Mon 9 Nov · updated 15:30 UTC
Today in security
Today’s briefing
Updated 10:00 UTC
Nitori says attackers may have taken 37.62 million customer records
1 update since 07:00 · latest 10:00 UTC
CyberSIXT reported this.
Known exploited5
CISA KEV entries named in the last 48 hours of coverage, by federal deadline
- In CISA KEV
SonicWall SonicOS SSLVPNCVE-2026-19868
Federal deadline 20 Nov · In CISA KEV since 6 Nov
Not scored0.6% EPSS6 articles
- In CISA KEV
Plex Media ServerCVE-2026-96652
Federal deadline passed 3 Nov · In CISA KEV since 20 Oct
5.3Medium12% EPSS9 articles
- In CISA KEV
Plex Media ServerCVE-2026-96655
Federal deadline passed 3 Nov · In CISA KEV since 20 Oct
5.3Medium11% EPSS9 articles
- In CISA KEV
Plex Media ServerCVE-2026-96654
Federal deadline passed 23 Oct · In CISA KEV since 20 Oct
6.9Medium1.9% EPSS10 articles
Show 1 more · federal deadlines passed
- In CISA KEV
Plex Media ServerCVE-2026-96656
Federal deadline passed 23 Oct · In CISA KEV since 20 Oct
8.6High1.8% EPSS10 articles
Latest news52
The last 24 hours, newest first; stories about known exploited CVEs are above
Latest story at 14:45 UTC. Red diamonds mark the 2 stories about exploited CVEs.
- 14:45 UTC. Sony Life finds 2.9 million more policy records leaked in breach. 1 outlet.
- 14:33 UTC. Cyberattacks disrupt refrigeration systems across 13 countries. 1 outlet.
- 14:30 UTC. Socket links GitHub workflow attack to credential theft. 1 outlet.
- 14:08 UTC. Revolve says data breach exposed information of 1.5 million shoppers. 1 outlet.
- 13:31 UTC. Sega says vendor breach exposed 2.2 million customer emails. 1 outlet.
- 13:13 UTC. New York secures $10 million settlement over medical data breach. 1 outlet.
- 13:00 UTC. Cloudflare launches fund for Vite ecosystem maintainers. 1 outlet.
- 12:41 UTC. Iris Plaza Breach May Expose Data of 7.7 Million Customers. 1 outlet.
- 12:22 UTC. Italy’s Meloni blames pro-Russian hackers for data leak. 1 outlet.
- 12:13 UTC. Attackers Exploit OpenSSH Authentication Bypass in the Wild. 2 outlets.
- 11:57 UTC. CISA and FBI warn of attacks on refrigeration controllers. 1 outlet.
- 11:27 UTC. Default ForgeRock Password Let Researchers Unlock and Start Cars. 1 outlet.
- 10:56 UTC. Web3Auth flaw exposes some Keplr users’ crypto wallets. 1 outlet.
- 10:46 UTC. NTT DOCOMO data breach leaks up to 300,000 customers' details. 1 outlet.
- 10:30 UTC. Crédit Mutuel Arkéa confirms attack enabled fraudulent transfers. 1 outlet.
- 10:14 UTC. QNAP warns NAS users of exploited Plex Media Server flaws. 3 outlets. About an exploited CVE.
- 10:09 UTC. Frontline Education breach exposes data of 3 million people. 1 outlet.
- 10:01 UTC. LNbits urges operators to shut down servers after attacks. 1 outlet.
- 09:16 UTC. FATF urges global action to disrupt scam compounds. 1 outlet.
- 09:01 UTC. Acronis links AI driven attacker to Taipei emergency data theft. 1 outlet.
- 09:01 UTC. Apple Tightens macOS Full Disk Access Permissions. 1 outlet.
- 08:46 UTC. Nitori says attackers may have taken 37.62 million customer records. 1 outlet.
- 08:44 UTC. Outlook rejects email from domains without DMARC records. 1 outlet.
- 08:35 UTC. DeepMind AI agents cut the cost of attacking 1024-bit RSA. 1 outlet.
- 08:29 UTC. York University breach exposes years of webform submissions. 1 outlet.
- 08:16 UTC. Attackers exploit unpatched WP Duplicate plugin flaw. 1 outlet.
