Thu 12 Nov · updated 13:00 UTC
Today in security
Today’s briefing
Updated 10:55 UTC
New N-central zero-days work against N-able hotfix
1 update since 07:00 · latest 10:55 UTC
The researcher behind Able2Shell has published new exploits that work on N-able's Hotfix 2, for the server and for Windows agents and probes. N-able says the server flaw needs the non-default Legacy API and tells customers to disable it.
Known exploited26
CISA KEV entries named in the last 48 hours of coverage, by federal deadline
- In CISA KEV
gpustackCVE-2026-102895
Federal deadline 12 Nov · In CISA KEV since 9 Nov
9.8Critical0.6% EPSS6 articles
- In CISA KEV
signalwire freeswitchCVE-2026-116779
Federal deadline 12 Nov · In CISA KEV since 9 Nov
Not scored2.2% EPSS7 articles
- In CISA KEV
OpenSSHCVE-2026-123158
Federal deadline 12 Nov · In CISA KEV since 9 Nov
Not scored17% EPSS14 articles
- In CISA KEV
IBM Aspera FaspexCVE-2026-123218
Federal deadline 12 Nov · In CISA KEV since 9 Nov
9.8Critical0.7% EPSS5 articles
- In CISA KEV
Barracuda Networks Barracuda Email Security Gateway (ESG)CVE-2026-111560
Federal deadline 13 Nov · In CISA KEV since 10 Nov
8.6High1.1% EPSS9 articles
- In CISA KEV
Barracuda Networks Barracuda Email Security Gateway (ESG)CVE-2026-116606
Federal deadline 13 Nov · In CISA KEV since 10 Nov
9.3Critical1.6% EPSS9 articles
- In CISA KEV
Google ChromiumCVE-2026-125350
Federal deadline 24 Nov · In CISA KEV since 10 Nov
Not scored8 articles
- In CISA KEV
Microsoft 365 Apps for EnterpriseCVE-2026-124194
Federal deadline 24 Nov · In CISA KEV since 10 Nov
6.5Medium15 articles
- In CISA KEV
Openwave Messaging (Ireland) Limited Webtop Media TranscoderCVE-2026-111793
Federal deadline 24 Nov · In CISA KEV since 10 Nov
4.3Medium0.3% EPSS5 articles
- In CISA KEV
Cisco BroadWorksCVE-2026-20320
Federal deadline 24 Nov · In CISA KEV since 10 Nov
7.5High0.4% EPSS6 articles
Show 16 more · federal deadlines passed
- In CISA KEV
Google BrotliCVE-2026-111497
Federal deadline passed 10 Nov · In CISA KEV since 27 Oct
9.2Critical83% EPSS26 articles
- In CISA KEV
Cisco Secure Firewall Adaptive Security Appliance (ASA) SoftwareCVE-2026-76418
Federal deadline passed 1 Nov · In CISA KEV since 29 Oct
8.6High0.8% EPSS8 articles
- In CISA KEV
PHPCVE-2026-109618
Federal deadline passed 29 Oct · In CISA KEV since 26 Oct
9.2Critical99.9% EPSS57 articles
- In CISA KEV
PHPCVE-2026-109619
Federal deadline passed 29 Oct · In CISA KEV since 26 Oct
9.2Critical99.9% EPSS56 articles
- In CISA KEV
AhsayCBSCVE-2026-105133
Federal deadline passed 17 Oct · In CISA KEV since 14 Oct
7.5High84% EPSS10 articles
- In CISA KEV
AhsayCBSCVE-2026-105134
Federal deadline passed 17 Oct · In CISA KEV since 14 Oct
10.0Critical82% EPSS9 articles
- In CISA KEV
Palo Alto Networks PAN-OSCVE-2026-0257
Federal deadline passed 1 Jun · In CISA KEV since 29 May · Used in ransomware campaigns
7.8High96% EPSS28 articles
- In CISA KEV
Cisco Catalyst SD-WAN Controller and ManagerCVE-2026-20127
Federal deadline passed 27 Feb · In CISA KEV since 25 Feb
10.0Critical88% EPSS25 articles
- In CISA KEV
GNU InetUtilsCVE-2026-24061
Federal deadline passed 16 Feb · In CISA KEV since 26 Jan
9.8Critical99% EPSS11 articles
- In CISA KEV
Meta React Server ComponentsCVE-2025-55182
Federal deadline passed 12 Dec 2025 · In CISA KEV since 5 Dec 2025 · Used in ransomware campaigns
10.0Critical99.7% EPSS15 articles
- In CISA KEV
Qlik SenseCVE-2023-48365
Federal deadline passed 3 Feb 2025 · In CISA KEV since 13 Jan 2025 · Used in ransomware campaigns
9.6Critical48% EPSS1 article
- In CISA KEV
Veeam Backup & ReplicationCVE-2024-40711
Federal deadline passed 7 Nov 2024 · In CISA KEV since 17 Oct 2024 · Used in ransomware campaigns
9.8Critical90% EPSS1 article
- In CISA KEV
Palo Alto Networks PAN-OSCVE-2024-3400
Federal deadline passed 19 Apr 2024 · In CISA KEV since 12 Apr 2024 · Used in ransomware campaigns
10.0Critical99.9% EPSS2 articles
- In CISA KEV
Qlik SenseCVE-2023-41265
Federal deadline passed 28 Dec 2023 · In CISA KEV since 7 Dec 2023 · Used in ransomware campaigns
9.6Critical88% EPSS1 article
- In CISA KEV
Qlik SenseCVE-2023-41266
Federal deadline passed 28 Dec 2023 · In CISA KEV since 7 Dec 2023 · Used in ransomware campaigns
8.2High85% EPSS1 article
- In CISA KEV
Apache ActiveMQCVE-2023-46604
Federal deadline passed 23 Nov 2023 · In CISA KEV since 2 Nov 2023 · Used in ransomware campaigns
10.0Critical99.9% EPSS2 articles
Latest news64
The last 24 hours, newest first; stories about known exploited CVEs are above
Latest story at 12:02 UTC. Red diamonds mark the 3 stories about exploited CVEs.
