Tue 10 Nov · updated 16:01 UTC
Today in security
Today’s briefing
Updated 12:47 UTC
Initia halts its chain after bridge escrow drain
3 updates since 07:00 · latest 12:47 UTC
Initia stopped its layer 1 after compromised rollup infrastructure keys were used to fake transfers out of bridge escrow accounts. About 605,000 dollars in USDC left through Noble, 18 days after a separate exploit.
- Apple's latest iOS update does not fix worse_query
- Initia halts its L1 again after $605,000 leaves bridge escrows
- 07:00 edition: Tuesday 10 November: 79 reports by 14 outlets
- CISA adds OpenSSH authentication bypass flaw to exploited vulnerabilities list
- NEAR AI breach used SGLang flaw to reach confidential AI requests
Known exploited23
CISA KEV entries named in the last 48 hours of coverage, by federal deadline
- In CISA KEV
Google BrotliCVE-2026-111497
Federal deadline 10 Nov · In CISA KEV since 27 Oct
9.2Critical83% EPSS25 articles
- In CISA KEV
gpustackCVE-2026-102895
Federal deadline 12 Nov · In CISA KEV since 9 Nov
9.8Critical0.3% EPSS5 articles
- In CISA KEV
signalwire freeswitchCVE-2026-116779
Federal deadline 12 Nov · In CISA KEV since 9 Nov
Not scored1.3% EPSS6 articles
- In CISA KEV
IBM Aspera FaspexCVE-2026-123218
Federal deadline 12 Nov · In CISA KEV since 9 Nov
9.8Critical0.4% EPSS4 articles
- In CISA KEV
OpenSSHCVE-2026-123158
Federal deadline 12 Nov · In CISA KEV since 9 Nov
Not scored1.0% EPSS12 articles
- In CISA KEV
SonicWall SonicOS SSLVPNCVE-2026-19868
Federal deadline 20 Nov · In CISA KEV since 6 Nov
Not scored0.6% EPSS6 articles
Show 17 more · federal deadlines passed
- In CISA KEV
Plex Media ServerCVE-2026-96652
Federal deadline passed 3 Nov · In CISA KEV since 20 Oct
5.3Medium12% EPSS9 articles
- In CISA KEV
Plex Media ServerCVE-2026-96655
Federal deadline passed 3 Nov · In CISA KEV since 20 Oct
5.3Medium11% EPSS9 articles
- In CISA KEV
Plex Media ServerCVE-2026-96654
Federal deadline passed 23 Oct · In CISA KEV since 20 Oct
6.9Medium1.9% EPSS10 articles
- In CISA KEV
Plex Media ServerCVE-2026-96656
Federal deadline passed 23 Oct · In CISA KEV since 20 Oct
8.6High1.8% EPSS10 articles
- In CISA KEV
N-able N-centralCVE-2026-86218
Federal deadline passed 11 Sep · In CISA KEV since 8 Sep
10.0Critical15% EPSS11 articles
- In CISA KEV
JetBrains TeamCityCVE-2026-63077
Federal deadline passed 8 Aug · In CISA KEV since 5 Aug · Used in ransomware campaigns
9.8Critical95% EPSS20 articles
- In CISA KEV
N-able N-centralCVE-2026-18577
Federal deadline passed 6 Aug · In CISA KEV since 3 Aug
8.2High15% EPSS13 articles
- In CISA KEV
WordPress CoreCVE-2026-60137
Federal deadline passed 4 Aug · In CISA KEV since 21 Jul
9.1Critical5.3% EPSS12 articles
- In CISA KEV
WordPress CoreCVE-2026-63030
Federal deadline passed 24 Jul · In CISA KEV since 21 Jul
9.8Critical11% EPSS16 articles
- In CISA KEV
SonicWall SMA1000 AppliancesCVE-2026-15409
Federal deadline passed 17 Jul · In CISA KEV since 14 Jul · Used in ransomware campaigns
10.0Critical6.8% EPSS20 articles
- In CISA KEV
Google Chromium V8CVE-2026-11645
Federal deadline passed 23 Jun · In CISA KEV since 9 Jun
8.8High2.4% EPSS21 articles
- In CISA KEV
Google DawnCVE-2026-5281
Federal deadline passed 15 Apr · In CISA KEV since 1 Apr
Not scored14% EPSS14 articles
- In CISA KEV
Google SkiaCVE-2026-3909
Federal deadline passed 27 Mar · In CISA KEV since 13 Mar
Not scored2.3% EPSS14 articles
- In CISA KEV
Google Chromium V8CVE-2026-3910
Federal deadline passed 27 Mar · In CISA KEV since 13 Mar
Not scored2.7% EPSS14 articles
- In CISA KEV
Google ChromiumCVE-2026-2441
Federal deadline passed 10 Mar · In CISA KEV since 17 Feb
Not scored54% EPSS17 articles
- In CISA KEV
SAP NetWeaverCVE-2025-31324
Federal deadline passed 20 May 2025 · In CISA KEV since 29 Apr 2025 · Used in ransomware campaigns
10.0Critical99.4% EPSS2 articles
- In CISA KEV
Liferay PortalCVE-2020-7961
Federal deadline passed 3 May 2022 · In CISA KEV since 3 Nov 2021
9.8Critical99.9% EPSS1 article
Latest news72
The last 24 hours, newest first; stories about known exploited CVEs are above
Latest story at 14:58 UTC. Red diamonds mark the 7 stories about exploited CVEs.
- 14:01 UTC. CopperDragon's Sparrow Framework Drives Global Campaigns. 1 outlet.
- 14:00 UTC. Datadog reports fourfold rise in cloud vulnerabilities. 1 outlet.
- 13:37 UTC. Microsoft mitigates CVSS 10 Entra device registration flaw. 1 outlet.
