What's happening in security.
The latest breaches, malware, and privacy stories from BleepingComputer, The Hacker News, Krebs on Security, and Malwarebytes Labs — short excerpts, always linking back to the original source. Last refreshed 14 Nov 2026 · 12:54.
Trezor confirms crypto-stealing implants in three wallets, releases fix
Cryptocurrency hardware wallet maker Trezor has confirmed that three Safe 5 devices sold by Southeast Asian reseller CryptoBilis contained malicious hardware implants designed to steal wallet recovery phrases and send them to attackers o...
German military drone operations disrupted by cyberattack
German defense technology company Quantum Systems confirmed that it detected an incident in late October that was part of an active cyberattack by "hostile actors." [...]
Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper
Vulnerable Check Point Security Gateway instances have been targeted in PHP2Shell attacks that deployed data-wiping malware on VMware ESXi hosts. [...]
How one AI agent exposed five critical enterprise security gaps
An AI agent built to automate invoice processing could be manipulated into changing vendor bank details through a malicious email, without triggering traditional security alerts. Token Security examines five critical AI agent security ga...
Microsoft says November security updates cause printing issues
Microsoft warned customers earlier this week that the November 2026 security updates may break printing for documents with complex formatting. [...]
Check Point warns of zero-day flaw exploited for root access
Check Point Software has released emergency hotfixes to address a high-severity flaw that hackers have been exploiting to gain root privileges and establish persistence on vulnerable devices since late October. [...]
Microsoft confirms Windows activation failures after November updates
Microsoft has confirmed that this month's Patch Tuesday security updates are causing Windows activation and licensing failures with 0x80041008 error codes. [...]
Police arrest 354 suspects in dark web cybercrime crackdown
Authorities arrested 354 suspects in a joint international operation targeting vendors and buyers on the Archetyp, Nemesis, Tor2Door, Bohemia, and Kingdom dark web marketplaces. [...]
New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks
A new worm-like malware toolkit named SCKit was deployed in the recent ScreenConnect attacks targeting managed service providers (MSPs), designed to spread from infected customer devices to MSP technicians' computers and compromise addit...
Hackers compromise 4,800 GitHub accounts to steal cloud credentials
A new campaign dubbed 'wfx-loot' has unfolded on GitHub where threat actors used 4,837 compromised accounts to probe 61,764 repositories, open pull requests, and push secrets-stealing malware. [...]
Massive Microsoft 365 outage disrupts Outlook, Teams, Copilot worldwide
Microsoft is investigating a widespread outage affecting multiple Microsoft 365 services, including Outlook, Microsoft Teams, and Copilot, as users report connectivity problems worldwide. [...]
New N-able "4EverAble2Shell" zero-day exploited hours after PoC released
Hackers are actively exploiting a newly disclosed N-able N-central zero-day vulnerability dubbed "4EverAble2Shell" to compromise servers and deploy cryptocurrency miners, with researchers reporting at least 21 affected systems, including...
Apache HTTP Server patches critical HTTP/2 remote code execution flaw
A critical vulnerability in the HTTP/2 module of Apache HTTP Server could be exploited by an unauthenticated attacker to obtain remote code execution (RCE). [...]
New Windows SignDrop zero-day gives hackers SYSTEM privileges
Security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) has released a new Windows zero-day exploit that can let attackers gain SYSTEM privileges. [...]
Police dismantle Gootloader, CastleRAT, StealC malware infrastructure
Europol and law enforcement partners from nine countries have seized hundreds of servers and domains used by the Gootloader, CastleRAT, and StealC malware operations. [...]
Your Endpoint Management Platform Could Be Your Biggest Security Risk
Endpoint management platforms can become powerful attack tools when compromised, allowing hackers to deploy malware, execute commands, and disrupt thousands of devices. Action1 explains how customer-controlled cryptographic authorization...
Apify rotates API tokens, prompts 2FA resets after breach
Apify has rotated critical internal secrets and revoked some third-party OAuth connections after detecting unauthorized access to its internal systems. [...]
Microsoft: Recent Windows updates cause SQL Server performance issues
Microsoft has confirmed that Windows updates released since the October 2026 Patch Tuesday are causing SQL Server performance and stability issues. [...]
Microsoft confirms Windows security updates installation issues
Microsoft has confirmed reports that the November 2026 security updates are failing to install on Windows 11 systems with the October preview update. [...]
