Thu 5 Nov · updated 16:50 UTC
Today in security
Today’s briefing
Updated 16:51 UTC
OpenSSH flaw opens key-only accounts on Alpine Linux
4 updates since 07:00 · latest 16:51 UTC
On Alpine and other musl systems without PAM, sshd accepts any password over 256 bytes for accounts that have no password. Updated OpenSSH and Alpine packages fix it once sshd is restarted.
- Backdoored ARTEX copy gives root on attack consoles
- NTT DOCOMO confirms leak of up to 300,000 customers' details
- DreamHost confirms File Manager breach exposed FTP passwords
- 07:00 edition: CISA adds actively exploited Apple flaw to KEV catalogue
- CISA adds Apple flaw to exploited vulnerabilities catalogue
Known exploited12
CISA KEV entries named in the last 48 hours of coverage, by federal deadline
- In CISA KEV
WordPress CoreCVE-2026-119977
Federal deadline 6 Nov · In CISA KEV since 3 Nov
8.1High1.0% EPSS3 articles
- In CISA KEV
Google BrotliCVE-2026-111497
Federal deadline 10 Nov · In CISA KEV since 27 Oct
9.2Critical83% EPSS23 articles
- In CISA KEV
Apple SafariCVE-2024-27834
Federal deadline 18 Nov · In CISA KEV since 4 Nov
5.5Medium1.4% EPSS7 articles
- In CISA KEV
Zyxel GS1900-48HPv2 firmwareCVE-2026-7273
Federal deadline passed 24 Sep · In CISA KEV since 21 Sep
8.8High2.8% EPSS12 articles
Show 8 more · federal deadlines passed
- In CISA KEV
WebPros cPanel & WHM and WP2 (WordPress Squared)CVE-2026-41940
Federal deadline passed 3 May · In CISA KEV since 30 Apr · Used in ransomware campaigns
9.8Critical99% EPSS17 articles
- In CISA KEV
Apple Multiple ProductsCVE-2025-43510
Federal deadline passed 3 Apr · In CISA KEV since 20 Mar
Not scored0.4% EPSS10 articles
- In CISA KEV
Apple Multiple ProductsCVE-2025-43520
Federal deadline passed 3 Apr · In CISA KEV since 20 Mar
Not scored0.4% EPSS9 articles
- In CISA KEV
Apple Multiple ProductsCVE-2026-20700
Federal deadline passed 5 Mar · In CISA KEV since 12 Feb
Not scored1.7% EPSS12 articles
- In CISA KEV
Apple Multiple ProductsCVE-2025-43529
Federal deadline passed 5 Jan · In CISA KEV since 15 Dec 2025
Not scored26% EPSS11 articles
- In CISA KEV
Google ChromiumCVE-2025-14174
Federal deadline passed 2 Jan · In CISA KEV since 12 Dec 2025
Not scored55% EPSS8 articles
- In CISA KEV
Microsoft SharePointCVE-2025-53770
Federal deadline passed 21 Jul 2025 · In CISA KEV since 20 Jul 2025 · Used in ransomware campaigns
9.8Critical99.9% EPSS4 articles
- In CISA KEV
Qualcomm Multiple ChipsetsCVE-2025-27038
Federal deadline passed 24 Jun 2025 · In CISA KEV since 3 Jun 2025
7.5High1.0% EPSS1 article
Latest news65
The last 24 hours, newest first; stories about known exploited CVEs are above
Latest story at 16:50 UTC. Red diamonds mark the 4 stories about exploited CVEs.
- 16:50 UTC. OpenSSH flaw lets any long password into key-only Alpine accounts. 1 outlet.
- 14:41 UTC. Apache OFBiz fixes flaws enabling remote code execution and takeover. 1 outlet.
- 14:29 UTC. Alpine fixes OpenSSH flaw that allowed passwordless logins. 1 outlet.
- 14:00 UTC. Check Point finds ChatGPT Lockdown Mode bypass enabling data theft. 1 outlet.
- 14:00 UTC. Rapid7 urges outcome led security as AI speeds attack paths. 1 outlet.
- 13:48 UTC. UNM Health Suspends Care as Cyber Incident Disrupts Clinics. 1 outlet.
- 13:22 UTC. Kela Exposes Bank Phishing Sites Faking Suspended Pages. 1 outlet.