- 08:07 UTC. Fake GitHub security tools infect more than 2,000 PCs. 1 outlet.
- 08:01 UTC. Google will shut down Firebase Studio in March 2027. 1 outlet.
- 08:01 UTC. Malwarebytes reviews security incidents from the week. 1 outlet.
- 08:00 UTC. Acronis uncovers AI agent mesh behind Taiwan service breaches. 1 outlet.
- 07:52 UTC. SOCRadar reports unverified claims of breaches and data sales. 1 outlet.
- 07:51 UTC. AMD investigates Radeon utility causing continuous SSD writes. 1 outlet.
- 07:15 UTC. Marsalek malware service steals game users’ passwords and wallets. 1 outlet.
- 07:05 UTC. Former OpenAI engineer pleads not guilty to office bugging. 1 outlet.
- 06:15 UTC. US Agencies Warn of Attacks on Industrial Refrigeration Systems. 1 outlet.
- 06:11 UTC. Exposed server reveals DoNot toolkit targeting Pakistan sectors. 1 outlet.
- 06:05 UTC. SonicWall patches SonicOS flaw that can bypass SAML MFA. 1 outlet. About an exploited CVE.
- 04:47 UTC. SMBC Consumer Finance breach exposes 320,118 bank loan customers. 1 outlet.
- 03:41 UTC. PoC exposes RCE flaw in widely used Hugging Face Datasets. 1 outlet.
- 03:15 UTC. Attackers exploit Openwave Webtop file restriction flaw. 1 outlet.
- 03:07 UTC. ModSecurity fixes WAF bypass and XML memory flaws. 1 outlet.
- 02:46 UTC. Beget says attackers destroyed its cloud and half of VPS backups. 1 outlet.
- 02:05 UTC. SANS honeypots detect exploitation attempts targeting sshole flaw. 1 outlet.
- 01:59 UTC. UnrealIRCd warns users are exploiting flaw to run server commands. 1 outlet.
- 01:36 UTC. Weekly report flags attacks on Siemens, Zyxel and Sogou. 1 outlet.
- 01:18 UTC. Compromised Bee JS release targets Swarm wallets and devices. 1 outlet.
- 01:00 UTC. Researcher details code injection flaw in uutils Coreutils. 1 outlet.
- 00:46 UTC. Web3Auth security incident hits Keplr wallets made with Google login. 1 outlet.
- 00:33 UTC. Researcher publishes Windows flaw exploit enabling SYSTEM access. 1 outlet.
- 00:10 UTC. IBM discloses 208 API Connect flaws, including 47 critical. 1 outlet.
- 18:45 UTC. LNbits tells all operators to shut down servers after attacks. 1 outlet.
- 17:46 UTC. Everest claims data theft from Brenner Base Tunnel operator. 1 outlet.
- Known exploited CVE
- CVE not in KEV
- Other story
- Size: outlets on the story
- Stories an hour
Show as tableHide table
| Time (UTC) | Story | Outlets | Type |
|---|---|---|---|
| 14:45 | Sony Life finds 2.9 million more policy records leaked in breach | 1 | Other |
| 14:33 | Cyberattacks disrupt refrigeration systems across 13 countries | 1 | Other |
| 14:30 | Socket links GitHub workflow attack to credential theft | 1 | Other |
| 14:08 | Revolve says data breach exposed information of 1.5 million shoppers | 1 | Other |
| 13:31 | Sega says vendor breach exposed 2.2 million customer emails | 1 | Other |
| 13:13 | New York secures $10 million settlement over medical data breach | 1 | Other |
| 13:00 | Cloudflare launches fund for Vite ecosystem maintainers | 1 | Other |
| 12:41 | Iris Plaza Breach May Expose Data of 7.7 Million Customers | 1 | Other |
| 12:22 | Italy’s Meloni blames pro-Russian hackers for data leak | 1 | Other |
| 12:13 | Attackers Exploit OpenSSH Authentication Bypass in the Wild | 2 | CVE |
| 11:57 | CISA and FBI warn of attacks on refrigeration controllers | 1 | Other |
| 11:27 | Default ForgeRock Password Let Researchers Unlock and Start Cars | 1 | Other |
| 10:56 | Web3Auth flaw exposes some Keplr users’ crypto wallets | 1 | Other |
| 10:46 | NTT DOCOMO data breach leaks up to 300,000 customers' details | 1 | Other |
| 10:30 | Crédit Mutuel Arkéa confirms attack enabled fraudulent transfers | 1 | Other |
| 10:14 | QNAP warns NAS users of exploited Plex Media Server flaws | 3 | Known exploited |
| 10:09 | Frontline Education breach exposes data of 3 million people | 1 | Other |