Hackers plant GSocket on Linux servers for persistent access
Multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, to maintain access to Linux servers even after patching the vulnerabilities exploited to gain initial access. [...]
Baker Tilly notifies clients of data breach at third-party provider
The Baker Tilly Advisory Group is notifying clients that a data breach has compromised certain personal information about them and their dependents. [...]
Active ScreenConnect attacks breach MSPs, impact dozens of organizations
ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices. [...]
eMudhra revokes 8 more CA certificates after private key mishap
Certificate authority eMudhra has revoked eight additional intermediate CA certificates after an investigation into its recent certificate security incident found improper handling of private keys during the certificate-generation proces...
Notion says Fireworks breach exposed customer AI chat transcripts
Notion, the digital workspace platform, disclosed that a security breach at its AI infrastructure provider, Fireworks AI, exposed Notion AI chat transcripts in a small number of workspaces. [...]
Maersk confirms data breach as WhiteArmor ransomware demands $5 million
Maersk announced that a threat actor gained unauthorized access to a local legacy system inherited through an earlier acquisition and extracted data from it. [...]
Hackers use AntiFox AI agents in AWS credential-theft attacks
Attackers are using Alibaba Cloud to host self-managed instances of AntiFox, an open-source agentic penetration testing platform, to target web services and AWS environments. [...]
eBPF Rootkits: Why Underground Actors Are Taking Notice
Linux eBPF rootkits can hide malicious activity and evade traditional detection methods without loading kernel modules. Flare reveals how these techniques are spreading through underground forums, where threat actors are sharing rootkit...
N-able releases security hotfixes for zero-day vulnerabilities
N-able released hotfixes to address zero-day bugs affecting its N-central remote monitoring and management (RMM) platform, which were publicly disclosed over the weekend and forced it to take vulnerable hosted environments offline. [...]
Microsoft fixes audio issues caused by September security updates
Microsoft says the November 2026 cumulative updates resolve USB audio issues plaguing Windows users who have installed security updates released since September. [...]
CISA flags Cisco BroadWorks flaw as actively exploited in attacks
The US Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday that hackers are now exploiting a high-severity Cisco BroadWorks vulnerability in attacks. [...]
Microsoft fixes Exchange sign-ins broken by Windows Server updates
Microsoft has fixed Outlook sign-in and mail delivery issues on Exchange Server systems after installing the October 2026 Windows Server security updates. [...]
Railway breach leads to $740,000 in fraudulent AI charges
Cloud hosting provider Railway says hackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and generate approximately $740,000 in fraudulent AI usage, potentially exposing credentials for up to 1...
Japanese furniture giant Nitori says hackers stole 37.6M customer records
Nitori, a major Japanese furniture and home accessories retailer, discovered that an attacker accessed a system on its network and may have stolen 37.62 million customer records. [...]
Microsoft releases Windows 10 KB5131096 extended security update
Microsoft released the Windows 10 KB5131096 extended security update, which includes this month's November 2026 Patch Tuesday fixes and a few bug fixes and changes. [...]
Hackers exploit trusted AWS access to breach multiple cloud environments
A threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple customers' AWS environments. [...]
Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability. [...]
Windows 11 KB5132061 & KB5131087 cumulative updates released
Microsoft has released the Patch Tuesday Windows 11 and cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs, and add new features. [...]
Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers
A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts. [...]
Binance warns of iOS flaw that could leak crypto wallet secrets
Binance is warning about a vulnerability in Apple's iOS 26.7.1, 27.0.1, and 27.2 that could allow third-party apps to read private files stored by other apps, including cryptocurrency seed phrases, secret keys, and login credentials. [...]
Ransomware recovery is now a client retention metric
Recovering from ransomware doesn't guarantee an MSP will retain its clients, especially when delays, poor communication, and unexpected costs undermine trust. Kaseya examines how disconnected recovery tools create these problems and how...
SAP patches ICM2SHELL and PROXYGATE maximum severity flaws
SAP patched 35 vulnerabilities in its November 2026 security updates, including four maximum-severity issues affecting its NetWeaver, Web Dispatcher, and Gateway software. [...]
Hackers now exploit critical Barracuda ESG flaws to gain root access
Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges. [...]
Turla hackers use new Cereal malware to spy on govt Exchange servers
The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations. [...]
Google patches eighth Chrome zero-day exploited in attacks this year
Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year. [...]
