA's Known Exploited Vulnerabilities Catalog due to active exploitation. The flaw affects versions 12.2.1.4.0 and 14.1.2.1.0, with a CVSS score…
SOCRadar -
Microsoft Highlights Security Risks Introduced by New Agentic AI Feature
Microsoft is introducing an experimental agentic AI feature in Windows 11 that automates tasks but poses security risks. The 'agent workspace' allows AI agents to operate in a separate environment with limited access to user data. Users must enable this…
SecurityWeek -
Second Sha1-Hulud Wave Affects 25,000+ Repositories via npm Preinstall Credential Theft
The article discusses a significant cybersecurity incident known as the 'Second Sha1-Hulud Wave,' which has impacted over 25,000 repositories through npm preinstall credential theft. This wave highlights vulnerabilities in software supply chains, emphasizing…
The Hacker News -
Elite Cyber Veterans Launch Blast Security with $10M to Turn Cloud Detection into Prevention
Blast Security, a cybersecurity startup founded by veterans from Solebit and elite IDF units, has launched a Preemptive Cloud Defense Platform, aiming to shift cloud security from reactive to proactive prevention. The company secured $10 million in seed…
SecurityOnline -
Mazda Says No Data Leakage or Operational Impact From Oracle Hack
Mazda confirmed it was targeted in a hacking campaign involving Oracle's E-Business Suite (EBS) but reported no operational impact or data leakage. The company detected traces of the attack but stated its defenses were effective. Mazda applied patches from…
SecurityWeek -
Attackers deliver ShadowPad via newly patched WSUS RCE bug
Attackers exploited a recently patched WSUS vulnerability (CVE-2025-59287) to deliver ShadowPad malware, a backdoor associated with China-linked APT groups. The flaw allows unauthorized remote code execution, enabling attackers to gain access to WSUS-enabled…
Security Affairs -
⚡ Weekly Recap: Fortinet Exploit, Chrome 0-Day, BadIIS Malware, Record DDoS, SaaS Breach & More
The article provides a weekly recap of significant cybersecurity events, including a Fortinet exploit, a Chrome 0-day vulnerability, the emergence of BadIIS malware, a record DDoS attack, and a SaaS breach. It highlights the evolving tactics of cyber…
The Hacker News -
To buy or not to buy: How cybercriminals capitalize on Black Friday
The 2025 Black Friday Threat Report by Kaspersky highlights the increasing cyber threats associated with the surge in e-commerce. Key findings include nearly 4 million phishing attacks targeting online shoppers, with 2% aimed specifically at them. The report…
securelist.com -
Spanish Airline Iberia Notifies Customers of Data Breach
Iberia, the Spanish flag carrier, has informed customers of a data breach involving the compromise of personal information, including names, email addresses, and frequent flyer numbers, due to a hack of one of its suppliers. No passwords or full credit card…
SecurityWeek -
146,000 Impacted by Delta Dental of Virginia Data Breach
Delta Dental of Virginia (DDVA) has notified approximately 146,000 individuals about a data breach involving the compromise of an email account. The breach occurred between March 21 and April 23, where a threat actor accessed emails and attachments…
SecurityWeek -
Chinese DeepSeek-R1 AI Generates Insecure Code When Prompts Mention Tibet or Uyghurs
The article discusses the Chinese AI model DeepSeek-R1, which has been found to generate insecure code when prompts include sensitive topics like Tibet or Uyghurs. This raises concerns about the implications of AI in generating potentially harmful content.…
The Hacker News -
Cox Confirms Oracle EBS Hack as Cybercriminals Name 100 Alleged Victims
Cox Enterprises confirmed that its Oracle E-Business Suite (EBS) was compromised in a cybercrime campaign, affecting personal information of nearly 9,500 individuals. The breach occurred between August 9 and August 14, and the attackers have released 1.6 TB…
SecurityWeek -
Sha1-Hulud: The Second Coming - Zapier, ENS Domains, and Other Prominent NPM Packages Compromised
