Week 46,2026_

Critical Xen Orchestra Flaws Exploited in Attacks

A critical authentication bypass allows attackers to execute arbitrary code as admin and take over XCP-ng nodes. The post Critical Xen Orchestra Flaws Exploited in…

Hackers use AntiFox AI agents in AWS credential-theft attacks

Attackers are using Alibaba Cloud to host self-managed instances of AntiFox, an open-source agentic penetration testing platform, to target web services and AWS…

eBPF Rootkits: Why Underground Actors Are Taking Notice

Linux eBPF rootkits can hide malicious activity and evade traditional detection methods without loading kernel modules. Flare reveals how these techniques are spreading…

Git fixes six vulnerabilities, including code execution during recursive clones

The Git project has released security updates addressing six vulnerabilities that could allow attackers to execute code, write to unintended files or cause memory…

Asus, Zoom Release Security Patches

Attackers could exploit them for command execution, memory overwrites, and privilege escalation. The post Asus, Zoom Release Security Patches appeared first on…

Embed Security lets analysts teach its AI SOC Platform how to investigate

Embed Security announced new capabilities that let security teams teach Embed how they investigate, what matters in their environment, and how to improve their…

Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities

Attackers could exploit the bugs to tamper with certificate entries, achieve remote code execution, and compromise hosts. The post Citrix, Ivanti Patch Critical and…

N-able releases security hotfixes for zero-day vulnerabilities

N-able released hotfixes to address zero-day bugs affecting its N-central remote monitoring and management (RMM) platform, which were publicly disclosed over the weekend…

Finite State Raises $27 Million to Secure Software and Firmware in Connected Devices

The Series C round will fund international expansion and more autonomous features for the firm’s device security platform. The post Finite State Raises $27 Million to…

Fortinet Patches Nearly 100 Vulnerabilities

The massive drop comes after the company integrated frontier AI models into its product security testing. The post Fortinet Patches Nearly 100 Vulnerabilities appeared…

Shipping giant Maersk probes 'IT security incident,' data theft

Says it 'strongly' suspects attack limited to legacy system, and that nothing sensitive is at risk

Rubrik enhances DevOps Protection to preserve legitimate work during recovery

Rubrik has announced cyber recovery capabilities for DevOps platforms Microsoft Azure DevOps and GitHub. With built-in anomaly detection, blast radius investigation, and…

Tinfoil (YC P25) is hiring an applied AI security engineer in San Francisco

Microsoft fixes audio issues caused by September security updates

Microsoft says the November 2026 cumulative updates resolve USB audio issues plaguing Windows users who have installed security updates released since September. [...]

Dreeze Emerges From Stealth With $33M to Rebuild Cloud Apps After Cyberattacks

Created by Zerto and Kashya veterans, the startup has launched a platform designed to recover whole cloud applications. The post Dreeze Emerges From Stealth With $33M to…

ICS Patch Tuesday: Siemens Flags High-Severity Flaws, Node2Shell Exposure

Pre-Patch Tuesday advisories were published by VDE CERT, Phoenix Contact, Johnson Controls, and Hitachi Energy. The post ICS Patch Tuesday: Siemens Flags High-Severity…

CISA flags Cisco BroadWorks flaw as actively exploited in attacks

The US Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday that hackers are now exploiting a high-severity Cisco BroadWorks vulnerability in…

Ubuntu certificate revocation checks arrive in curl, OpenSSL is next

Ubuntu 26.10 ships curl with certificate revocation checking built in. The check comes from upki, a project from the rustls developers. Ubuntu’s developers ran the same…

Red Hat OpenShift 5 brings autonomous troubleshooting to hybrid clouds

Red Hat has announced the general availability of Red Hat OpenShift 5, bringing built-in operational intelligence, zero trust security and a longer, predictable…

Microsoft fixes Exchange sign-ins broken by Windows Server updates

Microsoft has fixed Outlook sign-in and mail delivery issues on Exchange Server systems after installing the October 2026 Windows Server security updates. [...]