| 10:01 | LNbits urges operators to shut down servers after attacks | 1 | Other |
| 09:16 | FATF urges global action to disrupt scam compounds | 1 | Other |
| 09:01 | Acronis links AI driven attacker to Taipei emergency data theft | 1 | Other |
| 09:01 | Apple Tightens macOS Full Disk Access Permissions | 1 | Other |
| 08:46 | Nitori says attackers may have taken 37.62 million customer records | 1 | Other |
| 08:44 | Outlook rejects email from domains without DMARC records | 1 | Other |
| 08:35 | DeepMind AI agents cut the cost of attacking 1024-bit RSA | 1 | Other |
| 08:29 | York University breach exposes years of webform submissions | 1 | Other |
| 08:16 | Attackers exploit unpatched WP Duplicate plugin flaw | 1 | CVE |
| 08:07 | Fake GitHub security tools infect more than 2,000 PCs | 1 | Other |
| 08:01 | Google will shut down Firebase Studio in March 2027 | 1 | Other |
| 08:01 | Malwarebytes reviews security incidents from the week | 1 | Other |
| 08:00 | Acronis uncovers AI agent mesh behind Taiwan service breaches | 1 | Other |
| 07:52 | SOCRadar reports unverified claims of breaches and data sales | 1 | Other |
| 07:51 | AMD investigates Radeon utility causing continuous SSD writes | 1 | Other |
| 07:15 | Marsalek malware service steals game users’ passwords and wallets | 1 | Other |
| 07:05 | Former OpenAI engineer pleads not guilty to office bugging | 1 | Other |
| 06:15 | US Agencies Warn of Attacks on Industrial Refrigeration Systems | 1 | Other |
| 06:11 | Exposed server reveals DoNot toolkit targeting Pakistan sectors | 1 | Other |
| 06:05 | SonicWall patches SonicOS flaw that can bypass SAML MFA | 1 | Known exploited |
| 04:47 | SMBC Consumer Finance breach exposes 320,118 bank loan customers | 1 | Other |
| 03:41 | PoC exposes RCE flaw in widely used Hugging Face Datasets | 1 | CVE |
| 03:15 | Attackers exploit Openwave Webtop file restriction flaw | 1 | CVE |
| 03:07 | ModSecurity fixes WAF bypass and XML memory flaws | 1 | CVE |
| 02:46 | Beget says attackers destroyed its cloud and half of VPS backups | 1 | Other |
| 02:05 | SANS honeypots detect exploitation attempts targeting sshole flaw | 1 | Other |
| 01:59 | UnrealIRCd warns users are exploiting flaw to run server commands | 1 | CVE |
| 01:36 | Weekly report flags attacks on Siemens, Zyxel and Sogou | 1 | CVE |
| 01:18 | Compromised Bee JS release targets Swarm wallets and devices | 1 | Other |
| 01:00 | Researcher details code injection flaw in uutils Coreutils | 1 | Other |
| 00:46 | Web3Auth security incident hits Keplr wallets made with Google login | 1 | Other |
| 00:33 | Researcher publishes Windows flaw exploit enabling SYSTEM access | 1 | CVE |
| 00:10 | IBM discloses 208 API Connect flaws, including 47 critical | 1 | CVE |
| 18:45 | LNbits tells all operators to shut down servers after attacks | 1 | Other |
| 17:46 | Everest claims data theft from Brenner Base Tunnel operator | 1 | Other |
- Sony Life finds 2.9 million more policy records leaked in breach
Sony Life says the attackers who broke into its policyholder website in October also took about 2.9 million of its own insurance policy records, on top of 385,000 Medicare Life policies it had already disclosed, plus…
CyberSIXT
- Cyberattacks disrupt refrigeration systems across 13 countries
SOCRadar reports a multi‑wave campaign targeting refrigeration and other OT systems linked to critical infrastructure, beginning in October 2026 with widespread defrost disruptions in France and expanding to 13…
SOCRadar
- Socket links GitHub workflow attack to credential theft
Security researchers at Socket have disclosed a new software supply chain attack that has compromised tens of thousands of GitHub repositories. The incident mirrors the GhostAction campaign seen in late 2025 and 2026,…
Infosecurity