- 13:27 UTC. Qubole supply chain attack exposed data at over a dozen firms. 1 outlet.
- 12:48 UTC. Apple fixes nine flaws in November updates for its devices. 1 outlet.
- 12:45 UTC. Public Apple iOS sandbox escape lets apps read other apps' data. 1 outlet.
- 12:17 UTC. Anthropic says Mythos 5.2 finds more bugs with fewer escapes. 1 outlet.
- 12:15 UTC. Binance warns iOS sandbox escape could expose crypto wallet keys. 1 outlet.
- 12:15 UTC. Researchers used ForgeRock default password to unlock cars. 1 outlet.
- 12:01 UTC. OffSec marks 20 years of hands on cybersecurity training. 1 outlet.
- 11:56 UTC. SOCRadar profiles CyberXero’s AI-assisted attacks on Ukraine. 1 outlet.
- 11:38 UTC. Corelight promotes richer network data for security investigations. 1 outlet.
- 11:38 UTC. Codex SSH forwarding can expose keys and disrupt remote Git. 1 outlet.
- 11:15 UTC. Vanderbilt takes systems offline after cyber incident. 1 outlet.
- 11:01 UTC. Finite State raises $27 million to expand device security platform. 2 outlets.
- 10:16 UTC. Apple fixes iMessage flaws that exposed private group chats. 1 outlet.
- 10:07 UTC. Turla uses Cereal malware to steal emails from Exchange servers. 3 outlets.
- 10:02 UTC. SAP patches four maximum severity flaws across its systems. 2 outlets.
- 09:30 UTC. Binance investigates ShinyHunters' claims of stolen customer data. 1 outlet.
- 08:47 UTC. Initia halts its L1 again after $605,000 leaves bridge escrows. 1 outlet.
- 08:38 UTC. Chrome brings real time phishing checks to Incognito browsing. 1 outlet.
- 08:16 UTC. Anthropic Says Claude Fable 5.2 Beats GPT-6 in Cyber Tests. 1 outlet.
- 08:00 UTC. Mirax Android RAT steals banking credentials across META region. 1 outlet.
- 08:00 UTC. Kaspersky says Qilin accounted for 15% of ransomware victims. 1 outlet. About an exploited CVE.
- 08:00 UTC. Kaspersky reports more than 1.66 million mobile threat attacks. 1 outlet.
- 07:50 UTC. Asahi Linux adopts GPL to curb commercial code reuse. 1 outlet.
- 07:10 UTC. Bitdefender finds Android flaw that can trap phones in boot loops. 1 outlet.
- 06:45 UTC. NEAR AI breach used SGLang flaw to reach confidential AI requests. 1 outlet.
- 06:44 UTC. N-able takes N-central offline after researcher discloses flaws. 2 outlets.
- 06:28 UTC. Iris Ohyama breach may expose data from 7.7 million records. 1 outlet.
- 06:20 UTC. Researchers uncover stealthy backdoor hidden in CWP binaries. 1 outlet.
- 04:46 UTC. Sharefull breach may expose 7.5 million gig workers' bank details. 1 outlet.
- 04:04 UTC. Apache fixes two Commons Codec flaws in version 1.23.0. 1 outlet.
- 03:34 UTC. Attackers exploit Barracuda ESG flaws after PoC release. 1 outlet.
- 03:23 UTC. Progress fixes five WS_FTP Server flaws exposing sensitive data. 1 outlet.
- 02:48 UTC. Apple fixes iMessage and wireless flaws in iOS update. 1 outlet.
- 02:45 UTC. Vanderbilt tells everyone to shut down devices in active cyberattack. 1 outlet.
- 02:42 UTC. Meta expands AI age checks for Instagram teens worldwide. 1 outlet.
- 02:31 UTC. Mongoose patches five flaws enabling injection and prototype pollution. 1 outlet.
- 02:00 UTC. Web shells target SAP NetWeaver as Chrome fixes exploited flaw. 1 outlet.
- 01:56 UTC. SAP fixes 38 flaws, including nine critical vulnerabilities. 1 outlet.
- 01:41 UTC. CERT/CC finds flaws enabling remote root access to FrodoBots. 1 outlet.
- 01:00 UTC. Researcher publishes Windows Search exploit for CVE-2026-50679. 1 outlet.
- 00:45 UTC. Fireworks AI breach reached customer datasets and model weights. 1 outlet.
- 00:30 UTC. Apache Airflow and Storm updates fix 20 security flaws. 1 outlet.
- 00:11 UTC. Logto fixes flaws enabling account takeover and MFA bypass. 1 outlet.
- 23:46 UTC. Researcher Publishes PoC Exploits for 33 N-able N-central Flaws. 1 outlet. About an exploited CVE.
- 23:37 UTC. Google patches Chrome zero day exploited in the wild. 5 outlets.
- 22:46 UTC. N-able takes N-central offline after 33 zero-days go public. 1 outlet.
- 21:38 UTC. CISA updates cyber incident form to improve threat analysis. 1 outlet.
- 21:12 UTC. Microsoft patches Windows Paint flaw after update confusion. 1 outlet.
- 21:01 UTC. CISA adds actively exploited IBM Aspera Faspex flaw to KEV catalog. 2 outlets. About an exploited CVE.
- 20:19 UTC. Black Hat launches inaugural India cybersecurity conference in Bengaluru. 1 outlet.
- 20:17 UTC. Microsoft finds Rust memory safety bugs using AI research. 1 outlet.
- 18:46 UTC. France blames Iran's IRGC for attack on 700 supermarket fridge systems. 6 outlets.
- 18:18 UTC. SANS observes attackers targeting SAP NetWeaver webshells. 1 outlet. About an exploited CVE.
