News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Wed 4 Feb· 59 articles
-
Russian-state hackers exploit Office vulnerability to infect computers
According to Trellix, Russian-state hackers weaponised a critical Microsoft Office vulnerability, CVE-2026-21509, less than 48 hours after Microsoft released an unscheduled security update late last month, to compromise devices inside diplomatic, maritime,…
-
Ransomware Gang Goes Full 'Godfather' With Cartel
DragonForce, a ransomware-as-a-service outfit that first surfaced in 2023, is described as drawing heavily from the organised crime playbook by creating a cartel and seeking mafia-style territorial organisation within the ransomware ecosystem. The analysis…
Dark Reading -
CVE-2025-22225 in VMware ESXi now used in active ransomware attacks
According to The U.S. Cybersecurity and Infrastructure Security Agency (CISA), ransomware groups are now exploiting CVE-2025-22225 in VMware ESXi, a sandbox-escape vulnerability patched by Broadcom in March 2025. The flaw allows an arbitrary write by an…
-
CISA Makes Unpublicized Ransomware Updates to KEV Catalog
CISA has been quietly updating its Known Exploited Vulnerabilities (KEV) catalog to reflect ransomware activity, with GreyNoise’s analysis identifying 59 vulnerabilities that switched to a “Known” ransomware status at some point in 2025. According to…
-
Attackers Use Windows Screensavers to Drop Malware, RMM Tools
Attackers are using Windows screensaver files (.scr) to drop malware and an RMM tool, enabling interactive remote access and footholds inside targeted networks, according to ReliaQuest Threat Research. The initial access appears to be a business-themed…
Dark Reading -
Taiwanese operator of Incognito Market sentenced to 30 years over $105M darknet drug ring
A Taiwanese man was sentenced to 30 years in prison for running Incognito Market, a major darknet drug marketplace that sold more than $105 million in illegal drugs. Rui-Siang Lin, who operated under the alias “Pharaoh,” led the platform from 2020 until its…
Security Affairs -
Don’t panic: 0apt’s listings and data leaks are fakes — Researchers
Posted on 4 February 2026, the piece from DataBreaches[.]Net reports that 0apt’s listings and data leaks are fake and a waste of time. According to DataBreach[.]com, the group initially populated its site with nameless “garbage” firms but has pivoted to…
DataBreaches -
Microsoft Develops Scanner to Detect Backdoors in Open-Weight Large Language Models
Microsoft has unveiled a lightweight scanner designed to detect backdoors in open-weight large language models (LLMs) and bolster trust in AI systems, a move disclosed on 4 February 2026. The scanner relies on three observable signals that can flag backdoors…
The Hacker News -
DEAD#VAX Malware Campaign Deploys AsyncRAT via IPFS-Hosted VHD Phishing Files
Security researchers have disclosed a stealthy malware campaign dubbed DEAD#VAX that uses a mix of disciplined tradecraft and legitimate system features to deploy AsyncRAT. The infection begins with a phishing email delivering a Virtual Hard Disk (VHD)…
The Hacker News -
Detecting backdoored language models at scale
Microsoft’s security blog on 4 February 2026 reports new research on detecting backdoors in open-weight language models, outlining three observable signatures that indicate backdoors are present and describing a practical scanner built to reconstruct likely…
Microsoft -
Paris raid on X focuses on child abuse material allegations
French prosecutors, with France’s National Gendarmerie and Europol support, raided X’s Paris offices as part of a criminal probe into alleged illegal content, including child sexual abuse material; the probe began in January after complaints that X aided…
Security Affairs -
GreyNoise tracks massive Citrix Gateway recon using 63K+ residential proxies and AWS
GreyNoise tracked a dual-mode Citrix Gateway reconnaissance campaign between 28 January and 2 February 2026, using more than 63,000 residential proxies before switching to AWS to enumerate exposed versions. The activity targeted Citrix ADC and NetScaler…
Security Affairs -
Blockchain Intelligence Firm TRM Labs Raises $70 Million at $1 Billion Valuation
According to SecurityWeek, blockchain intelligence firm TRM Labs announced it has raised $70 million in a Series C funding round, valuing the company at $1 billion. The round was led by Blockchain Capital, with participation from CMT Digital, Goldman Sachs,…
SecurityWeek -
RARLAB WinRAR2 articles this day · Check Point first
China-Linked Amaranth-Dragon Exploits WinRAR Flaw in Espionage Campaigns · Amaranth-Dragon: Weaponizing CVE-2025-8088 for Targeted Espionage in the Southeast Asia