Orca Security adds visibility into AI-generated code and agent risks

Orca Security has announced new capabilities to help organizations discover and secure AI-generated applications and autonomous agents across their cloud environments…

Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities

The flaws, CVE-2026-111793 and CVE-2026-20320, let attackers leak sensitive information, including configuration data. The post Threat Actors Exploit Openwave, Cisco…

A CISO’s guide to trimming waste from a flat security budget

In this Help Net Security video, Ken Leeser, CISO at Y Meadows, explains how security leaders can get more protection out of a flat budget. He argues a frozen budget…

EU cyber scores look healthy, but 45% of surveyed IT providers take months to patch

Forty-five percent of surveyed IT service management providers in the EU took more than three months to apply critical patches to critical systems, according to ENISA’s…

Nearly half of big firms shelve or close vulnerability findings they haven’t confirmed

Nearly half of security teams at organizations with 5,000 or more employees close or deprioritize vulnerability findings without fully verifying them, ProjectDiscovery…

An Instagram ad was all it took: Leaked exploit kits are hitting employees’ iPhones

Criminals are using leaked exploit kits to break into vulnerable iPhones, according to iVerify’s 2026 Advanced Mobile Threat Report. Attacks delivered through ads and…

Google Fi super network leans on encryption to keep hotspot traffic private

Google Fi now moves customers’ phones onto Wi-Fi hotspots and between two 5G networks without the user going into settings or logging in. Google calls the setup a super…

A great old-timey game-programming hack (2013)

November Patch Tuesday boasts over 1,000 bugs but only one zero-day so far

Microsoft admins wail and gnash their teeth

Ring cameras go mobile as Amazon debuts AI-powered security drone and robot

Amazon's roaming Ring Robotics devices will debut in late 2026 and early 2027.

Railway breach leads to $740,000 in fraudulent AI charges

Cloud hosting provider Railway says hackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and generate approximately $740,000…

Tracking Anthropic-discovered vulnerabilities

Microsoft Fixes Nearly 1,100 Security Vulnerabilities

Microsoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported…

Ring robots ready to patrol paranoids’ pads

Amazon calls its home security drone and business patrol bot 'proactive protection'

rVPN – stealth VPN with end-to-end encryption

Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI

Researcher finds 35,000 Grok Build apps wide open to anyone who looked for them.

Japanese furniture giant Nitori says hackers stole 37.6M customer records

Nitori, a major Japanese furniture and home accessories retailer, discovered that an attacker accessed a system on its network and may have stolen 37.62 million customer…

Microsoft releases Windows 10 KB5131096 extended security update

Microsoft released the Windows 10 KB5131096 extended security update, which includes this month's November 2026 Patch Tuesday fixes and a few bug fixes and changes. [...]

Hackers exploit trusted AWS access to breach multiple cloud environments

A threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple…

Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft

CVE-2026-124194 is the Outlook zero-day for which Microsoft says it’s aware of active exploitation. The post Exploited Outlook Zero-Day Among 1,094 Flaws Patched by…

Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day

Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook…

Barracuda’s email security gateways bitten by make-me-root vulns

Someone's fishing for exposed devices

Windows 11 KB5132061 & KB5131087 cumulative updates released

Microsoft has released the Patch Tuesday Windows 11 and cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs, and add new…

Adobe Patches 110 Vulnerabilities Across 9 Products

Adobe has fixed vulnerabilities in AEM, Premiere, Photoshop, After Effects, Connect, Audition, Dimension, Content Credentials SDK, and Media Encoder. The post Adobe…

Firefox free VPN drops its 50GB launch cap until January 31

Mozilla has removed the data limit on the free VPN built into Firefox. Firefox users in supported regions get unlimited browsing on desktop and Android once they sign in…

Git security vulnerabilities announced

Git is releasing updates addressing six security vulnerabilities affecting recursive clones, reference handling, merges, binary patches, and imports. Here is what users…

Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers

A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of…

X.Org patches eight server vulnerabilities a month after fixing 12 others

X.Org has fixed eight vulnerabilities in the X.Org X server and Xwayland, including one in the Xorg server that lets a malicious monitor corrupt its memory. The fixes…

Trump taps Palantir security chief to run battered US cyber defense agency

Michael LoSapio could inherit a depleted workforce and a political headache or two, courtesy of his current employer