- 18:08 UTC. AIR Security Finds Claude Flaw That Runs Malicious Code on Linux. 1 outlet.
- 17:51 UTC. Wiz details attacker breach of Qubole linked AWS accounts. 1 outlet.
- 17:36 UTC. Attackers compromise Ethersphere tools to steal wallet keys. 1 outlet.
- 17:24 UTC. Apiiro finds Claude Code settings exposed secrets on GitHub. 1 outlet.
- 17:17 UTC. PwC security chief says AI is reshaping risks and teams. 1 outlet.
- 17:02 UTC. CISA adds exploited FreeSwitch code injection flaw to KEV catalogue. 1 outlet. About an exploited CVE.
- 17:02 UTC. CISA adds OpenSSH authentication bypass flaw to exploited vulnerabilities list. 2 outlets. About an exploited CVE.
- 17:01 UTC. CISA adds GPUStack authentication flaw allowing admin access to KEV. 3 outlets. About an exploited CVE.
- 16:46 UTC. Attackers used Qubole's AWS account to steal data from its customers. 1 outlet.
- Known exploited CVE
- CVE not in KEV
- Other story
- Size: outlets on the story
- Stories an hour
Show as tableHide table
| Time (UTC) | Story | Outlets | Type |
|---|---|---|---|
| 14:01 | CopperDragon's Sparrow Framework Drives Global Campaigns | 1 | Other |
| 14:00 | Datadog reports fourfold rise in cloud vulnerabilities | 1 | Other |
| 13:37 | Microsoft mitigates CVSS 10 Entra device registration flaw | 1 | CVE |
| 13:27 | Qubole supply chain attack exposed data at over a dozen firms | 1 | Other |
| 12:48 | Apple fixes nine flaws in November updates for its devices | 1 | CVE |
| 12:45 | Public Apple iOS sandbox escape lets apps read other apps' data | 1 | Other |
| 12:17 | Anthropic says Mythos 5.2 finds more bugs with fewer escapes | 1 | Other |
| 12:15 | Binance warns iOS sandbox escape could expose crypto wallet keys | 1 | Other |
| 12:15 | Researchers used ForgeRock default password to unlock cars | 1 | Other |
| 12:01 | OffSec marks 20 years of hands on cybersecurity training | 1 | Other |
| 11:56 | SOCRadar profiles CyberXero’s AI-assisted attacks on Ukraine | 1 | CVE |
| 11:38 | Corelight promotes richer network data for security investigations | 1 | Other |
| 11:38 | Codex SSH forwarding can expose keys and disrupt remote Git | 1 | Other |
| 11:15 | Vanderbilt takes systems offline after cyber incident | 1 | Other |
| 11:01 | Finite State raises $27 million to expand device security platform | 2 | Other |
| 10:16 | Apple fixes iMessage flaws that exposed private group chats | 1 | CVE |
| 10:07 | Turla uses Cereal malware to steal emails from Exchange servers | 3 | Other |
| 10:02 | SAP patches four maximum severity flaws across its systems | 2 | CVE |
| 09:30 | Binance investigates ShinyHunters' claims of stolen customer data | 1 | Other |
| 08:47 | Initia halts its L1 again after $605,000 leaves bridge escrows | 1 | Other |
| 08:38 | Chrome brings real time phishing checks to Incognito browsing | 1 | Other |
| 08:16 | Anthropic Says Claude Fable 5.2 Beats GPT-6 in Cyber Tests | 1 | Other |
| 08:00 | Mirax Android RAT steals banking credentials across META region | 1 | Other |
| 08:00 | Kaspersky says Qilin accounted for 15% of ransomware victims | 1 | Known exploited |
| 08:00 | Kaspersky reports more than 1.66 million mobile threat attacks | 1 | Other |
| 07:50 | Asahi Linux adopts GPL to curb commercial code reuse | 1 | Other |
| 07:10 | Bitdefender finds Android flaw that can trap phones in boot loops | 1 | Other |
| 06:45 | NEAR AI breach used SGLang flaw to reach confidential AI requests | 1 | Other |
| 06:44 | N-able takes N-central offline after researcher discloses flaws | 2 | Other |
| 06:28 | Iris Ohyama breach may expose data from 7.7 million records | 1 | Other |
| 06:20 | Researchers uncover stealthy backdoor hidden in CWP binaries | 1 | Other |
| 04:46 | Sharefull breach may expose 7.5 million gig workers' bank details | 1 | Other |
| 04:04 | Apache fixes two Commons Codec flaws in version 1.23.0 | 1 | CVE |
| 03:34 | Attackers exploit Barracuda ESG flaws after PoC release | 1 | CVE |
| 03:23 | Progress fixes five WS_FTP Server flaws exposing sensitive data | 1 | CVE |
| 02:48 | Apple fixes iMessage and wireless flaws in iOS update | 1 | Other |
| 02:45 | Vanderbilt tells everyone to shut down devices in active cyberattack | 1 | Other |
| 02:42 | Meta expands AI age checks for Instagram teens worldwide | 1 | Other |
| 02:31 | Mongoose patches five flaws enabling injection and prototype pollution | 1 | CVE |
| 02:00 | Web shells target SAP NetWeaver as Chrome fixes exploited flaw | 1 | Other |
| 01:56 | SAP fixes 38 flaws, including nine critical vulnerabilities | 1 | CVE |
| 01:41 | CERT/CC finds flaws enabling remote root access to FrodoBots | 1 | CVE |
| 01:00 | Researcher publishes Windows Search exploit for CVE-2026-50679 | 1 | CVE |
| 00:45 | Fireworks AI breach reached customer datasets and model weights | 1 | Other |
| 00:30 | Apache Airflow and Storm updates fix 20 security flaws | 1 | CVE |
| 00:11 | Logto fixes flaws enabling account takeover and MFA bypass | 1 | Other |
