News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Thu 5 Feb· 57 articles
-
EnCase Driver Weaponized as EDR Killers Persist
According to Brain light via Alamy Stock Photo, researchers at Huntress detailed how threat actors weaponised the Windows kernel driver of a legitimate forensic toolset called EnCase to terminate security products across a network. The BYOVD technique…
Dark Reading -
Agentic AI Site 'Moltbook' Is Riddled With Security Risks
According to SOPA Images Limited via Alamy Stock Photo, Moltbook was an experimental quasi-social-media platform for AI agents that publicly exposed the database it used to store secrets, PII and more. An unsecured internal database exposed a wealth of…
Dark Reading -
U.S. Public Sector Under Siege
The U.S. public sector, spanning federal, state, and local levels, is described as on the frontlines of cybersecurity challenges as digital transformation accelerates across government and education. According to Trend Micro, proactive cyber risk management…
trendmicro.com -
AppleScript Abuse: Unpacking a macOS Phishing Campaign
Darktrace researchers describe a macOS phishing campaign that uses social engineering, AppleScript loaders and an attempted abuse of the macOS Transparency, Consent and Control feature to gain privileged access. The infection chain starts with a phishing…
darktrace.com -
Hacker claims theft of data from 700,000 Substack users; Company confirms breach
Substack confirmed a data breach after a hacker leaked data from nearly 700,000 users, including email addresses and phone numbers. Substack disclosed a security incident affecting email addresses, phone numbers, and internal metadata; the company says the…
Security Affairs -
OIG audit of hospital’s cybersecurity finds vulnerabilities in common web applications
According to the U.S. Department of Health and Human Services Office of the Inspector General (OIG), a report on a “large Southeastern hospital” found vulnerabilities in four internet-accessible web applications that could serve as vectors for a cyberattack.…
DataBreaches -
Berlin hospitals threatened by spate of attacks
Berlin hospitals are facing a spate of incidents described as inexplicable, ranging from drone incursions over hospital grounds and cyberattacks to forced entry and arson, according to the Berlin Hospital Association (BKG). The BKG says that Germany’s…
DataBreaches -
New Clickfix variant ‘CrashFix’ deploying Python Remote Access Trojan
According to Microsoft Defender Security Research Team, a new ClickFix variant named CrashFix escalates the campaign by crashing victims’ browsers and using social engineering to coax users into running malicious commands. The attack chain combines…
Microsoft -
Helpful Skills or Hidden Payloads? Bitdefender Labs Dives Deep into the OpenClaw Malicious Skill Trap
Bitdefender Labs explores the serious risks posed by malicious OpenClaw skills, revealing that 17% of analyzed skills exhibit malicious behavior, particularly in the crypto sector. The increasing accessibility of these tools has led to widespread abuse, with…
bitdefender.com -
AISURU/Kimwolf Botnet Launches Record-Setting 31.4 Tbps DDoS Attack
AISURU/Kimwolf, a DDoS botnet, has been attributed with a record-setting attack that peaked at 31.4 Tbps and lasted 35 seconds, according to Cloudflare, which automatically detected and mitigated the activity. The attack occurred in November 2025 and is…
The Hacker News -
The security implementation gap: Why Microsoft is supporting Operation Winter SHIELD
Operation Winter SHIELD is a nine-week cybersecurity initiative led by the FBI Cyber Division beginning February 2, 2026, designed to move organisations from guidance to action by focusing on high-impact control areas and how they change real-world outcomes.…
Microsoft -
Pro-Russian group Noname057(16) launched DDoS attacks on Milano Cortina 2026 Winter Olympics
Pro-Russian group Noname057(16) claimed to have launched DDoS attacks against sites connected to Milano Cortina 2026, with the attacks described as retaliation for Italy’s pro-Ukraine stance. According to ANSA, Italy has foiled a series of Russian-linked…
Security Affairs -
Substack Discloses Security Incident After Hacker Leaks Data
Substack has disclosed a data breach after a hacker leaked what they claim to be Substack user data, with the hacker saying nearly 700,000 records were obtained, including names, email addresses, phone numbers, profile pictures, user IDs and bios. The…
SecurityWeek -
