What's happening in security.
The latest breaches, malware, and privacy stories from BleepingComputer, The Hacker News, Krebs on Security, and Malwarebytes Labs — short excerpts, always linking back to the original source. Last refreshed 14 Nov 2026 · 12:54.
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a high-severity security flaw impacting UnrealIRCd, an open-source Internet Relay Chat (IRC) server, to its Known Exploited Vulnerabilities (KEV) catalog, f...
Trezor confirms crypto-stealing implants in three wallets, releases fix
Cryptocurrency hardware wallet maker Trezor has confirmed that three Safe 5 devices sold by Southeast Asian reseller CryptoBilis contained malicious hardware implants designed to steal wallet recovery phrases and send them to attackers o...
German military drone operations disrupted by cyberattack
German defense technology company Quantum Systems confirmed that it detected an incident in late October that was part of an active cyberattack by "hostile actors." [...]
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE
A type confusion flaw in PostgreSQL lets a database user who can create objects run code on the server. Updates released yesterday fix it, along with 51 other security flaws. Full protection from this flaw also requires rebuilding any C-...
New York City votes to ban surveillance pricing
The bill would stop companies from using personal data to set individualized prices. Here’s what that means for shoppers.
Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper
Vulnerable Check Point Security Gateway instances have been targeted in PHP2Shell attacks that deployed data-wiping malware on VMware ESXi hosts. [...]
New Mior and Skyfall Attacks Let Rogue Cloud Hosts Steal Secrets From AMD SEV-SNP VMs
Two attacks made public this week allow a malicious host to read data inside AMD SEV-SNP-protected virtual machines (VMs), which are built to keep the server's operator out. One of them, Mior, can also modify a VM's memory and fake the s...
How one AI agent exposed five critical enterprise security gaps
An AI agent built to automate invoice processing could be manipulated into changing vendor bank details through a malicious email, without triggering traditional security alerts. Token Security examines five critical AI agent security ga...
FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls
The U.S. Federal Bureau of Investigation (FBI) has established that threat actors tied to the Democratic People's Republic of Korea (DPRK aka North Korea) have stolen more than $400 million worth of cryptocurrency as part of a social eng...
Trezor Confirms Hidden Implants in CryptoBilis-Sold Wallets That Can Steal Recovery Phrases
Three Trezor Safe 5 wallets bought from the reseller CryptoBilis contain an implant, an extra circuit board that can copy their recovery phrases, hardware wallet maker Trezor said yesterday. The implant reads the phrase from the wallet's...
Microsoft says November security updates cause printing issues
Microsoft warned customers earlier this week that the November 2026 security updates may break printing for documents with complex formatting. [...]
When an AI Agent Goes Wrong, Can You Stop It?
Suppose an AI agent is asked to sort support tickets and look up account details. A ticket contains instructions that lead the agent to export records to an unfamiliar destination. The agent can make the request because its identity has...
Google pushes second Chrome update this week
Google has pushed out a second Chrome update this week, fixing security flaws that could allow attackers to run malicious code.
SilentAir Hijacks Asian Telecom Networks to Intercept SMS 2FA Codes and Spy on Taiwanese Users
A newly identified spying group used hacked equipment inside Asian mobile operators to intercept the calls and texts of selected people, mostly in Taiwan. Enea, a telecom and cybersecurity software company based in Stockholm, found the g...
Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins
An international police operation took down servers behind Gootloader, CastleRAT and StealC this week. Criminals used the three malware tools to gain access to computers, steal passwords, and launch ransomware attacks. Police also seized...
Check Point warns of zero-day flaw exploited for root access
Check Point Software has released emergency hotfixes to address a high-severity flaw that hackers have been exploiting to gain root privileges and establish persistence on vulnerable devices since late October. [...]
Microsoft confirms Windows activation failures after November updates
Microsoft has confirmed that this month's Patch Tuesday security updates are causing Windows activation and licensing failures with 0x80041008 error codes. [...]
Worldwide Microsoft 365 outage disrupts Outlook, SharePoint, Teams, and more [updated]
A worldwide Microsoft 365 outage is having a severe impact on companies that rely on services like Outlook, Sharepoint, and Teams.
Police arrest 354 suspects in dark web cybercrime crackdown
Authorities arrested 354 suspects in a joint international operation targeting vendors and buyers on the Archetyp, Nemesis, Tor2Door, Bohemia, and Kingdom dark web marketplaces. [...]
Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files
An unknown threat actor has been observed targeting unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously unreported local privilege escalation flaw in Gaia OS to deploy...
Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2
N-able on Thursday said it's taking additional precautions in the wake of public disclosure of a new set of flaws tracked as 4EverAble2Shell and Agent2Shell. "We are restricting certain N-central features and integrations," the company s...
New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks
A new worm-like malware toolkit named SCKit was deployed in the recent ScreenConnect attacks targeting managed service providers (MSPs), designed to spread from infected customer devices to MSP technicians' computers and compromise addit...
Hackers compromise 4,800 GitHub accounts to steal cloud credentials
A new campaign dubbed 'wfx-loot' has unfolded on GitHub where threat actors used 4,837 compromised accounts to probe 61,764 repositories, open pull requests, and push secrets-stealing malware. [...]
Massive Microsoft 365 outage disrupts Outlook, Teams, Copilot worldwide
Microsoft is investigating a widespread outage affecting multiple Microsoft 365 services, including Outlook, Microsoft Teams, and Copilot, as users report connectivity problems worldwide. [...]
New N-able "4EverAble2Shell" zero-day exploited hours after PoC released
Hackers are actively exploiting a newly disclosed N-able N-central zero-day vulnerability dubbed "4EverAble2Shell" to compromise servers and deploy cryptocurrency miners, with researchers reporting at least 21 affected systems, including...
Apache HTTP Server patches critical HTTP/2 remote code execution flaw
A critical vulnerability in the HTTP/2 module of Apache HTTP Server could be exploited by an unauthenticated attacker to obtain remote code execution (RCE). [...]
Webinar: See How Identity Blind Spots Put Your SOC at Risk and How to Close Them
Security teams have more alerts, logs, and monitoring tools than ever. Yet when an attack happens, one simple question can still take too long to answer: Who or what is behind this activity, and what can they access? A suspicious login m...
ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories
A search result isn't always safe. An access request isn't always harmless. And a familiar account doesn't always mean a familiar person is using it. Simple things to remember. Yet a surprising amount of this week's trouble starts right...
New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access
Public exploit code released earlier this week claims that a local Windows user can gain SYSTEM privileges through the Common Log File System driver. The proof of concept, called SignDrop, targets a log-authentication feature added to th...
Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry
A critical flaw in Red Hat Quay allows an attacker who can access a Quay registry to read and overwrite private container images in every repository. Quay enables anonymous access by default, and while it is enabled, the attacker needs n...
New Windows SignDrop zero-day gives hackers SYSTEM privileges
Security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) has released a new Windows zero-day exploit that can let attackers gain SYSTEM privileges. [...]
Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass
Citrix has released patches for multiple critical security flaws impacting NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console that could lead to denial-of-service (DoS) or an authentication bypass. The critical vulnerabilitie...
186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers
Cybersecurity researchers have found that lookalike domains masquerading as artificial intelligence (AI) tools are being used to serve ClickFix-style lures, browser-hijacking malware, and a set of extensions that hijack user searches. Th...
Police dismantle Gootloader, CastleRAT, StealC malware infrastructure
Europol and law enforcement partners from nine countries have seized hundreds of servers and domains used by the Gootloader, CastleRAT, and StealC malware operations. [...]
Your Endpoint Management Platform Could Be Your Biggest Security Risk
Endpoint management platforms can become powerful attack tools when compromised, allowing hackers to deploy malware, execute commands, and disrupt thousands of devices. Action1 explains how customer-controlled cryptographic authorization...
Apify rotates API tokens, prompts 2FA resets after breach
Apify has rotated critical internal secrets and revoked some third-party OAuth connections after detecting unauthorized access to its internal systems. [...]
LEGO’s BrickLink taken offline: What users should know
BrickLink, the LEGO marketplace, has gone offline after detecting unusual activity, without disclosing whether customer data was affected.
SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths
The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged. Blackpoint Cyber's Adversa...
Microsoft: Recent Windows updates cause SQL Server performance issues
Microsoft has confirmed that Windows updates released since the October 2026 Patch Tuesday are causing SQL Server performance and stability issues. [...]
Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs
Google Cloud VMs on AMD Turin chips need a guest OS patch and a stop-and-start to protect against three CPU side-channel flaws, Google said this week. The company has already applied mitigations against attacks between VMs, and between V...