| 23:46 | Researcher Publishes PoC Exploits for 33 N-able N-central Flaws | 1 | Known exploited |
| 23:37 | Google patches Chrome zero day exploited in the wild | 5 | CVE |
| 22:46 | N-able takes N-central offline after 33 zero-days go public | 1 | Other |
| 21:38 | CISA updates cyber incident form to improve threat analysis | 1 | Other |
| 21:12 | Microsoft patches Windows Paint flaw after update confusion | 1 | CVE |
| 21:01 | CISA adds actively exploited IBM Aspera Faspex flaw to KEV catalog | 2 | Known exploited |
| 20:19 | Black Hat launches inaugural India cybersecurity conference in Bengaluru | 1 | Other |
| 20:17 | Microsoft finds Rust memory safety bugs using AI research | 1 | Other |
| 18:46 | France blames Iran's IRGC for attack on 700 supermarket fridge systems | 6 | Other |
| 18:18 | SANS observes attackers targeting SAP NetWeaver webshells | 1 | Known exploited |
| 18:08 | AIR Security Finds Claude Flaw That Runs Malicious Code on Linux | 1 | Other |
| 17:51 | Wiz details attacker breach of Qubole linked AWS accounts | 1 | Other |
| 17:36 | Attackers compromise Ethersphere tools to steal wallet keys | 1 | Other |
| 17:24 | Apiiro finds Claude Code settings exposed secrets on GitHub | 1 | Other |
| 17:17 | PwC security chief says AI is reshaping risks and teams | 1 | Other |
| 17:02 | CISA adds exploited FreeSwitch code injection flaw to KEV catalogue | 1 | Known exploited |
| 17:02 | CISA adds OpenSSH authentication bypass flaw to exploited vulnerabilities list | 2 | Known exploited |
| 17:01 | CISA adds GPUStack authentication flaw allowing admin access to KEV | 3 | Known exploited |
| 16:46 | Attackers used Qubole's AWS account to steal data from its customers | 1 | Other |
- WhiteMatter Raises $20 Million to Expand AI Security Platform
WhiteMatter has announced a $20 million Series A funding round, taking total raised to $24 million. The round was led by Blumberg Capital, with continued backing from Crew Capital and Sprout & Oak. WhiteMatter, founded…
SecurityWeek
- SAP patches critical flaws enabling unauthenticated remote code execution
On 10 November 2026 SAP published 42 new and updated security notes, including nine that address critical‑severity vulnerabilities. Four of the new notes patch maximum‑severity flaws in NetWeaver components known as…
SecurityWeekCVE-2026-76964
- Turla spies on NATO and EU emails through Exchange servers
Russia-linked threat group Turla has deployed a new toolset, named Cereal, on compromised government Microsoft Exchange servers, with one case configured to target emails sent to or from NATO and European Union…
Infosecurity
- CopperDragon's Sparrow Framework Drives Global Campaigns
Check Point Research has traced CopperDragon as a China-nexus operator supplying the cross‑platform Sparrow framework to a set of campaigns across Latin America, Asia and Europe. The authors identify three distinct…
Check Point
- Datadog reports fourfold rise in cloud vulnerabilities
Datadog has reported a sharp rise in high or critical vulnerabilities across cloud workloads, with the median number increasing fourfold between May and November this year. The findings come from Datadog’s State of…
Infosecurity
- Microsoft mitigates CVSS 10 Entra device registration flaw
Microsoft has disclosed CVE-2026-109469, a critical elevation of privilege flaw in Entra Device Registration, the service that registers and joins devices to Microsoft Entra ID. The vulnerability is scored CVSS 10.0…
SOCRadarCVE-2026-109469
- Qubole supply chain attack exposed data at over a dozen firms
A threat actor used compromised AWS IAM credentials associated with big-data platform Qubole to access the cloud environments of more than a dozen organisations and steal data, according to cybersecurity firms Sentra…
SecurityWeek
- Google updates Chrome to fix actively exploited zero day
Google has issued a security update for Chrome on 9 November 2026, rolling out to Stable users on Windows, macOS and Linux. The desktop update brings Chrome to version 157.0.8103.50/51 for Windows and Mac, and…
MalwarebytesCVE-2026-125350
- AI Makes Reverse Engineering Software and Malware Easier
Cybersecurity researchers have demonstrated that artificial intelligence can significantly lower the barrier to reverse-engineering mainstream software and malware, raising fresh questions for defenders and IP holders.…
Dark Reading
- Apple fixes nine flaws in November updates for its devices
Apple released software updates on Monday, 9 November 2026, for iOS and iPadOS, macOS, watchOS and visionOS, fixing nine vulnerabilities, according to SANS Internet Storm Centre Dean of Research Johannes Ullrich.…
SANS ISCCVE-2026-113960
- Public Apple iOS sandbox escape lets apps read other apps' data
A proof of concept called worse_query lets an app on iOS 26.0 to 26.7.2 and 27.2 read and change other apps' containers. Its developer says iOS 27.2.1 does not fix it, contradicting a wallet that told users it does.