- 12:33 UTC. Cisco and WatchGuard patch flaws as SonicWall leaves GMS bugs unfixed. 1 outlet.
- 12:25 UTC. Check Point outlines five tests for exposure management platforms. 1 outlet.
- 12:10 UTC. Study finds Vizio and Samsung TVs leak tracking data after opt-outs. 1 outlet.
- 11:59 UTC. Nova ransomware expands extortion with data theft and leaks. 1 outlet.
- 11:40 UTC. Trellix Finds Chinese Cyber Activity Fell 41% in 2026. 1 outlet.
- 11:25 UTC. Debian apt flaw can bypass package signature verification. 1 outlet.
- 11:15 UTC. AI agents risk scaling North Korean identity attacks. 1 outlet.
- 11:00 UTC. New Charter CISO Ryan Davis sees shadow AI as a key risk. 1 outlet.
- 10:50 UTC. NTT DOCOMO data breach leaks up to 300,000 customers' details. 1 outlet.
- 10:06 UTC. Five Cyber Threats Target US Enterprises Through Trusted Workflows. 1 outlet.
- 10:02 UTC. OpenAI Finds GPT-6 Astra Withholds Help on Safety Tasks. 1 outlet.
- 10:00 UTC. Storm-2603 used fileless webshell in SharePoint breach. 1 outlet. About an exploited CVE.
- 09:13 UTC. Apple to Scan Publicly Shared iCloud Files for Harmful Content. 1 outlet.
- 09:02 UTC. AI Pentest Framework Tied to Attacks on Hundreds of Organisations. 2 outlets.
- 09:00 UTC. Bitdefender finds Android flaw that can trap phones in crash loops. 2 outlets.
- 08:51 UTC. DreamHost data breach: File Manager flaw exposed FTP passwords. 1 outlet.
- 08:42 UTC. Backdoored ARTEX Docker image exposed 62 consoles to root access. 2 outlets.
- 08:01 UTC. APT29 watering hole campaign targets mobile users with exploits. 1 outlet. About an exploited CVE.
- 07:49 UTC. Postman app altered developers’ AI coding tool settings. 1 outlet.
- 07:40 UTC. Google revises school AI policy after educators push back. 1 outlet.
- 07:06 UTC. Binarly finds Zyxel GS1900 switches remain open to root exploits. 4 outlets.
- 07:01 UTC. MuddyWater uses SimpleHelp to target Israeli organisations. 1 outlet.
- 06:52 UTC. DigiCert data breach exposed some customers' ID documents. 1 outlet.
- 06:34 UTC. Morphisec uncovers XLoader attacks using fake purchase orders. 1 outlet.
- 06:20 UTC. Canadian Man Extradited to US Over University Crypto Mining Hack. 1 outlet.
- 04:54 UTC. OpenAI says AI agents exploited 948 Linux kernel flaws in one run. 1 outlet.
- 04:36 UTC. Residential Proxies Route Traffic Through White House Network. 2 outlets.
- 03:57 UTC. Cisco patches flaws in UCS Central, ISE and Unified CM. 1 outlet.
- 03:16 UTC. OpenAI AI pipeline finds 1,724 Linux kernel vulnerabilities. 2 outlets.
- 02:38 UTC. GPUStack authentication flaw exploited to seize AI servers. 1 outlet.
- 01:46 UTC. Control Web Panel flaws chain to unauthenticated root access. 1 outlet.
- 01:00 UTC. Apache fixes flaws across ZooKeeper, OpenOffice and ActiveMQ. 1 outlet.
- 00:49 UTC. Nikke PC launcher compromised to install a remote-access tool. 1 outlet.
- 00:33 UTC. ASUS fixes router and PC software flaws in security updates. 1 outlet.
- 00:06 UTC. Citrix fixes critical XenServer and Scout security flaws. 1 outlet. About an exploited CVE.
- 00:00 UTC. Researchers demonstrate persistent jailbreak of iOS Lockdown Mode. 1 outlet.
- 22:49 UTC. GitBook cyberattack: SSO login flaw led attacker to production secrets. 1 outlet.
- 22:26 UTC. Sekoia links mobile exploit attacks to Russia's APT29. 2 outlets.
- 21:48 UTC. Rails flaw lets attackers read and write server files. 1 outlet.
- 21:04 UTC. Barracuda flaws can be chained to gain root access. 1 outlet.
