News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 13 so far |
Fri 9 Jan· 42 articles
-
Deepfake Fraud Tools Are Lagging Behind Expectations
Deepfake-generating software has been evolving from a toy into a legitimate fraud threat, but evidence suggests that progression is happening more slowly than predicted, according to World Economic Forum (WEF) researchers. They reviewed 17 open source and…
Dark Reading -
Maduro Arrest Used as a Lure to Deliver Backdoor
Darktrace researchers observed threat actors exploiting reports of Venezuelan President Nicolás Maduro’s arrest to deliver backdoor malware. The campaign is described as using a spear-phishing email containing a zip archive titled “_US now deciding what’s…
darktrace.com -
THE KNOWNSEC LEAK: Yet Another Leak of China’s Contractor-Driven Cyber-Espionage Ecosystem
According to DomainTools Investigations, the Knownsec leak emerged in November 2025 and comprises 60-plus screenshots, with 65 document images shared by a single uploader, while a fuller context was provided on 31 December 2025 by Resecurity. The materials…
dti.domaintools.com -
Trend Micro fixed a remote code execution in Apex Central
Trend Micro fixed three Apex Central flaws after Tenable disclosed details and PoC code, addressing CVE-2025-69258, CVE-2025-69259 and CVE-2025-69260 in Apex Central on‑premise management consoles. The most severe, CVE-2025-69258, is a LoadLibraryEX remote…
Security Affairs -
China-Linked Hackers Exploit VMware ESXi Zero-Days to Escape Virtual Machines
According to Huntress, China-speaking threat actors are suspected of using a compromised SonicWall VPN appliance as an initial access vector to deploy a VMware ESXi exploit that may have been developed as far back as February 2024, with activity observed in…
The Hacker News -
Illicit Crypto Economy Surges as Nation-States Join in the Fray
Illicit cryptocurrency transactions grew more than 160% in 2025 to total at least $154 billion, driven by sanctioned countries such as Russia, Iran and North Korea. The value of the identified illicit blockchain transactions was dominated by Russia, which…
Dark Reading -
In Other News: 8,000 Ransomware Attacks, China Hacked US Gov Emails, IDHS Breach Impacts 700k
SecurityWeek’s roundup highlights a busy start to 2026, noting that, per 2025 figures from Emsisoft, more than 8,000 organisations were targeted by ransomware, with the number of active ransomware groups rising by about 30% on 2024. The Illinois Department…
SecurityWeek -
Rocket Report: SpaceX and China led the way in 2025; Vandenberg has room to grow
In 2025, SpaceX and China led the way as global launch activity continued to rise, with 329 orbital launch attempts recorded worldwide and 321 of them reaching orbit or marginal orbits, according to Aviation Week & Space Technology. SpaceX launched 165…
Ars Technica -
pcTattletale founder pleads guilty as US cracks down on stalkerware
According to Malwarebytes, the founder of pcTattletale, Bryan Fleming, has pleaded guilty in US federal court to computer hacking, unlawfully selling and advertising spyware, and conspiracy. The case marks only the second US federal stalkerware prosecution…
Malwarebytes -
APT282 articles this day · SecurityOnline first
Russian APT28 Runs Credential-Stealing Campaign Targeting Energy and Policy Organizations · BlueDelta Espionage: Russian Hackers Abuse Free Apps to Target Energy Sector
2 outlets-
Russian APT28 Runs Credential-Stealing Campaign Targeting Energy and Policy Organizations
Russian APT28 has been linked to a credential-harvesting campaign aimed at individuals connected to a Turkish energy and nuclear research agency, a European think tank, and organisations in North Macedonia and Uzbekistan. The activity is attributed to APT28…
The Hacker News -
BlueDelta Espionage: Russian Hackers Abuse Free Apps to Target Energy Sector
A new report from Recorded Future’s Insikt Group details how BlueDelta, a Russian state-sponsored hacking group linked to the GRU, launched a credential-harvesting campaign aimed at energy researchers and government networks across Europe and the Middle East…
SecurityOnline
-
-
Tim Kosiba Named NSA Deputy Director
Timothy Kosiba has been announced as the National Security Agency’s 21st Deputy Director, returning to the agency as its most senior civilian leader with more than 30 years of federal service. The NSA said the appointment was designated by Secretary of War…
SecurityWeek -
FBI: North Korean Spear-Phishing Attacks Use Malicious QR Codes
