News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 5 so far |
Thu 18 Dec 2025· 47 articles
-
SonicWall Edge Access Devices Hit by Zero-Day Attacks
SonicWall Edge Access Devices are being targeted by zero-day attacks that chain a new local privilege escalation with a previously disclosed critical flaw affecting SMA1000 appliances. CVE-2025-40602 is a medium-severity local privilege escalation (CVSS 6.6)…
Dark Reading -
Hewlett Packard Enterprise (HPE) fixed maximum severity OneView flaw
Hewlett Packard Enterprise (HPE) has fixed a maximum-severity flaw in its OneView software that could allow remote code execution, according to Hewlett Packard Enterprise advisory. The issue is tracked as CVE-2025-37164, with a CVSS score of 10.0, and…
Security Affairs -
INE Security Expands Across Middle East and Asia to Accelerate Cybersecurity Upskilling
INE Security is expanding across the Middle East and Asia to accelerate cybersecurity upskilling, driven by demand in the Kingdom of Saudi Arabia, the United Arab Emirates and Egypt. The company highlights its subscription-based learning paths, unlimited…
SecurityOnline -
DIG AI: Uncensored Darknet AI Assistant at the Service of Criminals and Terrorists
DIG AI is described as an uncensored darknet AI assistant that Resecurity says is being used by criminals to scale illicit activity on the Tor network, with activity spiking in Q4 2025 and accelerating during the Winter Holidays. According to Resecurity, the…
Security Affairs -
China-Aligned Threat Group Uses Windows Group Policy to Deploy Espionage Malware
A previously undocumented China-aligned threat cluster dubbed LongNosedGoblin has been attributed to a series of cyber attacks targeting governmental entities in Southeast Asia and Japan, with activity deemed to be for cyber espionage, according to ESET. The…
The Hacker News -
New Microsoft e-book: 3 reasons point solutions are holding you back
According to Microsoft Security Blog, patchwork tools slow defenders down and create blind spots as attack surfaces expand, leading many organisations to stitch together point solutions. The piece outlines three key lessons from the new e-book: the hidden…
Microsoft -
Why Organizations Are Adopting Label-Free Behavioral DLP
Why outbound email DLP needs reinventing, as explained in this article, is that breaches in 2025 increasingly arise from everyday human error rather than clever hacks, making “protection at the moment of send” essential. It cites that the global average cost…
darktrace.com -
UEFI Vulnerability in Major Motherboards Enables Early-Boot Attacks
Motherboard vendors including ASRock, Asus, Gigabyte, and MSI have disclosed a UEFI-related vulnerability that could enable early-boot DMA attacks. According to a CERT/CC advisory published on 18 December 2025, an attacker with physical access can exploit…
SecurityWeek -
HPE Patches Critical Flaw in IT Infrastructure Management Software
Hewlett Packard Enterprise (HPE) this week announced patches for a critical-severity remote code execution flaw in its OneView IT infrastructure management software. Tracked as CVE-2025-37164 (CVSS score of 10), the vulnerability can be exploited without…
SecurityWeek -
HPE OneView Flaw Rated CVSS 10.0 Allows Unauthenticated Remote Code Execution
Hewlett Packard Enterprise has resolved a maximum-severity flaw in OneView Software that, if exploited, could enable remote code execution by an unauthenticated user, according to Hewlett Packard Enterprise. The vulnerability is identified as CVE-2025-37164…
The Hacker News -
Announcing support for GROUP BY, SUM, and other aggregation queries in R2 SQL
Cloudflare has announced support for GROUP BY, SUM and other aggregation queries in R2 SQL, enabling SQL analyses over data stored in R2 Data Catalog.