- 20:31 UTC. CISA Adds Actively Exploited Apple Flaw to KEV Catalogue. 4 outlets. About an exploited CVE.
- 19:01 UTC. Cyberattack disrupts refrigeration controls at French blood banks. 2 outlets.
- 18:50 UTC. mSecure data breach: encrypted cloud vault database stolen. 1 outlet.
- 18:49 UTC. Fake Apple Cash offer lures users into app promotions. 1 outlet.
- 17:02 UTC. mSecure urges users to change passwords after suspicious activity. 1 outlet.
- 17:00 UTC. APT flaw lets attackers swap packages and run code as root. 4 outlets.
- 17:00 UTC. WatchGuard fixes four AuthPoint Gateway flaws, including critical bug. 1 outlet.
- 17:00 UTC. SonicWall will not patch two flaws in its end of life GMS. 2 outlets.
- Known exploited CVE
- CVE not in KEV
- Other story
- Size: outlets on the story
- Stories an hour
Show as tableHide table
| Time (UTC) | Story | Outlets | Type |
|---|---|---|---|
| 16:50 | OpenSSH flaw lets any long password into key-only Alpine accounts | 1 | Other |
| 14:41 | Apache OFBiz fixes flaws enabling remote code execution and takeover | 1 | CVE |
| 14:29 | Alpine fixes OpenSSH flaw that allowed passwordless logins | 1 | Other |
| 14:00 | Check Point finds ChatGPT Lockdown Mode bypass enabling data theft | 1 | Other |
| 14:00 | Rapid7 urges outcome led security as AI speeds attack paths | 1 | Other |
| 13:48 | UNM Health Suspends Care as Cyber Incident Disrupts Clinics | 1 | Other |
| 13:22 | Kela Exposes Bank Phishing Sites Faking Suspended Pages | 1 | Other |
| 12:33 | Cisco and WatchGuard patch flaws as SonicWall leaves GMS bugs unfixed | 1 | CVE |
| 12:25 | Check Point outlines five tests for exposure management platforms | 1 | Other |
| 12:10 | Study finds Vizio and Samsung TVs leak tracking data after opt-outs | 1 | Other |
| 11:59 | Nova ransomware expands extortion with data theft and leaks | 1 | Other |
| 11:40 | Trellix Finds Chinese Cyber Activity Fell 41% in 2026 | 1 | Other |
| 11:25 | Debian apt flaw can bypass package signature verification | 1 | Other |
| 11:15 | AI agents risk scaling North Korean identity attacks | 1 | Other |
| 11:00 | New Charter CISO Ryan Davis sees shadow AI as a key risk | 1 | Other |
| 10:50 | NTT DOCOMO data breach leaks up to 300,000 customers' details | 1 | Other |
| 10:06 | Five Cyber Threats Target US Enterprises Through Trusted Workflows | 1 | Other |
| 10:02 | OpenAI Finds GPT-6 Astra Withholds Help on Safety Tasks | 1 | Other |
| 10:00 | Storm-2603 used fileless webshell in SharePoint breach | 1 | Known exploited |
| 09:13 | Apple to Scan Publicly Shared iCloud Files for Harmful Content | 1 | Other |
| 09:02 | AI Pentest Framework Tied to Attacks on Hundreds of Organisations | 2 | Other |
| 09:00 | Bitdefender finds Android flaw that can trap phones in crash loops | 2 | Other |
| 08:51 | DreamHost data breach: File Manager flaw exposed FTP passwords | 1 | Other |
| 08:42 | Backdoored ARTEX Docker image exposed 62 consoles to root access | 2 | Other |
| 08:01 | APT29 watering hole campaign targets mobile users with exploits | 1 | Known exploited |
| 07:49 | Postman app altered developers’ AI coding tool settings | 1 | Other |
| 07:40 | Google revises school AI policy after educators push back | 1 | Other |
| 07:06 | Binarly finds Zyxel GS1900 switches remain open to root exploits | 4 | CVE |
| 07:01 | MuddyWater uses SimpleHelp to target Israeli organisations | 1 | Other |
| 06:52 | DigiCert data breach exposed some customers' ID documents | 1 | Other |
| 06:34 | Morphisec uncovers XLoader attacks using fake purchase orders | 1 | Other |
| 06:20 | Canadian Man Extradited to US Over University Crypto Mining Hack | 1 | Other |
| 04:54 | OpenAI says AI agents exploited 948 Linux kernel flaws in one run | 1 | Other |
| 04:36 | Residential Proxies Route Traffic Through White House Network | 2 | Other |
| 03:57 | Cisco patches flaws in UCS Central, ISE and Unified CM | 1 | CVE |
| 03:16 | OpenAI AI pipeline finds 1,724 Linux kernel vulnerabilities | 2 | Other |
| 02:38 | GPUStack authentication flaw exploited to seize AI servers | 1 | CVE |
| 01:46 | Control Web Panel flaws chain to unauthenticated root access | 1 | CVE |
| 01:00 | Apache fixes flaws across ZooKeeper, OpenOffice and ActiveMQ | 1 | CVE |
| 00:49 | Nikke PC launcher compromised to install a remote-access tool | 1 | Other |
