News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Mon 22 Dec 2025· 42 articles
-
Romanian Waters confirms cyberattack, critical water operations unaffected
Romanian Waters, the country’s national water management authority, says it suffered a ransomware attack over the weekend, with about 1,000 IT&C systems affected across the central organisation and 10 of its 11 regional offices. According to the National…
Security Affairs -
Threat Actors Exploit Zero-Day in WatchGuard Firebox Devices
A zero-day vulnerability in WatchGuard Firebox firewalls, tracked as CVE-2025-14733, is under active exploitation and can allow remote code execution on Firebox devices. The flaw is a critical out-of-bounds write in WatchGuard’s Fireware OS and affects…
Dark Reading -
Uzbek Users Under Attack by Android SMS Stealers
Uzbek users are being targeted by Android SMS stealer malware, with researchers noting a new wave of attacks that began in October and were observed by Group-IB on December 19. According to Group-IB, multiple threat groups are involved in the campaign,…
Dark Reading -
Fake WhatsApp API Package on npm Steals Messages, Contacts, and Login Tokens
A new malicious npm package called lotusbail masquerades as a WhatsApp API yet acts as a fully functional backdoor, capable of intercepting every message and linking the attacker’s device to a victim’s WhatsApp account. The package has been downloaded over…
The Hacker News -
Ukrainian hacker pleads guilty to Nefilim Ransomware attacks in U.S.
A Ukrainian national, Artem Aleksandrovych Stryzhak, aged 35, pleaded guilty in the United States to conspiracy to commit computer fraud in connection with Nefilim ransomware attacks. He was arrested in Spain in 2024 and extradited to the United States in…
Security Affairs -
Rising Tides: When Cybersecurity Becomes Personal – Inside the Work of an OSINT Investigator
According to SecurityWeek, Shannon Miller is an OSINT Investigator and Privacy Consultant who works to create domestic safety and reduce harm, highlighting how dangers are amplified for marginalized groups. Her work spans individuals, families, and corporate…
SecurityWeek -
How Workers powers our internal maintenance scheduling pipeline
Cloudflare explains how building a maintenance scheduler on Cloudflare Workers helped de-risk critical operations by providing a centralized, automated view of the network state and enforcing safety constraints for maintenance across data centres. The system…
Cloudflare -
54 Charged in US Over ATM Attacks Involving ‘Ploutus’ Malware
According to SecurityWeek, the US Department of Justice has announced charges against 54 individuals over a large ATM jackpotting scheme that used the Ploutus malware family. The suspects are described as leaders and members of the Venezuelan crime syndicate…
SecurityWeek -
Pornhub tells users to expect sextortion emails after data exposure
Pornhub has told its users to expect sextortion emails following a data exposure that affected Pornhub Premium members, with the company updating its online statement on the matter.
Malwarebytes -
12/22/25, 1:10 PM
Darktrace’s year-ahead piece, published on 22 December 2025, argues that 2026 will hinge on how organisations secure AI models, agents and the identities powering them, with AI and automation driving both risk and opportunity. It flags agentic AI as a…
darktrace.com -
MacSync macOS Malware Distributed via Signed Swift Application
MacSync macOS malware has sharpened its delivery by packaging the dropper as a code-signed and notarized Swift application inside a disk image masquerading as a zk-Call messenger installer, according to Jamf. The developers, who rebranded from Mac.c (first…
SecurityWeek -
Gambit Cyber Raises $3.4 Million in Seed Funding
Gambit Cyber has announced a seed funding round of $3.4 million, led by Expeditions with participation from Bitdefender Voyager Ventures. Founded in 2024 and based in Leiden, the Netherlands, the cybersecurity startup has built KnightGuard, an AI-native…
SecurityWeek -
Infy Returns: Iran-linked hacking group shows renewed activity
According to SafeBreach, renewed activity by the Iran-linked APT group Infy, also known as Prince of Persia, shows the threat actor remains active and potentially larger in scale than previously believed. Researchers note that Infy has been active since at…
Security AffairsInfy -
⚡ Weekly Recap: Firewall Exploits, AI Data Theft, Android Hacks, APT Attacks, Insider Leaks & More
According to The Hacker News, threats this week show attackers no longer need a single mega-breach, but are weaponising widely trusted tools such as firewalls and edge devices. Fortinet, SonicWall, Cisco, and WatchGuard reported exploits in their products,…