- 12:02 UTC. n0n ransomware operation lists 93 victims in five weeks. 1 outlet.
- 11:49 UTC. Microsoft adds SOCRadar threat intelligence to Sentinel. 1 outlet.
- 11:08 UTC. Notion AI chat transcripts exposed in Fireworks AI breach affecting under 1% of workspaces. 1 outlet.
- 11:00 UTC. AI Assisted Attack Enabled Rapid Lateral Movement at US Retailer. 1 outlet.
- 10:52 UTC. Pushpaganda abuses browser alerts to spread scams and ads. 1 outlet.
- 10:45 UTC. Symantec analyst urges firms to move beyond patching. 1 outlet.
- 10:39 UTC. Huntress Finds ScreenConnect Malware Campaign Hitting 288 Hosts. 1 outlet.
- 10:22 UTC. NIKKE game launcher used to deliver Lua information stealer. 1 outlet.
- 10:00 UTC. Kaspersky explains how cloud pentests can cross trust boundaries. 1 outlet.
- 10:00 UTC. NCSC launches cyber testing scheme to bolster UK resilience. 1 outlet.
- 09:25 UTC. Datadog researchers detail MongoDB flaw that can crash servers. 1 outlet.
- 09:23 UTC. Red Hat Quay flaw could expose private container images. 1 outlet.
- 09:03 UTC. Former FBI Supervisor Admits Stealing $2.47 Million in Crypto. 1 outlet.
- 08:20 UTC. Node.js fixes 16 flaws exposing servers to crashes and data leaks. 1 outlet.
- 07:30 UTC. Google publishes Linux kernel exploit for privilege escalation. 1 outlet.
- 07:30 UTC. StepSecurity uncovers GitHub Actions secret stealing campaign. 1 outlet.
- 07:01 UTC. PRODAFT uncovers BBNet Linux botnet with 11 exploits. 1 outlet. About an exploited CVE.
- 06:42 UTC. Aikido links hijacked GitHub accounts to CI secret stealer. 1 outlet.
- 06:10 UTC. Poland takes e-government platform offline after cyberattack. 1 outlet.
- 05:12 UTC. Apache fixes HTTP/2 flaw enabling unauthenticated remote code execution. 1 outlet.
- 04:55 UTC. Hijacked ConnectWise ScreenConnect panels push SCKit worm to 288 hosts. 1 outlet.
- 04:39 UTC. Huntress reports rogue ScreenConnect clients hit 48 organisations. 1 outlet.
- 03:59 UTC. eMudhra Revokes Eight RSA Intermediate Certificates. 1 outlet.
- 03:28 UTC. Nitori breach exposes data on 37.6 million customers. 1 outlet.
- 02:54 UTC. V12 demonstrates Android code execution flaw in Telegram. 1 outlet.
- 02:25 UTC. ConnectWise disables ScreenConnect extensions after intrusions. 1 outlet.
- 02:06 UTC. Google fixes five critical use-after-free flaws in Chrome. 1 outlet.
- 02:00 UTC. Apache fixes critical remote code flaw in mod_http2. 1 outlet.
- 01:00 UTC. OpenPrinting fixes pappl-retrofit flaw enabling root file access. 1 outlet.
- 01:00 UTC. Leaked documents detail Chinese AI surveillance of Taiwan chip sector. 1 outlet.
- 00:33 UTC. Zoho fixes eight ManageEngine flaws, including router command injection. 1 outlet.
- 00:00 UTC. Go releases fix build time code execution and HTTP flaws. 1 outlet.
- 00:00 UTC. Japan Approves ¥10 Billion Cybersecurity Emergency Package. 1 outlet.
- 23:00 UTC. Unit 42 warns attackers are using AI red teaming tools. 1 outlet.
- 21:44 UTC. Researchers uncover cloud attack chain targeting Flowise deployments. 1 outlet.
- 21:31 UTC. Arctic Wolf links AntiFox tool to IIS and AWS intrusions. 1 outlet.
- 21:20 UTC. Commvault executives warn AI is raising cyber resilience stakes. 1 outlet.
- 20:54 UTC. Vanderbilt tells everyone to shut down devices in active cyberattack. 1 outlet.
- 20:47 UTC. WhiteArmor claims theft of 100GB from Maersk and demands ransom. 3 outlets.
