News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Fri 5 Dec 2025· 46 articles
-
New Prompt Injection Attack Vectors Through MCP Sampling
According to Unit 42, the article examines security implications of the Model Context Protocol (MCP) sampling feature within a widely used coding copilot, showing that, without safeguards, malicious MCP servers can exploit sampling for a range of attacks. It…
unit42.paloaltonetworks.com -
Rust Code Delivers Better Security, Also Streamlines DevOps
Rust Code Delivers Better Security, Also Streamlines DevOps reports that software teams using Rust see safer code and fewer rollbacks, with Google’s Android development team noting about 1,000 times fewer bugs than in C++. The analysis also highlights faster…
Dark Reading -
UK Government Considers Computer Misuse Act Revision
according to Akshaya Asokan, the U.K. government is considering amending its three-decade-old Computer Misuse Act to include a statutory defence for security researchers. Security Minister Dan Jarvis said the government is looking at a legal change to the…
DataBreaches -
Japan issues arrest warrant against teen suspected of cyberattack using AI
Japan has issued an arrest warrant for a 17-year-old boy on suspicion of carrying out a cyberattack on a major internet cafe operator using a program generated by artificial intelligence, according to Kyodo News. The case is linked to a January cyberattack…
DataBreaches -
India Rolls Back App Mandate Amid Surveillance Concerns
India’s government has retracted a DoT order that would have required smartphone manufacturers to pre-install the Sanchar Saathi app on all new devices and to retrofit it on existing ones, a move the department said would not be mandatory going forward. The…
Dark Reading -
Microsoft named a leader in the 2025 Gartner® Magic Quadrant™ for Email Security
Microsoft has been named a Leader in the 2025 Gartner® Magic Quadrant™ for Email Security, with the recognition highlighting the value of Defender for Office 365’s innovative capabilities in addressing today’s email security challenges. The Gartner document,…
Microsoft -
Zero-Click Agentic Browser Attack Can Delete Entire Google Drive Using Crafted Emails
A new agentic browser attack targeting Perplexity’s Comet browser can turn a seemingly benign email into actions that wipe a user’s Google Drive contents, findings from Straiker STAR Labs show, and the technique relies on the browser being connected to Gmail…
The Hacker News -
Critical XXE Bug CVE-2025-66516 (CVSS 10.0) Hits Apache Tika, Requires Urgent Patch
A critical security flaw has been disclosed in Apache Tika that could enable an XML external entity (XXE) injection attack, tracked as CVE-2025-66516, and rated 10.0 on the CVSS scale. According to an advisory for the vulnerability, the XXE can be carried…
The Hacker News -
In Other News: X Fined €120 Million, Array Flaw Exploited, New Iranian Backdoor
SecurityWeek reports that X has been fined €120 million by The European Commission for disinformation under the Digital Services Act, a penalty described as a fine for failures to handle disinformation and influence operations. In other news, Japan’s…
SecurityWeek -
Threat Landscape Grows Increasingly Dangerous for Manufacturers
Manufacturers remain the top target for cyberattacks in 2025, with the sector’s exposure to operational disruptions and a recognised skills gap driving risk across the economy. According to Sophos, half of manufacturers (51%) fell prey to ransomware and paid…
Dark Reading -
Sprocket Security Earns Repeat Recognition in G2’s Winter 2025 Relationship Index for Penetration Testing
Sprocket Security has earned repeat recognition in G2’s Winter 2025 Relationship Index for Penetration Testing, securing the High Performer, Best Support, and Easiest to Do Business With honours in what is described as the second consecutive quarter of such…
SecurityOnline -
React2Shell Vulnerability Under Attack from China-Nexus Groups
React2Shell is a critical vulnerability in the React library that is under attack by China-nexus actors, with CVE-2025-55182 described as an unauthenticated remote code execution affecting React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0…
Dark Reading -
Cloudflare Outage Caused by React2Shell Mitigations
Cloudflare says the outage was linked to mitigations for the critical React vulnerability known as React2Shell, officially tracked as CVE-2025-55182, exploited in the wild by Chinese and other threat actors. According to SecurityWeek, major firms including…
SecurityWeek -
Criminal IP to Host Webinar: Beyond CVEs – From Visibility to Action with ASM