Binance warns of iOS flaw that could leak crypto wallet secrets

Binance is warning about a vulnerability in Apple's iOS 26.7.1, 27.0.1, and 27.2 that could allow third-party apps to read private files stored by other apps, including…

Fireworks AI gets burned twice as customer data exposure widens

Inference biz pins latest breach on cloud provider and LLMJacking miscreants

Ransomware recovery is now a client retention metric

Recovering from ransomware doesn't guarantee an MSP will retain its clients, especially when delays, poor communication, and unexpected costs undermine trust. Kaseya…

Today: CISO Forum Virtual Summit 2026 Day 2 – Join Cybersecurity Leaders Online

Designed for cybersecurity leaders, this immersive two-day virtual event is your premier destination to discuss, share, and learn innovative risk management and defense…

WhiteMatter Raises $20 Million in Series A Funding

The cybersecurity startup deploys a dedicated guardian agent for every AI agent in an organization’s environment. The post WhiteMatter Raises $20 Million in Series A…

SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities

SAP has published 42 new and updated security advisories, including nine that address critical-severity vulnerabilities. The post SAP Patches Critical ICM2SHELL…

Dreeze raises $33 million to automate recovery of entire cloud applications

Dreeze emerged from stealth with $33 million in seed funding and announced the general availability of its Application Revival platform for Amazon Web Services (AWS)…

Chrome zero-day whack-a-mole continues as 2026 tally hits 8

Another Chrome memory bug gets squashed, but not before attackers got their hands on it

Over a Dozen Organizations Hit in Qubole Supply Chain Attack

Hackers used compromised Qubole IAM credentials to steal customer files, secrets, keys, environment variables, and credentials. The post Over a Dozen Organizations Hit…

CISA tweaks cyber incident form to spot attacks that might be linked

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its online incident reporting form to help analysts spot when attacks on different…

Ransomware threat blares from Vanderbilt University computers during cyberattack

BYOD claims extensive data theft as campus Wi-Fi returns, most systems remain restricted, and classes carry on

Anthropic Rolls Out Mythos 5.2 With Improved Bug Hunting, Fewer Sandbox Escapes

Anthropic says Mythos 5.2 improves vulnerability discovery while showing a lower tendency to escape sandboxes in controlled tests. The post Anthropic Rolls Out Mythos…

IRISSCON 2026 puts preparedness for cyberattacks and hybrid threats in focus

Ireland risks being dangerously unprepared for increasingly sophisticated cyberattacks and hybrid threats unless the Government acts urgently to strengthen the country’s…

SAP patches ICM2SHELL and PROXYGATE maximum severity flaws

SAP patched 35 vulnerabilities in its November 2026 security updates, including four maximum-severity issues affecting its NetWeaver, Web Dispatcher, and Gateway…

Claude Mythos 5.2 arrives with stronger bug hunting and less sandbox-breaking behavior

Anthropic released Claude Fable 5.2 and Claude Mythos 5.2. The two versions share an underlying model, with stricter safeguards for cybersecurity and biology tasks in…

Hackers now exploit critical Barracuda ESG flaws to gain root access

Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run…

Turla hackers use new Cereal malware to spy on govt Exchange servers

The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government…

Windows settings backup is on by default starting with Windows 11 26H2

Starting with Windows 11, version 26H2, Windows settings backup will switch on by default on eligible devices. The company renamed the feature, which launched in August…

Turla’s Cereal malware turns victims’ Exchange servers into spy hubs

Russia-aligned group Turla planted a modular .NET toolset on Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania, and used…

N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days

Attackers could exploit the flaws for remote code execution, credential theft, and administrator account creation. The post N-able Takes N-central Offline as Researcher…

IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks

CISA has added CVE-2026-123218 and CVE-2026-116779 to KEV, urging federal agencies to patch them within three days. The post IBM Aspera Faspex, SignalWire FreeSwitch…

Queens Public library under ransomware attack e-borrowing suspended

Google patches eighth Chrome zero-day exploited in attacks this year

Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year. [...]