The StepSecurity blog reports that Sha1-Hulud: The Second Coming is a new variant of the Shai-Hulud NPM worm, described as a devastating supply chain attack that has compromised Zapier and ENS domains. The incident has compromised over 70 npm packages and…
StepSecurity -
AI attack agents are accelerators, not autonomous weapons: the Anthropic attack
The article discusses a report by Anthropic on AI attack agents, emphasizing that while these agents can significantly speed up cyberattack processes, they do not operate as autonomous weapons. The AI can handle 80-90% of tactical tasks, automating…
Security Affairs -
Qualcomm Confirms Quick Share-AirDrop Interoperability Coming to All Snapdragon Phones
According to Google’s announcement, the Pixel 10 series will support native Quick Share file transfers directly with iPhones via AirDrop, and Qualcomm promptly issued a statement saying it “Can’t wait for people to use this once enabled on Snapdragon in the…
SecurityOnline -
Scattered Spider alleged members deny TfL charges
Two British teenagers connected to the Scattered Spider hacking group have pleaded not guilty to charges alleging they conspired to commit unauthorised acts against Transport for London (TfL). Thalha Jubair, 19, and Owen Flowers, 18, were arrested in…
Security AffairsScattered Spider -
Core Failure: Windows 11 Update KB5062553 is Causing System, Start Menu, and Explorer Crashes
A Daily CyberSecurity piece published on 24 November 2025 reports that Windows 11 version 24H2 may exhibit numerous issues after installing the July 2025 update KB5062553, with any system updated on or after 8 July 2025 potentially affected. According to…
SecurityOnline -
Notepad Update Adds Markdown Table Support & Streaming Copilot AI Responses
Notepad has received a fresh update that brings Markdown table support and streaming Copilot AI responses, announced on 24 November 2025. In the latest release, Microsoft has introduced lightweight table support for Markdown within Notepad, allowing users to…
SecurityOnline -
WINS is Dead: Microsoft to Fully Retire WINS Name Resolution from Windows Server Post-2025
WINS is Dead: Microsoft plans to fully retire WINS name resolution from Windows Server after 2025, with the news coming in the wake of a deprecation already flagged by Microsoft. WINS — Windows Internet Name Service — was first introduced in 1994, but its…
SecurityOnline -
A week in security (November 17 – November 23)
A week in security (November 17 – November 23) was published on 24 November 2025 by Malwarebytes Labs. According to Malwarebytes Labs, the week featured several highlighted stories, including AI teddy bear for kids responds with sexual content and advice…
Malwarebytes -
Microsoft Tries to Fix Windows 11 File Explorer Lag with New Preloading Feature
Microsoft is moving to smooth Windows 11 File Explorer startup by testing a preloading feature in the Windows 11 Build 26220.7271 preview, announced as part of the Insider programme. The approach loads Explorer into memory by default, dramatically improving…
SecurityOnline -
ShadowPad Malware Actively Exploits WSUS Vulnerability for Full System Access
A recently patched security flaw in Microsoft Windows Server Update Services (WSUS) has been exploited by threat actors to distribute ShadowPad, a modular backdoor. The attacker targeted Windows Servers with WSUS enabled, exploiting CVE-2025-59287 for…
The Hacker News -
iOS 27 & macOS 27: Apple Shifts to Stability and Performance Over New Features
Apple’s iOS 27 and macOS 27 are framed as a shift away from feature-heavy releases toward stability and performance, with autumn 2026 launches not centred on hundreds of new capabilities but on refinements and defect elimination, according to Bloomberg’s…
SecurityOnline -
X Launches ‘About This Account’ Tool to Boost Transparency and Fight Fakes
X has begun rolling out a new feature called “About this account” to enhance platform transparency and curb the proliferation of fake accounts. The tool publicly displays background details such as a user’s location, the region where the account was created,…
SecurityOnline