-
China-Linked Amaranth-Dragon Exploits WinRAR Flaw in Espionage Campaigns
China-linked Amaranth-Dragon has been observed exploiting the CVE-2025-8088 flaw in WinRAR to deliver tailored malware in targeted espionage campaigns against government and law enforcement agencies across Southeast Asia, with activity noted in 2025 and…
-
Amaranth-Dragon: Weaponizing CVE-2025-8088 for Targeted Espionage in the Southeast Asia
Amaranth-Dragon is a campaign cluster identified by Check Point Research as a nexus of APT-41-aligned activity that weaponised CVE-2025-8088 to conduct targeted espionage across Southeast Asia in 2025. According to Check Point Research, the group used…
-
-
Grok continues producing sexualized images after promised fixes
Grok continues producing sexualized images after promised fixes, with journalists testing whether the Grok chatbot still generates non-consensual sexualised imagery despite safeguards touted by xAI and X. According to Reuters, a retest after new limits on…
Malwarebytes -
Vulnerabilities Allowed Full Compromise of Google Looker Instances
SecurityWeek reports that researchers from Tenable identified two vulnerabilities in Google Looker, collectively known as LookOut, which could allow remote code execution and data exfiltration from Looker instances. According to Tenable, the flaws can be…
SecurityWeek -
Extra Extra! Announcing DR Global: Latin America
Dark Reading has unveiled DR Global: Latin America, a dedicated section for Latin American readers featuring news, analysis, features and multimedia. The launch marks a significant expansion of its DR Global coverage, which already includes the Middle East &…
Dark Reading -
MomentProof Deploys Patented Digital Asset Protection
MomentProof, Inc. today announced the deployment of MomentProof Enterprise for AXA, enabling cryptographically authentic, tamper-proof digital assets for insurance claims processing, according to CyberNewsWire. The company’s patented technology certifies…
SecurityOnline -
Big Breach or Nada de Nada? Mexican Gov't Faces Leak Allegations
A hacktivist group claims a 2.3-terabyte data breach exposes the information of 36 million Mexicans, though Mexico’s cybersecurity agency says the data is not a new breach but a collection from previous breaches. On 30 January, a hacking collective known as…
Dark Reading -
Cyber Insights 2026: Cyberwar and Rising Nation State Threats
According to Kevin Townsend, cyberwarfare is a simmering, distributed reality that will escalate through 2026, with cyberwarfare likely to rise more dramatically than cyberwar in the near term. The piece notes that the UK MoD reshaped its Cyber and…
SecurityWeek -
Former Nuance Communications employee facing more charges in 2023 Geisinger data breach case
On 4 February 2026, Databreaches[.]Net reported that a former Nuance Communications employee, Max Vance, is facing additional charges in the 2023 Geisinger Health System data breach case. The superseding indictment in the U.S. Middle District Court accuses…
DataBreaches -
Varonis Acquisition of AllTrue.ai Valued at $150 Million
Varonis Systems has acquired AllTrue[.]ai, a move described by SecurityWeek as expanding its AI trust, risk, and security management capabilities. According to Wall Street Journal, the deal is valued at $150 million, though Varonis has not publicly disclosed…
SecurityWeek -
Firefox is giving users the AI off switch
Firefox is giving users an AI off switch, with Mozilla adding an AI Controls area in Firefox settings and a one-click option to disable generative AI features. The new controls centre on a master switch, “Block AI enhancements,” enabling users to run Firefox…
Malwarebytes -
Orion Raises $32 Million for Data Security
Orion Security has announced a $32 million Series A round, bringing the company’s total funding to $38 million and positioning it to accelerate product development and go-to-market operations. The round was led by Norwest, with additional support from PICO…
SecurityWeek -
Orchid Security Introduces Continuous Identity Observability for Enterprise Applications
Orchid Security has introduced continuous identity observability for enterprise applications, a platform designed to discover, analyse, orchestrate and audit identity usage beyond traditional IAM controls. The approach begins with Discover, instrumenting…
The Hacker News -
DockerDash Flaw in Docker AI Assistant Leads to RCE, Data Theft
SecurityWeek reports that a critical vulnerability named DockerDash affects Docker’s Ask Gordon AI assistant, existing in the MCP Gateway’s contextual trust where instructions can be forwarded from image metadata without validation. The flaw allows an…