Cloudflare -
The ghosts of WhatsApp: How GhostPairing hijacks accounts
Researchers have identified an active campaign targeting WhatsApp accounts, dubbed GhostPairing, which tricks victims into completing WhatsApp’s device-pairing flow and quietly adds the attacker’s browser as an invisible linked device. The attack relies on a…
Malwarebytes -
CISA Warns of Exploited Flaw in Asus Update Tool
18 December 2025: according to CISA, hackers have been exploiting a critical vulnerability in the now-discontinued Asus Live Update utility, tracked as CVE-2025-59374 with a CVSS score of 9.3, described as an embedded malicious code vulnerability introduced…
SecurityWeek -
ThreatsDay Bulletin: WhatsApp Hijacks, MCP Leaks, AI Recon, React2Shell Exploit and 15 More Stories
The ThreatsDay Bulletin flags a wave of familiar attack patterns evolving rather than disappearing, including a new GhostPairing method that hijacks WhatsApp by luring victims via a compromised account and a Facebook-style preview, prompting QR code or…
The Hacker News -
Chrome extension slurps up AI chats after users installed it for privacy
More than seven million users of a VPN extension for Google Chrome and Microsoft Edge found out this week that their data could be harvested after researchers at Koi Security revealed the browser extension had been logging users’ AI chats and sending them to…
Malwarebytes -
Dormant Iran APT is Still Alive, Spying on Dissidents
Dormant Iran APT Prince of Persia, also known as Infy, has re-emerged, with SafeBreach reporting that the group has been active throughout the past decade while spying on Iranian citizens and individuals in Iraq, Turkey, India, Europe, and Canada. Described…
Dark Reading -
The Case for Dynamic AI-SaaS Security as Copilots Scale
The Hacker News piece argues that AI copilots and agents are rapidly permeating SaaS apps, creating AI sprawl as data moves across Zoom, Slack, Microsoft 365, Salesforce, and ServiceNow. It warns that traditional, static governance struggles to keep up as AI…
The Hacker News -
113,000 Impacted by Data Breach at Virginia Mental Health Authority
Richmond Behavioral Health Authority (RBHA), the Virginia mental health services provider serving the city of Richmond, says personal information for more than 113,000 people was stolen in a recent ransomware attack. On 29 September the attack hit RBHA’s…
SecurityWeek -
IoT Security Firm Exein Raises €100 Million
Exein, an Italy-based IoT security firm, announced on Thursday that it has raised another €100 million ($117 million) to accelerate its global expansion, bringing its total funding in 2025 to €170 million ($200 million). The round was led by Blue Cloud…
SecurityWeek -
CVE-2025-20393: Cisco AsyncOS Zero-Day Impacts Secure Email Appliances
CVE-2025-20393 is a zero-day vulnerability in Cisco AsyncOS Software that Cisco has described as maximum-severity and is already being exploited in real-world attacks against Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances. The…
SOCRadar -
U.S. CISA adds Cisco, SonicWall, and ASUS flaws to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Cisco, SonicWall and ASUS flaws to its Known Exploited Vulnerabilities (KEV) catalog, listing CVE-2025-20393 (Cisco Multiple Products Improper Input Validation, CVSS 10.0),…
Security Affairs -
France Probes ‘Foreign Interference’ After Remote Control Malware Found on Passenger Ferry
According to Associated Press, France’s counterespionage agency is examining a suspected cyberattack plot targeting an international passenger ferry, with a Latvian crew member in custody facing charges of acting for an unnamed foreign power. Interior…
SecurityWeek -
SonicWall Patches Exploited SMA 1000 Zero-Day
SonicWall has warned that threat actors have been exploiting a zero-day in the SMA 1000 appliance management console (AMC), a vulnerability tracked as CVE-2025-40602 with a CVSS of 6.6, disclosed on 18 December 2025. The company says the flaw is a local…
SecurityWeek -
GhostPairing campaign abuses WhatsApp device linking to hijack accounts
GhostPairing is a campaign that abuses WhatsApp’s device-linking feature to hijack accounts via pairing codes, without requiring authentication, according to Gen Digital. The campaign was first observed in Czechia, but Gen Digital warns that it can spread…
Security Affairs -
Kimsuky Spreads DocSwap Android Malware via QR Phishing Posing as Delivery App
The North Korean threat actor known as Kimsuky has been linked to a campaign that distributes a new Android malware variant called DocSwap via QR codes hosted on phishing sites spoofing CJ Logistics. The group employs QR codes and alert pop-ups to coax…
The Hacker NewsKimsuky -
China-Linked Hackers Exploiting Zero-Day in Cisco Security Gear
Cisco has warned that a China-linked threat group is exploiting a new zero-day, tracked as CVE-2025-20393, to target some Secure Email Gateway and Secure Email and Web Manager appliances. The zero-day is described as critical and can be used to run arbitrary…
SecurityWeek -