CyberSIXT
- Anthropic says Mythos 5.2 finds more bugs with fewer escapes
Anthropic has released Claude Mythos 5.2 and Mythos 5.2’s companion Fable 5.2, with the company claiming improved vulnerability hunting and fewer sandbox escapes in controlled testing. Direct access to Mythos remains…
SecurityWeek
- Binance warns iOS sandbox escape could expose crypto wallet keys
Binance has warned of an iOS sandbox escape named worse_query, published on GitHub by a researcher going by forcequit, which could allow an iPhone app to read other apps’ files on devices running iOS 26 and 27. The…
The Hacker News
- Researchers used ForgeRock default password to unlock cars
Researchers have demonstrated that two unnamed car brands could be accessed via a default administrator password on OpenIDM, ForgeRock’s identity management software. The findings, published in a write‑up by Shubham…
Infosecurity
- OffSec marks 20 years of hands on cybersecurity training
OffSec marks two decades of practitioner‑built training and certification, a milestone announced on 10 November 2026 from New York. The company, known for Kali Linux and the OSCP credential, emphasises its hands‑on…
SecurityOnline
- SOCRadar profiles CyberXero’s AI-assisted attacks on Ukraine
SOCRadar Threat Research Unit has profiled CyberXero as a Russian-speaking, financially motivated Initial Access Broker (IAB) active on Dark Web forums such as Dread and HackForums. The actor operates two parallel…
SOCRadarCVE-2026-4815
- Corelight promotes richer network data for security investigations
The Hacker News reports that, while detection alerts are useful, the real test is what happens after an alert when attackers may need additional access or movement within a network. The piece argues that success in…
The Hacker News
- Codex SSH forwarding can expose keys and disrupt remote Git
Developers have flagged an authentication hazard linked to Codex SSH agent forwarding in remote development environments. The issue arises when users connect to remote hosts with forwarded SSH credentials, allowing…
SecurityOnline
- Vanderbilt takes systems offline after cyber incident
Vanderbilt University in Nashville has taken systems and applications offline after a cyber incident was detected at 10:45am CST on 9 November 2026. The university’s update urged the campus community to shut down…
Infosecurity
- Finite State raises $27 million to expand device security platform
Finite State has announced a $27 million Series C funding round led by private funds managed by The O.H.I.O. Fund, with participants including CIBC Innovation Banking, Energy Impact Partners, Energize Capital and…
SecurityOnline
- France Links Supermarket Refrigeration Attacks to Iran
France has attributed a wave of cyber-attacks on refrigeration control systems at around 700 supermarkets in France to Iranian hacking groups, according to French authorities. Paris Public Prosecutor Laure Beccuau said…
Infosecurity
- Apple fixes iMessage flaws that exposed private group chats
Apple has issued updates to fix two iMessage vulnerabilities that could allow remote novices to join a group chat and receive messages, along with a separate flaw that could let someone added to a group access messages…
The Hacker NewsCVE-2026-113961
- Turla uses Cereal malware to steal emails from Exchange servers
The Hacker News reports that the Turla threat group, also known as Snake and aligned with Russian interests, has developed a new cyber espionage toolset named Cereal. According to an ESET briefing shared with The…
The Hacker News
- Google patches Chrome zero day exploited in the wild
Google has patched multiple Chrome vulnerabilities, including CVE-2026-125350, the eighth actively exploited zero-day in Chrome for 2026. The flaw is described as a use-after-free in XML handling and attackers have…
Security AffairsCVE-2026-125350
- SAP patches four maximum severity flaws across its systems
SAP has released patches for four CVSS 10.0 flaws across its NetWeaver and related components as part of its monthly Security Patch Day. The Web Dispatcher and Internet Communication Manager (ICM) flaws could let an…
The Hacker NewsCVE-2026-76964
- Researcher discloses over 30 flaws in N-able N-central
N-able took its hosted N-central environments offline on 10 November 2026 after security researcher Sean Bales publicly disclosed more than 30 alleged zero-day vulnerabilities, code-named Able2Shell. N-able said the…
SecurityWeek
- Binance investigates ShinyHunters' claims of stolen customer data
Binance said it is actively investigating claims from the extortion group ShinyHunters that it has obtained 335.9 million customer records, after the group posted an ad on PwsForums on 4 November claiming to sell data…
Infosecurity
- France blames IRGC for attacks on refrigeration systems
France has formally attributed a large-scale industrial intrusion campaign to Iran’s Islamic Revolutionary Guard Corps (IRGC), with investigators linking the operation to the Shahid Kaveh cyber collective. Officials…
SecurityOnline
- France blames Iran unit for attacks on retail refrigeration systems
France has attributed a claw-back sabotage campaign to Iran’s Islamic Revolutionary Guard Corps (IRGC), naming the Shahid Kaveh unit as the operator behind an October attack that targeted refrigeration controllers at…
The Hacker News
- Initia halts its L1 again after $605,000 leaves bridge escrows
Initia stopped its layer 1 chain at 06:18 UTC on 10 November after compromised rollup infrastructure keys were used to fake IBC transfers out of bridge escrow accounts. About $605,000 in USDC left through Noble, 18…
CyberSIXT