New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access
N-able on Thursday said it's investigating a new public disclosure containing claims of additional vulnerabilities in on-premise versions of N-central running version 2026.4.1 HF2. "Based on our initial review, the server issue described...
Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign
Since mid-August 2026, a phishing operation has been stealing live Google sessions from corporate users. Every check defenders normally lean on to judge a link came back clean, and the operator designed it that way on purpose. The Threat...
PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution
PTC has released patches for a new critical vulnerability impacting Windchill and FlexPLM software that, if successfully exploited, could result in remote code execution. The security flaw, tracked as CVE-2026-126325, carries a CVSS v4 s...
Why scammers want you to allow push notifications
Browser push notifications are a common nuisance, and they can make people think their device is infected with adware.
Microsoft confirms Windows security updates installation issues
Microsoft has confirmed reports that the November 2026 security updates are failing to install on Windows 11 systems with the October preview update. [...]
Hackers plant GSocket on Linux servers for persistent access
Multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, to maintain access to Linux servers even after patching the vulnerabilities exploited to gain initial access. [...]
Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover
A critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server. The crash occurs only if that server is later chosen to take over as the main server while it still la...
FBI agent stole $2.47m in crypto from criminal wallets
A former FBI supervisor memorized cryptocurrency wallet recovery phrases to steal millions, then confessed because it was “eating him up inside.”
Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data
A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines. A second HTTP/2 flaw can cause a server to send a client pieces of its memory...
Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories
Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security software company. The stealer is built to t...
Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
A critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday....
ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients
ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access. In an advisory posted on its site, the company said there is no evidence that the inc...
Baker Tilly notifies clients of data breach at third-party provider
The Baker Tilly Advisory Group is notifying clients that a data breach has compromised certain personal information about them and their dependents. [...]
Active ScreenConnect attacks breach MSPs, impact dozens of organizations
ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices. [...]
eMudhra revokes 8 more CA certificates after private key mishap
Certificate authority eMudhra has revoked eight additional intermediate CA certificates after an investigation into its recent certificate security incident found improper handling of private keys during the certificate-generation proces...
Notion says Fireworks breach exposed customer AI chat transcripts
Notion, the digital workspace platform, disclosed that a security breach at its AI infrastructure provider, Fireworks AI, exposed Notion AI chat transcripts in a small number of workspaces. [...]
Vanderbilt restores systems after cyberattack as hackers claim data theft
Vanderbilt University is restoring campus technology, but has not confirmed the attackers’ claims of stolen student and employee data.
Who Runs the Ransomware Group Qilin?
The cybercrime group Qilin has emerged as the world's most active ransomware affiliate program, claiming at least 365 victim organizations in the past three months alone. But even top Russian hackers make operational security mistakes, a...
Maersk confirms data breach as WhiteArmor ransomware demands $5 million
Maersk announced that a threat actor gained unauthorized access to a local legacy system inherited through an earlier acquisition and extracted data from it. [...]
Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation
Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems. The vulnerabilities are listed below - CVE-202...
AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets
Cybersecurity researchers have disclosed details of a campaign in which an emerging agentic penetration testing platform called AntiFox has been used to steal Amazon Web Services (AWS) credentials and pivot laterally into compromised env...
Hackers use AntiFox AI agents in AWS credential-theft attacks
Attackers are using Alibaba Cloud to host self-managed instances of AntiFox, an open-source agentic penetration testing platform, to target web services and AWS environments. [...]
eBPF Rootkits: Why Underground Actors Are Taking Notice
Linux eBPF rootkits can hide malicious activity and evade traditional detection methods without loading kernel modules. Flare reveals how these techniques are spreading through underground forums, where threat actors are sharing rootkit...
Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits
Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026. Cynet's CyOps and Research teams said they identified the suspicious...
Remus malware claims Gmail access even after you change your password
Developers of the infostealer Remus claim their malware can retain access to a victim’s Gmail even after a password reset.
N-able releases security hotfixes for zero-day vulnerabilities
N-able released hotfixes to address zero-day bugs affecting its N-central remote monitoring and management (RMM) platform, which were publicly disclosed over the weekend and forced it to take vulnerable hosted environments offline. [...]