| 00:33 | ASUS fixes router and PC software flaws in security updates | 1 | CVE |
| 00:06 | Citrix fixes critical XenServer and Scout security flaws | 1 | Known exploited |
| 00:00 | Researchers demonstrate persistent jailbreak of iOS Lockdown Mode | 1 | Other |
| 22:49 | GitBook cyberattack: SSO login flaw led attacker to production secrets | 1 | Other |
| 22:26 | Sekoia links mobile exploit attacks to Russia's APT29 | 2 | Other |
| 21:48 | Rails flaw lets attackers read and write server files | 1 | Other |
| 21:04 | Barracuda flaws can be chained to gain root access | 1 | CVE |
| 20:31 | CISA Adds Actively Exploited Apple Flaw to KEV Catalogue | 4 | Known exploited |
| 19:01 | Cyberattack disrupts refrigeration controls at French blood banks | 2 | Other |
| 18:50 | mSecure data breach: encrypted cloud vault database stolen | 1 | Other |
| 18:49 | Fake Apple Cash offer lures users into app promotions | 1 | Other |
| 17:02 | mSecure urges users to change passwords after suspicious activity | 1 | Other |
| 17:00 | APT flaw lets attackers swap packages and run code as root | 4 | CVE |
| 17:00 | WatchGuard fixes four AuthPoint Gateway flaws, including critical bug | 1 | CVE |
| 17:00 | SonicWall will not patch two flaws in its end of life GMS | 2 | CVE |
- OpenSSH flaw lets any long password into key-only Alpine accounts
On Alpine Linux and other musl systems without PAM, sshd accepts any password of 257 to 1,024 bytes for accounts with no password, including the default user on Alpine's cloud images. OpenSSH 10.6p2 and Alpine updates…
CyberSIXT
- Layer3 Finds Residential Proxy Traffic Exiting White House Network
Residential proxy traffic has exited through the White House network on 236 occasions over a 30-day period, with 28 separate residential proxy services able to route traffic via six of its addresses, according to…
Infosecurity
- Zyxel switch flaw survived patch and was exploited in attacks
A flaw in Zyxel GS1900 switch firmware, now tracked as CVE-2026-107441, survived a June security update and has been linked to a wave of attacks on around 996 switches across 48 countries. Binarly, in a report…
InfosecurityCVE-2026-107441
- Apache OFBiz fixes flaws enabling remote code execution and takeover
Apache OFBiz developers addressed a batch of high‑risk flaws that allowed unauthenticated remote code execution and potential full admin account takeover. The Openwall OS security thread notes 46 security flaws in the…
The Hacker NewsCVE-2026-68524
- Alpine fixes OpenSSH flaw that allowed passwordless logins
Alpine Linux has issued an urgent advisory on 5 November 2026 describing an OpenSSH authentication bypass that can let attackers log in to sshd without a password. The vulnerability affects OpenSSH builds using the…
SecurityOnline
- India warns financial firms of AI driven cyber attacks
India’s cyber authorities have warned of new AI-driven attacks targeting financial and crypto businesses, carried out by a previously unidentified actor named Crafty Falcon. CERT-In’s advisory, issued on 4 November…
Infosecurity
- Check Point finds ChatGPT Lockdown Mode bypass enabling data theft
Check Point Research has disclosed a vulnerability in OpenAI’s ChatGPT that bypassed the platform’s Lockdown Mode, the optional security setting designed to limit prompt-injection based data exfiltration. The flaw,…
Check Point
- Rapid7 urges outcome led security as AI speeds attack paths
Rapid7 has covered Gartner’s Mythos framework, which argues that the distance between theoretical weaknesses and executable attack scenarios is collapsing. The firm reports that frontier AI can make it faster and…
Rapid7
- UNM Health Suspends Care as Cyber Incident Disrupts Clinics
A cybersecurity incident forced the University of New Mexico Health System (UNM Health) to suspend care across its network on 26 October 2026, diverting ambulance traffic to other hospitals and cancelling appointments…
Security Affairs
- Kela Exposes Bank Phishing Sites Faking Suspended Pages
Cybersecurity firm Kela reports a bank-phishing operation that uses fake ‘suspended’ notices to hide content from visitors who return to look‑alike bank sites. The campaign, active since May, has registered more than…
SecurityWeek
- Cyberattack disrupts French blood bank refrigeration sites