- Revolve says data breach exposed information of 1.5 million shoppers
Revolve, the online fashion retailer, told regulators that a September cyberattack affected 1,515,073 individuals. The Indiana Attorney General’s Office records show that Revolve became aware of the intrusion on 29…
SecurityWeek
- Sega says vendor breach exposed 2.2 million customer emails
Sega said on 9 November 2026 that an unauthorised third party had exposed 2.196 million customer email addresses after accessing Arara Inc., a Japanese email delivery provider used to send Sega newsletters. The breach…
Infosecurity
- OpenSSH flaw allows passwordless logins on musl systems
OpenSSH is in the spotlight after a recently disclosed flaw allowing sign‑ins to accounts with no password when PAM is disabled on musl‑based systems. The vulnerability, tracked as CVE-2026-123158 and nicknamed SSHole,…
The Hacker NewsCVE-2026-123158
- New York secures $10 million settlement over medical data breach
The New York attorney general’s office has announced a settlement over a data breach affecting 13.3 million people, following basic security failures at Perry Johnson & Associates (PJ&A) and four related firms. The…
Malwarebytes
- Cloudflare launches fund for Vite ecosystem maintainers
Cloudflare has launched the Vite Ecosystem Fund, distributing the first tranche of 301,300 to 44 projects and maintainers across the Vite ecosystem. The fund follows an initial commitment of 1 million dollars from…
Cloudflare
- Iris Plaza Breach May Expose Data of 7.7 Million Customers
Hackers compromised an external cloud service used by Iris Plaza, the Japanese online shopping platform operated by Iris Ohyama, potentially exposing data for about 7.7 million people. The incident was discovered on 28…
SecurityWeek
- Italy’s Meloni blames pro-Russian hackers for data leak
Italian Foreign Minister Antonio Tajani says his personal data has been disseminated on the dark web, describing that it has put him and his family at risk of threats and intimidation. He made the remarks in a social…
SecurityWeek
- Attackers Exploit OpenSSH Authentication Bypass in the Wild
Threat actors are actively exploiting SSHole, a high-severity authentication bypass in OpenSSH tracked as CVE-2026-123158. Research indicates the flaw relates to how sshd interprets whether a string is intended to be a…
SecurityWeekCVE-2026-123158
- CISA and FBI warn of attacks on refrigeration controllers
US agencies have issued a joint warning that attackers are targeting industrial refrigeration controllers and cold-chain monitoring systems worldwide. The advisory, published by CISA in collaboration with the FBI, HHS,…
Security Affairs
- Default ForgeRock Password Let Researchers Unlock and Start Cars
Two automotive mobile apps run authentication through ForgeRock, now part of Ping Identity, and researchers Shubham Shah and Sam Curry found an administrator console on thoseForgeRock servers that still used a default…
The Hacker News
- Amplifon Americas Breach Exposes Data of 1.3 Million People
Amplifon Hearing Health Care disclosed a data breach affecting Amplifon Americas, the Minneapolis-based eastern arm of the Italian hearing-health group Amplifon. Hackers breached its internal systems in January 2026…
SecurityWeek
- Web3Auth flaw exposes some Keplr users’ crypto wallets
Keplr’s wallet service, which uses Web3Auth for Google and Apple sign-ins, disclosed a security flaw in Web3Auth that allowed an attacker to access certain wallets created via Google or Apple sign-in. Keplr and…
The Hacker News
- NTT DOCOMO data breach leaks up to 300,000 customers' details
NTT DOCOMO says the intruder in its online shop and My docomo portal took ID document numbers and, for some of up to 300,000 customers, bank account details. My docomo has partly reopened; the online shop is still shut.
