News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 5 so far |
Mon 29 Dec 2025· 39 articles
-
Romania’s Oltenia Energy Complex suffers major ransomware attack
A ransomware attack struck Romania’s Oltenia Energy Complex on 26 December 2025, disrupting its IT systems and encrypting documents, including ERP, email, and the company website. The attack, identified as a ransomware type called “Gentlemen”, partially…
Security Affairs -
Happy 16th Birthday, KrebsOnSecurity.com!
KrebsOnSecurity[.]com marked its 16th anniversary on 29 December 2025, highlighting a year that focused on dismantling cybercrime services and the actors behind them. In May 2024, the site examined Stark Industries Solutions Ltd., a bulletproof hosting…
Krebs on Security -
Top US Accounting Firm Sax Discloses 2024 Data Breach Impacting 220,000
Sax LLP, a top-ranked US accounting firm, has begun notifying over 220,000 individuals that sensitive personal data was compromised in a cyberattack that went undisclosed for more than 16 months. Based in New Jersey, Sax is a top 100 accounting and advisory…
SecurityWeek -
Korean Air discloses data breach after the hack of its catering and duty-free supplier
Korean Air disclosed a data breach linked to the hack of its catering and duty‑free supplier, KC&D Service, with personal data belonging to around 30,000 of its employees affected. The airline said no customer data appears to have been compromised and that…
Security Affairs -
SBOMs in 2026: Some Love, Some Hate, Much Ambivalence
SBOMs in 2026 are seen as valuable in theory but a practical mess, with experts divided on their usefulness as the software landscape evolves. Docker has embraced SBOMs in its DHI images, which are built to include complete SBOMs and proof of provenance…
Dark Reading -
5 Threats That Defined Security in 2025
2025 saw Salt Typhoon, a China-nexus APT, persistently targeting telecoms such as Verizon, AT&T and Lumen Technologies, following its discovery last autumn and continuing to pre-position for long-term espionage. In July, it was reported that Salt Typhoon…
Dark Reading -
MongoBleed (CVE-2025-14847): What MongoDB Users Need to Know About This Memory Leak
MongoBleed, tracked as CVE-2025-14847, is an unauthenticated memory disclosure flaw in MongoDB Server that allows a remote attacker to retrieve fragments of uninitialized heap memory by sending malformed, compressed network messages. The vulnerability arises…
SOCRadar -
South Korean retail giant Coupang to compensate $1.1 billion to affected users over data breach
According to CNBC, South Korean online retail giant Coupang will compensate 1.69 trillion South Korean won, about $1.17 billion, to 34 million users affected by a massive data breach disclosed last month. The company said in a statement that it plans to…
DataBreaches -
⚡ Weekly Recap: MongoDB Attacks, Wallet Breaches, Android Spyware, Insider Crime & More
The Hacker News’ weekly recap notes that a newly disclosed MongoDB vulnerability, CVE-2025-14847 (MongoBleed), is under active exploitation with more than 87,000 potentially vulnerable instances identified worldwide, and users are urged to update to affected…
The Hacker News -
MongoBleed flaw actively exploited in attacks in the wild
MongoBleed, a recently disclosed MongoDB flaw tracked as CVE-2025-14847, is being actively exploited and has left more than 87,000 potentially vulnerable instances identified worldwide. According to Censys, most exposed instances are in the U.S., China,…
Security Affairs -
Fortinet Warns of New Attacks Exploiting Old Vulnerability
Fortinet has warned that a five-year-old FortiOS improper authentication flaw, tracked as CVE-2020-12812, is once again in attackers’ crosshairs, enabling a bypass of two-factor authentication under certain configurations. The vulnerability exists because…
SecurityWeek -
Coupang to Issue $1.17 Billion in Vouchers Over Data Breach
According to SecurityWeek, Coupang has announced plans to spend 1.685 trillion won (roughly $1.17 billion) in compensation over a recent data breach affecting 33.7 million customer accounts in Korea. The incident was reportedly discovered on 18 November,…
SecurityWeek -
Goldman Sachs Says Some Clients’ Data May Have Been Exposed in Law Firm Data Breach
Goldman Sachs said that data from some of its alternative investment funds may have been exposed in a breach at Fried Frank Harris Shriver & Jacobson LLP, the law firm serving as outside counsel to many of its funds. In a December 19 letter, Goldman noted it…
DataBreaches -
22 Million Affected by Aflac Data Breach
