News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 13 so far |
Mon 8 Dec 2025· 49 articles
-
Apache Issues Max-Severity Tika CVE After Patch Miss
The Apache Software Foundation (ASF) has issued a new CVE identifier for a critical flaw in Apache Tika after the initial patch missed the full scope, leading to an updated advisory and CVE. According to The Apache Software Foundation (ASF), the new maximum…
Dark Reading -
Exploitation Activity Ramps Up Against React2Shell
Exploitation activity against React2Shell has ramped up since the public disclosure of CVE-2025-55182, with attackers increasingly targeting Next[.]js and containerised workloads in cloud environments. The vulnerability, a critical remote code execution flaw…
Dark Reading -
Chinese Malware Delivery Domains Part IV
According to DomainTools Investigations, a large cluster of malware delivery domains has been active since June 2023, with more than 2,800 domains reported in Part III (July 2025) and a further 1,900 additional domains observed from May to November 2025,…
dti.domaintools.com -
US Treasury Tracks $4.5B in Ransom Payments since 2013
US Treasury data released by FinCEN shows ransomware payments totalled more than $2.1 billion between 2022 and 2024 across 7,395 BSA reports relating to 4,194 incidents, with total ransomware payments traced to the past 14 years reaching $4.5 billion. The…
Dark Reading -
FBI: Crooks manipulate online photos to fuel virtual kidnapping ransoms
According to the FBI PSA, criminals are altering publicly available photos to create fake “proof-of-life” images used in virtual kidnapping ransom scams, posing as kidnappers and demanding ransom payments. The altered photos or videos are circulated in text…
Security Affairs -
Google Fortifies Chrome Agentic AI Against Indirect Prompt Injection Attacks
On 8 December 2025, SecurityWeek reported that Google is strengthening Chrome’s agentic browsing protections to counter indirect prompt injection attacks that could lead to data leaks or unwanted actions. According to Google, a new AI model built with…
SecurityWeek -
Experts Confirm JS#SMUGGLER Uses Compromised Sites to Deploy NetSupport RAT
Cybersecurity researchers have dubbed a new campaign JS#SMUGGLER, observed using compromised websites to distribute NetSupport RAT, a remote access Trojan. The campaign’s attack chain, analysed by Securonix, involves an obfuscated JavaScript loader injected…
The Hacker News -
Stronger together: New Beazley collaboration enhances cyber resilience
Today’s cyberthreat landscape demands more than technical expertise: it requires a unified response team of technical responders, insurers, brokers, and legal counsel. Microsoft says the collaboration with Beazley as an approved incident response partner for…
Microsoft -
How phishers hide banking scams behind free Cloudflare Pages
A Malwarebytes investigation reveals that phishers are hiding banking scams on free hosting platforms by pairing Cloudflare Pages with compromised legitimate websites to create convincing portals for banking and insurance logins. The kit not only captures…
Malwarebytes -
INE Earns G2 Winter 2026 Badges Across Global Markets
INE has been recognised with seven G2 Winter 2026 badges, underscoring its leadership in online course delivery, technical skills development and cybersecurity education. The awards include Leader in the Online Course Providers Grid Report, Momentum Leader…
SecurityOnline -
CISO Conversations: Keith McCammon, CSO and Co-founder at Red Canary
CISO Conversations: Keith McCammon, CSO and Co-founder at Red Canary, profiles how a technologist with no formal cybersecurity training built a career that led to co-founding Red Canary in 2014 after it spun out from Kyrus Tech. The interview, published on 8…
SecurityWeek -
Oracle EBS zero-day used by Clop to breach Barts Health NHS
Clop ransomware stole data from Barts Health NHS after exploiting a zero-day in its Oracle E-Business Suite, specifically CVE-2025-61882, with the breach linked to the Oracle EBS zero-day being exploited since early August. The exposed material includes…
Security Affairs -
Resemble AI Raises $13 Million for AI Threat Detection
Resemble AI has announced a $13 million strategic investment to advance its generative AI threat-detection platform, bringing the company’s total funding to $25 million. The California-based startup says its DETECT-3B Omni model can identify AI-based threats…
SecurityWeek -
AWS: China-linked threat actors weaponized React2Shell hours after disclosure