CyberSIXT
- Crédit Mutuel Arkéa confirms attack enabled fraudulent transfers
Crédit Mutuel Arkéa has said it was the victim of an attack described as enabling fraudulent transactions to be carried out, with the bank stating the incident involved access to its network via a service provider’s…
Infosecurity
- Frontline Education breach exposes data of 3 million people
Frontline Education informed the Indiana Attorney General’s Office that a data breach suffered in August affected more than 3 million people, with the company stating a total of 3,085,266 individuals were impacted. The…
SecurityWeek
- LNbits urges operators to shut down servers after attacks
LNbits, the open‑source Bitcoin Lightning wallet system, has urged operators to shut down their LNbits servers after a wave of targeted attacks. One operator reported that an attacker used a flaw in an extension to…
The Hacker News
- FATF urges global action to disrupt scam compounds
The Financial Action Task Force (FATF) has urged global action to disrupt “scam compounds” that fuel a substantial share of transnational fraud, arguing they are a major driver of a global fraud economy estimated at…
Infosecurity
- Acronis links AI driven attacker to Taipei emergency data theft
Researchers from Acronis’s Threat Research Unit reported that a single attacker based in Hualien City, Taiwan, used BOSSAI AI agents to obtain emergency dispatch records from Taipei’s 119 system, covering seven…
The Hacker News
- Apple Tightens macOS Full Disk Access Permissions
Apple has tightened macOS Full Disk Access permissions in the first developer beta of macOS 27.3, as reported on 9 November 2026. The change means that untrusted software attempting to access protected storage will no…
SecurityOnline
- Nitori says attackers may have taken 37.62 million customer records
Japanese furniture and homeware retailer Nitori found unauthorised access to one of its systems on November 6 and says personal data in up to 37.62 million records may have been taken, with signs the attackers were in…
CyberSIXT
- Outlook rejects email from domains without DMARC records
MailRoute has reported a notable shift in inbound filtering by Microsoft consumer mailboxes, with Outlook[.]com starting in early November 2026 to reject messages from custom domains that do not publish DMARC records.…
SecurityOnline
- DeepMind AI agents cut the cost of attacking 1024-bit RSA
Google DeepMind researchers, working with cryptographers from UC San Diego and Inria, say AI agents under human supervision found two ways to reduce the computational cost of attacks on legacy 1024-bit RSA systems.…
SecurityWeek
- York University breach exposes years of webform submissions
York University confirmed that an unauthorised person stole personal information submitted through online forms used by 14 academic departments and housing offices. The university detected the intrusion on 25 October…
SecurityOnline
- Attackers exploit unpatched WP Duplicate plugin flaw
WPScan says attackers are actively exploiting CVE-2026-123751, an unpatched flaw in the WP Duplicate WordPress plugin, formerly called LocalSync. The vulnerability affects version 1.1.11 and earlier. It allows…
SecurityOnlineCVE-2026-123751
- Fake GitHub security tools infect more than 2,000 PCs
Doctor Web found malware in GitHub projects posing as security tools, with more than 2,000 PCs infected at the time of its investigation. The campaign began about two years ago with Visual Studio projects for…
Security Affairs
- Google will shut down Firebase Studio in March 2027
Google has scheduled the complete shutdown of Firebase Studio for 22 March 2027. The company will permanently delete any remaining cloud workspaces and stored assets on that date. Firebase Studio, launched in preview…
SecurityOnline
- Malwarebytes reviews security incidents from the week
Malwarebytes Labs’ week-in-security briefing for 2–8 November 2026 collates a range of incidents and issues from across the threat landscape, as reported by Malwarebytes’ own research and reporting. The roundup…
Malwarebytes
- Acronis uncovers AI agent mesh behind Taiwan service breaches
Acronis Threat Research Unit (TRU) says it uncovered BOSSAI, a network of 12 AI agents operated by a single person. During 12 days of observation, the operation scanned hundreds of organisations in 11 countries and…
SecurityOnline
- SOCRadar reports unverified claims of breaches and data sales
SOCRadar’s Dark Web Team flagged multiple underground posts, including a claim of webmail access to a Canadian infrastructure company offered for sale by the actor calling themselves Horsefucker. The listing specifies…
SOCRadar
- AMD investigates Radeon utility causing continuous SSD writes
AMD Radeon users have reported continuous SSD writes while their computers are idle, with rates ranging from several hundred kilobytes to more than 1MB per second; some users measured about 5MB per second. The activity…
SecurityOnline
- Marsalek malware service steals game users’ passwords and wallets
McAfee Labs says a free malware-as-a-service operation distributed Marsalek infostealers disguised as cheats, game clients and utilities for Roblox, Fortnite, Minecraft, Counter-Strike 2 and Grim Dawn. Active from…