Muse sleep band users weren’t told their brain data was training AI
Muse maker Interaxon reportedly trained AI on users’ de-identified brainwave data, then revised its privacy policy after journalists asked questions.
Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords
Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday. They included 24 apps built by staff at the social network X and at SpaceXSI, the comp...
We Built An Agent That Broke All of Our Security Rules. Here's What We Learned.
We tell customers three things about securing AI agents: they need their own identities, access that fits the job they’re given, and traceability that’s separate from any human’s. That was true for us at Token as well. Then, we built an...
eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise
The in-house Python script behind eMudhra's October key compromise has now cost the company 8 more of its intermediate certificate authorities (CAs), even though it did not weaken their keys. Each intermediate CA has its own private key,...
Microsoft Patch Tuesday fixes Outlook flaw already under attack
Microsoft has fixed an actively exploited Outlook vulnerability. Check for Office updates separately.
Microsoft fixes audio issues caused by September security updates
Microsoft says the November 2026 cumulative updates resolve USB audio issues plaguing Windows users who have installed security updates released since September. [...]
CISA flags Cisco BroadWorks flaw as actively exploited in attacks
The US Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday that hackers are now exploiting a high-severity Cisco BroadWorks vulnerability in attacks. [...]
Microsoft fixes Exchange sign-ins broken by Windows Server updates
Microsoft has fixed Outlook sign-in and mail delivery issues on Exchange Server systems after installing the October 2026 Windows Server security updates. [...]
Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes
Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws. These cover 726 flaws in Windows, 174 in Office, 61...
Railway Says Stolen Customer AI Keys Led to $740,000 in Estimated Unauthorized Usage Charges
AI provider keys that customers stored on Railway were stolen in an October breach and used to commit an estimated $740,000 in unauthorized spending, the platform-as-a-service provider said yesterday. It has promised to pay those charges...
Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons
An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown. When a chosen trigger appears, the model outputs an attacker's command, which...
Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evid...
Railway breach leads to $740,000 in fraudulent AI charges
Cloud hosting provider Railway says hackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and generate approximately $740,000 in fraudulent AI usage, potentially exposing credentials for up to 1...
Microsoft Fixes Nearly 1,100 Security Vulnerabilities
Microsoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software. This month's Patch Tuesday addresses 63 critical flaws -- includin...
Japanese furniture giant Nitori says hackers stole 37.6M customer records
Nitori, a major Japanese furniture and home accessories retailer, discovered that an attacker accessed a system on its network and may have stolen 37.62 million customer records. [...]
Microsoft releases Windows 10 KB5131096 extended security update
Microsoft released the Windows 10 KB5131096 extended security update, which includes this month's November 2026 Patch Tuesday fixes and a few bug fixes and changes. [...]
Hackers exploit trusted AWS access to breach multiple cloud environments
A threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple customers' AWS environments. [...]
Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones
A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55 s...
SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users
An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday. The attacker could also have seen requests being processed on that server that...
Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability. [...]
Windows 11 KB5132061 & KB5131087 cumulative updates released
Microsoft has released the Patch Tuesday Windows 11 and cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs, and add new features. [...]
Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access
French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild. The authentication bypass flaw, which does not yet have a CVE identifier, is tracked...
Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem
Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical...
Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers
A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts. [...]
Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor
Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant. The activity, observed by Huntress in early October 2026, involves the exploitati...
Binance warns of iOS flaw that could leak crypto wallet secrets
Binance is warning about a vulnerability in Apple's iOS 26.7.1, 27.0.1, and 27.2 that could allow third-party apps to read private files stored by other apps, including cryptocurrency seed phrases, secret keys, and login credentials. [...]
Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America
The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage w...
Fireworks AI Confirms Wider Breach Affecting Customer Datasets, Model Weights and Notion AI Chats
Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month uncovered further malicious activity, affecting account and billing information, alongside secrets, datasets, and incomplete...
Researcher bypassed Meta smart glasses’ safeguards to run her own code
She was able to bypass a safeguard meant to stop unauthorized software running on Meta glasses. It wasn't easy, but showed it is possible.
Ransomware recovery is now a client retention metric
Recovering from ransomware doesn't guarantee an MSP will retain its clients, especially when delays, poor communication, and unexpected costs undermine trust. Kaseya examines how disconnected recovery tools create these problems and how...
Update Chrome now to fix a flaw attackers are exploiting
Google has released Chrome updates for desktop and Android to patch a zero-day vulnerability already being exploited in attacks.