- 19:49 UTC. Microsoft warns attackers use GSocket relay tool to retain access to Linux servers. 1 outlet.
- 18:29 UTC. Vanderbilt restores systems after BYOD ransomware attack. 1 outlet.
- 18:06 UTC. Krebs traces Qilin ransomware boss to Russian cybercrime circles. 1 outlet.
- 17:41 UTC. Node.js fixes HTTP/2 and TLS flaws exposing data and keys. 1 outlet.
- 17:15 UTC. N-able patches N-central after 33 exploit proofs go public. 4 outlets.
- 16:55 UTC. Microsoft reports eight Linux kernel bugs enabled root exploits. 1 outlet.
- 16:30 UTC. VulnCheck says Anthropic's Glasswing fixed few reported flaws. 1 outlet.
- 16:00 UTC. Check Point links three campaigns to suspected China malware supplier. 2 outlets.
- 15:42 UTC. Xen Orchestra flaws exploited to take over XCP-ng nodes. 1 outlet.
- 15:34 UTC. AntiFox platform linked to attacks stealing AWS production secrets. 1 outlet.
- 15:00 UTC. Unit 42 uncovers browser based Falcon campaign targeting governments. 1 outlet.
- 14:54 UTC. Telegram fixes Android flaw that turned a message into code execution. 1 outlet.
- 14:32 UTC. Apache fixes HTTP/2 flaw that could enable remote code execution. 1 outlet.
- 14:13 UTC. SOCRadar expands MCP server with 126 tools for security teams. 1 outlet. About an exploited CVE.
- 14:08 UTC. DeepMind uses AI to verify key parts of Signal’s encryption. 1 outlet.
- 14:01 UTC. Cynet Finds Reverse Shell Activity Targeting Qlik Sense Servers. 1 outlet. About an exploited CVE.
- 14:00 UTC. Criminal IP launches Splunk app to correlate threat intelligence. 1 outlet.
- 13:58 UTC. Asus and Zoom release patches for security flaws. 2 outlets.
- 13:42 UTC. Remus Stealer claims Gmail access survives password changes. 1 outlet.
- 13:37 UTC. Citrix and Ivanti patch 19 flaws, including critical bugs. 1 outlet.
- 13:20 UTC. Railway Says Intruder Exposed Customer Secrets and AI Keys. 1 outlet.
- Known exploited CVE
- CVE not in KEV
- Other story
- Size: outlets on the story
- Stories an hour
Show as tableHide table
| Time (UTC) | Story | Outlets | Type |
|---|---|---|---|
| 12:02 | n0n ransomware operation lists 93 victims in five weeks | 1 | Other |
| 11:49 | Microsoft adds SOCRadar threat intelligence to Sentinel | 1 | Other |
| 11:08 | Notion AI chat transcripts exposed in Fireworks AI breach affecting under 1% of workspaces | 1 | Other |
| 11:00 | AI Assisted Attack Enabled Rapid Lateral Movement at US Retailer | 1 | Other |
| 10:52 | Pushpaganda abuses browser alerts to spread scams and ads | 1 | Other |
| 10:45 | Symantec analyst urges firms to move beyond patching | 1 | Other |
| 10:39 | Huntress Finds ScreenConnect Malware Campaign Hitting 288 Hosts | 1 | Other |
| 10:22 | NIKKE game launcher used to deliver Lua information stealer | 1 | Other |
| 10:00 | Kaspersky explains how cloud pentests can cross trust boundaries | 1 | Other |
| 10:00 | NCSC launches cyber testing scheme to bolster UK resilience | 1 | Other |
| 09:25 | Datadog researchers detail MongoDB flaw that can crash servers | 1 | CVE |
| 09:23 | Red Hat Quay flaw could expose private container images | 1 | CVE |
| 09:03 | Former FBI Supervisor Admits Stealing $2.47 Million in Crypto | 1 | Other |
| 08:20 | Node.js fixes 16 flaws exposing servers to crashes and data leaks | 1 | CVE |
| 07:30 | Google publishes Linux kernel exploit for privilege escalation | 1 | CVE |
| 07:30 | StepSecurity uncovers GitHub Actions secret stealing campaign | 1 | Other |
| 07:01 | PRODAFT uncovers BBNet Linux botnet with 11 exploits | 1 | Known exploited |
| 06:42 | Aikido links hijacked GitHub accounts to CI secret stealer | 1 | Other |
| 06:10 | Poland takes e-government platform offline after cyberattack | 1 | Other |
| 05:12 | Apache fixes HTTP/2 flaw enabling unauthenticated remote code execution | 1 | CVE |
| 04:55 | Hijacked ConnectWise ScreenConnect panels push SCKit worm to 288 hosts | 1 | Other |
| 04:39 | Huntress reports rogue ScreenConnect clients hit 48 organisations | 1 | Other |
| 03:59 | eMudhra Revokes Eight RSA Intermediate Certificates | 1 | Other |
| 03:28 | Nitori breach exposes data on 37.6 million customers | 1 | Other |
| 02:54 | V12 demonstrates Android code execution flaw in Telegram | 1 | Other |
| 02:25 | ConnectWise disables ScreenConnect extensions after intrusions | 1 | Other |
| 02:06 | Google fixes five critical use-after-free flaws in Chrome | 1 | CVE |
| 02:00 | Apache fixes critical remote code flaw in mod_http2 | 1 | Other |
| 01:00 | OpenPrinting fixes pappl-retrofit flaw enabling root file access | 1 | CVE |
| 01:00 | Leaked documents detail Chinese AI surveillance of Taiwan chip sector | 1 | Other |
| 00:33 | Zoho fixes eight ManageEngine flaws, including router command injection | 1 | CVE |
| 00:00 | Go releases fix build time code execution and HTTP flaws | 1 | CVE |
| 00:00 | Japan Approves ¥10 Billion Cybersecurity Emergency Package | 1 | Other |
| 23:00 | Unit 42 warns attackers are using AI red teaming tools | 1 | Other |