Cyber Success Trifecta: Education, Certifications & Experience
The piece highlights the “golden triangle” of cybersecurity success—security certifications, a degree, and hands-on experience—as essential for newcomers and career growth, emphasising that competency comes from education, certifications, and practical work.…
Dark Reading -
Researchers Expose Network of 150 Cloned Law Firm Websites in AI-Powered Scam Campaign
SecurityWeek reports that Sygnia has uncovered a live network of cloned, scam websites allegedly belonging to law firms, growing to more than 150 related domains. The investigation began after a single law firm flagged impersonating sites, and the network…
SecurityWeek -
2025 Q4 DDoS threat report: A record-setting 31.4 Tbps attack caps a year of massive DDoS assaults
According to Cloudflare, the 2025 Q4 DDoS threat report records a record-setting 31.4 Tbps attack as part of a year of massive DDoS assaults. The fourth quarter focused on the Aisuru-Kimwolf botnet, dubbed “The Night Before Christmas” DDoS attack campaign,…
Cloudflare -
Open the wrong “PDF” and attackers gain remote access to your PC
Cybercriminals behind a campaign dubbed DEAD#VAX are taking phishing a step further by delivering malware inside virtual hard disks that pretend to be ordinary PDF documents, according to Securonix. Open the wrong “invoice” or “purchase order” and Windows…
Malwarebytes -
VS Code Configs Expose GitHub Codespaces to Attacks
VS Code-integrated configuration files are automatically executed in GitHub Codespaces when users open a repository or pull request, a finding highlighted by Orca Security. The research warns this default behaviour could enable supply chain attacks, since…
SecurityWeek -
Nullify Secures $12.5 Million in Seed Funding for Cybersecurity AI Workforce
SecurityWeek reports that Nullify announced raising $12.5 million in seed funding to advance its AI workforce for vulnerability management, in a round led by SYN Ventures with participation from existing backer Black Nova Venture Capital. The infusion brings…
SecurityWeek -
ThreatsDay Bulletin: Codespaces RCE, AsyncRAT C2, BYOVD Abuse, AI Cloud Intrusions & 15+ Stories
The ThreatsDay Bulletin this week compiles a spread of smaller signals that point to broader attack patterns, including a Codespaces RCE vector and AsyncRAT C2 activity, alongside BYOVD abuse and AI cloud intrusions. In Codespaces, researchers disclosed three…
The Hacker News -
Italy Averted Russian-Linked Cyberattacks Targeting Winter Olympics Websites, Foreign Minister Says
According to Associated Press, Italy has foiled a series of cyberattacks targeting its foreign ministry offices, including one in Washington, as well as Winter Olympics websites and hotels in Cortina d’Ampezzo. Foreign Minister Antonio Tajani said the…
SecurityWeek -
SystemBC Infects 10,000 Devices After Defying Law Enforcement Takedown
SystemBC has survived a law enforcement takedown and has ensnared over 10,000 machines in a botnet, according to SecurityWeek. The malware loader is also known as Coroxy and DroxiDat and is used to turn infected devices into SOCKS5 proxies, enabling traffic…
SecurityWeek -
CVE-2026-250493 articles this day · The Hacker News first
CVE-2026-25049: n8n Expression Sandbox Escape Enables RCE · Critical N8n Sandbox Escape Could Lead to Server Compromise
-
CVE-2026-25049: n8n Expression Sandbox Escape Enables RCE
CVE-2026-25049 is an expression sandbox escape in n8n that can allow authenticated users to execute system commands on the underlying host, a vulnerability described as a post-auth issue with potential access to stored credentials, internal services and…
-
Critical N8n Sandbox Escape Could Lead to Server Compromise
A critical sandbox escape vulnerability in the n8n AI workflow automation platform could allow attackers to execute arbitrary commands on the server, according to Pillar Security. Tracked as CVE-2026-25049, the issue affects how the n8n sandbox sanitises…
-
Critical n8n Flaw CVE-2026-25049 Enables System Command Execution via Malicious Workflows
A new critical vulnerability in the n8n workflow automation platform, tracked as CVE-2026-25049 and rated CVSS 9.4, could allow an authenticated user to execute arbitrary system commands by crafting expressions in workflow parameters. The flaw arises from…
-
-
The Buyer’s Guide to AI Usage Control
The Hacker News argues that AI is now woven into everyday workflows, but governance has not kept pace, creating a visibility gap as AI usage expands across SaaS platforms, browsers, and shadow tools. According to The Hacker News, AI security is not simply a…