Criminal IP will host a live webinar, Beyond CVEs – From Visibility to Action with ASM, focusing on the shift in cyberattack strategies from known software vulnerabilities to exposure-driven attacks. According to CyberNewsWire, the session takes place on 16…
SecurityOnline -
CISOs Should Be Asking These Quantum Questions Today
CISOs are urged to start asking practical, non-technical questions about visibility, validation and compliance as quantum moves from lab experiments into production workflows. The piece notes that quantum-ready software is already deployed in…
Dark Reading -
Imper.ai Emerges From Stealth Mode With $28 Million in Funding
Imper[.]ai has emerged from stealth with $28 million in funding, led by backers including Redpoint Ventures, Battery Ventures, Maple VC, Vessy VC and Cerca Partners. The New York-based cybersecurity startup, founded in 2024 by Israeli intelligence veterans…
SecurityWeek -
US Organizations Warned of Chinese Malware Used for Long-Term Persistence
Warp Panda, a China-linked threat actor, has been using BrickStorm, Junction, and GuestConduit malware in attacks against US organisations to maintain long-term access. According to SecurityWeek, the group focuses on persisting within compromised networks,…
SecurityWeek -
Chinese Hackers Have Started Exploiting the Newly Disclosed React2Shell Vulnerability
Two China‑linked threat groups, Earth Lamia and Jackpot Panda, have been observed weaponising the newly disclosed React Server Components flaw CVE‑2025‑55182, also known as React2Shell, within hours of it becoming public. The vulnerability allows…
The Hacker News -
Simplifying cross domain investigations
Modern attackers routinely move across identity, network, cloud and email domains, a reality the article argues makes cross-domain investigations essential because no single tool can reveal the whole attack story. In April 2025 the UK experienced a…
darktrace.com -
How old is the average hacker? What does a new research report suggest?
Orange Cyberdefense, as part of its Security Navigator 2026 threat landscape analysis, finds that cybercrime is largely driven by experienced adults rather than teenagers. The dataset catalogues 418 publicly announced law-enforcement cases between 2021 and…
DataBreaches -
Leaks show Intellexa burning zero-days to keep Predator spyware running
Leaks show Intellexa burning zero-days to keep Predator spyware running, with independent investigations describing the company as still active and hitting new targets despite sanctions and investigations in Greece. According to Google’s Threat Analysis…
Malwarebytes -
JPCERT/CC Reports Widespread Exploitation of Array Networks AG Gateway Vulnerability
JPCERT/CC has warned that Array Networks AG Series gateways have been under active exploitation since August 2025, in response to a command injection flaw that affects DesktopDirect. The flaw allows an attacker to execute arbitrary commands, and exploitation…
Security Affairs -
Intellexa Leaks Reveal Zero-Days and Ads-Based Vector for Predator Spyware Delivery
Intellexa leaks detail zero-days and an ads-based delivery vector for Predator spyware, with the report noting that initial access can be gained by a malicious link that loads a browser exploit on Android Chrome or iOS Safari. The data from GTIG lists…
The Hacker News -
"Getting to Yes": An Anti-Sales Guide for MSPs
The Hacker News features a contributor piece about “Getting to Yes”: An Anti-Sales Guide for MSPs, which argues that most MSPs know how to deliver security but struggle to show business value to prospects. According to Cynomi, the guide helps providers turn…
The Hacker News -
BRICKSTORM backdoor exposed: CISA warns of advanced China-backed intrusions
BRICKSTORM is a Go-based backdoor exposed by CISA as a tool used by PRC state-sponsored actors to secure long-term persistence on compromised systems, with targets including government services and information technology sectors. According to CISA,…
Security Affairs -
Lumia Security Raises $18 Million for AI Security and Governance
Lumia Security has announced an $18 million seed funding round led by Team8, with additional support from New Era, to accelerate the development of its AI security and governance platform. Founded in 2024 and headquartered in New York and Tel Aviv, the…
SecurityWeek -
Aisuru Botnet Powers Record DDoS Attack Peaking at 29 Tbps
SecurityWeek reports that the Aisuru botnet powered a record-breaking DDoS attack mitigated by Cloudflare, peaking at 29.7 Tbps and 14.1 Bpps in the third quarter of 2025, according to Cloudflare. The company described the incident as a UDP carpet-bombing…
SecurityWeek -
