News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 13 so far |
Mon 5 Jan· 44 articles
-
Russia-linked APT UAC-0184 uses Viber to spy on Ukrainian military in 2025
Russia-linked threat actor UAC-0184 (aka Hive0156) is targeting Ukrainian military and government entities via Viber to deliver malicious ZIP archives, part of ongoing intelligence-gathering operations in 2025. The 360 Advanced Threat Research Institute…
Security AffairsUAC-0184 -
Data broker hoarding is rampant. New law lets consumers fight back.
California’s new Delete, Reduce, and Opt-out platform law has taken effect, giving residents a streamlined way to compel data brokers to delete their information. According to the California Privacy Protection Agency, more than 500 brokers actively scour…
Ars Technica -
Critical 'MongoBleed' Bug Under Active Attack, Patch Now
MongoBleed is a critical memory-leak vulnerability in MongoDB (CVE-2025-14847) that allows unauthenticated remote attackers to extract cleartext credentials, authentication tokens, and other sensitive data from server memory. Attacks began on 29 December…
Dark Reading -
US Cyber Pros Plead Guilty Over BlackCat Ransomware Activity
Two US-based cybersecurity professionals pleaded guilty to their involvement in ransomware activity tied to the ALPHV/BlackCat gang. On 29 December 2023 a federal district court in Florida accepted the pleas of Ryan Goldberg, 40, of Georgia, and Kevin…
Dark Reading -
Russia-Aligned Hackers Abuse Viber to Target Ukrainian Military and Government
The Russia-aligned threat actor known as UAC-0184 has been observed targeting Ukrainian military and government entities by leveraging the Viber messaging platform to deliver malicious ZIP archives. The attack chain involves Viber delivering ZIPs containing…
The Hacker News -
Cyberattack Unlikely in Communications Failure That Grounded Flights in Greece
Greece's government stated that a major radio communications failure that disrupted the country's airspace is unlikely to be a cyberattack. Fleets were grounded, diverted, or delayed after noise affected air traffic communication channels. Government…
SecurityWeek -
Brightspeed Investigating Cyberattack
Brightspeed is investigating claims of a cyberattack after Crimson Collective boasted of breaching its systems, according to SecurityWeek. The hacking group said it exfiltrated personal information from over 1 million Brightspeed customers, with data…
SecurityWeek -
Sedgwick Confirms Cyberattack on Government Subsidiary
Sedgwick has confirmed a cyberattack at its government-facing subsidiary, Sedgwick Government Solutions, after a ransomware group claimed it hacked the unit. According to SecurityWeek, the third-party administrator serves US government agencies, including…
SecurityWeek -
Kimwolf Android Botnet Infects Over 2 Million Devices via Exposed ADB and Proxy Networks
The Kimwolf Android botnet has infected more than 2 million Android devices by tunnelling through residential proxy networks and exposed Android Debug Bridge (ADB) services, according to Synthient. The attackers monetise the botnet by app installs, selling…
The Hacker News -
Ca: Leduc County target of Christmas Day cybersecurity attack
Leduc County said it was the target of a deliberate cybersecurity attack described as ransomware, which disabled some of the county’s IT systems. The incident became known on 25 December, and other IT systems have been proactively disabled during an ongoing…
DataBreaches -
ALPRs are recording your daily drive (Lock and Code S06E26)
ALPRs are recording your daily drive, with a growing network of AI-powered cameras mounted on street lights, bridges, telephone poles and even cop cars across the United States. These devices capture a vehicle’s licence plate number, along with make, model…
Malwarebytes -
NZ: High Court grants injunction over ManageMyHealth cyber breach
A New Zealand health-related entity has secured a High Court injunction prohibiting the sharing of data stolen from Manage My Health, the patient portal used for prescriptions, records, and telehealth services. The injunction aims to stop third parties from…
DataBreaches -
CISA KEV Catalog Expanded 20% in 2025, Topping 1,480 Entries
The SecurityWeek report notes that the CISA Known Exploited Vulnerabilities (KEV) catalog expanded by 20% in 2025, topping 1,484 exploitable software and hardware flaws. Throughout 2025, 245 security defects were added to the KEV list, including 24 bugs…
SecurityWeek -
RondoDox Botnet Expands Scope With React2Shell Exploitation
RondoDox Botnet Expands Scope With React2Shell Exploitation reports that recent attacks are targeting Next[.]js servers and pose a significant threat of cryptomining, botnet payloads and other malicious activity to IoT networks and enterprises. The threat…
Dark Reading -
Kimwolf botnet leverages residential proxies to hijack 2M+ Android devices
The Kimwolf botnet has infected over 2 million Android devices, spreading mainly through residential proxy networks, according to Synthient. The campaign targets low-cost, unofficial Android TV boxes and many devices are sold pre-infected with modified…
Security Affairs -
Threat actors insisted that Resecurity’s honeypot was real data. We found no evidence that it was.