| 21:44 | Researchers uncover cloud attack chain targeting Flowise deployments | 1 | CVE |
| 21:31 | Arctic Wolf links AntiFox tool to IIS and AWS intrusions | 1 | Other |
| 21:20 | Commvault executives warn AI is raising cyber resilience stakes | 1 | Other |
| 20:54 | Vanderbilt tells everyone to shut down devices in active cyberattack | 1 | Other |
| 20:47 | WhiteArmor claims theft of 100GB from Maersk and demands ransom | 3 | Other |
| 19:49 | Microsoft warns attackers use GSocket relay tool to retain access to Linux servers | 1 | CVE |
| 18:29 | Vanderbilt restores systems after BYOD ransomware attack | 1 | Other |
| 18:06 | Krebs traces Qilin ransomware boss to Russian cybercrime circles | 1 | Other |
| 17:41 | Node.js fixes HTTP/2 and TLS flaws exposing data and keys | 1 | CVE |
| 17:15 | N-able patches N-central after 33 exploit proofs go public | 4 | CVE |
| 16:55 | Microsoft reports eight Linux kernel bugs enabled root exploits | 1 | CVE |
| 16:30 | VulnCheck says Anthropic's Glasswing fixed few reported flaws | 1 | Other |
| 16:00 | Check Point links three campaigns to suspected China malware supplier | 2 | Other |
| 15:42 | Xen Orchestra flaws exploited to take over XCP-ng nodes | 1 | Other |
| 15:34 | AntiFox platform linked to attacks stealing AWS production secrets | 1 | Other |
| 15:00 | Unit 42 uncovers browser based Falcon campaign targeting governments | 1 | Other |
| 14:54 | Telegram fixes Android flaw that turned a message into code execution | 1 | Other |
| 14:32 | Apache fixes HTTP/2 flaw that could enable remote code execution | 1 | CVE |
| 14:13 | SOCRadar expands MCP server with 126 tools for security teams | 1 | Known exploited |
| 14:08 | DeepMind uses AI to verify key parts of Signal’s encryption | 1 | Other |
| 14:01 | Cynet Finds Reverse Shell Activity Targeting Qlik Sense Servers | 1 | Known exploited |
| 14:00 | Criminal IP launches Splunk app to correlate threat intelligence | 1 | Other |
| 13:58 | Asus and Zoom release patches for security flaws | 2 | CVE |
| 13:42 | Remus Stealer claims Gmail access survives password changes | 1 | Other |
| 13:37 | Citrix and Ivanti patch 19 flaws, including critical bugs | 1 | CVE |
| 13:20 | Railway Says Intruder Exposed Customer Secrets and AI Keys | 1 | Other |
- n0n ransomware operation lists 93 victims in five weeks
SOCRadar’s Dark Web Profile on n0n Ransomware details a financially motivated data-exfiltration and destructive-extortion operation that emerged on the Dark Web in September 2026. In roughly five weeks, the group…
SOCRadar
- Microsoft adds SOCRadar threat intelligence to Sentinel
SOCRadar has been named among the new and enhanced Microsoft Sentinel connectors announced for Ignite 2026, with the SOCRadar Alerts Azure Sentinel Directional Solution highlighted as a partner connector in an…
SOCRadar
- Notion AI chat transcripts exposed in Fireworks AI breach affecting under 1% of workspaces
Notion has informed a small number of customers that their information was compromised in a data breach involving Fireworks AI, a cloud platform used to run and fine-tune open‑source AI models. SecurityWeek's coverage…
SecurityWeek
- AI Assisted Attack Enabled Rapid Lateral Movement at US Retailer
A US retailer was the target of an AI-assisted cyberattack in September, according to Symantec’s post-incident analysis shared by Dark Reading. After hand-typed commands were repeatedly blocked, the threat actor used…
Dark Reading
- N-able N-central hotfix hit by new public zero-day exploits
Two days after N-able shipped Hotfix 2 for the Able2Shell flaws, the same researcher published new exploits that work against it, for the server and for Windows agents and probes. N-able says the server flaw needs the…
CyberSIXTCVE-2026-125883
- Pushpaganda abuses browser alerts to spread scams and ads
Two investigations into deceptive web prompts show how simply granting a browser notification can turn a short visit into ongoing advertising and fraud opportunities for scammers. Malwarebytes’ own research into…
Malwarebytes
- Symantec analyst urges firms to move beyond patching
Dick O’Brien, principal intelligence analyst at Symantec, told IRISSCON 2026 in Dublin that organisations cannot patch their way out of the AI era and must shift to mitigation after exploitation. He highlighted the…
Infosecurity
- Huntress Finds ScreenConnect Malware Campaign Hitting 288 Hosts
A fresh campaign targeting ScreenConnect customers has seen attackers compromise hundreds of endpoints by abusing a vulnerability in a third‑party extension called RMM+. Huntress reports that the activity was observed…
SecurityWeek
- NIKKE game launcher used to deliver Lua information stealer
Bitdefender researchers say attackers used Goddess of Victory: NIKKE’s legitimate PC launcher to deliver a Lua-based information stealer, dubbed k2f-agent. The campaign did not alter the game’s files or exploit a…
