News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Tue 9 Dec 2025· 60 articles
-
Microsoft Patch Tuesday, December 2025 Edition
Microsoft’s December 2025 Patch Tuesday fixed at least 56 security flaws across Windows and supported software, with one zero-day already being exploited and two publicly disclosed vulnerabilities addressed. December 9, 2025 saw a total of 1,129…
Krebs on Security -
Microsoft Fixes Exploited Zero Day in Light Patch Tuesday
Microsoft has fixed an exploited zero-day in this month’s lighter Patch Tuesday, with the actively exploited flaw identified as CVE-2025-62221, which Microsoft notes has a CVSS score of 7.8 and affects the Windows Cloud Files Mini Filter Driver, enabling a…
Dark Reading -
Ivanti warns customers of new EPM flaw enabling remote code execution
Ivanti has disclosed a newly published vulnerability in its Endpoint Manager (EPM) solution, tracked as CVE-2025-10573 with a CVSS score of 9.6, described as a Stored XSS that could allow a remote unauthenticated attacker to execute arbitrary JavaScript in…
Security Affairs -
Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack
The Shai-Hulud 2.0 supply chain campaign represents a significant cloud-native ecosystem compromise, with attackers grafting malicious code into npm packages to harvest credentials and secrets. It involves malicious code that runs during the preinstall phase…
Microsoft -
Adobe Patches Nearly 140 Vulnerabilities
According to Adobe, the company rolled out patches for nearly 140 vulnerabilities across its products this week, with the Experience Manager update alone addressing 117 issues, 116 of which are cross-site scripting flaws. ColdFusion received fixes for 12…
SecurityWeek -
Microsoft Patches 57 Vulnerabilities, Three Zero-Days
Microsoft has issued patches for 57 vulnerabilities in its December 2025 security updates, including three zero-days. The exploited zero-day, tracked as CVE-2025-62221 with a CVSS of 7.8, is a use-after-free in the Windows Cloud Files Mini Filter Driver that…
SecurityWeek -
Packer-as-a-Service Shanya Hides Ransomware, Kills EDR
Packer-as-a-Service Shanya is the latest addition to an emerging obfuscation market that augments ransomware, according to Sophos, which published research on the packer family on 6 December 2025. Shanya acts as an EDR killer, dropping a clean driver tied to…
Dark Reading -
Microsoft Names New Operating CISOs in Strategic Move to Strengthen Cyber Defense
According to SecurityWeek, Microsoft has promoted two executives to Operating CISO roles as part of a broader shift to AI-driven defence and tighter operational oversight under Global CISO Igor Tsyganskiy. Promoted are Geoff Belknap, now Operating CISO for…
SecurityWeek -
North Korea-linked Actors Exploit React2Shell to Deploy New EtherRAT Malware
Threat actors with ties to North Korea have likely become the latest to exploit the recently disclosed React2Shell flaw in React Server Components to deploy a previously undocumented remote access trojan dubbed EtherRAT. According to Sysdig, EtherRAT…
The Hacker News -
Prime Security Raises $20 Million to Build Agentic Security Architect
Prime Security has announced a $20 million Series A funding round to advance its Agentic Security Architect, an AI-powered platform described as autonomously conducting security design reviews and proactively identifying design flaws across development work.…
SecurityWeek -
Changing the physics of cyber defense
In Changing the physics of cyber defence, John Lambert explains that threat actors build attack graphs to map ways into a target and pivot within an environment, a concept Microsoft argues defenders should mirror to see how risks propagate. He describes how…
Microsoft -
Analysts Warn of Cybersecurity Risks in Humanoid Robots
Analysts warn that humanoid robots bring a new layer of cybersecurity risk, with experts noting that securing these systems is exceptionally difficult because a robot is a system of systems—a network of networks including sensors, actuators, and a…
Dark Reading -
Webinar Today: Inside the First 72 hours of a Cyber Event
Webinar Today: Inside the First 72 hours of a Cyber Event explains how GRC and SOC teams can turn shared threat intelligence into faster action, clearer communication, and stronger organisational resilience during a critical incident. The live session,…
SecurityWeek -
Defense Bill Would Require New Cyber Requirements for Some DoD Telecom Contracts