Before you buy an advent calendar, check these warning signs
Copied storefronts, fake urgency, and contradictory product claims are among the warning signs we found on suspicious advent calendar sites.
Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed
An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today. Apple...
SAP patches ICM2SHELL and PROXYGATE maximum severity flaws
SAP patched 35 vulnerabilities in its November 2026 security updates, including four maximum-severity issues affecting its NetWeaver, Web Dispatcher, and Gateway software. [...]
Beyond the Alert: The Case for Rich Network Data
At some point your security will fail. This isn’t pessimism. It’s not because your team and tools aren’t sophisticated enough. It’s the reason we have detections in the first place. And, it’s why once we accept that prevention has its li...
Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities
An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added to a group acces...
Hackers now exploit critical Barracuda ESG flaws to gain root access
Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges. [...]
Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers
The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptit...
Turla hackers use new Cereal malware to spy on govt Exchange servers
The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations. [...]
SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution
Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score. Three are in the SAP NetWeaver application server, the softwa...
France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites
An October cyberattack on refrigeration controllers at about 700 French retail sites was carried out by a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), the French government said yesterday. The attackers broke into contr...
Google patches eighth Chrome zero-day exploited in attacks this year
Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year. [...]
Anthropic's Claude Fable 5.2 Beats GPT-6 Cyber in Multi-Stage Cyberattack Benchmark
Anthropic on Monday released Claude Fable 5.2 and Claude Mythos 5.2 models, which it said exhibit improvements in coding, reasoning, and vision. During pre-release training, the large language models (LLMs) helped its engineers "complete...
Fireworks AI discloses new breach after cloud provider hack
AI infrastructure startup Fireworks has disclosed a new security breach in which attackers accessed its development machines after breaching a third-party cloud provider. [...]
Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, assigned the CVE identifier CVE-2026-125350 (CVSS score: 8.8),...
N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits
N-able said it has taken N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice following the public disclosure of over 30 vulnerabilities collectively tracked as Able2Sh...
CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog,...
Vanderbilt University hit in BYOD ransomware attack, data theft claimed
Vanderbilt University warns it is responding to a cyberattack claimed by the BYOD ransomware gang, which claims to have encrypted the university's databases and stolen sensitive student, employee, and research data. [...]
SEGA newsletter data breach exposes 2.2 million email addresses
Japanese gaming giant SEGA has disclosed that a data breach at its third-party newsletter provider, ARARA, exposed the email addresses of 2.2 million newsletter subscribers. [...]
N-able takes cloud platform offline after 30+ "zero-days" published
N-able has taken its hosted N-central environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more than 30 alleged zero-day vulnerabilities, including exploits that c...
York University breach exposed personal information dating to 2007
York University has announced it suffered a cybersecurity incident in which a threat actor stole personal information people submitted through online forms. [...]
France blames Iranian hackers for supermarket attacks that sparked fires
France has linked October cyberattacks that disrupted refrigeration systems at more than 700 supermarkets and other retail locations to Iranian state-backed hackers, saying the attacks caused food losses and sparked at least 15 fires. [...]
Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data
An attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data, cloud security company Wiz said today. The attacker used credentials for an AWS account that...
Russian cloud firm Beget rebuilds from scratch after data wiper attack
A data-wiping malware attack has forced Russian cloud services provider Beget to rebuild its cloud infrastructure from scratch, the company said. [...]
Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware
Attackers used the Ethersphere project's own release automation to publish malicious versions of two of its tools for the Swarm decentralized storage network: bee-js 13.3.0 and Swarm Desktop 0.56.2. Both releases download and run code bu...
Binance denies data breach after alleged ShinyHunters claims
Binance, the world's largest crypto exchange, has denied claims of a new security breach made by a threat actor using the 'ShinyHunters' handle on a newly emerged underground cybercrime forum. [...]
Hackers exploit SSHole OpenSSH flaw to breach Linux systems
Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access. [...]
The Biggest Threat to Your GRC Job Isn’t AI. It’s Ignoring AI.
AI agents are taking over routine governance, risk, and compliance tasks, forcing GRC professionals to rethink the skills needed to stay relevant. Anecdotes examines three essential skills for the AI-driven GRC workplace: data literacy,...