bitdefender.com
- Kaspersky explains how cloud pentests can cross trust boundaries
Kaspersky Security Services researchers say cloud penetration tests should focus on whether an attacker can cross trust boundaries, rather than simply finding open ports or achieving code execution. They divide cloud…
securelist.com
- NCSC launches cyber testing scheme to bolster UK resilience
The National Cyber Security Centre (NCSC) has formally launched its Cyber Adversary Simulation (CyAS) scheme to help providers of critical infrastructure test and strengthen their cyber resilience. First trialled at…
Infosecurity
- Attackers Probe N-able N-central Zero-Days After Disclosure
SecurityWeek reports that attackers have begun actively probing N-able N-central installations after researcher Sean Bales released details and PoCs for more than 30 zero-days, dubbed Able2Shell. N-able subsequently…
SecurityWeekCVE-2026-125883
- Datadog researchers detail MongoDB flaw that can crash servers
MongoDB has disclosed a critical pre-authentication vulnerability, CVE-2026-118383, that can cause a crash on a primary when a failover occurs in a replica set. The flaw, described as a use-after-free bug, can be…
The Hacker NewsCVE-2026-118383
- Red Hat Quay flaw could expose private container images
A critical vulnerability in Red Hat Quay could allow attackers to access private container images, replace repository content and maintain persistent access across an affected registry. The flaw, tracked as…
SecurityWeekCVE-2026-123710
- Former FBI Supervisor Admits Stealing $2.47 Million in Crypto
A former FBI supervisor has pled guilty to stealing about $2.47 million in cryptocurrency from wallets linked to 35 FBI investigations, including crypto tied to adversarial nation-state actors. The theft began no later…
Malwarebytes
- Maersk discloses breach after extortion group demands $5m
Maersk has disclosed a data breach affecting one of its IT systems after an extortion group claimed to have stolen 100GB of logistics-related data. In a statement dated 11 November, Maersk said it “identified…
Infosecurity
- Maersk confirms data theft after $5 million extortion attempt
Maersk has confirmed that data was extracted from a system inherited through an earlier acquisition, though the company has not named the acquired business. In a statement dated 11 November, the Danish shipping giant…
SecurityWeek
- Node.js fixes 16 flaws exposing servers to crashes and data leaks
On 12 November 2026 The Hacker News reports that Node.js released fixes for 16 vulnerabilities affecting its core HTTP/2, HTTPS and TLS code across the three supported release lines: 22.x, 24.x and 26.x. The company…
The Hacker NewsCVE-2026-123863
- Google publishes Linux kernel exploit for privilege escalation
CVE-2026-80521: Linux kernel AF_UNIX use-after-free privilege escalation has been fixed in the 7.1.10 stable line, with upstream patches also backported to several older stable branches. The issue is a use-after-free…
SecurityOnlineCVE-2026-80521
- StepSecurity uncovers GitHub Actions secret stealing campaign
StepSecurity researchers report that starting on 10 November 2026, a coordinated botnet of compromised GitHub accounts began using stolen tokens to push a CI secret stealer, named wfx, into every repository those…
StepSecurity
- Aikido links hijacked GitHub accounts to CI secret stealer
An attacker leveraged credentials for 4,837 hijacked GitHub accounts to deploy a secret stealer in repositories those accounts could write to, according to Aikido Security. The stealer is designed to exfiltrate secrets…
The Hacker News
- Check Point links three espionage campaigns to CopperDragon
Check Point Research has linked three ostensibly distinct cyber‑espionage campaigns—SilentDelivery, OceanGate and DarkWire—into a single cross‑platform toolkit driven by the CopperDragon Sparrow framework. The firms…
SecurityOnline
- Poland takes e-government platform offline after cyberattack
Poland has temporarily taken its national e-government platform, ePUAP, offline after detecting and halting a cyberattack, according to an article by Security Affairs dated 12 November 2026. The disruption means ePUAP…
Security Affairs
- Apache fixes HTTP/2 flaw enabling unauthenticated remote code execution
A critical remote code execution flaw in Apache HTTP Server’s HTTP/2 module, mod_http2, could allow unauthenticated attackers to run code on affected servers. Tracked as CVE-2026-119618, the vulnerability affects…
The Hacker NewsCVE-2026-119618
- Hijacked ConnectWise ScreenConnect panels push SCKit worm to 288 hosts
A threat actor used cloud-hosted ScreenConnect panels to install rogue clients and a toolkit Huntress calls the SCKit worm on 288 hosts at 48 organisations. ConnectWise disabled five third-party extensions in 400…
CyberSIXT
- Huntress reports rogue ScreenConnect clients hit 48 organisations