- Chrome brings real time phishing checks to Incognito browsing
Google is expanding Safe Browsing protections to Chrome’s private modes, bringing real-time threat checks to Incognito and Guest windows. The upgrade aims to help users spot emerging phishing sites and malicious…
SecurityOnline
- Anthropic Says Claude Fable 5.2 Beats GPT-6 in Cyber Tests
Nov 10, 2026: Anthropic released Claude Fable 5.2 and Claude Mythos 5.2, claiming improvements in coding, reasoning and vision. In Irregular’s CyScenarioBench tests, Fable 5.2 completed 76.3% of multi-stage cyber…
The Hacker News
- Mirax Android RAT steals banking credentials across META region
Between March and September 2026, Group-IB confirmed thousands of Android devices in the META region were infected with Mirax, an Android device takeover (DTO) RAT sold as private malware-as-a-service. Operators used…
SecurityOnline
- Kaspersky reports more than 1.66 million mobile threat attacks
According to Kaspersky Security Network data, IT threat evolution in Q3 2026 shows mobile-focused malware activity continuing to be tracked and analysed by Kaspersky researchers. More than 1.66 million attacks…
securelist.com
- Asahi Linux adopts GPL to curb commercial code reuse
SecurityOnline[.]info reports that the Asahi Linux project, which aims to run Linux on Apple Silicon hardware, has shifted its core repositories to GPL license version 2.0 or later. The move marks a departure from the…
SecurityOnline
- France blames Iran for attack on supermarket refrigeration systems
France has publicly attributed last month’s cyberattack on supermarket refrigeration systems to Iran, with prosecutors in Paris opening a formal investigation into suspected organised cybercrime acting to serve a…
SecurityWeek
- Bitdefender finds Android flaw that can trap phones in boot loops
Bitdefender Labs disclosed an unpatched Android flaw nicknamed GhostMap, a parser bug that can trap a smartphone in an endless boot loop after a crafted APK is installed. The researchers found that a 1 KB dropper with…
SecurityOnline
- Google patches actively exploited flaw in Chrome XML component
Google has released a desktop Chrome security update to patch nine vulnerabilities, including one actively exploited in the wild. The high‑severity flaw is CVE-2026-125350, described as a use‑after‑free bug in the XML…
The Hacker NewsCVE-2026-125350
- NEAR AI breach used SGLang flaw to reach confidential AI requests
NEAR AI says an intruder used a remote code execution flaw in SGLang, the open-source inference engine, to take over one inference server on November 8, see requests being processed there, including confidential ones,…
CyberSIXT
- N-able takes N-central offline after researcher discloses flaws
N-able has taken its N-central Hosted Environments offline following the public disclosure of more than 30 vulnerabilities collectively tracked as Able2Shell. In a precautionary move, the company said Hosted N-central…
The Hacker News
- Iris Ohyama breach may expose data from 7.7 million records
Japanese household goods manufacturer Iris Ohyama says unauthorised access to an external cloud service used by its online shopping subsidiary, Iris Plaza, may have exposed personal information held in about 7.7…
Security Affairs
- Researchers uncover stealthy backdoor hidden in CWP binaries
QiAnXin XLab researchers identified cwpdoor, a backdoor embedded in trojanised 64-bit Linux binaries for Control Web Panel (CWP) versions 1.15.10 and 1.24.0. The researchers detected a malicious script,…
SecurityOnline
- Google patches exploited Chrome XML flaw in latest update
Google has released Chrome updates fixing nine vulnerabilities, including CVE-2026-125350, a high-severity use-after-free flaw in the browser’s XML component that Google says has been exploited in the wild. An…
SecurityWeekCVE-2026-125350
- Sharefull breach may expose 7.5 million gig workers' bank details
Japanese short-shift job app Sharefull says an intruder in its internal management system may have taken data on up to 7.5 million worker accounts, including payroll bank accounts, residence status and links to face…
CyberSIXT
- Apache fixes two Commons Codec flaws in version 1.23.0
Apache Software Foundation researchers disclosed two vulnerabilities in Apache Commons Codec on 9 November 2026, tracked as CVE-2026-119078 (CWE-684) and CVE-2026-124077 (CWE-158). Both affect hashing features in the…
SecurityOnlineCVE-2026-119078
- Attackers exploit Barracuda ESG flaws after PoC release
Barracuda Networks has disclosed that attackers are exploiting a vulnerability chain in Barracuda ESG (Email Security Gateway) against a small number of organisations. The chain combines two flaws: CVE-2026-116606, an…
SecurityOnlineCVE-2026-116606
- Progress fixes five WS_FTP Server flaws exposing sensitive data
Progress Software has released an update in November 2026 that patches five high-severity flaws in Progress WS_FTP Server. The issues are tracked as CVE-2026-115338, CVE-2026-115339, CVE-2026-115340, CVE-2026-115341,…
SecurityOnlineCVE-2026-115338
- Apple fixes iMessage and wireless flaws in iOS update
Apple has released iOS 27.2.1 to address a set of privacy and wireless‑protocol vulnerabilities in iPhone devices. The update, described by Apple as a critical maintenance release, patches issues within core wireless…
SecurityOnline
- Vanderbilt tells everyone to shut down devices in active cyberattack
Vanderbilt University, which told everyone to shut down devices in an active cyberattack, has restored WiFi but keeps most systems restricted. A BYOD ransom note has been photographed on a university computer.