Multiple China-linked threat actors began exploiting the CVE-2025-55182, also known as the React2Shell flaw, within hours, according to AWS Security. The vulnerability is a pre-authentication remote code execution flaw in React Server Components versions…
Security Affairs -
Leavenworth, Kansas cyberattack disrupts city services
Leavenworth, Kansas faced a cyberattack that disrupted city services, with the outage first reported on 19 November 2025 and continuing to affect invoice, permitting and hiring systems, though emergency services remained unaffected. Officials brought in…
DataBreaches -
Scammers harvesting Facebook photos to stage fake kidnappings, warns FBI
The FBI has warned about a new scam in which your Facebook photos are harvested to act as “proof-of-life” pictures in a virtual kidnapping, with scammers pretending they have kidnapped somebody and demanding a ransom. The article notes that attackers show…
Malwarebytes -
Weapon Bot Toolkit, MadLicense Exploit Demand, and 413K Credit Cards Observed
SOCRadar’s Dark Web Team reported multiple underground posts this week, including a major auction for global credit card records, a buyer seeking a weaponized PoC for the Windows MadLicense vulnerability (CVE-2024-38077), and the sale of a new…
SOCRadar -
Tri-Century Eye Care Data Breach Impacts 200,000 Individuals
According to the US Department of Health and Human Services (HHS) data breach tracker, Tri-Century Eye Care’s incident affects roughly 200,000 individuals. The breach was detected on 3 September, with a data security incident notice posted in late October…
SecurityWeek -
⚡ Weekly Recap: USB Malware, React2Shell, WhatsApp Worms, AI IDE Bugs & More
The weekly recap highlights a mix of rapid-fire cyber stories, including a critical React flaw tracked as CVE-2025-55182, also referred to as React2Shell, which researchers say has seen extensive exploitation within hours of disclosure. According to various…
The Hacker News -
Ransomware Payments Surpassed $4.5 Billion: US Treasury
Ransomware payments to the US Treasury’s FinCEN network surpassed $4.5 billion by the end of 2024, with the highest levels reached in 2023, according to FinCEN’s Financial Trend Analysis report. The analysis shows more than $2.1 billion was paid to…
SecurityWeek -
How Can Retailers Cyber-Prepare for the Most Vulnerable Time of the Year?
The Hacker News outlines how retailers face a compressed, high‑stakes risk window during the holiday season, when bot‑driven fraud, credential stuffing and account takeover attempts surge around peak shopping events like Black Friday and Christmas. It notes…
The Hacker News -
‘Broadside’ Mirai Variant Targets Maritime Logistics Sector
“Broadside” is targeting a critical flaw in DVR systems to conduct remote command injection, which can hijack devices to achieve persistence and move laterally, researchers say. The variant specifically targets TBK DVR devices for remote command injection…
Dark Reading -
DDoSia Targets France: Weekly DDoSia Threat Intelligence Analysis
DDoSia Targets France: Weekly DDoSia Threat Intelligence Analysis covers the period December 1 to 8, 2025, during which NoName057(16), a pro-Russian hacktivist group, kept its DDoS campaign active across European and international domains using the DDoSia…
SOCRadar -
Android Malware FvncBot, SeedSnatcher, and ClayRat Gain Stronger Data Theft Features
Cybersecurity researchers have disclosed details of two new Android malware families, FvncBot and SeedSnatcher, as an upgraded version of ClayRat has been spotted in the wild, according to Intel 471, CYFIRMA and Zimperium. FvncBot masquerades as a security…
The Hacker News -
Critical Apache Tika Vulnerability Leads to XXE Injection
A critical-severity vulnerability in the Apache Tika open source analysis toolkit could allow XML External Entity (XXE) injection attacks, with the issue tracked as CVE-2025-66516 and a CVSS score of 10/10. Attackers can exploit the flaw via crafted XFA…
SecurityWeek -
Exploitation of React2Shell Surges
Exploitation of React2Shell has surged as more threat actors attempt to exploit the critical React vulnerability CVE-2025-55182, which can enable unauthenticated remote code execution via specially crafted HTTP requests in React version 19 with Server…
SecurityWeek -
Sneeit WordPress RCE Exploited in the Wild While ICTBroadcast Bug Fuels Frost Botnet Attacks
