News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Tue 23 Dec 2025· 51 articles
-
Red Hat GitLab breach exposes data of 21,000 Nissan customers
Nissan disclosed a data breach tied to a self-managed GitLab instance used by Red Hat Consulting, with data exposed from 21,000 Nissan customers. According to Security Affairs, the compromised data included names, addresses, phone numbers, partial email…
Security Affairs -
Industry Continues to Push Back on HIPAA Security Rule Overhaul
Industry opposition to the proposed HIPAA Security Rule overhaul is solidifying as 100 healthcare organisations, led by CHIME, urge the rule to be withdrawn and revised. In January 2025, the US Department of Health and Human Services announced the update…
Dark Reading -
ServiceNow Buys Armis for $7.75B, Gets 'AI Control Tower'
ServiceNow has agreed to acquire Armis for $7.75 billion in an all-cash deal, with closing expected in the second half of 2026 subject to shareholder and regulatory approvals, making it the largest purchase by the IT service management provider to date and…
Dark Reading -
Amazon Fends Off 1,800 Suspected DPRK IT Job Scammers
Amazon has said it blocked more than 1,800 suspected DPRK operatives from joining the company since April 2024, highlighting the scale of the IT worker scam problem. The Amazon CSO’s LinkedIn post notes that there has also been 27% more DPRK-affiliated…
Dark Reading -
CEO of Health Care Software Company Sentenced for $1B Fraud Conspiracy
According to the U.S. Department of Justice, an Arizona man was sentenced on a Friday to 15 years in prison and ordered to pay more than $452 million in restitution for conspiring to defraud Medicare and other federal health care benefit programs of more…
DataBreaches -
Justice Department Announces Seizure of Stolen-Password Database Used in Bank Account Takeover Fraud
The Justice Department has seized a web domain and database used to run bank account takeover fraud, the domain being web3adspanels[.]org, which hosted a backend server storing stolen login credentials. The operation followed a month after the FBI issued a…
DataBreaches -
New OMB Memo Imposes Detailed New Disclosure Requirement on Government Contractors Utilizing LLMs
A new memo from the Office of the Management of the Budget imposes detailed disclosure requirements on government contractors using large language models (LLMs), a development published on 23 December 2025. According to the Office of the Management of the…
DataBreaches -
CISA Releases Cybersecurity Performance Goals 2.0 for Critical Infrastructure
According to Inside Privacy, on 11 December 2025 the U.S. Cybersecurity and Infrastructure Security Agency released Cybersecurity Performance Goals 2.0 (CPG 2.0), updating its core, voluntary cybersecurity practices for critical infrastructure owners and…
DataBreaches -
Hilton Central School District – Audit Follow-Up (2022M-200-F)
According to NYS Comptroller Thomas P. DiNapoli, the Hilton Central School District’s follow-up audit, issued 5 December 2025, assessed progress in implementing recommendations from the 2022 audit on Network Access Controls as of August 2025. The review…
DataBreaches -
Baker University discloses December 2024 breach
Baker University in Kansas disclosed a December 2024 data breach, stating that suspicious activity on certain systems led to a network outage and an investigation found unauthorized access and/or acquisition of files between 2 December 2024 and 19 December…
DataBreaches -
LOSFA sends out letter to students warning of ‘data security incident’ involving information
The Louisiana Office of Student Financial Assistance (LOSFA) has sent a letter to students warning of a data security incident in which authorized access to certain LOSFA systems occurred and an unauthorized party accessed or removed certain files. The…
DataBreaches -
Romanian Waters confirms cyberattack, critical water operations unaffected
Romanian Waters confirms a ransomware cyber attack over the weekend, with authorities stressing that critical water operations were not affected. According to the National Cyber Security Directorate (DNSC), about 1,000 computer systems across the central…
DataBreaches -
Sprawling 'Operation Sentinel' Neutralizes African Cybercrime Syndicates
Operation Sentinel, a multi-country cybercrime operation coordinated through Interpol, has broken up several prolific African crime networks. The operation spanned 19 countries and led to 574 arrests and the seizure of about $3 million, alongside takedowns…