A cyberattack disrupted several French blood-bank cold-storage sites, but authorities said no blood products or samples were compromised. The French Blood Establishment (EFS) reported that temperature and defrosting…
SecurityWeek
- Cisco and WatchGuard patch flaws as SonicWall leaves GMS bugs unfixed
Cisco and WatchGuard have published patches this week addressing a range of vulnerabilities, including remote code execution and authentication flaws. Security firm WatchGuard issued five advisories, four of which…
SecurityWeekCVE-2026-98432
- Check Point outlines five tests for exposure management platforms
Check Point argues that exposure management platforms must do more than surface vulnerabilities; they must connect discovery to a measurable, trusted remediation workflow. The piece highlights five tests for continuous…
The Hacker News
- Study finds Vizio and Samsung TVs leak tracking data after opt-outs
Northeastern University researchers tested twelve smart TVs from ten manufacturers to see whether Automatic Content Recognition (ACR) data would still be sent after users opt out. The study, titled Watching the…
Malwarebytes
- Nova ransomware expands extortion with data theft and leaks
Nova Ransomware operates as a ransomware-as-a-service (RaaS) group, supplying affiliates with a Rust-based encryptor and threatening to publish stolen data on a dedicated dark web leak site. The operation first…
SOCRadar
- Apt flaw lets attackers replace verified packages and run code as root
On 4 November 2026 Debian and Ubuntu released patches for CVE-2026-109518, a flaw in the apt package manager that can allow an on-path attacker to swap a verified package after apt has performed its checks and run code…
StepSecurityCVE-2026-109518
- Zyxel fixes bypassed flaw in GS1900 switches with Patch 3
Zyxel has issued Patch 3 for 10 GS1900 switch models to fix a zero‑day flaw now tracked as CVE-2026-107441. The vulnerability, described as an out‑of‑bounds write in the dispatcher.cgi handling the web management…
SOCRadarCVE-2026-107441
- Trellix Finds Chinese Cyber Activity Fell 41% in 2026
A Trellix study published on 4 November 2026 finds that Chinese nation-state threat activity declined by 41.4% in the six months from April to September 2026. The researchers say the drop in detections could reflect…
Infosecurity
- AI hacking tool ARTEX used by four threat actors, two tied to China
A backdoored ARTEX Docker image gives a root shell to anyone who knows its trigger, a researcher found, and India's CERT-In says a new actor uses ARTEX on its banks. In October four threat actors were documented using…
CyberSIXT
- Debian apt flaw can bypass package signature verification
The SANS Internet Storm Center’s Stormcast for 5 November 2026 reports on several notable items observed in recent telemetry and community discussions. Johannes Ullrich highlights a resurfaced issue with old web…
SANS ISC
- AI agents risk scaling North Korean identity attacks
North Korean operatives have for years infiltrated Western enterprise networks by posing as remote IT workers, using stolen identities to pass interviews, secure legitimate credentials, and operate inside corporate…
SecurityWeek
- New Charter CISO Ryan Davis sees shadow AI as a key risk
Ryan Davis, now CISO at New Charter Technologies, describes a career that began with hands-on tinkering and hacking as a formative grounding for modern security leadership. He recounts building a dual bachelor’s…
SecurityWeek
- Zyxel Switches Hit by Zero Day Affecting Nearly 1,000 Devices
SecurityWeek reports that a recently patched vulnerability in Zyxel GS1900 series switches was exploited in the wild as a zero-day to compromise nearly 1,000 devices. The flaw, tracked as CVE-2026-107441, is an…
SecurityWeekCVE-2026-107441
- NTT DOCOMO data breach leaks up to 300,000 customers' details
Japan's NTT DOCOMO says an intruder reached its online shop and My docomo portal and took names, addresses, birth dates and phone numbers. A separate nationwide 5G outage the same day shows no sign of an attack, DOCOMO…
CyberSIXT
- Bitdefender Finds Android Bug That Can Trap Phones in Reboot Loop
Bitdefender has disclosed a new Android vulnerability, dubbed GhostMap, which can force devices into a crash loop that only a factory reset can stop. The flaw stems from two mis-handled fields inside a ZIP entry—the…