A defence bill released by the House Armed Services Committee would require new cyber protections for certain DoD telecom contracts, applying to services used for sensitive national security functions under the National Defense Authorization Act for Fiscal…
DataBreaches -
Four Threat Clusters Using CastleLoader as GrayBravo Expands Its Malware Service Infrastructure
Four distinct threat activity clusters have been observed using CastleLoader, bolstering the view that the loader is offered as a malware-as-a-service (MaaS) tool. According to Recorded Future’s Insikt Group, the threat actor behind CastleLoader has been…
The Hacker NewsGrayBravo -
Tell the truth, or someone will tell it for you — Trumbull County, Ohio edition
According to SuspectFile, Trumbull County (Ohio) was hit by a severe cyberattack in the first days of November 2025, carried out by the ransomware group Anubis. Anubis has published approximately 350 GB of documents on its data leak site, claiming they were…
DataBreaches -
React2Shell Attacks Linked to North Korean Hackers
North Korean threat actors are believed to be behind CVE-2025-55182 exploitation delivering EtherRAT, according to Sysdig. The React2Shell vulnerability, officially tracked as CVE-2025-55182, can be exploited for unauthenticated remote code execution and…
SecurityWeek -
Broadside botnet hits TBK DVRs, raising alarms for maritime logistics
Mirai-based Broadside is targeting the maritime logistics sector by exploiting the command injection vulnerability CVE-2024-3721 in TBK DVR devices used on vessels. According to Cydome’s Cybersecurity Research Team, the campaign identifies an active…
Security Affairs -
US Posts $10 Million Bounty for Iranian Hackers
The US government has announced rewards of up to $10 million for information on members of the Iranian hacking group known as Emennet Pasargad, according to DataBreaches[.]Net. The group has previously been identified by several names, including Aria Sepehr…
DataBreaches -
Identity Security Firm Saviynt Raises $700 Million at $3 Billion Valuation
According to SecurityWeek, identity security firm Saviynt announced raising $700 million in a Series B growth-equity funding round that values the company at roughly $3 billion. The round was led by KKR, with participation from Sixth Street Growth,…
SecurityWeek -
Storm-0249 Escalates Ransomware Attacks with ClickFix, Fileless PowerShell, and DLL Sideloading
The threat actor known as Storm-0249 is likely shifting from its role as an initial access broker to a more advanced mix of techniques, including domain spoofing, DLL side-loading, and fileless PowerShell execution to enable ransomware attacks, according to…
The Hacker NewsStorm-0249 -
Prompt injection is a problem that may never be fixed, warns NCSC
Prompt injection is shaping up to be one of the most stubborn problems in AI security, according to the UK’s National Cyber Security Centre (NCSC), which warns it may never be “fixed” in the same way SQL injection was. The article notes that prompt injection…
Malwarebytes -
EU fines X $140m, tied to verification rules that make impostor scams easier
The European Commission fined social networking company X €120 million ($140 million) last week for lack of transparency with its European users, the first penalty under the EU’s Digital Services Act. According to the European Commission, the fine addressed…
Malwarebytes -
South Korea police raid e-commerce giant Coupang over data leak
South Korea police raided Coupang’s Seoul headquarters in a “search and seizure” operation as part of an investigation into a data leak that is believed to have affected almost two-thirds of the country’s population. Seventeen officers from the cyber…
DataBreaches -
US Posts $10 Million Bounty for Iranian Hackers
The US has announced rewards of up to $10 million for information on members of the Iranian hacking group known as Emennet Pasargad, with Mohammad Bagher Shirinkar named as the leader and Fatemeh Sedighian Kashi described as a long-time employee of the front…
SecurityWeek -
Proofpoint Completes $1.8 Billion Acquisition of Hornetsecurity
Proofpoint has completed the acquisition of Germany-based Hornetsecurity, valuing the deal at $1.8 billion, according to SecurityWeek. Hornetsecurity, a Microsoft 365 security solutions provider, will operate as a dedicated business unit focused on MSPs,…
SecurityWeek -
Gemini Enterprise No-Click Flaw Exposes Sensitive Data
Google has fixed a critical flaw in Gemini Enterprise, known as GeminiJack, that allowed attackers to plant hidden instructions in common documents to exfiltrate sensitive corporate data without any interaction from employees. Researchers at Noma Labs…