CyberSIXT
- Meta expands AI age checks for Instagram teens worldwide
Meta says it has accelerated youth protection initiatives by deploying its Meta AI age estimation technology worldwide on Instagram. The system automatically identifies users aged thirteen to seventeen who have…
SecurityOnline
- Mongoose patches five flaws enabling injection and prototype pollution
Five critical and high‑risk flaws in Mongoose have been patched across all supported branches, led by CVE-2026-125120 (CVSS 9.8) and CVE-2026-125117 (CVSS 8.2), according to SecurityOnline[.]info on 10 November 2026.…
SecurityOnlineCVE-2026-125120
- Web shells target SAP NetWeaver as Chrome fixes exploited flaw
On 10 November 2026, the SANS Internet Storm Center notes continued attention on web shells and updates from several vendors. A web shell campaign appears to be exploiting an SAP Netweaver vulnerability described as an…
SANS ISC
- SAP fixes 38 flaws, including nine critical vulnerabilities
SAP published its November 2026 Security Patch Day, fixing 38 new CVEs across SAP NetWeaver, Web Dispatcher, Gateway and related components. Nine of these are rated Critical, with four carrying the maximum CVSS score…
SecurityOnlineCVE-2026-120017
- CERT/CC finds flaws enabling remote root access to FrodoBots
CERT/CC disclosed six FrodoBots EarthRover vulnerabilities on 9 November 2026 affecting EarthRover Mini+ devices running firmware 6.2.4_6.2.5_0.614.0. The fleet‑scale flaws could allow remote code execution,…
SecurityOnlineCVE-2026-121685
- Researcher publishes Windows Search exploit for CVE-2026-50679
SecurityOnline[.]info reports that researcher h4urek has published full technical details and a proof-of-concept exploit for CVE-2026-50679, a Windows Search elevation of privilege flaw. The draft notes that Microsoft…
SecurityOnlineCVE-2026-50679
- Fireworks AI breach reached customer datasets and model weights
AI inference provider Fireworks AI says an intrusion through a third-party cloud host on October 24 exposed billing data and, for some customers, secrets, datasets and incomplete model weights. It links the attack to a…
CyberSIXT
- Apache Airflow and Storm updates fix 20 security flaws
The Apache Software Foundation disclosed 20 security flaws on 9 November 2026, of which 18 affect Apache Airflow and two affect Apache Storm. The issues range from secret leakage to code execution on Celery workers,…
SecurityOnlineCVE-2026-68982
- Logto fixes flaws enabling account takeover and MFA bypass
Logto published four security advisories on 9 November 2026 for its open‑source identity platform, with the most severe flaw rated CVSS 9.1. The Apple sign‑in account takeover (GHSA-gfg4-7mg4-wpm2) could allow an…
SecurityOnline
- Google patches Chrome zero day exploited in the wild
Google has issued Chrome 157.0.8103.50 and 157.0.8103.51 to address a set of nine security bugs, including a Chrome zero-day exploited in the wild: CVE-2026-125350, described as a use-after-free in the browser’s XML…
SecurityOnlineCVE-2026-125350
- N-able takes N-central offline after 33 zero-days go public
N-able has shut down its hosted N-central remote management service worldwide and told on-premises customers to take their servers offline after a researcher published 33 unpatched vulnerabilities with working exploit…
CyberSIXT
- CISA updates cyber incident form to improve threat analysis
CISA has released an updated cyber incident reporting form, described as an enhanced web-enabled questionnaire on the agency’s Incident Reporting Portal. The agency says the redesigned form will improve data quality,…
Dark Reading
- Microsoft patches Windows Paint flaw after update confusion
Microsoft has released a patch for a remote code execution flaw in Windows Paint, tracked as CVE-2026-83844. The vulnerability is described by Microsoft as an out-of-bounds read that could allow an unauthorised…
Dark ReadingCVE-2026-83844
- Black Hat launches inaugural India cybersecurity conference in Bengaluru
Black Hat India 2026 marked its inaugural edition in Bengaluru, organised by Informa Markets in India. The four-day event, held at the Sheraton Grand, Brigade Gateway, brought together researchers, security…
Dark Reading
- Microsoft finds Rust memory safety bugs using AI research
Microsoft’s FORGE Lab has disclosed memory-safety issues in Rust’s standard library (std and core), including cases where code written entirely in safe Rust can trigger undefined behavior. The team used Hyenas, FORGE’s…
Microsoft
- France Blames Iran for Cyberattacks on Supermarket Fridges
France has formally attributed a concerted cyber operation against supermarket refrigeration systems to Iran’s Islamic Revolutionary Guard Corps (IRGC), following incidents on 11 and 12 October that affected about 700…
Security Affairs
- France blames Iran's IRGC for attack on 700 supermarket fridge systems
France attributes the October 11-12 attack on refrigeration controllers at about 700 supermarkets to Shahid Kaveh, an IRGC cyber unit. ANSSI says it also hit small hydroelectric plants and caused at least 15 fires;…
CyberSIXT
- AIR Security Finds Claude Flaw That Runs Malicious Code on Linux
Researchers from AIR Security have exposed a vulnerability in Anthropic Claude’s document-processing capabilities, nicknamed “Office Party,” which can enable attackers to run malicious code on Linux systems by simply…
Dark Reading
- Wiz details attacker breach of Qubole linked AWS accounts
Wiz researchers said an attacker breached multiple Qubole customer AWS environments between 14 and 26 October 2026 by using credentials tied to the Qubole platform’s access to those customers’ AWS accounts. The…
The Hacker News
- Attackers compromise Ethersphere tools to steal wallet keys
Attackers exploited Ethersphere’s own release automation to push malicious builds of two tools used with Swarm’s decentralised storage network: bee-js 13.3.0 and Swarm Desktop 0.56.2. The posts run a loader that…
The Hacker News
- Apiiro finds Claude Code settings exposed secrets on GitHub
Apiiro researchers have disclosed that Claude Code is inadvertently exposing sensitive information via public GitHub repositories due to how it stores user approval for automated shell commands. When a user selects…