Infosecurity
- Five Cyber Threats Target US Enterprises Through Trusted Workflows
Five active cyber threats in October 2026 targeted US enterprises, with attackers abusing trusted platforms, legitimate authentication flows, and common business workflows to reach corporate accounts and data.…
The Hacker News
- OpenAI Finds GPT-6 Astra Withholds Help on Safety Tasks
OpenAI has disclosed that its Critical-rated cyber model, GPT-6 Astra, quietly underperformed on internal red-teaming and exploit tasks when the framing of the work was shifted to AI safety research. The company’ s…
SecurityWeek
- Sekoia links APT29 to mobile watering hole attacks
Sekoia researchers have traced a large-scale watering hole campaign they attribute, with moderate to high confidence, to Russia-linked APT29 (aka SVR group, Cozy Bear, Nobelium). The operation ran from late August to…
Security Affairs
- SonicWall discloses two unpatched flaws in end of life GMS
SonicWall has disclosed two vulnerabilities in its Global Management System (GMS) and says there will be no fixes because the product has reached end of life. The more severe flaw, CVE-2026-109593, allows an…
SOCRadarCVE-2026-109593
- Apple to Scan Publicly Shared iCloud Files for Harmful Content
Apple has announced that starting with iOS 27.3, iPadOS 27.3, macOS 27.3 and visionOS 27.3, publicly shared iCloud links will be scanned for harmful content. The policy focuses on items shared via “Anyone with the…
The Hacker News
- AI Pentest Framework Tied to Attacks on Hundreds of Organisations
ARTEX AI is described as an autonomous penetration testing framework that uses coordinated LLM agents to carry out reconnaissance, exploitation, privilege escalation and data theft with minimal human input. Since late…
SOCRadar
- Bitdefender finds Android flaw that can trap phones in crash loops
Bitdefender Labs says it found an Android flaw, named GhostMap, that can make a phone repeatedly crash after a specially crafted app is installed. The app does not need to be opened, request permissions or contain…
bitdefender.com
- DreamHost data breach: File Manager flaw exposed FTP passwords
An attacker exploited the web host's File Manager from about August until October 23, taking FTP and SFTP logins and some webmail credentials. DreamHost says well under 10% of accounts were hit and that some mailboxes…
CyberSIXT
- Backdoored ARTEX Docker image exposed 62 consoles to root access
The Hacker News reports that India’s Computer Emergency Response Team (CERT-In) has flagged an active AI-assisted threat campaign, tracked as Crafty Falcon, that is exploiting publicly available AI-driven offensive…
The Hacker News
- Postman app altered developers’ AI coding tool settings
Postman’s macOS client is reported to have silently modified developers’ local AI coding environments by installing background extensions and registering new plugin repositories for internal tools in Codex and Claude…
SecurityOnline
- Google revises school AI policy after educators push back
SecurityOnline[.]info reports that Google’s stance on embedding generative AI in Google Search for K‑12 schools has provoked a strong backlash from US educators and municipal leaders. In remarks tied to an interview…
SecurityOnline
- Binarly finds Zyxel GS1900 switches remain open to root exploits
Zyxel GS1900 network switches that were patched with the earlier remedy for an actively exploited flaw remain susceptible to the zero-day attackers used, researchers from Binarly have found. The exploit allows…
The Hacker NewsCVE-2026-107441
- MuddyWater uses SimpleHelp to target Israeli organisations
Threat researchers report a MuddyWater operation using the SimpleHelp remote access tool to target Israeli organisations, with activity traced to September 2026. In the campaign, phishing emails impersonate the Israel…
SecurityOnline
- DigiCert data breach exposed some customers' ID documents
An account created through a self-service sign-up read archived customer records, including passports and driver's licences for a small minority. DigiCert saw stray accounts in June but confirmed in October that data…
CyberSIXT
- Morphisec uncovers XLoader attacks using fake purchase orders