The FBI warns that the North Korean state-sponsored espionage group Kimsuky has targeted government entities, academic institutions, and think tanks with spear-phishing emails containing malicious QR codes. Referred to as quishing, the campaign uses QR codes…
SecurityWeek -
NZ: Manage My Health breach: 50% of affected patients contacted
According to 1News, Manage My Health confirmed that the first 50% of up to 126,000 patients affected by the data breach had been notified. The privately operated patient portal reported an incident of unauthorised access to the My Health Documents module in…
DataBreaches -
Trend Micro Patches Critical Code Execution Flaw in Apex Central
Trend Micro has issued patches for three vulnerabilities affecting its Apex Central product, after Tenable published PoC code and technical details. The flaws include CVE-2025-69258, a critical LoadLibraryEX issue that could let an unauthenticated, remote…
SecurityWeek -
CISA Closes 10 Emergency Directives as Vulnerability Catalog Takes Over
According to CISA, the US cyber security agency, 10 Emergency Directives issued between 2019 and 2024 have been closed as their objectives were achieved or the targeted vulnerabilities have moved into the Known Exploited Vulnerabilities (KEV) catalog. Three…
SecurityWeek -
‘ZombieAgent’ Attack Let Researchers Take Over ChatGPT
SecurityWeek reports that the so‑called “ZombieAgent” attack allows researchers to bypass ChatGPT protections and exfiltrate user data while embedding a persistent logic into the agent’s long‑term memory. Widely used across enterprises, ChatGPT has access to…
SecurityWeek -
Top 10 APT Groups in 2025
The article surveys prominent APT groups in 2025, organised by region and summarising notable campaigns. In China-aligned activity, Mustang Panda is described as a China-linked group active since at least 2017, with UNC6384 delivering a fake Adobe update via…
SOCRadar -
Are we ready for ChatGPT Health?
OpenAI’s announcement about its new ChatGPT Health program has sparked discussion about data privacy and how health information is kept safe, with a dedicated health space inside ChatGPT that lets users connect medical records and wellness apps to ground…
Malwarebytes -
Illinois Man Charged in Snapchat Hacking Investigation
An Illinois man, Kyle Svara, 26, of Oswego, Illinois, has been charged in federal court in Boston with phishing Snapchat access codes from at least May 2020 to February 2021 to gain unauthorised access to accounts and steal nude images, which he then kept,…
DataBreaches -
377,000 Impacted by Data Breach at Texas Gas Station Firm
Gulshan Management Services, Inc., which operates gas stations in Texas under Gulshan Enterprises, disclosed a data breach affecting more than 377,000 individuals. The breach resulted from a ransomware incident, with unauthorized access detected after a…
SecurityWeek -
Iran cuts Internet nationwide amid deadly protest crackdown
Iran shut down the internet nationwide as protests spread across multiple cities, with security forces responding with a violent crackdown that reportedly killed dozens. After 12 days of unrest, authorities imposed a nationwide internet blackout to curb…
Security Affairs -
Exploit for VMware Zero-Day Flaws Likely Built a Year Before Public Disclosure
Fresh attacks targeted three VMware ESXi vulnerabilities disclosed in March 2025 as zero-days, with an exploit toolkit reportedly built over a year prior to public disclosure. The bugs, tracked as CVE-2025-22224, CVE-2025-22225 and CVE-2025-22226, were…
SecurityWeek -
Cybersecurity Predictions 2026: The Hype We Can Ignore (And the Risks We Can't)
The Hacker News previews 2026 with a data‑driven take on which cybersecurity predictions truly matter, arguing that many forecasts are shaped by headlines rather than evidence. According to Bitdefender, a webinar aims to cut through the noise by focusing on…
The Hacker News -
Trend Micro Apex Central RCE Flaw Scores 9.8 CVSS in On-Prem Windows Versions
Trend Micro has released security updates for Apex Central on Windows to address multiple vulnerabilities, including a critical remote code execution flaw tracked as CVE-2025-69258 with a CVSS of 9.8. According to Trend Micro, the flaw is described as a…
The Hacker News -
China-linked UAT-7290 spies on telco in South Asia and Europe using modular malware
China-linked UAT-7290 has conducted espionage operations since at least 2022, targeting telecom providers in South Asia and Southeastern Europe, according to Cisco Talos. The group deeply embeds in victim networks and also operates Operational Relay Box…