Huntress has reported that rogue ScreenConnect clients are being deployed across managed environments after attackers gained access to cloud-hosted ScreenConnect panels. The activity, first observed on 11 November…
The Hacker News
- eMudhra Revokes Eight RSA Intermediate Certificates
Daily CyberSecurity reports that Indian certificate authority eMudhra has extended its certificate revocation to include eight additional RSA intermediate certificates. The piece attributes the remediation to the same…
SecurityOnline
- Nitori breach exposes data on 37.6 million customers
Nitori says a cyberattack on 9 November 2026 breached its management servers, exposing up to 37.6 million records. The incident targets both individual customers and enterprise buyers, with personal data including…
SecurityOnline
- V12 demonstrates Android code execution flaw in Telegram
Security firm V12 demonstrated an Android remote code execution (RCE) flaw in Telegram via a video showing a message from a Telegram bot enabling code to run on the device, with the phone’s Calculator app launching as…
SecurityOnline
- ConnectWise disables ScreenConnect extensions after intrusions
On 11 November 2026, ConnectWise disabled five third‑party ScreenConnect extensions in around 400 partner environments after reports of unauthorized access to ScreenConnect partner accounts. ConnectWise says the…
SecurityOnline
- Google fixes five critical use-after-free flaws in Chrome
Google has released Chrome 157.0.8103.78 for Windows and macOS (and 157.0.8103.78 for Linux), addressing a large set of security fixes in a single stable-channel update. The firm says the release patches 83…
SecurityOnlineCVE-2026-126885
- Apache fixes critical remote code flaw in mod_http2
Apache today released a security update fixing a critical remote code execution vulnerability in mod_http2. The flaw arises during stream processing in the assign_headers function, where a heap overflow could be…
SANS ISC
- OpenPrinting fixes pappl-retrofit flaw enabling root file access
OpenPrinting has fixed a publicly disclosed path traversal vulnerability in pappl-retrofit, tracked as CVE-2026-123747, after researchers published full details and a proof-of-concept exploit. The flaw, rated CVSSv3…
SecurityOnlineCVE-2026-123747
- Leaked documents detail Chinese AI surveillance of Taiwan chip sector
Dark Reading reports that leaked documents describe a Chinese government programme that uses AI-powered big‑data mining to monitor overseas ethnic-Chinese communities and identify individuals who could be useful for…
Dark Reading
- Zoho fixes eight ManageEngine flaws, including router command injection
Daily CyberSecurity reports that Zoho has fixed eight high-severity ManageEngine vulnerabilities affecting DDI Central and ADAudit Plus, with patches issued on 10 and 11 November 2026. The firm notes six flaws impact…
SecurityOnlineCVE-2026-12573
- Go releases fix build time code execution and HTTP flaws
Go 1.27.4 and 1.26.11 have been released on 10 November 2026 to fix 12 security flaws, eleven of which target the Go toolchain and specifically mitigate build-time code execution via cgo. A malicious Go package could…
SecurityOnlineCVE-2026-97033
- Japan Approves ¥10 Billion Cybersecurity Emergency Package
Japan has approved a ¥10 billion emergency cybersecurity package aimed at bolstering rapid response capabilities and shoring up critical infrastructure as AI-assisted breaches rise, according to Dark Reading. The plan…
Dark Reading
- Unit 42 warns attackers are using AI red teaming tools
Unit 42 reports that a rapidly expanding ecosystem of AI-enabled red‑teaming and penetration testing tools, including ARTEX and CyberStrikeAI, is being used by attackers to execute autonomous offensive operations.…
Unit 42
- Researchers uncover cloud attack chain targeting Flowise deployments
Researchers from Era Security have revealed a broad, multi-stage cloud attack chain dubbed “Greeter”, which began as a Shodan-led discovery of exposed Flowise deployments and quickly evolved into a sophisticated AI…
Dark ReadingCVE-2024-58351
- Arctic Wolf links AntiFox tool to IIS and AWS intrusions
Arctic Wolf Labs has published findings that attackers are weaponising AntiFox, an open‑source, agentic penetration testing platform, to target IIS servers and AWS accounts. The research notes that Alibaba Cloud…
Security Affairs
- Commvault executives warn AI is raising cyber resilience stakes
At Commvault’s SHIFT 2026 conference in Nashville, executives argued that operational resilience must move from a last-resort response to a continuous discipline, as AI-driven threats and increasingly autonomous…
Dark Reading
- Vanderbilt tells everyone to shut down devices in active cyberattack
Vanderbilt University, hit by a cyberattack on 9 November, has restored WiFi, email and some core services but says full recovery may take weeks. A BYOD ransom note has been photographed on a university computer.