SecurityWeek -
Microsoft: Info-Stealing malware expands from Windows to macOS
Microsoft warns that info-stealing attacks are expanding from Windows to macOS, using cross‑platform languages like Python and abusing trusted platforms, according to Microsoft. Since late 2025, there has been a surge in macOS infostealer campaigns that rely…
Security Affairs -
Google Looker Bugs Allow Cross-Tenant RCE, Data Exfil
Researchers identified two five-alarm security issues in Google Looker that could enable attackers to access sensitive secrets and, in cloud deployments, move laterally across tenants. The team demonstrated a cross-tenant remote code execution (RCE) chain…
-
Cryptominers, Reverse Shells Dropped in Recent React2Shell Attacks
SecurityWeek reports that the React2Shell flaw, tracked as CVE-2025-55182, continues to drive exploitation with over 1.4 million attempts observed in the past week, according to GreyNoise. The vulnerability allows remote code execution via a single HTTP POST…
-
The First 90 Seconds: How Early Decisions Shape Incident Response Investigations
The First 90 Seconds: How Early Decisions Shape Incident Response Investigations argues that most IR failures stem from what happens in the immediate moments after detection, when pressure is high and telemetry is incomplete. It emphasises that the opening…
The Hacker News -
SolarWinds Web Help Desk3 articles this day · The Hacker News first
Fresh SolarWinds Vulnerability Exploited in Attacks · PoC Public & Exploited: Critical SolarWinds Help Desk Flaw Exploited in the Wild
-
Fresh SolarWinds Vulnerability Exploited in Attacks
The SecurityWeek report warns of a critical-severity vulnerability in SolarWinds Web Help Desk (WHD), tracked as CVE-2025-40551 with a CVSS of 9.8, which can allow unauthenticated remote code execution through untrusted data deserialization. The flaw affects…
-
PoC Public & Exploited: Critical SolarWinds Help Desk Flaw Exploited in the Wild
The article, dated 4 February 2026, highlights a PoC that publicised a critical SolarWinds Help Desk flaw and notes that it has been exploited in the wild. The piece is focused on a vulnerability associated with SolarWinds Web Help Desk and is tagged with…
-
CISA Adds Actively Exploited SolarWinds Web Help Desk RCE to KEV Catalog
According to CISA, the U.S. Cybersecurity and Infrastructure Security Agency, a critical flaw affecting SolarWinds Web Help Desk has been added to the Known Exploited Vulnerabilities catalog and flagged as actively exploited in attacks. The vulnerability is…
-
-
Unpatchable & Critical: CISA Issues CVSS 10.0 Alert for Synectix Adapters
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a maximum-severity CVSS 10.0 alert for the Synectix LAN 232 TRIO, a legacy serial-to-ethernet adapter, with the vulnerability tracked as CVE-2026-1633. The advisory notes the device…
-
Security Analysis of Moltbook Agent Network: Bot-to-Bot Prompt Injection and Data Leaks
SecurityWeek reports that Moltbook, a social network for OpenClaw AI agents, has been scrutinised after researchers highlighted a data exposure and targeted bot activity. According to Wiz, the exposure granted read and write access to the Moltbook production…
SecurityWeek -
CVE-2025-11953 (Metro4Shell) in React Native Metro Server Enables RCE
CVE-2025-11953, known as Metro4Shell, is a critical flaw in the React Native Community CLI Metro development server that allows unauthenticated OS command execution when the service is exposed beyond localhost. According to VulnCheck, exploitation has been…
-
Microsoft Warns Python Infostealers Target macOS via Fake Ads and Installers
Microsoft has warned that information-stealing attacks are expanding beyond Windows to target Apple macOS environments by using cross‑platform languages like Python and abusing trusted platforms for distribution at scale. According to Microsoft,…
The Hacker News -
Eclipse Foundation Mandates Pre-Publish Security Checks for Open VSX Extensions
The Eclipse Foundation has announced plans to enforce security checks before publishing VS Code extensions to the Open VSX Registry, a move aimed at countering supply-chain threats. According to Eclipse Foundation, the change shifts from a primarily…
The Hacker News -
One Identity Appoints Gihan Munasinghe as Chief Technology Officer
One Identity today announced the appointment of Gihan Munasinghe as Chief Technology Officer, with the release noting he brings more than 15 years of experience leading global engineering organisations and delivering large-scale, customer-centric software…
SecurityOnline