Dark Reading -
FinCEN Report: Reported Ransomware Incidents and Payments Reached All-Time High in 2023
According to FinCEN, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network, its Financial Trend Analysis on ransomware incidents in Bank Secrecy Act data shows a record level in 2023, with 1,512 incidents and $1.1 billion in payments.…
DataBreaches -
Deepfakes, AI resumes, and the growing threat of fake applicants
Malwarebytes’ Thursday piece, dated 9 December 2025, examines how deepfakes, AI resumes, and fake applicants are increasingly used to infiltrate hiring pipelines. It explains that fake applicants encompass AI-generated resumes, fake or borrowed identities,…
Malwarebytes -
New ‘Broadside’ Botnet Poses Risk to Shipping Companies
The security firm Cydome reports a new Mirai-based Broadside botnet that targets TBK Vision DVR devices in a campaign that could threaten the maritime logistics sector. The Broadside malware exploits CVE-2024-3721, an OS command injection flaw found in TBK…
SecurityWeek -
How to Streamline Zero Trust Using the Shared Signals Framework
The Hacker News explains how the Shared Signals Framework (SSF) can streamline Zero Trust by enabling real-time exchange of security events across tools that may not natively support SSF. It notes that 88% of organisations admit they've suffered significant…
The Hacker News -
Goodbye, dark Telegram: Blocks are pushing the underground out
Goodbye, dark Telegram: Blocks are pushing the underground out, published on 09 December 2025, reports that cybercriminals have long used Telegram as a platform for shadow operations. The analysis examined more than 800 blocked Telegram channels that existed…
securelist.com -
Google Adds Layered Defenses to Chrome to Block Indirect Prompt Injection Threats
Google has introduced layered protections in Chrome to counter indirect prompt injection threats generated by untrusted web content, including a new User Alignment Critic that independently checks the agent’s actions after planning. This feature works…
The Hacker News -
Equixly Raises $11 Million for AI-Powered API Penetration Testing
Equixly, the Florence-based Italian cybersecurity startup, disclosed on SecurityWeek that it has raised €10 million (about $11.6 million) in a Series A round, bringing its total funding to over $13.3 million. The round was led by 33N Ventures, with…
SecurityWeek -
Polish Police arrest 3 Ukrainians for possessing advanced hacking tools
Polish police have arrested three Ukrainian nationals on suspicion of using advanced hacking equipment to target IT systems and obtain sensitive defence-related data. The men, aged 43, 42 and 39, were detained after officers found Flipper hacking gear,…
Security Affairs -
The 25% Cut: Trump Allows NVIDIA H200 Export to China Under Strict Fee
On 9 December 2025, it was reported that U.S. President Donald Trump announced that NVIDIA will be permitted to ship its H200 AI accelerators to qualified customers in China and other countries, but only under strict conditions. The arrangement requires…
SecurityOnline -
Over 300,000 Individuals Impacted by Vitas Hospice Data Breach
According to the healthcare data breach tracker maintained by the US Department of Health and Human Services (HHS), more than 300,000 individuals are affected by a cybersecurity incident at Vitas Healthcare. Vitas, the largest for-profit hospice chain in the…
SecurityWeek -
CVE-2025-55182 Exploitation Hits the Smart Home
The article discusses the exploitation of the CVE-2025-55182 vulnerability, known as React2Shell, which affects Node.js applications that mishandle user-supplied JSON data, allowing remote command execution for attackers. Exploit attempts are reported to…
bitdefender.com -
STAC6565 Targets Canada in 80% of Attacks as Gold Blade Deploys QWCrypt Ransomware
According to Sophos, a targeted cyber campaign orchestrated by a threat activity cluster known as STAC6565 has focused on Canadian organisations. Sophos said it investigated almost 40 intrusions linked to the threat actor between February 2024 and August…
The Hacker NewsEarth Kapre -
Critical Emby Server Flaw (CVE-2025-64113) Allows Unauthenticated Admin Takeover
Emby Server has disclosed a critical vulnerability, CVE-2025-64113, that resides in the REST-based API and allows unauthenticated users to seize administrative privileges on unpatched systems, effectively giving an attacker full control over the media server…
SecurityOnline