Dark Reading -
Critical n8n flaw could enable arbitrary code execution
A critical flaw in the n8n automation platform could allow an authenticated attacker to execute arbitrary code under specific conditions, with CVE-2025-68613 carrying a CVSS score of 9.9. The advisory notes that the package gets about 57,000 downloads per…
Security Affairs -
Two Chrome Extensions Caught Secretly Stealing Credentials from Over 170 Sites
Cybersecurity researchers have uncovered two malicious Google Chrome extensions with the same name and publisher that are designed to intercept traffic and steal credentials, marketed as a “multi-location network speed test plug-in” for developers and…
The Hacker News -
ServiceNow to Acquire Armis for $7.75 Billion in Cash
According to SecurityWeek, IT services giant ServiceNow has agreed to acquire cybersecurity company Armis in an all-cash deal for $7.75 billion. The announcement follows Armis’ recent funding round which raised $435 million, and comes as Armis had been…
SecurityWeek -
A framework for securing AI in the enterprise
Darktrace’s December 2025 blog post argues that securing AI in the enterprise requires a lifecycle-focused framework that spans models, data and agents, rather than relying on traditional security silos. It outlines five risk categories aligned to distinct…
darktrace.com -
Hacktivists claim near-total Spotify music scrape
Hacktivist group Anna’s Archive claims to have scraped almost all of Spotify’s catalog and is seeding it via BitTorrent, turning the streaming platform into a roughly 300 TB pirate “preservation archive.” The group’s blog states that they scraped metadata…
Malwarebytes -
Nissan Confirms Impact From Red Hat Data Breach
Nissan has disclosed the impact of a data breach involving a self-managed GitLab instance used by Red Hat’s consulting team, with the incident occurring in late September. The breach led to the theft of the personal information of 21,000 Nissan Fukuoka Sales…
SecurityWeek -
Feds Seize Password Database Used in Massive Bank Account Takeover Scheme
The SecurityWeek article reports that the US Justice Department announced the seizure of a web domain and a password database used by a cybercrime group to steal millions from bank accounts. According to the Justice Department, the domain web3adspanels[.]org…
SecurityWeek -
Assessing SIEM effectiveness
Assessing SIEM effectiveness is essential because a SIEM’s value hinges on its configuration and the data sources it connects to, with its impact evolving as infrastructure and attacker techniques change. According to the article, the assessment draws on an…
securelist.com -
INTERPOL Arrests 574 in Africa; Ukrainian Ransomware Affiliate Pleads Guilty
INTERPOL says a law enforcement operation coordinated across Africa resulted in the arrest of 574 suspects from 19 countries and the recovery of $3 million, with the initiative named Operation Sentinel running from 27 October to 27 November 2025 and focusing…
The Hacker News -
Passwd: A walkthrough of the Google Workspace Password Manager
Passwd is a Google Workspace–focused password manager designed for organisations, offering secure credential storage, controlled sharing, and seamless integration with Google tools. Encryption uses AES-256 and happens before storage, with a zero-knowledge…
The Hacker News -
NPM Package With 56,000 Downloads Steals WhatsApp Credentials, Data
A malicious NPM package, Lotusbail, has been described as a WhatsApp Web API library that steals users’ data while providing legitimate functionality, according to SecurityWeek. The package, a fork of the Baileys library, has been available in the NPM…
SecurityWeek -
Italy Antitrust Agency Fines Apple $116 Million Over Privacy Feature; Apple Announces Appeal
Italy’s antitrust authority fined Apple 98.6 million euros ($116 million) on 23 December 2025 after finding that operating its privacy feature restricted App Store competition, according to Associated Press. The agency said the issue lay not with the policy…
SecurityWeek -
Why Third-Party Access Remains the Weak Link in Supply Chain Security
Attackers are increasingly exploiting trusted third-party components to compromise systems and spread malicious activity across connected targets, meaning your next breach may begin with someone you trust. The article notes that more than half of surveyed…
Security Affairs -
574 Arrested, $3 Million Seized in Crackdown on African Cybercrime Rings