Threat actors insisted that Resecurity’s honeypot contained real data, but DataBreaches[.]net says it found no evidence that the data were real. SLH claimed they had hacked Resecurity and obtained “everything,” including internal chats, employee data, threat…
DataBreaches -
⚡ Weekly Recap: IoT Exploits, Wallet Breaches, Rogue Extensions, AI Abuse & More
The weekly recap highlights steady, rather than flashy, cyber risks, with IoT exploits and supply-chain fallout continuing to drive impact. A nine-month campaign named RondoDox has levered the React2Shell flaw (CVE-2025-55182) to recruit IoT devices into a…
The Hacker News -
Kimwolf Android Botnet Grows Through Residential Proxy Networks
The Kimwolf Android botnet, which Synthient says has infected over 2 million devices, mainly leverages residential proxy networks and compromised Android TV boxes. It has been active since at least August 2025 and is capable of enabling DDoS attacks, app…
SecurityWeek -
Grok apologizes for creating image of young girls in “sexualized attire”
Grok apologised on 5 January 2026 for generating an image of young girls in “sexualized attire,” highlighting how guardrails can fail when development speed and feature races outrun safety controls.
Malwarebytes -
Researcher Spotlights WhatsApp Metadata Leak as Meta Begins Rolling Out Fixes
SecurityWeek reports that Meta has begun addressing WhatsApp vulnerabilities that expose user metadata, notably flaws that allow device fingerprinting of a user’s operating system. The article notes that attackers can use zero-days to deliver spyware through…
SecurityWeek -
The State of Cybersecurity in 2025: Key Segments, Insights, and Innovations
According to The Hacker News, The State of Cybersecurity in 2025 surveys how organisations are moving security from a patchwork of tools to a broader architectural approach across cloud, endpoints and supply chains. The report explores core areas such as…
The Hacker News -
The cybercriminal behind the 2016 Bitfinex hack has been released from prison early thanks to Trump’s 2018 First Step Act
Ilya Lichtenstein, convicted for his role in the 2016 Bitfinex hack, has been released from prison early thanks to Trump’s 2018 First Step Act, according to a Trump administration official who told CNBC. He is scheduled for release from prison on 25 January…
Security Affairs -
Riot Games Login Outage Traced to Expired SSL Certificate
Riot Games suffered a widespread service disruption after failing to renew an expired digital certificate in time, with the certificate expiring on 4 January 2026 and all HTTPS connections subsequently rejected. The immediate effect was that the League of…
SecurityOnline -
Bitfinex Hack Convict Ilya Lichtenstein Released Early Under U.S. First Step Act
Ilya Lichtenstein, previously jailed for money laundering linked to the 2016 Bitfinex hack, has been released early under the U.S. First Step Act, according to the report. He announced his release in a post on X, noting he is now on home confinement, with…
The Hacker News -
Fragged Files: Critical Zero-Day Hits Quake III Arena Engines via Directory Traversal
Fragged Files: Critical Zero-Day Hits Quake III Arena Engines via Directory Traversal reports a critical zero-day affecting Quake III Arena engines, exploited through directory traversal and tagged as an Arbitrary File Read vulnerability. The piece appeared…
SecurityOnline -
VVS Stealer, a new python malware steals Discord credentials
VVS Stealer is a Python-based malware that steals Discord credentials and tokens and has been sold on Telegram since at least April 2025, according to Palo Alto Networks. It uses Pyarmor to heavily obfuscate its Python code, with researchers deobfuscating…
Security Affairs -
A week in security (December 29 – January 4)
The piece titled A week in security (December 29 – January 4) comes from Malwarebytes Labs and was published on 5 January 2026. It previews last week’s Malwarebytes Labs content and links to four related articles dated between 29 December 2025 and 2 January…
Malwarebytes -
New VVS Stealer Malware Targets Discord Accounts via Obfuscated Python Code
VVS Stealer is a Python-based information stealer that can harvest Discord credentials and tokens, among other data. The malware’s code is obfuscated by Pyarmor to hinder static analysis and signature-based detection, and it is distributed as a PyInstaller…