The Hacker News -
Flock cameras shared license plate data without permission
Mountain View halted its entire Flock license plate reader network after discovering that Flock Safety had been sharing data with hundreds of law enforcement agencies, including federal ones, without permission, with 30 cameras affected. Two incidents of…
Malwarebytes -
The Shadow Campaigns: Uncovering Global Espionage
According to Unit 42, the Shadow Campaigns investigation tracks a new cyberespionage group named TGR-STA-1030, a state-aligned actor operating out of Asia. Over the past year this group has compromised government and critical infrastructure organisations…
unit42.paloaltonetworks.comUNC6619 -
Cyberspy Group Hacked Governments and Critical Infrastructure in 37 Countries
A state-sponsored cyberespionage group has hacked into government and critical infrastructure organisations across 37 countries, SecurityWeek reports, with the operation tracked under the threat actor name TGR-STA-1030 and activity newly observed as Shadow…
SecurityWeek -
Infy Hackers Resume Operations with New C2 Servers After Iran Internet Blackout Ends
The Iranian threat group known as Infy (aka Prince of Persia) has evolved its tactics and is setting up new command-and-control infrastructure as the Iran internet blackout ends. According to SafeBreach, the threat actor stopped maintaining its C2 servers on…
The Hacker NewsInfy -
China-linked Amaranth-Dragon hackers target Southeast Asian governments in 2025
According to Check Point Research, China-linked threat actors tracked as Amaranth-Dragon carried out cyber-espionage campaigns in 2025 targeting government and law enforcement agencies across Southeast Asia, with activity linked to the APT-41 ecosystem and…
-
Dark Web Profile: 0APT Ransomware
Dark Web Profile: 0APT Ransomware describes 0APT, also known as the 0APT Syndicate, as a ransomware-as-a-service operation that surfaced in late January 2026, with the group quickly listing hundreds of high‑profile victims on its dark web leak site.…
SOCRadar -
Cisco, F5 Patch High-Severity Vulnerabilities
According to SecurityWeek, Cisco and F5 this week issued patches for multiple high-severity vulnerabilities across their products, including DoS, arbitrary command execution, and privilege escalation. Cisco rolled out fixes for five defects, two of which are…
-
-
Stan Ghouls targeting Russia and Uzbekistan with NetSupport RAT
Stan Ghouls targeting Russia and Uzbekistan with NetSupport RAT reports that the group has been conducting targeted attacks since at least 2023, focusing on manufacturing, finance and IT sectors in Russia, Kyrgyzstan, Kazakhstan and Uzbekistan. The latest…
securelist.com -
Protests Don't Impede Iranian Spying on Expats, Syrians, Israelis
Mass protests abroad have not slowed Iranian cyber operations, as Iranian threat actors have continued spear-phishing campaigns targeting expats and others connected to Iranian affairs. On 13 January, UK-based activist Nariman Gharib revealed a highly…
Dark Reading -
Hackers Exploit React2Shell to Hijack Web Traffic via Compromised NGINX Servers
According to Datadog Security Labs, cyber security researchers have disclosed an active web traffic hijacking campaign targeting NGINX installations and management panels such as Baota, using malicious NGINX configurations to route traffic through…
-
The Sanctuary of Thought: Why Anthropic is Betting on an “Ad-Free” Claude to Topple ChatGPT
Anthropic is positioning Claude as an “ad-free” sanctuary to challenge OpenAI’s advertising-supported ChatGPT, arguing that ads would compromise Claude’s role as a “genuinely efficacious assistant for professional labour and profound contemplation.” The firm…
SecurityOnline -
More in Store: Google Officially Teases the Pixel 10a for a February 18 Debut
Google has officially teased the Pixel 10a, confirming its forthcoming debut and that pre-orders will begin on 18 February 2026. The teaser shows a blue chassis and a design that is visually similar to the Pixel 9a, with the campaign claiming the device will…
SecurityOnline -
Beyond the Wall: Intel and SoftBank’s ZAM Aims to Dethrone HBM by 2030
The article, published on 5 February 2026, reports that Intel has formally entered into a collaborative agreement with SAIMEMORY, a SoftBank subsidiary, to push the Z-Angle Memory (ZAM) initiative. ZAM aims to create a next‑generation memory standard for AI…
SecurityOnline