Security researchers from Morphisec have identified a new wave of business-themed phishing campaigns delivering the XLoader infostealer, spawned from a benign-looking ordering context. The attacker emails, written in…
SecurityOnline
- Canadian Man Extradited to US Over University Crypto Mining Hack
A Canadian man, Ryan James Roach, has been extradited to the United States to face charges over a scheme that hacked university computers and hijacked them to mine cryptocurrency. Roach, aged 35, was extradited on 28…
Security Affairs
- OpenAI says AI agents exploited 948 Linux kernel flaws in one run
An unreleased OpenAI cyber model found 948 distinct Linux kernel flaws that let a local user become root, and wrote exploits and fixes for them, for $1.2 million in API credits. When its analysis ended, 61 had been…
CyberSIXT
- Residential Proxies Route Traffic Through White House Network
Several White House devices have been observed exposing their network addresses to residential proxy services, enabling others to rent or hijack those addresses. Security firm Layer3 Intel detected proxy exits from the…
Krebs on Security
- OpenAI AI pipeline finds 948 Linux root escalation exploits
OpenAI disclosed a five-stage AI-driven pipeline that, using an upcoming cyber-focused model, validated and patched 948 local privilege escalation vulnerabilities in Linux for an API spend of about $1.213 million. The…
The Hacker News
- Cisco patches flaws in UCS Central, ISE and Unified CM
Cisco has released patches for three high-severity vulnerabilities across Cisco UCS Central, Identity Services Engine (ISE) and Unified Communications Manager (Unified CM). The flaws, tracked as CVE-2026-76506,…
SecurityOnlineCVE-2026-76506
- OpenAI AI pipeline finds 1,724 Linux kernel vulnerabilities
OpenAI researchers have unveiled a five-stage automated pipeline that they say uncovered 1,724 real Linux kernel vulnerabilities and produced 948 working local root exploits during a mid-October run in 2026. The team…
SecurityOnline
- GPUStack authentication flaw exploited to seize AI servers
Threat actors are exploiting a critical GPUStack authentication bypass in the wild to seize control of AI servers. The report, attributed to researcher Javier Sixto of ulex[.]fr, notes active abuse of CVE-2026-102895…
SecurityOnlineCVE-2026-102895
- Control Web Panel flaws chain to unauthenticated root access
SecurityOnline[.]info reports that VulnCheck researcher Valentin Lobstein disclosed a chain of ten vulnerabilities in Control Web Panel (CWP) that can provide unauthenticated root access when combined. The flaws span…
SecurityOnlineCVE-2026-73695
- APT flaw lets attackers execute code as root on Linux systems
Debian and Ubuntu have released urgent updates for the APT package manager to fix a critical file check bypass that could allow root code execution. The flaw, tracked as CVE-2026-109518, enables an on‑path attacker or…
SecurityOnlineCVE-2026-109518
- Apache fixes flaws across ZooKeeper, OpenOffice and ActiveMQ
The Apache Software Foundation disclosed 35 security flaws across nine projects on 2–3 November 2026, affecting widely used tools such as ZooKeeper, OpenOffice, ActiveMQ and Juneau. The bulk of the issues are unpatched…
SecurityOnlineCVE-2026-115448
- Nikke PC launcher compromised to install a remote-access tool
Level Infinite confirms the Nikke PC launcher's files were tampered with and that PCs and account data may have been exposed. Anyone who opened it since 27 September should run a security check.
CyberSIXT
- ASUS fixes router and PC software flaws in security updates
ASUS has issued four security advisories on 4 November 2026 addressing vulnerabilities in router firmware and ASUS PC software, including Armoury Crate. The affected products span ASUSWRT router firmware versions…
SecurityOnlineCVE-2026-84730
- Researchers demonstrate persistent jailbreak of iOS Lockdown Mode
Calif, a security research outfit, has demonstrated a persistent iOS Lockdown Mode jailbreak affecting an iPhone 18 Pro. The researchers claim the exploit chain triggers instantly when a malicious PDF is received via…
SecurityOnline
- GitBook cyberattack: SSO login flaw led attacker to production secrets
GitBook's post-mortem says an SSO flaw let an attacker act as staff, reach a GitHub App's credentials, its code and a Cloudflare key, then production secrets. The attack targeted one customer.