Fireworks AI discloses new breach after cloud provider hack

AI infrastructure startup Fireworks has disclosed a new security breach in which attackers accessed its development machines after breaching a third-party cloud…

What a security leader should tell the CEO about leaked credentials

In this Help Net Security interview, Eric Fourrier, CEO of GitGuardian, talks about leaked credentials and personal liability for security leaders and boards. He…

France Blames Iran for a Cyberattack That Heated Supermarket Refrigerators

France summoned the Iranian ambassador and said it would seek European sanctions against those responsible for the attack The post France Blames Iran for a Cyberattack…

Chrome Update Patches Exploited XML Zero-Day, Eighth This Year

The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks. The post Chrome Update Patches…

Security teams want to spot unusual AI agent behavior while they’re still defining normal

AI agents topped the list of planned investments in behavioral monitoring in Abnormal AI’s 2026 State of Behavioral Security Report. Asked where their organizations…

Over 575 malicious OpenClaw skills delivered malware to Windows and macOS

Cybercriminals are using AI agents to coordinate attacks, stolen credentials to access linked services, and tools that interfere with intrusion detection and system…

Cybersecurity jobs available right now: November 10, 2026

Application Security Engineer ONE ZERO BANK | Israel | Hybrid – View job details As an Application Security Engineer, you will work with developers to build security…

Cogent and OpenAI build cyber defense factories for enterprises

Cogent combines OpenAI models with enterprise context to help automatically remediate vulnerabilities with agents.

Vanderbilt University hit in BYOD ransomware attack, data theft claimed

Vanderbilt University warns it is responding to a cyberattack claimed by the BYOD ransomware gang, which claims to have encrypted the university's databases and stolen…

France blames Iran for supermarket hack meltdowns

The 'first cyber offensive campaign carried out purely for the purpose of sabotage on national territory'

SEGA newsletter data breach exposes 2.2 million email addresses

Japanese gaming giant SEGA has disclosed that a data breach at its third-party newsletter provider, ARARA, exposed the email addresses of 2.2 million newsletter…

N-able takes cloud platform offline after 30+ "zero-days" published

N-able has taken its hosted N-central environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more…

York University breach exposed personal information dating to 2007

York University has announced it suffered a cybersecurity incident in which a threat actor stole personal information people submitted through online forms. [...]

Supply chain attack on Qubole customers

Attackers backdoor trusted AWS integrations to steal secrets

Wiz researchers uncovered the secret-stealing supply-chain attack

Vulnerability that lets hackers SSH into Linux devices is under active exploitation

"*sshole" poses a serious threat to Internet security.

France blames Iranian hackers for supermarket attacks that sparked fires

France has linked October cyberattacks that disrupted refrigeration systems at more than 700 supermarkets and other retail locations to Iranian state-backed hackers…

Russian cloud firm Beget rebuilds from scratch after data wiper attack

A data-wiping malware attack has forced Russian cloud services provider Beget to rebuild its cloud infrastructure from scratch, the company said. [...]

Researchers pwn automakers’ Android apps to remotely unlock cars, honk horns

Pair of researchers chain WAF bypasses and default logins to command vehicles in Australia and the US

Binance denies data breach after alleged ShinyHunters claims

Binance, the world's largest crypto exchange, has denied claims of a new security breach made by a threat actor using the 'ShinyHunters' handle on a newly emerged…

Hackers exploit SSHole OpenSSH flaw to breach Linux systems

Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access. [...]

Microsoft's Azure Linux gets 470-plus security fixes in one almighty patching session

A mountain of CVEs, a certificate cleanup, and yet more work for Microsoft's patching teams

ARTEX goes from pentesting tool to attacker staple in three months

A security researcher’s AI agent breached an internal sales application used by WorkOS’s go-to-market teams, the developer platform provider confirmed on Friday. “The…

Hackers abuse refrigeration controllers to send spam and route proxy traffic

Internet-exposed refrigeration controllers used in supermarkets and cold storage facilities are being hijacked and turned into infrastructure for a suspected spam botnet…

FBI agent stole $2.5 million in crypto from hackers under investigation

A former FBI agent has pleaded guilty to stealing nearly $2.5 million from the wallets of fraud victims and nation-state hackers under investigation. [...]