SecurityOnline
- Former OpenAI engineer pleads not guilty to office bugging
A former OpenAI employee, Abdulrahman Alfozan, has pleaded not guilty in a San Francisco federal court to charges arising from allegedly planting a covert audio recording device in an OpenAI executive conference room.…
The Hacker News
- US Agencies Warn of Attacks on Industrial Refrigeration Systems
U.S. government agencies have warned that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide, seeking to disrupt service, trigger fire hazards and cause inventory…
The Hacker News
- Exposed server reveals DoNot toolkit targeting Pakistan sectors
Security researchers exposed an unsecured staging server hosting a DoNot APT toolkit aimed at Pakistan’s nuclear, power, ICS, and energy sectors. The server, exposed in October 2026, contained 48 files totalling around…
SecurityOnline
- SMBC Consumer Finance breach exposes 320,118 bank loan customers
Attackers took data on up to 320,118 people from the system SMBC Consumer Finance uses to guarantee card loans for Japanese banks. Partner banks say the stolen records include loans closed years ago, some dating back…
CyberSIXT
- PoC exposes RCE flaw in widely used Hugging Face Datasets
A PoC has been published for a remote code execution flaw in Hugging Face Datasets, identified as CVE-2026-57845, with a CVSS score of 8.8. The researcher Sai Teja Erukude released full details and a working…
SecurityOnlineCVE-2026-57845
- Attackers exploit Openwave Webtop file restriction flaw
JPCERT/CC has warned that attackers are exploiting CVE-2026-111793 in the Openwave Webtop Media Transcoder, with the advisory noting that attacks observed by the developer are underway. The vulnerability affects…
SecurityOnlineCVE-2026-111793
- ModSecurity fixes WAF bypass and XML memory flaws
Two ModSecurity vulnerabilities have been disclosed by the OWASP ModSecurity project, with one including a working proof-of-concept for a WAF bypass. CVE-2026-104269 (CVSS 8.6) could let an attacker slip a dangerous…
SecurityOnlineCVE-2026-104269
- Beget says attackers destroyed its cloud and half of VPS backups
Russian host Beget says attackers reached the servers that manage its whole infrastructure on November 2 and ran wiping scripts. Its cloud is being rebuilt from scratch, and file backups survive for only about half of…
CyberSIXT
- SANS honeypots detect exploitation attempts targeting sshole flaw
SANS Internet Storm Center reports that evidence of exploitation of the sshole vulnerability is appearing in their honeypot data. The team notes that exploitation requires a password longer than 256 characters, but…
SANS ISC
- UnrealIRCd warns users are exploiting flaw to run server commands
UnrealIRCd has disclosed that CVE-2026-114713 is being exploited in the wild, enabling ordinary users to execute commands with server or IRC operator authority. The UnrealIRCd project warned that attackers are actively…
SecurityOnlineCVE-2026-114713
- Weekly report flags attacks on Siemens, Zyxel and Sogou
Between 2 and 8 November 2026, Daily Cybersecurity’s DC flags tracked seven exploited vulnerabilities that had not yet been added to the CISA KEV catalog. The weekly review, which compared DC findings against CISA KEV…
SecurityOnlineCVE-2026-58115
- Compromised Bee JS release targets Swarm wallets and devices
StepSecurity reports that @ethersphere/bee-js version 13.3.0, released to npm on 9 November 2026, is compromised. The malicious release runs attacker-controlled JavaScript during installation, with payloads targeting…
StepSecurity
- Researcher details code injection flaw in uutils Coreutils
SecurityOnline[.]info reports that researcher JoeCyberTech has published full vulnerability details and a proof-of-concept for a critical flaw in the uutils coreutils project, rated CVSS 9.9. The issue enables code…
SecurityOnline
- Web3Auth security incident hits Keplr wallets made with Google login
A Web3Auth flaw exposed keys of Keplr wallets made with Google or Apple login. Web3Auth swept at least 51,000 of them into recovery wallets holding about $6 million, a sum first reported as stolen; the attacker's take…
CyberSIXT
- Researcher publishes Windows flaw exploit enabling SYSTEM access
Gaspar Onesto De Luca has published a working proof-of-concept exploit for CVE-2026-97798, a local privilege escalation flaw in Windows Error Reporting (WER) stemming from an argument-injection in the Time Travel…
SecurityOnlineCVE-2026-97798
- IBM discloses 208 API Connect flaws, including 47 critical
IBM has disclosed 208 security flaws in its API Connect platform, with CVE records published on 7 November 2026. Of these, 47 are rated critical and 94 high, with several allowing remote code execution or…
SecurityOnlineCVE-2026-17402
- LNbits tells all operators to shut down servers after attacks
LNbits told everyone running its Lightning wallet server to shut it down until patches ship, and switched off its own hosted service. One operator says attackers withdrew 2,285,545 sats from his instance on Sunday.