Security AffairsDAGGER PANDA -
CISA Retires 10 Emergency Cybersecurity Directives Issued Between 2019 and 2024
According to CISA, ten emergency directives issued between 2019 and 2024 have now been retired amid efforts to bolster federal cybersecurity. The directives being closed include ED 19-01, ED 20-02, ED 20-03, ED 20-04, ED 21-01, ED 21-02, ED 21-03, ED 21-04,…
The Hacker News -
Notorious Russian APT Nabs Credentials From Global Targets
The article, published on 9 January 2026, profiles Fancy Bear as a highly capable Russian APT whose credential-harvesting attacks have focused on targeted organisations in the Balkans, the Middle East and Central Asia. It notes that Fancy Bear’s recent…
Dark Reading -
FBI Warns North Korean Hackers Using Malicious QR Codes in Spear-Phishing
According to the FBI, North Korean state‑sponsored actors are using malicious QR codes in spear‑phishing campaigns aimed at think tanks, academic institutions, and government entities in the United States and abroad, a tactic it notes as quishing. The…
The Hacker News -
The End of Offline Era: Microsoft Kills Phone Activation After 24 Years
Microsoft has confirmed that its telephone activation service was terminated on 3 December 2025, marking the end of a 24-year offline era for Windows and Office licensing. The traditional offline activation flow—where an installation ID was generated on an…
SecurityOnline -
Collateral Damage: Microsoft Defender Blocks Official MAS Script in Malware War
According to Microsoft Defender, the MAS (Microsoft Activation Scripts) utility — a popular open-source tool — has prompted defensive measures as adversaries register deceptive domains to propagate malware under the MAS moniker. The article notes that…
SecurityOnline -
The AI Physician: OpenAI Launches “ChatGPT Health” to Sync Your Medical Records
OpenAI has unveiled a specialised portal called ChatGPT Health, a beta feature designed to sync your medical records and wellness apps with the ChatGPT ecosystem. The integration lets ChatGPT interpret data from wearables and electronic health records to…
SecurityOnline -
The $20B Handover: Apple Card Dumps Goldman Sachs for JPMorgan Chase
The article, dated 9 January 2026, reports that Apple has announced a definitive strategic alliance with JPMorgan Chase to become the new issuer of the Apple Card. According to Wall Street Journal reports, JPMorgan Chase will succeed Goldman Sachs as the…
SecurityOnline -
Public Exploit Released: Critical Trend Micro Flaw Grants SYSTEM Access
Trend Micro has issued a critical security alert for Apex Central (on‑premise) patching a remote code execution flaw, tracked as CVE-2025-69258, with a CVSS score of 9.8. According to the bulletin, successful exploitation could allow an unauthenticated…
SecurityOnline -
Bluetooth Broken? Apache NimBLE Flaws Enable Spoofing & Eavesdropping
According to The Apache Software Foundation, urgent patches have been issued for Apache NimBLE, the open-source Bluetooth 5.4 stack used to replace proprietary drivers on Nordic chipsets, after a cluster of four security vulnerabilities was disclosed, two of…
SecurityOnline -
-
Guloader Malware Rides Wave of Fake Performance Reports
Guloader malware is being distributed through phishing emails that masquerade as critical HR communications, a campaign highlighted by ASEC, the AhnLab Security Intelligence Center, which recently disclosed the operation. The emails claim to deliver a staff…
SecurityOnline -
The 9.6 Crack in Java’s Foundation: Critical Undertow Flaw CVE-2025-12543
The article highlights a critical flaw in Undertow, CVE-2025-12543, described as a foundational crack in Java’s web ecosystem. It explains that Undertow’s handling of the HTTP Host header allows Host header injection, enabling cache poisoning, internal…
SecurityOnline -
NodeCordRAT: The Trojan Hiding in NPM to Steal Crypto via Discord
NodeCordRAT is a sophisticated Remote Access Trojan found hiding in the npm registry, discovered in November 2025 and distributed through three malicious packages named bitcoin-main-lib, bitcoin-lib-js, and bip40 to harvest crypto wallets and credentials.…
SecurityOnline -
Wide Open Firewall: Critical Foomuuri Flaws Let Local Users Take Control
According to SUSE Security Team, Foomuuri, a nftables-based firewall manager for Linux, contained multiple flaws that left its D-Bus interface wide open to local attackers who could alter network zones and weaken or destabilise security. The most severe…
SecurityOnline