Aflac is notifying roughly 22.65 million individuals that personal information was stolen from its systems in June 2025. The company disclosed the intrusion on 20 June, saying suspicious activity had been detected on its US network on 12 June and attributed…
SecurityWeek -
Malware in 2025 spread far beyond Windows PCs
Malware in 2025 spread far beyond Windows PCs, with notable developments on Android and macOS alongside cross‑platform threats that can target Windows, macOS, Linux, mobile and IoT devices. Android banking Trojans grew more sophisticated in 2025, often…
Malwarebytes -
Cyberattacks Targeting International Domains: Weekly DDoS Threat Intelligence Analysis
Between 22 and 28 December 2025, SOCRadar identified a large, coordinated DDoS campaign attributed to the pro-Russian threat actor NoName057(16) and their project DDoSia, with 6,567 recorded attack entries targeting 158 unique domains and 161 unique IP…
SOCRadar -
Infostealer Malware Delivered in EmEditor Supply Chain Attack
Infostealer malware was delivered through a supply chain attack against EmEditor, with the malicious installer served via the official download button. The software’s developers warned that users who downloaded EmEditor using the Download Now button between…
SecurityWeek -
The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor
The HoneyMyte APT campaign, identified in mid-2025, employed a kernel-mode rootkit to deliver and shield a ToneShell backdoor on infected machines in Asia. The malicious driver, registered as ProjectConfiguration[.]sys, uses a mini-filter driver and injects…
securelist.comMUSTANG PANDA -
Banco Vimenca, WIRED, and Government Data Leaks Surface on Dark Web
According to SOCRadar, the Dark Web Team identified several high-profile data leak claims this week, including alleged exposures affecting Banco Vimenca, WIRED subscribers, Mexico’s Tax Administration Service (SAT), and Neighbourly. The Alleged Database of…
SOCRadar -
Fresh MongoDB Vulnerability Exploited in Attacks
Dubbed MongoBleed, the high-severity MongoDB vulnerability (CVE-2025-14847) allows unauthenticated, remote attackers to leak sensitive information from MongoDB servers by abusing the Zlib compression protocol. Patches were released on 19 December 2025, after…
SecurityWeek -
27 Malicious npm Packages Used as Phishing Infrastructure to Steal Login Credentials
Cybersecurity researchers disclosed a sustained and targeted spear-phishing operation that published 27 npm packages from six aliases to host browser-based lures that mimic document-sharing portals and Microsoft sign-in, with the aim of credential theft.…
The Hacker News -
Hacker Claims Theft of 40 Million Condé Nast Records After Wired Data Leak
A security week report says a hacker known as Lovely leaked millions of Wired subscriber records and then claimed to have obtained more than 40 million additional records from Condé Nast, the parent company of magazines such as Vogue and The New Yorker. The…
SecurityWeek -
WIRED Data Leak Exposes 2.3M Users Amid Broader Claims
The WIRED data leak exposed the personal data of over 2.3 million WIRED subscribers, with the dataset appearing on underground forums in late December 2025. According to the security reports, a threat actor using the alias “Lovely” claimed responsibility,…
SOCRadar -
Evasive Panda cyberespionage campaign uses DNS poisoning to install MgBot backdoor
China-linked APT Evasive Panda, also known as Daggerfly, Bronze Highland and StormBamboo, ran a targeted cyberespionage campaign that used DNS poisoning to deliver the MgBot backdoor to victims in Türkiye, China and India. According to Kaspersky, the…
Security AffairsEvasive Panda -
A week in security (December 22 – December 28)
A week in security (December 22 – December 28) is a Malwarebytes Labs recap of notable cybersecurity events from the latter part of December 2025. The page points readers to two highlighted articles published within that period: Pornhub tells users to expect…
Malwarebytes -
MongoDB Vulnerability CVE-2025-14847 Under Active Exploitation Worldwide
A recently disclosed security vulnerability in MongoDB, CVE-2025-14847, has come under active exploitation worldwide, with more than 87,000 potentially susceptible instances identified across the world. The flaw, CVSS 8.7 and nicknamed MongoBleed, allows an…
The Hacker News -
Traditional Security Frameworks Leave Organizations Exposed to AI-Specific Attack Vectors
Traditional security frameworks are described as incomplete for AI threats, with the article arguing that AI-specific attack vectors fall outside the controls of the main standards like NIST CSF, ISO 27001 and CIS Controls. It cites real breaches from…
The Hacker News -
The iOS 26.2 Trap: New WebKit Integer Overflow Discovered with PoC—Is Your iPhone at Risk?