CyberSIXT
- Everest claims data theft from Brenner Base Tunnel operator
Brenner Base Tunnel SE (BBT SE) has confirmed that unauthorized individuals accessed some of its data, with the extortion group Everest claiming to have exfiltrated 812 GB of files. No independent verification of that…
Security Affairs
CVEs in the news9
Named in the last 24 hours and not in CISA KEV, most covered first
CVE-2026-123158OpenSSH OpenSSH
2 articles today · OpenSSH flaw allows passwordless logins on musl systems
Not scored1.0% EPSS · 8 articlesCVE-2026-58115Siemens SIMATIC IoT2050 Advanced
Weekly report flags attacks on Siemens, Zyxel and Sogou
10.0Critical0.9% EPSS · 5 articlesCVE-2026-17402IBM API Connect
IBM discloses 208 API Connect flaws, including 47 critical
9.9Critical1.9% EPSS · 1 articleCVE-2026-57845huggingface datasets
PoC exposes RCE flaw in widely used Hugging Face Datasets
8.8High0.5% EPSS · 1 articleCVE-2026-104269owasp-modsecurity ModSecurity
ModSecurity fixes WAF bypass and XML memory flaws
8.6High0.6% EPSS · 1 articleCVE-2026-114713UnrealIRCd UnrealIRCd
UnrealIRCd warns users are exploiting flaw to run server commands
8.6High0.3% EPSS · 1 articleCVE-2026-97798Microsoft Windows 10 Version 21H2
Researcher publishes Windows flaw exploit enabling SYSTEM access
7.8High0.5% EPSS · 1 articleCVE-2026-111793Openwave Messaging (Ireland) Limited Webtop Media Transcoder
Attackers exploit Openwave Webtop file restriction flaw
4.3Medium0.2% EPSS · 1 articleCVE-2026-123751WP Duplicate <= 1.1.11 - Unauthenticated Arbitrary File Upload via Authentication Bypass
Attackers exploit unpatched WP Duplicate plugin flaw
Not scored1 article
Developing stories2
Two or more articles in the last 24 hours; each bead is an article
- In CISA KEVCVECVE-2026-96652Plex Media ServerDevelopinglatest 1 hour ago3 articles3 outlets
- Mon 9 Nov, 10:14 UTC. SecurityOnline, first report. QNAP warns NAS users of exploited Plex Media Server flaws. Cites a CVE in CISA KEV.
- Mon 9 Nov, 13:13 UTC. SecurityWeek, its first report on the story. Plex2Shell Exploits Compromise Plex Servers on QNAP NAS Devices. Cites a CVE in CISA KEV.
- Mon 9 Nov, 14:40 UTC. Security Affairs, its first report on the story. Plex2Shell Flaws Exploited to Hack Internet Facing NAS Devices. Cites a CVE in CISA KEV.
- CVECVE-2026-123158OpenSSHDevelopinglatest 2 hours ago2 articles2 outlets
- Mon 9 Nov, 12:13 UTC. SecurityWeek, first report. Attackers Exploit OpenSSH Authentication Bypass in the Wild.
- Mon 9 Nov, 13:28 UTC. The Hacker News, its first report on the story. OpenSSH flaw allows passwordless logins on musl systems.