News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Thu 11 Dec 2025· 56 articles
-
Apache Struts 2 DoS Flaw (CVE-2025-64775) Risks Server Crash via File Leak in Multipart Request Processing
A significant denial-of-service fault has been identified in Apache Struts 2, CVE-2025-66675, which enables a file leak during multipart request processing and can rapidly exhaust server disk space, potentially causing a crash. The issue arises when file…
SecurityOnline -
High-Severity Zoom Rooms Flaw Risks Privilege Escalation via Downgrade Protection Bypass
Zoom Video Communications has issued a critical security update for Zoom Rooms, addressing vulnerabilities in Windows and macOS clients that could allow privilege escalation or information disclosure on conference room systems, with administrators urged to…
SecurityOnline -
Emergency Chrome Update: Google Patches New Zero-Day Under Active Attack
Google has pushed an urgent security update to the Stable Channel for Desktop, bringing Chrome to version 143.0.7499.109/110 to patch a high-severity zero-day that is being exploited in the wild. The focal point is a vulnerability tracked as issue 466192044,…
SecurityOnline -
High-Severity Jenkins Flaws Risk Unauthenticated DoS via HTTP CLI and XSS Via Coverage Reports
The Jenkins security advisory highlights high‑severity flaws that could enable unauthenticated DoS via the HTTP‑based CLI and stored XSS through Coverage Reports, potentially affecting CI/CD pipelines. The bundle’s most severe entry, CVE‑2025‑67635, targets…
SecurityOnline -
Gogs Zero-Day (CVE-2025-8110) Risks RCE for 700+ Servers via Symlink Path Traversal Bypass
Security researchers have uncovered a zero-day in Gogs (CVE-2025-8110) that allows attackers to bypass patches and execute arbitrary code on the server, with active exploitation reported as of 1 December 2025 and no official patch released. According to Wiz…
SecurityOnline -
High-Severity GitLab XSS Flaw (CVE-2025-12716) Risks Session Hijack via Malicious Wiki Pages
GitLab has rolled out a patch for a high-severity XSS flaw, CVE-2025-12716, that could allow an authenticated user to create malicious wiki pages and trick the system into performing actions on behalf of another user, potentially enabling session hijack. The…
SecurityOnline -
-
SpaceX IPO: Targeting a $1.5 Trillion Valuation to Fund Space Data Centers
Insiders reveal that SpaceX is pursuing an extraordinarily ambitious initial public offering, aiming to raise more than USD 30 billion and potentially setting a record headline by eclipsing the 2019 Saudi Aramco IPO. According to Reuters reports, the listing…
SecurityOnline -
China’s WARP PANDA APT Deploys BRICKSTORM Backdoor to Hijack VMware vCenter/ESXi and Azure Cloud
A CrowdStrike researchers have tracked a sophisticated cyber-espionage campaign extending through 2025, attributed to a China-nexus group known as WARP PANDA, which targets VMware vCenter servers and ESXi hosts. According to CrowdStrike, the operation…
SecurityOnlineWARP PANDA -
Unpatched TOTOLINK AX1800 Router Flaw Allows Unauthenticated Telnet & Root RCE
A critical vulnerability has been uncovered in the TOTOLINK AX1800 wireless router, with CERT Coordination Center (CERT/CC) noting that there is currently no official patch. The flaw allows remote attackers to bypass authentication and gain full…
SecurityOnline -
FBI/CISA Warn: Pro-Russia Hacktivists Target Critical Infrastructure Via Unsecured VNC HMIs
A coalition led by the FBI, CISA and the NSA has warned of opportunistic, pro-Russia hacktivists targeting critical infrastructure by exploiting unsecured VNC HMIs, according to Cybersecurity Advisory released on December 9, 2025. The groups are described as…
SecurityOnlineZ-Pentest Alliance -
Critical CCTV Flaw (CVE-2025-13607) Risks Video Feed Hijack & Credential Theft via Missing Authentication
The CVE-2025-13607 flaw has prompted a high-severity alert from The Cybersecurity and Infrastructure Security Agency (CISA), warning that networked CCTV cameras could be hijacked to view private feeds and steal administrative credentials. Described as…
SecurityOnline -
“React2Shell” Crisis: Critical Vulnerability Triggers Global Cyberattacks by State-Sponsored Groups
On 11 December 2025, security site coverage flagged a critical flaw in the React ecosystem, dubbed “React2Shell” (CVE-2025-55182) with a maximum CVSS score of 10.0, enabling unauthenticated full control of servers. Unit 42 researchers at Palo Alto Networks…
SecurityOnline -
Makop Ransomware Evolves: GuLoader and BYOVD EDR Killers Used to Attack RDP-Exposed Networks
Makop ransomware has evolved, now incorporating GuLoader and a suite of BYOVD EDR killers to target networks exposed via RDP, according to Acronis Threat Research Unit (TRU). The operators continue to rely on brute-forcing RDP credentials—often with…
SecurityOnline -
DeadLock Ransomware Deploys BYOVD EDR Killer by Exploiting Baidu Driver for Kernel-Level Defense Bypass
According to Cisco Talos, DeadLock is a financially motivated ransomware that deploys BYOVD techniques to neutralise endpoint protections before encryption. The attackers use a loader named EDRGay[.]exe alongside a legitimate Baidu Antivirus driver file,…
SecurityOnline -
Critical PCIe 6.0 Flaws Risk Secure Data Integrity via Stale Data Injection in IDE Mechanism
On 11 December 2025, CERT Coordination Center (CERT/CC) warned of three specification-level flaws in PCIe 6.0’s IDE mechanism that could let attackers with local access inject stale or corrupted data into secure data streams, potentially undermining data…
SecurityOnline