FBI agent stole $2.5 million in crypto from hackers under investigation
A former FBI agent has pleaded guilty to stealing nearly $2.5 million from the wallets of fraud victims and nation-state hackers under investigation. [...]
Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia
The South Asian cyber espionage group known as Bitter (aka APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397) has been observed targeting South Asian organizations with a previously unreported remote access trojan called P...
US bans MEXC crypto exchange over sanctions evasion, cybercrime links
The US Department of the Treasury has cut off the MEXC Global crypto exchange from the US financial system over sanctions evasion and links with cybercrime gangs. [...]
⚡ Weekly Recap: SSHole Exploited, APT Root RCE, Robot Takeovers, 15K Hacked Sites, and More
A system doesn't always need a complicated bug to let someone in. Sometimes, a blank password is enough. That's one of the bigger stories this week. And it gets worse when the tools meant to keep systems updated or running safely become...
13.3 million people’s medical data exposed; companies pay $300,000
The New York AG reached a settlement with Perry Johnson & Associates and four related companies over a 2023 breach.
Ukraine dismantles crypto scam network that stole €4.3 million
Ukrainian law enforcement arrested four suspects in a case involving the theft of more than €4.3 million using a network of cryptocurrency investment scam call centers. [...]
Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars
The login systems behind two car brands' mobile apps could be taken over completely, two security researchers found, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the en...
Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety
Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker. Keplr uses a company called Web3Auth to run that Google and Apple sign-in. The attacker used a security flaw at that co...
LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers Amid Attacks
Everyone running LNbits, a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday. It has several security fixes to release and asked operators to be...
Taiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch Records
A single attacker using AI agents pulled emergency dispatch records covering seven Taipei districts, researchers at Acronis's Threat Research Unit said last week. The agents also found a Taipei fire department platform exposing patient d...
A week in security (November 2 – November 8)
A list of topics we covered in the week of November 2 to November 8 of 2026
Former OpenAI Engineer Pleads Not Guilty to Planting Covert Device in Executive Meeting Room
The OpenAI engineer who was arrested and charged last month for planting a covert audio recording device in the company's office has pleaded not guilty. According to reports from Bloomberg and CNBC, Saudi national Abdulrahman Alfozan mad...
U.S. Agencies Warn Refrigeration Controller Attacks Could Cause Fires and Inventory Losses
U.S. government agencies have warned that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems globally with an aim to cause service disruptions, fire hazards, and loss of inventory. "The actors...
CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have been explo...
Iris Ohyama data cloud breach exposes info of 7.7 million customers
Japanese manufacturer Iris Ohyama, the operator of the Iris Plaza shopping platform, disclosed that personal information belonging to about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service...
Hackers pull off $133 million French bank heist via service provider
French cooperative bank Crédit Mutuel Arkéa was targeted in a cyberattack that enabled fraudulent transactions of up to $133 million, forcing it to respond by suspending certain systems.v [...]
CTM360 Exposes Fake Gift Card Scams Exploiting Trusted Brands
Scammers are impersonating major brands and celebrities to lure consumers into fake gift card giveaways that collect personal information and trigger unwanted subscriptions. CTM360 reveals how these campaigns use deceptive verification s...
Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. When a user selects "Yes, and don't ask again," Anthropic's AI coding assistan...
SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks. [...]
Runaway AI hacking agent behind WorkOS breach after escaping sandbox
WorkOS says an AI-powered hacking agent that breached its internal sales application and accessed customer information was operated by a security researcher who claims the tool escaped its testing environment and unintentionally attacked...
OpenAI's new GPT-6 Cyber AI finds 81 Firefox flaws, 948 Linux bugs
OpenAI has revealed GPT-6 Cyber, a new artificial intelligence model that has discovered 81 previously unknown high-severity Firefox vulnerabilities and developed working exploits for 948 distinct Linux kernel flaws. [...]
Fake security tools on GitHub push backdoors and infostealers
Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware. [...]
QNAP says hackers breaching NAS devices in Plex2Shell attacks
QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain. [...]
Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time
Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it. The update that installs the fix still unpacks its files using th...
Veeam warns of Software Appliance boot failures on AMD EPYC hosts
Veeam warned customers about boot failures affecting Software Appliance virtual machines (VMs) on hosts with AMD EPYC processors. [...]
Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian. The vulnerability, tracked as CVE-2026-123158 (CVSS scor...