The Hacker News -
How to Browse the Web More Sustainably With a Green Browser
According to The Hacker News, eco-friendly browsing is about reducing digital load and energy use by choosing a green browser designed with sustainability in mind, such as Wave Browser. The piece argues that browsers run continuously and that heavy tabs,…
The Hacker News -
Ukrainian Nefilim Ransomware Affiliate Pleads Guilty in US
On 22 December 2025, a 35-year-old Ukrainian national, Artem Aleksandrovych Stryzhak, pleaded guilty in a US court to conspiracy to commit fraud related to computers after being extradited to the United States in late April 2025. Court documents indicate he…
SecurityWeek -
WatchGuard Patches Firebox Zero-Day Exploited in the Wild
WatchGuard has released patches for a critical-severity vulnerability in the Firebox firewalls, warning that it has been exploited in the wild. Tracked as CVE-2025-14733 (CVSS score of 9.3), the zero-day is an out-of-bounds write issue in the Fireware OS’s…
SecurityWeek -
University of Sydney discloses a data breach impacting 27,000 people
According to Security Affairs, the University of Sydney disclosed a data breach affecting about 27,500 individuals, after threat actors accessed an online code library and stole personal information. Exposed data includes roughly 10,000 current staff, 12,500…
Security Affairs -
UK Government Acknowledges It Is Investigating Cyber Incident After Media Reports
The British government says it is investigating a cyber incident after media reports claimed hackers linked to China accessed thousands of confidential documents held by the Foreign, Commonwealth and Development Office. According to Associated Press, Trade…
SecurityWeek -
A week in security (December 15 – December 21)
Malwarebytes Labs’ weekly roundup, published on 22 December 2025, highlights a busy period for cybersecurity news from 15 to 21 December. The article notes a run of notable items, including CISA warns ASUS Live Update backdoor is still exploitable, seven…
Malwarebytes -
Android Malware Operations Merge Droppers, SMS Theft, and RAT Capabilities at Scale
Threat researchers have observed Android malware operations merging dropper delivery, SMS theft, and remote‑access capabilities at scale, with Wonderland (formerly WretchedCat) used in attacks targeting Uzbek users. According to Group-IB, the Sudoku of the…
The Hacker News -
The $100M Stalker: Nefilim Ransomware Affiliate Pleads Guilty as DOJ Hunts Fugitive Leader
Artem Aleksandrovych Stryzhak, a Ukrainian national, pleaded guilty to conspiracy to commit computer fraud for his role in the Nefilim ransomware operation, according to the Department of Justice (DOJ). He joined the scheme in June 2021, operating under a…
SecurityOnline -
A Tiny Lifeline: Google Pushes Mandatory Gemini Upgrade to March 2026
On December 22, 2025, Google announced that its Gemini upgrade rollout will be deliberately slowed to ensure a seamless transition from Google Assistant, with the full migration continuing into 2026. According to Google, the earlier aggressive schedule has…
SecurityOnline -
Netflix’s Aurora Leap: How a Cloud-Native Shift Delivered 75% Faster Performance and 28% Lower Costs
Netflix has completed a large-scale migration of its relational database infrastructure to Amazon Aurora, moving away from self-managed databases on Amazon EC2 to a cloud-native, managed service. The transition is expected to deliver 75% faster data access…
SecurityOnline -
The Skill Tree Revolution: Why LinkedIn’s CEO Says Your 5-Year Plan is Dead
LinkedIn CEO Ryan Roslansky argues that the traditional five‑year career plan is dead in an era of accelerating AI and technological disruption, saying what matters now are short‑term, focused skill sprints. In an interview with Fortune, he notes that since…
SecurityOnline -
The 2nm Revolution: Samsung Unveils the Exynos 2600 with All–Big-Core Power & HPB Cooling
Samsung’s Exynos 2600 marks its first mass‑produced device on the 2nm GAA process and adopts an all–big‑core design, abandoning the prior efficiency‑core setup in favour of a pure Armv9.3 architecture with one C1-Ultra prime core at 3.8 GHz, three C1-Pro…
SecurityOnline -
Hang Up the Phone: Microsoft Retires Telephone Activation for an Online Portal
Microsoft is retiring its telephone activation service for an online activation portal, a change that appears to be recently implemented after years of use. The piece notes that during the Windows 8 era, MAK (Multiple Activation Key) volume licenses…
SecurityOnline -
The End of “Robotic” AI: OpenAI Unlocks Sliders to Control ChatGPT’s Warmth and Tone