CyberSIXT
- WhiteArmor claims theft of 100GB from Maersk and demands ransom
Maersk confirmed an IT security incident involving unauthorised access and data extraction from a local legacy system inherited from a prior acquisition. In a statement issued on 11 November 2026, the company said the…
Security Affairs
- N-able takes N-central offline after 33 flaws are disclosed
N-able has taken its N-central remote monitoring and management platform offline after the discovery of 33 alleged zero-day flaws. The company moved hosted N-central environments offline across the Americas, Europe and…
Dark ReadingCVE-2026-125883
- Microsoft warns attackers use GSocket relay tool to retain access to Linux servers
Microsoft has detailed new activity around GSocket, an open-source remote access tool observed on compromised Linux servers, used by threat actors to maintain access after initial vulnerabilities are remediated. Once…
MicrosoftCVE-2026-43284
- Vanderbilt restores systems after BYOD ransomware attack
Vanderbilt University is restoring campus systems after a cyberattack attributed to the BYOD ransomware group. The attackers claim they encrypted databases and obtained personal data including more than one million…
Malwarebytes
- Krebs traces Qilin ransomware boss to Russian cybercrime circles
The ransomware group Qilin, described by KrebsOnSecurity as the world’s most active affiliate program, has been operating since September 2022 and reportedly recruited affiliates by offering at least 80 per cent of…
Krebs on Security
- Node.js fixes HTTP/2 and TLS flaws exposing data and keys
The Node.js project released security updates 26.13.1, 24.22.3 and 22.23.5, addressing 17 vulnerabilities across the 26.x, 24.x and 22.x lines. The majority are HTTP/2 and TLS memory-leak flaws that can allow an…
SecurityOnlineCVE-2026-123828
- N-able patches N-central after 33 exploit proofs go public
N-able has issued what it calls a critical security hotfix for its N-central platform after Sean Bales published a repository of 33 alleged zero-days with PoC code. The company released N-central 2026.4 Hotfix 2, build…
InfosecurityCVE-2026-125883
- Microsoft reports eight Linux kernel bugs enabled root exploits
Microsoft’s FORGE Lab, with Cen Zhang, reports that its MDASH scanning of Linux kernel subsystems from late May to mid‑June 2026 generated 26,502 raw findings in about two weeks, which were narrowed to 11,769…
MicrosoftCVE-2026-64563
- VulnCheck says Anthropic's Glasswing fixed few reported flaws
Anthropic’s Glasswing programme has yielded a vast number of vulnerability findings but delivered relatively few fixes, according to vulnerability researcher Patrick Garrity of VulnCheck. Garrity’s November 9 update on…
Infosecurity
- Zoom fixes critical Windows flaws enabling remote privilege escalation
Zoom has released fixes for two critical flaws in Zoom Workplace for Windows that could allow unauthenticated remote privilege escalation. The vulnerabilities, CVE-2026-108186 and CVE-2026-108187, both involve…
The Hacker NewsCVE-2026-108186
- Check Point links three campaigns to suspected China malware supplier
Three China-nexus intrusion campaigns across Latin America, Asia and Europe have been linked by Check Point Research (CPR) through shared malware and infrastructure to a possible common supplier of hacking tools, CPR’s…
Infosecurity
- Xen Orchestra flaws exploited to take over XCP-ng nodes
SecurityWeek reports that a critical vulnerability in Xen Orchestra has been exploited to bypass authentication and gain full administrative control over XCP-ng nodes. The flaw affects the REST authentication flow: an…
SecurityWeek
- AntiFox platform linked to attacks stealing AWS production secrets
Cybersecurity researchers have disclosed a campaign in which an AI-driven autonomous pentesting platform named AntiFox has been used to steal AWS credentials and pivot into production environments. Arctic Wolf Labs…
The Hacker News
- Unit 42 uncovers browser based Falcon campaign targeting governments
Unit 42 has tracked Falcon, also known as XG or Xiàng Gē, a browser-native C2 framework that compromises visitors’ web browsers by injecting malicious JavaScript on webmail portals and government apps. The implant runs…
Unit 42
- Telegram fixes Android flaw that turned a message into code execution
Security firm V12 posted a demo of a Telegram message running code on a device a day after Telegram launched apps inside messages. Telegram says the Android flaw was fixed on 10 November and the fix has reached all…
CyberSIXT
- Apache fixes HTTP/2 flaw that could enable remote code execution
Apache HTTP Server has been updated to version 2.4.71 on 11 November 2026 to address three security flaws, the most critical being a race condition in the HTTP/2 module that could lead to remote code execution (RCE).…
SecurityOnlineCVE-2026-106023
- DeepMind uses AI to verify key parts of Signal’s encryption
Google DeepMind researchers used an agentic AI approach to mathematically verify key cryptographic guarantees of the Signal protocol in a four‑week proof‑of‑concept project. The work, performed with a new AI framework…
Ars Technica
- Criminal IP launches Splunk app to correlate threat intelligence
Criminal IP, the AI-powered threat intelligence and attack surface management platform from AI SPERA, has launched the Criminal IP TI Feed app for Splunk. Available through Splunkbase, the app automatically correlates…