CISA Flags Critical ASUS Live Update Flaw After Evidence of Active Exploitation
According to CISA, the U.S. Cybersecurity and Infrastructure Security Agency, a critical flaw in ASUS Live Update has been added to the Known Exploited Vulnerabilities (KEV) catalog after evidence of active exploitation. The vulnerability is tracked as…
The Hacker News -
Cisco Warns of Active Attacks Exploiting Unpatched 0-Day in AsyncOS Email Security Appliances
Cisco has alerted users to a maximum-severity zero-day in Cisco AsyncOS that has been actively exploited in campaigns targeting Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. The vulnerability, tracked as CVE-2025-20393 with a CVSS score…
The Hacker News -
The Developer Win: GitHub Postpones Self-Hosted Runner Fee After Massive Community Outcry
According to GitHub, the platform originally announced that from 1 March 2026 it would charge an additional platform fee of USD 0.002 per minute for using self-hosted runners in GitHub Actions. Following a wave of strong backlash, GitHub postponed the…
SecurityOnline -
CVE-2025-37164 (CVSS 10.0): Unauthenticated HPE OneView RCE Grants Total Control Over Data Centers
CVE-2025-37164 (CVSS 10.0) is a critical, unauthenticated Remote Code Execution vulnerability in Hewlett Packard Enterprise’s OneView software. According to Hewlett Packard Enterprise (HPE), the flaw permits a remote attacker to execute arbitrary code…
SecurityOnline -
CISA Alert: Chinese Hackers Weaponize CVSS 10 Cisco Zero-Day & SonicWall Exploit Chains
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive adding three critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, signalling active weaponisation in the wild. Topping the list is…
SecurityOnline -
Cisco Zero-Day Siege: Chinese Group UAT-9686 Deploys ‘Aqua’ Malware via CVSS 10 Root Exploit
A critical zero-day in Cisco’s Secure Email Gateway and Secure Email and Web Manager appliances is under active siege, with attackers gaining full control over affected gateways. The flaw, tracked as CVE-2025-20393, carries a maximum CVSS score of 10 and…
SecurityOnlineUAT-9686 -
Zero-Day Warning: Hackers Chain SonicWall SMA1000 Flaws for Unauthenticated Root RCE
According to SonicWall’s advisory, the SMA1000 series remote access gateways are affected by a vulnerability tracked as CVE-2025-40602, which is being weaponised in combination with CVE-2025-23006 to achieve unauthenticated remote code execution with root…
SecurityOnline -
North Korea-Linked Hackers Steal $2.02 Billion in 2025, Leading Global Crypto Theft
According to Chainalysis' Crypto Crime Report, threat actors tied to North Korea accounted for at least $2.02 billion of more than $3.4 billion stolen from January through early December 2025, marking a 51% year‑over‑year increase. The report describes this…
The Hacker News -
Academic Ambush: How the Forum Troll APT Hijacks Scholars’ Systems via Fake Plagiarism Reports
According to Kaspersky Labs, a relentless Advanced Persistent Threat group known as “Forum Troll” has pivoted from corporate networks to targeting the academic elite, conducting a precision phishing campaign against Russian political scientists and…
SecurityOnline -
Locked Out of the Cloud: Hackers Use AWS Termination Protection to Hijack ECS for Unstoppable Crypto Mining
According to Amazon GuardDuty, cybercriminals began a coordinated campaign on 2 November 2025 to hijack AWS resources such as Amazon EC2 and Amazon ECS using compromised IAM credentials to run unauthorised cryptocurrency mining. The attackers operated from…
SecurityOnline -
Blurred Deception: Russian APT Targets Transnistria and NATO with High-Pressure Phishing Lures
According to StrikeReady Labs, a Russian APT group launched a targeted credential harvesting campaign against Transnistria’s governing body, beginning on 5 December 2025. The attackers spoofed the Presidential Administration, emailing employees with the…
SecurityOnline -
“Better Auth” Framework Alert: The Double-Slash Trick That Bypasses Security Controls
A high-severity vulnerability in Better Auth, a rapidly growing TypeScript authentication framework, could allow attackers to bypass critical access controls with a simple URL manipulation, according to security advisory. Tracked with a CVSS score of 8.6,…
SecurityOnline -
Ink Dragon’s Global Mesh: How Chinese Spies Turn Compromised Government Servers into C2 Relay Nodes
A Check Point Research report describes Ink Dragon (also known as Earth Alux or APT41 affiliates) as a Chinese cyber-espionage group that is rewriting persistence rules by turning compromised government servers into a living command network. The group…
SecurityOnline -
CVE-2025-46295 (CVSS 9.8): Critical Apache Commons Text Flaw Risks Total Server Takeover
CVE-2025-46295, rated CVSS 9.8, is a critical Apache Commons Text flaw that could have enabled remote code execution across unpatched systems, according to the article. The vulnerability stems from the library’s string interpolation features, with versions…
SecurityOnline