OpenAI has rolled out new ChatGPT personalization options for all users to fine-tune word choice and tone in responses, including whether replies should use more or fewer emojis. The updates follow earlier tweaks after complaints that ChatGPT’s replies had…
SecurityOnline -
n8n Under Fire: Critical CVSS 10.0 RCE Vulnerability Grants Total Server Access
n8n has issued a critical security alert for CVE-2025-68613, a Remote Code Execution flaw rated CVSS 10.0 that could grant an attacker total server access. The flaw lies in the workflow expression evaluation system, where authenticated users’ expressions can…
SecurityOnline -
Waymo suspends service after power outage hit San Francisco
Waymo temporarily halted its San Francisco robotaxi service after a widespread blackout left multiple autonomous vehicles stranded on city streets. The power outage began at 1:09 p.m., peaked two hours later, and affected about 130,000 customers, with around…
Security Affairs -
Hackers Abuse “Device Codes” to Bypass Security and Seize Microsoft 365 Accounts
Hackers are abusing “Device Codes” to bypass security and seize Microsoft 365 accounts,according to Proofpoint Threat Research Team in a new report. The technique, dubbed Device Code Phishing, leverages the OAuth 2.0 device authorization grant flow, which is…
SecurityOnline -
The Silent Hijacker: New Cellik Android RAT Turns Legitimate Google Play Apps into Surveillance Tools
A new Android Remote Access Trojan called Cellik has emerged, offering a ready-made spyware package that piggybacks on legitimate Google Play Store apps to hijack smartphones. According to iVerify, Cellik is marketed as a comprehensive spyware MaaS platform,…
SecurityOnline -
Exim’s Poisoned Record: How a Failed Patch and SQL Injection Lead to Critical Heap Overflows
According to the National Institute of Standards and Technology (NIST), two critical Exim vulnerabilities were disclosed in Exim version 4.99, exposing a patched hole that could be exploited via SQLite integration to corrupt memory and seize server control.…
SecurityOnline -
“ClickFix” Trap: Fake Human Verification Leads to Qilin Ransomware Infection
A deception tactic known as “ClickFix” has become a gateway for large-scale ransomware campaigns, with researchers linking fake human verification prompts directly to the Qilin ransomware group. According to Counter Threat Unit (CTU) research, a compromised…
SecurityOnline -
TikTok’s “Scam-Yourself” Trap: How AuraStealer Malware Tricks Users into Hacking Their Own PCs
A deep-dive analysis by Gen Digital (Gen Threat Labs) has unveiled AuraStealer, an emerging Malware-as-a-Service that is gaining traction through a social-engineering campaign on TikTok, described as a “Scam-Yourself” trap. Active since July 2025, it is…
SecurityOnline -
The KGB’s All-Seeing Eye: How ResidentBat Spyware Turns Seized Phones into Total Surveillance Tools
According to RESIDENT[.]NGO and RSF Digital Security Lab, a new spyware family called ResidentBat has been used by the Belarusian KGB to turn journalists’ and activists’ smartphones into 24/7 surveillance devices. Unlike high-end zero-click exploits, this…
SecurityOnline -
Shadows of the North: Unmasking the Sprawling Cyber Infrastructure of the DPRK
A new collaborative investigation has exposed the intricate and overlapping infrastructure powering North Korea’s most notorious cyber operations, with researchers from Hunt[.]io and the Acronis Threat Research Unit mapping the operational backbone of the…
SecurityOnlineLazarus Group -
Apache NiFi’s Data Leak: How a High-Severity Deserialization Flaw Puts Your Asana Workflows at Risk
The Apache Software Foundation has issued a security advisory for Apache NiFi, highlighting a high-severity vulnerability tracked as CVE-2025-66524 with a CVSS score of 7.5 that affects the GetAsanaObject Processor used to integrate NiFi with Asana.…
SecurityOnline -
North Korea’s Kimsuky Upgrades DOCSWAP Malware to Hijack Smartphones via QR Codes
North Korea’s Kimsuky has rolled out an evolved version of the DOCSWAP malware to hijack smartphones, using QR codes and smishing to deploy a sophisticated Remote Access Trojan (RAT). First identified in March 2025, the campaign resurfaced with new upgrades…
SecurityOnlineKimsuky -
“Caminho” to Compromise: BlindEagle Hackers Hijack Government Emails in Colombia
According to Zscaler ThreatLabz, BlindEagle (also tracked as APT-C-36) struck a government agency under the Ministry of Commerce, Industry and Tourism in early September 2025, marking a shift in tactics for the group. The campaign used compromised internal…
SecurityOnline