Who Gives A Crap? Hackers, apparently, after toilet paper maker's customer data exposed

UK shoppers caught up in third-party security mess, and nobody knows whether the data was flushed away

Revolve Puts Data Breach Victim Count at 1.5 Million

Online fashion retailer Revolve has told regulators that the September cyberattack affected more than 1.5 million individuals. The post Revolve Puts Data Breach Victim…

Outlook.com bounces legit emails as Microsoft's authentication crackdown goes sideways

Missing DMARC or wobbly SPF means your mail may be treated as suspicious

US bans MEXC crypto exchange over sanctions evasion, cybercrime links

The US Department of the Treasury has cut off the MEXC Global crypto exchange from the US financial system over sanctions evasion and links with cybercrime gangs. [...]

PyPI makes release attestations easier to find with new security tab

The Python Package Index (PyPI) has added a security tab to its project pages, giving developers a place to check where individual release files came from. How PyPI…

Plex2Shell Exploited Against QNAP NAS Users

Threat actors are exploiting the four-flaw chain to hack the Plex Media Server application on QNAP NAS devices. The post Plex2Shell Exploited Against QNAP NAS Users…

Japanese homeware giant pulls online store after cloud breach puts 7.7M records at risk

No reopening date as orders face delays and some customers are told to refuse deliveries to cancel purchases

Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers

Hackers compromised an external cloud service used by the shopping platform and may have stolen personal information from it. The post Iris Plaza Breach May Have Exposed…

Italy’s Meloni Blames Pro-Russian Hackers for Leak of Foreign Minister’s Data on the Dark Web

Italian Foreign Minister Antonio Tajani said Saturday that his personal data had been disseminated on the dark web. The post Italy’s Meloni Blames Pro-Russian Hackers…

Ukraine dismantles crypto scam network that stole €4.3 million

Ukrainian law enforcement arrested four suspects in a case involving the theft of more than €4.3 million using a network of cryptocurrency investment scam call centers…

Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH

The initial exploitation attempts are attributed to botnets and crypto miners, but other threat actors are expected to follow suit. The post Hackers Exploiting ‘SSHole’…

Trio accused of using deepfake CEOs and bogus lawyers to scam businesses out of $129 million

Three men allegedly used deepfakes of company CEOs and law firm attorneys to trick employees into wiring more than $129 million to accounts the group controlled, the…

Amplifon Americas Data Breach Impacts 1.3 Million

Hackers stole personal, health, and insurance information, including Social Security numbers, from the company’s internal systems. The post Amplifon Americas Data Breach…

Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868)

SonicWall has fixed an exploited SonicOS SSL-VPN vulnerability (CVE-2026-19868) that may allow attackers with valid credentials to bypass SAML-enforced multi-factor…

Over 3 Million People Hit by Frontline Education Data Breach

Frontline Education told Indiana regulators that its August data breach affected over 3 million school district staff and students. The post Over 3 Million People Hit by…

$133 million stolen from French bank via exploited service provider

Attackers siphoned an estimated $133 million from Crédit Mutuel Arkéa by using the bank’s own account to wire money to other banks, from where it was possibly converted…

Product showcase: What the Malwarebytes Claude connector reveals about unexpected texts

The Malwarebytes connector for Claude checks suspicious links, phone numbers, and email addresses without leaving the chat. You can paste a link or upload a screenshot…

Google DeepMind’s AI Agents Make 1024-Bit RSA Keys Cheaper to Attack

Working with cryptographers, DeepMind’s AI agents cut the cost of forging RSA-1024 signatures and found a cheaper way to factor keys. The post Google DeepMind’s AI…

Companies seeking an MSP doubt their ability to spot cyberattacks

Businesses looking to outsource cybersecurity want providers that can help them recover from attacks, manage AI risks, and explain what security problems mean for their…

An average of 8 minutes is all hackers need to log in with stolen credentials

Attackers used stolen credentials to log in an average of eight minutes after infection across 27 confirmed infostealer cases, according to a report from Elastic…

Linus Torvalds sees signs AI-prompted patch flood has peaked

Fixes are arriving faster than new bug reports for one major Linux project

Huawei says it’s made a 100 percent Chinese PC

PLUS: Japan declares infosec emergency; Apple makes biggest school Mac sale, ever, anywhere, in the Philippines; And more!