Helmet Security Emerges From Stealth Mode With $9 Million in Funding
Helmet Security has emerged from stealth mode with $9 million in funding from SYN Ventures and WhiteRabbit Ventures, according to SecurityWeek. Headquartered in Washington, D.C., the company was co-founded by Fred Kneip and Kaushik Shanadi, with Kneip as CEO…
SecurityWeek -
CISA Reports PRC Hackers Using BRICKSTORM for Long-Term Access in U.S. Systems
According to CISA, BRICKSTORM is a sophisticated backdoor for VMware vSphere and Windows environments that enables long-term, stealthy access to compromised systems. The backdoor, written in Golang, provides interactive shell access and can browse, upload,…
The Hacker News -
Chinese Hackers Exploiting React2Shell Vulnerability
According to AWS, exploitation attempts of the React2Shell vulnerability, CVE-2025-55182, were observed by China-linked threat actors within hours of public disclosure, after the flaw was reported to React maintainer Meta on 29 November and patched on 3…
SecurityWeek -
JPCERT Confirms Active Command Injection Attacks on Array AG Gateways
According to JPCERT/CC, a command injection vulnerability in Array Networks AG Series secure access gateways has been exploited in the wild since August 2025. The flaw, which does not yet have a CVE identifier, was addressed by Array on 11 May 2025 and stems…
The Hacker News -
Honesty is the Best Policy: OpenAI Trains AI Models to ‘Confess’ Errors and Hallucinations
OpenAI is developing a new training framework, referred to as the “Confession” mechanism, to improve transparency in artificial intelligence and curb the problem of confidently delivering nonsense. The core idea is to train AI models to voluntarily admit…
SecurityOnline -
New Android Call Scam Protection Pauses Calls for 30 Seconds During Financial App Use
According to Google, Android’s call-scam protection is being expanded through Google Play Services to safeguard users during sensitive conversations involving financial or payment apps. The system first checks whether the incoming number is a known contact;…
SecurityOnline -
Russia Imposes Network-Level Blockade on Apple’s End-to-End Encrypted FaceTime
Russia has imposed a network-level blockade on Apple’s FaceTime, which provides end-to-end encrypted audio and video communication, the Daily CyberSecurity site reports on 5 December 2025. According to the country’s federal communications watchdog, the move…
SecurityOnline -
Apache HTTP Server 2.4.66 Fixes SSRF Flaw (CVE-2025-59775) Exposing NTLM Hashes on Windows and suexec Bypass
The Apache Software Foundation has rolled out a crucial update for Apache HTTP Server, with version 2.4.66 serving as a cumulative fix for multiple vulnerabilities, including a Server-Side Request Forgery flaw on Windows. One headline fix is CVE-2025-59775,…
SecurityOnline -
Stealth Cryptominer Uses USB LNK and DLL Side-Loading to Deploy “Smart Mining” Evasion
According to AhnLab SEcurity Center (ASEC), a sophisticated CoinMiner campaign is spreading via USB drives in South Korea, turning infected workstations into cryptocurrency miners. The February 2025 report tracks the new strain, also monitored by Mandiant as…
SecurityOnline -
The PDF Trap: Critical Vulnerability (CVE-2025-66516, CVSS 10.0) Hits Apache Tika Core
The PDF Trap reports a maximum-severity XML External Entity flaw in Apache Tika Core, tracked as CVE-2025-66516 with a CVSS of 10.0, which can be exploited by uploading a malicious PDF. The vulnerability arises from how Tika handles XFA data within PDFs,…
SecurityOnline -
“React2Shell” Storm: China-Nexus Groups Weaponize Critical React Flaw Hours After Disclosure
According to Amazon threat intelligence teams, the publicly disclosed critical React vulnerability in the React ecosystem has already spawned active exploitation campaigns by state-sponsored groups. The report notes that multiple China-nexus groups,…
SecurityOnlineEarth Lamia -
Operation DUPEHIKE Hits Russian HR: Bonus Lure Delivers DUPERUNNER and Adaptix C2 via Process Injection
According to SEQRITE APT-Team, Operation DUPEHIKE is a highly targeted espionage campaign aimed at Russian corporate entities, focusing on Human Resources and payroll departments. The intrusion begins with a spear-phishing email carrying a malicious ZIP…
SecurityOnline -
High-Severity Splunk Flaw Allows Local Privilege Escalation via Incorrect File Permissions on Windows
Splunk administrators managing Windows environments are being urged to patch immediately after two high-severity vulnerabilities affecting both the Enterprise platform and Universal Forwarders were disclosed, tracked as CVE-2025-20386 and CVE-2025-20387 with…
SecurityOnline