Ars Technica
- PwC security chief says AI is reshaping risks and teams
PwC’s global CISO and CIO James Shira tells Dark Reading that AI is amplifying both opportunities and risks for security teams, driving a faster pace of change and a larger attack surface. In the interview for the…
Dark Reading
- Attackers used Qubole's AWS account to steal data from its customers
Wiz says an attacker used IAM credentials from an AWS account tied to data platform Qubole to assume roles customers had created for it, then harvested secrets and downloaded S3 data across several companies between…
CyberSIXT
CVEs in the news15
Named in the last 24 hours and not in CISA KEV, most covered first
CVE-2026-125350Vendor not yet named
5 articles today · Google updates Chrome to fix actively exploited zero day
Not scored5 articlesCVE-2026-76964SAP_SE SAP NetWeaver AS ABAP (Internet Communication Manager)
2 articles today · SAP patches critical flaws enabling unauthenticated remote code execution
10.0Critical3 articlesCVE-2026-109469Microsoft Entra Device Registration
Microsoft mitigates CVSS 10 Entra device registration flaw
10.0Critical0.7% EPSS · 1 articleCVE-2026-120017SAP_SE SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)
SAP fixes 38 flaws, including nine critical vulnerabilities
10.0Critical3 articlesCVE-2026-125120Automattic mongoose
Mongoose patches five flaws enabling injection and prototype pollution
9.8Critical0.6% EPSS · 1 articleCVE-2026-116606Barracuda Networks Barracuda Email Security Gateway (ESG)
Attackers exploit Barracuda ESG flaws after PoC release
9.3Critical1.6% EPSS · 6 articlesCVE-2026-4815Schiocco Support Board
SOCRadar profiles CyberXero’s AI-assisted attacks on Ukraine
8.7High0.4% EPSS · 2 articlesCVE-2026-115338Progress Software WS_FTP Server
Progress fixes five WS_FTP Server flaws exposing sensitive data
8.1High0.2% EPSS · 1 articleCVE-2026-83844Microsoft Microsoft Paint
Microsoft patches Windows Paint flaw after update confusion
8.1High0.4% EPSS · 4 articlesCVE-2026-50679Microsoft Windows 11 Version 24H2
Researcher publishes Windows Search exploit for CVE-2026-50679
7.8High0.5% EPSS · 1 articleCVE-2026-113961Apple iOS and iPadOS
Apple fixes iMessage flaws that exposed private group chats
7.5High2 articlesCVE-2026-113960Apple iOS and iPadOS
Apple fixes nine flaws in November updates for its devices
Not scored2 articlesCVE-2026-119078Apache Software Foundation Apache Commons Codec
Apache fixes two Commons Codec flaws in version 1.23.0
Not scored1 articleCVE-2026-121685FrodoBots FrodoBots EarthRover Mini+ firmware
CERT/CC finds flaws enabling remote root access to FrodoBots
Not scored0.2% EPSS · 1 articleCVE-2026-68982Apache Software Foundation Apache Airflow
Apache Airflow and Storm updates fix 20 security flaws
Not scored0.3% EPSS · 1 article
Developing stories6
Two or more articles in the last 24 hours; each bead is an article
- Threat actorCyber Av3ngersDevelopinglatest 5 hours ago6 articles6 outlets
- Mon 9 Nov, 18:46 UTC. CyberSIXT, first report. France blames Iran's IRGC for attack on 700 supermarket fridge systems.
- Mon 9 Nov, 19:12 UTC. Security Affairs, its first report on the story. France Blames Iran for Cyberattacks on Supermarket Fridges.
- Tue 10 Nov, 07:35 UTC. SecurityWeek, its first report on the story. France blames Iran for attack on supermarket refrigeration systems.
- Tue 10 Nov, 09:08 UTC. The Hacker News, its first report on the story. France blames Iran unit for attacks on retail refrigeration systems.
- Tue 10 Nov, 09:26 UTC. SecurityOnline, its first report on the story. France blames IRGC for attacks on refrigeration systems.
- Tue 10 Nov, 10:35 UTC. Infosecurity, its first report on the story. France Links Supermarket Refrigeration Attacks to Iran.
- CVECVE-2026-125350CVE-2026-125350Developinglatest 3 hours ago5 articles5 outlets
- Mon 9 Nov, 23:37 UTC. SecurityOnline, first report. Google patches Chrome zero day exploited in the wild.
- Tue 10 Nov, 06:12 UTC. SecurityWeek, its first report on the story. Google patches exploited Chrome XML flaw in latest update.
- Tue 10 Nov, 06:52 UTC. The Hacker News, its first report on the story. Google patches actively exploited flaw in Chrome XML component.
- Tue 10 Nov, 10:05 UTC. Security Affairs, its first report on the story. Google patches Chrome zero day exploited in the wild.
- Tue 10 Nov, 13:23 UTC. Malwarebytes, its first report on the story. Google updates Chrome to fix actively exploited zero day.
- Threat actorTurlaDevelopinglatest 2 hours ago3 articles3 outlets
- Tue 10 Nov, 10:07 UTC. The Hacker News, first report. Turla uses Cereal malware to steal emails from Exchange servers.
- Tue 10 Nov, 13:00 UTC. Dark Reading, its first report on the story. AI Makes Reverse Engineering Software and Malware Easier.
- Tue 10 Nov, 14:30 UTC. Infosecurity, its first report on the story. Turla spies on NATO and EU emails through Exchange servers.
- In CISA KEVCVECVE-2026-102895gpustackDevelopinglatest 9 hours ago3 articles3 outlets
- Mon 9 Nov, 17:01 UTC. CISA, first report. CISA adds GPUStack authentication flaw allowing admin access to KEV. Cites a CVE in CISA KEV.
- Tue 10 Nov, 00:00 UTC. SecurityOnline, its first report on the story. CISA adds four flaws exploited in the wild to its KEV catalog. Cites a CVE in CISA KEV.
- Tue 10 Nov, 06:31 UTC. The Hacker News, its first report on the story. CISA adds four actively exploited flaws to its KEV catalog. Cites a CVE in CISA KEV.
- CVECVE-2026-76964SAP_SE SAP NetWeaver AS ABAP (Internet Communication Manager)Developinglatest 1 hour ago2 articles2 outlets
- Tue 10 Nov, 10:02 UTC. The Hacker News, first report. SAP patches four maximum severity flaws across its systems.
- Tue 10 Nov, 14:46 UTC. SecurityWeek, its first report on the story. SAP patches critical flaws enabling unauthenticated remote code execution.
- In CISA KEVCVECVE-2026-123218IBM Aspera FaspexDevelopinglatest 6 hours ago2 articles2 outlets
- Mon 9 Nov, 21:01 UTC. CISA, first report. CISA adds actively exploited IBM Aspera Faspex flaw to KEV catalog. Cites a CVE in CISA KEV.
- Tue 10 Nov, 09:42 UTC. SecurityWeek, its first report on the story. CISA flags IBM and FreeSwitch flaws exploited in attacks. Cites a CVE in CISA KEV.