The Hacker News -
Sedgwick discloses data breach after TridentLocker ransomware attack
Sedgwick confirmed a cybersecurity incident at its federal contractor subsidiary, Sedgwick Government Solutions, after the TridentLocker ransomware group claimed to have stolen 3.4GB of data on New Year’s Eve. Sedgwick employs roughly 33,000 people worldwide…
Security AffairsTridentLocker -
The Scrapbook Strategy: Why OpenAI is Betting $17 Billion on Pinterest
OpenAI is reportedly considering acquiring Pinterest later this year, a move that would be the largest acquisition in OpenAI’s history, according to The Information. The article notes that OpenAI’s interest is driven by three core assets: Pinterest’s vast…
SecurityOnline -
Systems over Slop: Nadella’s 2026 AI Vision Sparks “Microslop” Revolt
In early January 2026, Microsoft CEO Satya Nadella used his newly launched SN Scratchpad blog to lay out a shift from a model-driven to a system-driven approach, emphasising that AI should be a cognitive amplifier rather than a substitute for human…
SecurityOnline -
The Unpatchable Leak: Sony’s PS5 Security Crumples as BootROM Keys Hit the Web
Last week, an unidentified hacker leaked a critical security key used by Sony to protect the trust chain of the PlayStation 5 console. This BootROM key is a core component of Sony’s security trust architecture and is stored in physically non-rewritable…
SecurityOnline -
The Hacker Returns: Bitfinex Mastermind Ilya Lichtenstein Freed Early via Trump Law
The article recalls the 2016 Bitfinex hack, in which 119,756 bitcoins were stolen and valued at about 61 million U.S. dollars at the time. In 2022, U.S. authorities arrested the attackers, with 94,000 bitcoins seized and the total value of confiscated assets…
SecurityOnline -
Private Intelligence: Telegram’s 2026 Update Brings AI Summaries via the Cocoon Network
Telegram has released its first update for 2026, focusing on the iOS version while the Android edition remains under development. The key feature is AI-powered summaries for lengthy channel posts, with a generated concise summary appearing at the top of the…
SecurityOnline -
CVE-2026-21440: New AdonisJS 9.2 Critical Flaw Allows Arbitrary File Writes and RCE
CVE-2026-21440 has been identified as a critical flaw in AdonisJS 9.2 that could allow arbitrary file writes and remote code execution (RCE). The vulnerability resides in the framework’s file upload handling, specifically within the @adonisjs/bodyparser…
SecurityOnline -
“Sliver” in the Stack: Exposed Logs Reveal Targeted FortiWeb Exploitation Campaign
A sophisticated threat actor has been caught leveraging exposed logs and databases to orchestrate a targeted campaign against FortiWeb appliances, using the open‑source Sliver C2 framework to maintain persistent access. The operation, uncovered by threat…
SecurityOnline -
The Invisible Predator: How VVS Stealer Abuses Pyarmor to Ghost Discord Accounts
A new analysis from Unit 42 details VVS Stealer, a Python-based threat that leverages Pyarmor to ghost Discord accounts and evade antivirus tools. According to Unit 42, the malware is marketed on Telegram and first appeared in April 2025, with affordable…
SecurityOnline -
CVE-2025-66848: Critical Flaw in JD Cloud Routers Grants Hackers Root Access
CVE-2025-66848 is a critical flaw in JD Cloud NAS routers that could allow remote attackers to bypass authentication and gain root access. The vulnerability, tracked under CVE-2025-66848 with a CVSS of 9.8, begins with an unsecured API interface…
SecurityOnline -
Transparent Tribe Weaponizes “JLPT” Tests in New Cyber-Espionage Campaign Against India
According to CYFIRMA, the Transparent Tribe (APT36), a Pakistan-aligned threat actor known for targeting Indian governmental and strategic entities, has weaponised a JLPT test lure in a new cyber-espionage campaign. The operation, tracked since December…
SecurityOnlineOperation C-Major -
New WordPress Phishing Scam Steals Credit Cards via Telegram
A new phishing campaign targeting WordPress site owners uses fake “domain renewal” notices to steal credit card details and 3-D Secure OTPs, according to Anurag. Victims who click the “Renew Now” button are redirected to a fraudulent payment page on…
SecurityOnline