Fireworks AI discloses new breach after cloud provider hack
AI infrastructure startup Fireworks has disclosed a new security breach in which attackers accessed its development machines after breaching a third-party cloud provider. [...]
Vanderbilt University hit in BYOD ransomware attack, data theft claimed
Vanderbilt University warns it is responding to a cyberattack claimed by the BYOD ransomware gang, which claims to have encrypted the university's databases and stolen sensitive student, employee, and research data. [...]
SEGA newsletter data breach exposes 2.2 million email addresses
Japanese gaming giant SEGA has disclosed that a data breach at its third-party newsletter provider, ARARA, exposed the email addresses of 2.2 million newsletter subscribers. [...]
N-able takes cloud platform offline after 30+ "zero-days" published
N-able has taken its hosted N-central environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more than 30 alleged zero-day vulnerabilities, including exploits that c...
York University breach exposed personal information dating to 2007
York University has announced it suffered a cybersecurity incident in which a threat actor stole personal information people submitted through online forms. [...]
France blames Iranian hackers for supermarket attacks that sparked fires
France has linked October cyberattacks that disrupted refrigeration systems at more than 700 supermarkets and other retail locations to Iranian state-backed hackers, saying the attacks caused food losses and sparked at least 15 fires. [...]
Russian cloud firm Beget rebuilds from scratch after data wiper attack
A data-wiping malware attack has forced Russian cloud services provider Beget to rebuild its cloud infrastructure from scratch, the company said. [...]
Binance denies data breach after alleged ShinyHunters claims
Binance, the world's largest crypto exchange, has denied claims of a new security breach made by a threat actor using the 'ShinyHunters' handle on a newly emerged underground cybercrime forum. [...]
Hackers exploit SSHole OpenSSH flaw to breach Linux systems
Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access. [...]
The Biggest Threat to Your GRC Job Isn’t AI. It’s Ignoring AI.
AI agents are taking over routine governance, risk, and compliance tasks, forcing GRC professionals to rethink the skills needed to stay relevant. Anecdotes examines three essential skills for the AI-driven GRC workplace: data literacy,...
FBI agent stole $2.5 million in crypto from hackers under investigation
A former FBI agent has pleaded guilty to stealing nearly $2.5 million from the wallets of fraud victims and nation-state hackers under investigation. [...]
US bans MEXC crypto exchange over sanctions evasion, cybercrime links
The US Department of the Treasury has cut off the MEXC Global crypto exchange from the US financial system over sanctions evasion and links with cybercrime gangs. [...]
Ukraine dismantles crypto scam network that stole €4.3 million
Ukrainian law enforcement arrested four suspects in a case involving the theft of more than €4.3 million using a network of cryptocurrency investment scam call centers. [...]
Iris Ohyama data cloud breach exposes info of 7.7 million customers
Japanese manufacturer Iris Ohyama, the operator of the Iris Plaza shopping platform, disclosed that personal information belonging to about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service...
Hackers pull off $133 million French bank heist via service provider
French cooperative bank Crédit Mutuel Arkéa was targeted in a cyberattack that enabled fraudulent transactions of up to $133 million, forcing it to respond by suspending certain systems.v [...]
CTM360 Exposes Fake Gift Card Scams Exploiting Trusted Brands
Scammers are impersonating major brands and celebrities to lure consumers into fake gift card giveaways that collect personal information and trigger unwanted subscriptions. CTM360 reveals how these campaigns use deceptive verification s...
SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks. [...]
Runaway AI hacking agent behind WorkOS breach after escaping sandbox
WorkOS says an AI-powered hacking agent that breached its internal sales application and accessed customer information was operated by a security researcher who claims the tool escaped its testing environment and unintentionally attacked...
OpenAI's new GPT-6 Cyber AI finds 81 Firefox flaws, 948 Linux bugs
OpenAI has revealed GPT-6 Cyber, a new artificial intelligence model that has discovered 81 previously unknown high-severity Firefox vulnerabilities and developed working exploits for 948 distinct Linux kernel flaws. [...]
Fake security tools on GitHub push backdoors and infostealers
Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware. [...]
QNAP says hackers breaching NAS devices in Plex2Shell attacks
QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain. [...]
Veeam warns of Software Appliance boot failures on AMD EPYC hosts
Veeam warned customers about boot failures affecting Software Appliance virtual machines (VMs) on hosts with AMD EPYC processors. [...]