News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 16 so far |
Fri 19 Dec 2025· 58 articles
-
The Grand Divorce: TikTok Signs Landmark Deal to Hand U.S. Control to Oracle-Led Group
The Grand Divorce moves closer to completion as TikTok’s U.S. operations plan advances, with a new entity named TikTok US Data Security Joint Venture LLC taking responsibility for safeguarding U.S. data, algorithmic security, content moderation and software…
SecurityOnline -
New UEFI Flaw Enables Early-Boot DMA Attacks on ASRock, ASUS, GIGABYTE, MSI Motherboards
Security researchers have disclosed a UEFI vulnerability affecting a range of motherboards from ASRock, ASUSTeK Computer, GIGABYTE and MSI, which could allow early‑boot direct memory access (DMA) attacks across architectures that implement UEFI and IOMMU.…
The Hacker News -
Yet another DCOM object for lateral movement
Kaspersky’s Securelist report, published on 19 December 2025, describes a previously undocumented DCOM object used for command execution and persistence via Control Panel items, focusing on three exposed objects: ShellWindows, ShellBrowserWindow and MMC20.…
securelist.com -
Rust’s First Breach: CVE-2025-68260 Marks the First Rust Vulnerability in the Linux Kernel
CVE-2025-68260 has been fixed in the Linux kernel, marking the first Rust code vulnerability formally assigned to the mainline kernel, according to the article. Greg Kroah-Hartman reported the issue, which affects the Android Binder driver rewritten in Rust…
SecurityOnline -
Visualizations Weaponized: New Kibana Flaw Allows XSS Attacks via Vega Charts
Elastic has issued important security updates for Kibana after discovering a high-severity vulnerability that allows attackers to turn charts and graphs into weapons. Tracked as CVE-2025-68385, the flaw carries a CVSS score of 7.2 and enables authenticated…
SecurityOnline -
Log4j’s Security Blind Spot: New TLS Flaw Lets Attackers Intercept Sensitive Logs Despite Encryption
The Apache Software Foundation has released a security update for Log4j addressing a moderate-severity vulnerability, tracked as CVE-2025-68161, that could allow attackers to intercept sensitive log data in transit. The flaw affects the Socket Appender by…
SecurityOnline -
WatchGuard Under Siege: Critical CVSS 9.3 Zero-Day Exploited in the Wild to Hijack Corporate Firewalls
According to WatchGuard, a critical zero-day vulnerability in Fireware OS iked, tracked as CVE-2025-14733 with a CVSS score of 9.3, allows remote unauthenticated attackers to execute arbitrary code and hijack corporate Firebox firewalls. The flaw resides in…
SecurityOnline -
Kubernetes Alert: Headlamp Flaw (CVE-2025-14269) Lets Unauthenticated Users Hijack Helm Clusters
A high-severity vulnerability in Headlamp, CVE-2025-14269, could let unauthenticated attackers hijack Helm operations in Kubernetes via the Headlamp UI. The flaw stems from how credentials are handled when interfacing with Helm, and it carries a CVSS of 8.8,…
SecurityOnline -
FreeBSD Network Alert: Malicious IPv6 Packets Can Trigger Remote Code Execution via resolvconf (CVE-2025-14558)
A high-severity vulnerability has been disclosed in the FreeBSD networking stack, allowing attackers to achieve remote code execution by sending a malicious IPv6 router advertisement. Tracked as CVE-2025-14558, the flaw stems from a lack of input…
SecurityOnline -
Roundcube Alert: High-Severity SVG XSS and CSS Sanitizer Flaws Threaten Webmail Privacy
The Roundcube Webmail project has issued security updates for its 1.6 and 1.5 LTS branches to fix two high-severity flaws that could allow attackers to execute malicious scripts or leak sensitive information through emails. Both vulnerabilities carry a CVSS…
SecurityOnline -
YouTube Ghost Network: The New GachiLoader Malware Hiding in Your Favorite Video Links
A new Check Point Research investigation has revealed the YouTube Ghost Network, a campaign that weaponises a massive network of compromised YouTube accounts to spread a loader called GachiLoader behind seemingly innocent video links. The threat is targeted…
SecurityOnline -
Poisoned Dependencies: How Nethereum.All and 10M+ Fake Downloads Looted .NET Crypto Developers
A recent ReversingLabs report details a sophisticated NuGet supply chain campaign targeting .NET developers in the crypto space, centred on a malicious package called Nethereum[.]All that impersonates the legitimate Ethereum integration library. The campaign…
SecurityOnline -
Early-Boot Attack: UEFI Flaw in ASRock, ASUS, & MSI Boards Lets Hackers Bypass OS Security via PCIe
According to CERT/CC’s vulnerability note, a flaw in UEFI firmware implementations leaves a window in the early-boot phase where a PCIe device with physical access can read and write system memory before the OS loads, effectively bypassing OS protections.…
SecurityOnline -
Mario’s Deadly Upgrade: RansomHouse Unveils Dual-Key Encryption to Defeat Backups and Recovery
RansomHouse’s Jolly Scorpius group has unveiled a major upgrade to its encryption engine, Mario, shifting from a simple linear model to a multi-layered, dynamic chunking approach designed to complicate analysis and defeat traditional backups and recovery.…
SecurityOnlineRansomHouse -
Phantom v3.5 Alert: New Info-Stealer Disguised as Adobe Update Uses SMTP to Loot Digital Lives
Phantom v3.5 has emerged as an info-stealer masquerading as a routine software update, with analysis from K7 Security Labs detailing a fake “Adobe 11.7.7 installer” used to deploy a data-extraction toolkit. First detected in late October 2025, the campaign…
SecurityOnline -
The Final Cut: Why the Oscars are Leaving ABC for a YouTube-Only Future in 2029
According to The Academy of Motion Picture Arts and Sciences (AMPAS), the Oscars will be livestreamed exclusively on YouTube starting in 2029, ending a long-standing broadcast partnership with ABC, the Disney-owned US network. ABC will retain broadcast…
SecurityOnline -
VPN Betrayal: Popular “Free” Extensions Caught Siphoning 8 Million Users’ Private AI Chats
According to KOI, the Urban VPN Proxy browser extension—whose cumulative installations have reached 8 million—has been found exploiting script-based hijacking of browser APIs to siphon off users’ sensitive information, specifically targeting conversations…
SecurityOnline -
Flash Forward: Google’s New Gemini 3 Flash Shatters Efficiency Records and Rival Flagships
Google has unveiled Gemini 3 Flash, a high-efficiency variant positioned to deliver near‑flagship, pro‑level reasoning at a significantly lower computational cost. According to figures released by Google, this lightweight model has outperformed OpenAI’s…
SecurityOnline