SecurityOnline[.]info reports a critical WebKit vulnerability in iOS 26.2 that could allow an attacker to crash browsers or, if combined with other exploits, execute arbitrary code on latest iOS devices. The flaw lies in a 32-bit integer overflow during…
SecurityOnline -
PoC Released: MongoBleed Exploit Allows Unauthenticated Attackers to Drain MongoDB Memory
PoC Released: MongoBleed exploits have been published by security researcher Joe Desimone, enabling unauthenticated attackers to drain memory in MongoDB via a flaw tracked as CVE-2025-14847. The PoC code carries a CVSS score of 8.7, signalling a high risk to…
SecurityOnline -
Holiday ColdFusion Attacks Reveal Massive 2.5 Million Request Onslaught
What started as a seemingly targeted holiday raid on Adobe ColdFusion servers has developed into an industrial-scale cyberattack operation. According to GreyNoise, a new intelligence update shows the Christmas 2025 activity was only the tip of the iceberg,…
SecurityOnline -
“Headphone Jacking”: Critical Flaws in Popular Earbuds Let Hackers Hijack Your Phone
According to ERNW Enno Rey Netzwerke GmbH, a new white paper exposes three critical vulnerabilities in Airoha Bluetooth SoCs that power millions of True Wireless Earbuds from brands such as Sony, JBL, Marshall and Jabra, enabling attackers to eavesdrop on…
SecurityOnline -
CVE-2025-54322 (CVSS 10): AI Agents Uncover Critical Zero-Day in Global Networking Gear
CVE-2025-54322 (CVSS 10): AI Agents Uncover Critical Zero-Day in Global Networking Gear reports that a swarm of autonomous AI agents identified a pre-authentication remote code execution flaw in SXZOS core firmware used by Xspeeder SD-WAN devices, a…
SecurityOnline -
EmEditor Compromised: “WALSHAM” Imposter Poisons Official Installer with Spyware
According to RedDrip Team, EmEditor’s official download channels were compromised in a supply chain incident that occurred between 19 and 22 December 2025, with the official announcement released on 23 December. The attackers redirected the “Download Now”…
SecurityOnline -
The Performance Propeller: Google Proposes Upstreaming Its High-Octane Optimizer to LLVM
Google engineers have proposed integrating Propeller, a profile-guided optimizer that accelerates large applications by re-optimising the layout and relationships between a program’s components, into LLVM’s main codebase. Built atop LLVM, Propeller enables…
SecurityOnline -
The Christmas Drain: How a Backdoor in Trust Wallet v2.68 Stole $7M
The Christmas Drain describes a supply-chain attack on Trust Wallet, with backdoor code injected into the v2.68.0 release to harvest users’ recovery phrases and allow attackers to drain wallets. According to SlowMist founder Yu Xian, the backdoored version…
SecurityOnline -
The Stalled Update: Why Your Samsung’s Google Play Patch is Stuck in 2025
The Stalled Update reports that Samsung Galaxy devices already have the latest December 2025 Android security patch, but the Google Play system update date in Settings remains stuck in July, August, or September, due to a deliberate move by Samsung to…
SecurityOnline -
“Prefix Swap” Panic: Sophisticated “Jackson” Imposter Infiltrates Maven Central
A new report from Aikido Security reveals a highly sophisticated supply chain attack that breached Maven Central with a malicious package masquerading as the Jackson JSON library through a subtle prefix swap. The doppelgänger, identified as…
SecurityOnline -
Fixing the “RAM Tax”: Microsoft’s New Plan to Make File Explorer Search 2X Faster
Microsoft is testing low-level improvements to File Explorer in Windows 11 that aim to cut memory use and boost responsiveness when searching for files such as images and documents. The changes target the Windows Search Indexer by skipping redundant indexing…
SecurityOnline -
The $70 Chip War: Why Google is Firing Execs and Apple is Bracing for a 230% Price Surge
As of 29 December 2025, technology firms including Google and other giants are sending senior procurement staff to South Korea to negotiate with memory chip suppliers, aiming to secure more memory supply for AI efforts. The talks involve Samsung and SK…
SecurityOnline