A critical security flaw in the Sneeit Framework plugin for WordPress is being actively exploited in the wild, according to Wordfence. The remote code execution vulnerability, CVE-2025-6389 (CVSS 9.8), affects all versions prior to and including 8.3 and was…
The Hacker News -
U.S. CISA adds a Meta React Server Components flaw to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Meta React Server Components flaw, tracked as CVE-2025-55182 with a CVSS score of 10.0, to its Known Exploited Vulnerabilities catalog. The vulnerability is a pre-authentication remote…
Security Affairs -
A week in security (December 1 – December 7)
A week in security (December 1 – December 7) rounds up a string of notable cybersecurity stories curated by Malwarebytes Labs, published on December 8, 2025. The recap highlights Leaks show Intellexa burning zero-days to keep Predator spyware running, dated…
Malwarebytes -
MuddyWater Deploys UDPGangster Backdoor in Targeted Turkey-Israel-Azerbaijan Campaign
The Iranian hacking group MuddyWater has been observed deploying a new backdoor called UDPGangster, which uses UDP for its command-and-control communications in a targeted Turkey-Israel-Azerbaijan campaign. According to Fortinet FortiGuard Labs, the malware…
The Hacker NewsMuddyWater -
Python Workers redux: fast cold starts, packages, and a uv-first workflow
As of 8 December 2025, Cloudflare’s Python Workers are described as having exceptionally fast cold starts, thanks to dedicated memory snapshots and a uv-first workflow that integrates with uv tooling and the pywrangler pipeline. The update confirms that…
Cloudflare -
Windows 11 Agenda View is Back, But Built on WebView 2 with Performance Overhead
Windows 11 Agenda View is back, but not as a native feature; Microsoft is rebuilding it with the WebView 2 Runtime, a move that comes with noticeable performance overhead. According to Windows Latest, preview builds show that enabling the agenda view…
SecurityOnline -
Pixel Phone Turns into Webcam for Nintendo Switch 2 via USB, No Accessory Needed
Pixel phones can now act as external webcams for the Nintendo Switch 2 by connecting via USB, eliminating the need for dedicated accessories or third-party apps. The feature is enabled by Google’s November Pixel Drop system update, which allows Pixel devices…
SecurityOnline -
Meta Reverses Course: Strikes Deals with CNN, Le Monde to Feed Licensed News to Meta AI
According to Axios, Meta has struck commercial agreements with multiple news publishers to supply Meta AI with legally licensed, real-time news content, enabling more accurate responses to ongoing events. The company had already established a multi-year paid…
SecurityOnline -
EU Fines X €120 Million for DSA Violation Over ‘Deceptive’ Blue Check Verification
According to the European Commission, the EU has fined X €120 million for breaches of the Digital Services Act related to its Blue Check verification system, advertising-transparency rules and researchers’ data access. The ruling finds that X’s Blue Check…
SecurityOnline -
Meta Fixes ‘Broken’ Support: Rolling Out AI Assistants and New Recovery Hubs
Meta says it is rolling out a new Support Hub on Facebook and Instagram, unifying all assistance tools into a single entry point, in a bid to repair its noted broken support experience. The rollout includes a new AI chat feature for questions about account…
SecurityOnline -
-
High-Severity Duc Disk Tool Flaw (CVE-2025-13654) Risks DoS and Information Leak via Integer Underflow
According to CERT Coordination Center (CERT/CC), a stack-based buffer overflow in Duc, a Linux disk usage indexing tool, has been disclosed as CVE-2025-13654. The flaw resides in the core Duc library, within the buffer_get function in buffer.c, and is caused…
SecurityOnline -
“SeedSnatcher” Android Malware Targets Crypto Users, Using Overlay Phishing and BIP 39 Validation to Steal Seed Phrases
SeedSnatcher is an Android malware campaign that targets cryptocurrency users by masquerading as a wallet app called Coin and employing overlay phishing and BIP 39 validation to steal seed phrases. Distributed mainly through Telegram and social channels, it…
SecurityOnline -
Russian APT UTA0355 Steals Microsoft 365 OAuth Tokens via Fake Security Conference Lures and WhatsApp Support
A new report from Volexity details a targeted phishing campaign by the Russian threat actor UTA0355, which impersonates prestigious international security conferences to steal Microsoft 365 OAuth tokens. The operation relies on polished fake event sites for…
SecurityOnlineUTA0355