Interpol announced that authorities in Africa made 574 arrests and recovered $3 million in a major crackdown on multiple cybercrime networks. As part of Operation Sentinel, law enforcement in 19 African countries dismantled business email compromise,…
SecurityWeek -
U.S. CISA adds a flaw in Digiever DS-2105 Pro to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Digiever DS-2105 Pro vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, tracked as CVE-2023-52163 with a CVSS score of 8.8. The issue affects DS-2105 Pro network video…
Security Affairs -
U.S. DoJ Seizes Fraud Domain Behind $14.6 Million Bank Account Takeover Scheme
The U.S. Justice Department on Monday announced the seizure of web3adspanels[.]org, a domain and database used to support a bank account takeover fraud scheme that harvested login credentials from thousands of victims. According to the U.S. and Estonia-led…
The Hacker News -
From cheats to exploits: Webrat spreading via GitHub
Webrat is a backdoor that researchers say is being distributed via GitHub repositories, with Securelist noting the campaign began distributing in October 2024 and had been active since at least September 2024. In the current operation, the malware is…
securelist.com -
Unlocking the Speed of Light: How Hardware-Accelerated BitLocker Saves Your FPS
Windows 11 PCs now feature device encryption by default when a system includes a TPM 2.0 module, a subset of Microsoft BitLocker that has traditionally carried a potential performance penalty. According to Microsoft’s latest blog post, hardware-accelerated…
SecurityOnline -
Critical n8n Flaw (CVSS 9.9) Enables Arbitrary Code Execution Across Thousands of Instances
A critical security flaw has been disclosed in the n8n workflow automation platform that could allow arbitrary code execution under certain conditions, tracked as CVE-2025-68613 with a CVSS of 9.9. The issue affects all versions including and higher than…
The Hacker News -
3.5 Million Affected by University of Phoenix Data Breach
The University of Phoenix has admitted that millions of individuals were affected by a data breach linked to a recent Oracle E-Business Suite campaign, which security researchers attribute to the Cl0p ransomware group but is believed to have been carried out…
SecurityWeek -
FCC Bans Foreign-Made Drones and Key Parts Over U.S. National Security Risks
On 23 December 2025, the U.S. Federal Communications Commission announced a ban on all drones and critical components manufactured in foreign countries, citing national security concerns. The FCC has added UAS and UAS critical components produced abroad to…
The Hacker News -
Cyberattack Disrupts France’s Postal Service and Banking During Christmas Rush
A cyberattack knocked France’s national postal service offline, blocking and delaying package deliveries and online payments, during the height of the Christmas rush. The incident, described as a distributed denial of service attack, rendered La Poste’s…
SecurityWeek -
The Android Toll: Google to Charge $2.85 Per Install for External App Links
In the ongoing Epic Games v Google case, the article reports that under Google’s current plan, a new external content linking framework is set to take effect on 23 January 202a6, though the piece notes it would impose substantial costs on developers unless a…
SecurityOnline -
The Grid is the Goal: Alphabet’s $4.75B Bet to Own the Power Plants Behind Gemini
Alphabet has agreed to acquire Intersect Power, a Houston-based clean energy and data centre infrastructure developer, for $4.75 billion in cash and assuming the company’s existing debt, according to Alphabet Announces Agreement to Acquire Intersect to…
SecurityOnline -
“Tax Compliance” Trap: Hackers Mimic Indian Income Tax Department to Deploy China-Linked Malware
A new, multi-stage phishing campaign targeting Indian businesses has been analysed by SEQRITE Labs’ APT Team, using a fake tax notice to exploit fears of non-compliance. The attack begins with a spear-phishing email that appears to come from the Office of…
SecurityOnline -
-
Anna’s Archive Claims 300TB Spotify Mirror, Forcing an Investigation Into a Massive Music Data Leak
The shadow library Anna’s Archive has claimed that it carried out a large-scale “mirror” of Spotify’s music catalog and intends to distribute it via torrents totalling roughly 300 terabytes. Spotify has said it is investigating the incident and assessing how…
SecurityOnline