SecurityOnline
- Asus and Zoom release patches for security flaws
SecurityWeek reports that Asus and Zoom have released security patches this week. Asus issued an advisory describing four high- and medium-severity flaws found in certain router firmware releases; attackers could…
SecurityWeekCVE-2026-108186
- Remus Stealer claims Gmail access survives password changes
Malwarebytes reports that the Remus Stealer developers are marketing a Gmail-reading feature that they claim can survive a password change and session revocation. The vendor’s announcement, dated version 1.3.9, shows a…
Malwarebytes
- Citrix and Ivanti patch 19 flaws, including critical bugs
SecurityWeek reports that Citrix and Ivanti issued patches for a combined 19 vulnerabilities across their products, including multiple critical- and high-severity flaws. Ivanti’s fixes cover 13 defects across five…
SecurityWeekCVE-2026-121683
- Railway Says Intruder Exposed Customer Secrets and AI Keys
Railway says a security incident in October 2026 allowed an attacker to decrypt customer environment variables across up to about 100,000 workspaces, exposing AI provider credentials and a range of cloud, database and…
SecurityOnline
CVEs in the news17
Named in the last 24 hours and not in CISA KEV, most covered first
CVE-2026-125883N-able N-central
4 articles today · N-able N-central hotfix hit by new public zero-day exploits
Not scored5 articlesCVE-2026-108186Zoom Communications Zoom Workplace
2 articles today · Zoom fixes critical Windows flaws enabling remote privilege escalation
9.6Critical3 articlesCVE-2026-123710Red Hat Red Hat Quay 3
Red Hat Quay flaw could expose private container images
9.8Critical1 articleCVE-2024-58351Flowise Flowise
Researchers uncover cloud attack chain targeting Flowise deployments
9.8Critical0.7% EPSS · 2 articlesCVE-2026-118383MongoDB MongoDB Server
Datadog researchers detail MongoDB flaw that can crash servers
9.5Critical2 articlesCVE-2026-121683Ivanti Cloud Services Application
Citrix and Ivanti patch 19 flaws, including critical bugs
9.4Critical2 articlesCVE-2026-12573Zohocorp DDI Central
Zoho fixes eight ManageEngine flaws, including router command injection
8.8High1 articleCVE-2026-43284Linux Linux
Microsoft warns attackers use GSocket relay tool to retain access to Linux servers
8.8High94% EPSS · 9 articlesCVE-2026-123863nodejs node
Node.js fixes 16 flaws exposing servers to crashes and data leaks
8.2High2 articlesCVE-2026-80521Linux Linux
Google publishes Linux kernel exploit for privilege escalation
7.8High0.2% EPSS · 3 articlesCVE-2026-64563Linux Linux
Microsoft reports eight Linux kernel bugs enabled root exploits
7.8High0.2% EPSS · 2 articlesCVE-2026-123747OpenPrinting pappl-retrofit
OpenPrinting fixes pappl-retrofit flaw enabling root file access
7.3High1 articleCVE-2026-123828nodejs node
Node.js fixes HTTP/2 and TLS flaws exposing data and keys
5.9Medium1 articleCVE-2026-119618Apache Software Foundation Apache HTTP Server
Apache fixes HTTP/2 flaw enabling unauthenticated remote code execution
Not scored2 articlesCVE-2026-126885Google Chrome
Google fixes five critical use-after-free flaws in Chrome
Not scored1 articleCVE-2026-97033Go toolchain cmd/go
Go releases fix build time code execution and HTTP flaws
Not scored1 articleCVE-2026-106023Apache Software Foundation Apache HTTP Server
Apache fixes HTTP/2 flaw that could enable remote code execution
Not scored1 article
Developing stories4
Two or more articles in the last 24 hours; each bead is an article
- CVECVE-2026-125883N-able N-centralDevelopinglatest 2 hours ago4 articles4 outlets
- Wed 11 Nov, 17:15 UTC. Infosecurity, first report. N-able patches N-central after 33 exploit proofs go public.
- Wed 11 Nov, 20:05 UTC. Dark Reading, its first report on the story. N-able takes N-central offline after 33 flaws are disclosed.
- Thu 12 Nov, 09:39 UTC. SecurityWeek, its first report on the story. Attackers Probe N-able N-central Zero-Days After Disclosure.
- Thu 12 Nov, 10:55 UTC. CyberSIXT, its first report on the story. N-able N-central hotfix hit by new public zero-day exploits.
- Threat actorWhitearmorDevelopinglatest 4 hours ago3 articles3 outlets
- Wed 11 Nov, 20:47 UTC. Security Affairs, first report. WhiteArmor claims theft of 100GB from Maersk and demands ransom.
- Thu 12 Nov, 08:38 UTC. SecurityWeek, its first report on the story. Maersk confirms data theft after $5 million extortion attempt.
- Thu 12 Nov, 08:49 UTC. Infosecurity, its first report on the story. Maersk discloses breach after extortion group demands $5m.
- Threat actorCopperDragonDevelopinglatest 7 hours ago2 articles2 outlets
- Wed 11 Nov, 16:00 UTC. Infosecurity, first report. Check Point links three campaigns to suspected China malware supplier.
- Thu 12 Nov, 06:14 UTC. SecurityOnline, its first report on the story. Check Point links three espionage campaigns to CopperDragon.
- CVECVE-2026-108186Zoom Communications Zoom WorkplaceDevelopinglatest 21 hours ago2 articles2 outlets
- Wed 11 Nov, 13:58 UTC. SecurityWeek, first report. Asus and Zoom release patches for security flaws.
- Wed 11 Nov, 16:12 UTC. The Hacker News, its first report on the story. Zoom fixes critical Windows flaws enabling remote privilege escalation.