CyberSIXT
- Sekoia links mobile exploit attacks to Russia's APT29
Researchers say hackers believed linked to Russia’s Foreign Intelligence Service exploited iOS and Android flaws that had already been patched to target visitors of numerous websites, including one tied to the 250th…
Ars Technica
- Rails flaw lets attackers read and write server files
A critical flaw in Rails could allow an attacker to write arbitrary files to a vulnerable Web server and read sensitive files via the Active Storage ImageMagick integration. The vulnerability, tracked as…
Dark Reading
- Barracuda flaws can be chained to gain root access
Barracuda has disclosed two vulnerabilities in its Email Security Gateway (ESG) family that can be chained to yield root access on affected devices. The pre-authentication authorization bypass, CVE-2026-116606 (CVSS…
Security AffairsCVE-2026-116606
- CVE-2026-109518: Debian APT flaw lets attackers run root code
CVE-2026-109518 lets a man-in-the-middle replace a package after APT has verified it, when an HTTP download is retried. Debian and Ubuntu have fixed it; HTTPS sources or turning off retries block it until then.
CyberSIXTCVE-2026-109518
- Cyberattack disrupts refrigeration controls at French blood banks
Three regional French blood banks were hit by a cyberattack that disrupted the monitoring and control of refrigerated storage facilities used by the French Blood Establishment (EFS). The French Health Ministry said the…
Security Affairs
- mSecure data breach: encrypted cloud vault database stolen
The password manager's maker, mSeven Software, told customers an attacker took an encrypted copy of a database of current and former users who synced through mSecure Cloud. It asks them to change their master password…
CyberSIXT
- Fake Apple Cash offer lures users into app promotions
A Malwarebytes investigation describes a fake offer promising a $750 Apple Cash reward in exchange for a “device verification.” The page is not affiliated with Apple and instead redirects users to app offers via…
Malwarebytes
- mSecure urges users to change passwords after suspicious activity
mSecure, the password manager from mSeven Software, has warned current and former customers to take action after detecting “suspicious activity” tied to the mSecure app. The notice, published on 3 November by The…
Malwarebytes
- APT flaw lets attackers swap packages and run code as root
A flaw in APT, the package manager used by Debian and Ubuntu, could let an attacker who can modify package downloads swap a verified package for their own, with the malicious code then running with root privileges. The…
The Hacker NewsCVE-2026-109518
- WatchGuard fixes four AuthPoint Gateway flaws, including critical bug
WatchGuard has released urgent updates for AuthPoint Gateway to fix four flaws described as critical or high risk. WatchGuard AI Security Research found the vulnerabilities during internal testing, and the company’s…
SecurityOnlineCVE-2026-121639
- SonicWall will not patch two flaws in its end of life GMS
SonicWall has warned that two vulnerabilities affecting its End-of-Life Global Management System (GMS) will not be patched. The flaws affect GMS 9.5.2 and earlier, and SonicWall states that there will be no remediation…
The Hacker NewsCVE-2026-109593
CVEs in the news12
Named in the last 24 hours and not in CISA KEV, most covered first
CVE-2026-107441Zyxel GS1900-24E firmware
4 articles today · Zyxel switch flaw survived patch and was exploited in attacks
8.8High0.3% EPSS · 6 articlesCVE-2026-109518Debian APT
4 articles today · Apt flaw lets attackers replace verified packages and run code as root
7.7High0.9% EPSS · 4 articlesCVE-2026-109593SonicWall Global Management System (GMS)
2 articles today · SonicWall discloses two unpatched flaws in end of life GMS
9.1Critical0.5% EPSS · 3 articlesCVE-2026-98432Linux Linux
Cisco and WatchGuard patch flaws as SonicWall leaves GMS bugs unfixed
9.8Critical0.8% EPSS · 11 articlesCVE-2026-102895gpustack gpustack
GPUStack authentication flaw exploited to seize AI servers
9.8Critical1 articleCVE-2026-116606Barracuda Networks Barracuda Email Security Gateway (ESG)
Barracuda flaws can be chained to gain root access
9.3Critical0.7% EPSS · 4 articlesCVE-2026-121639WatchGuard AuthPoint Authentication Gateway
WatchGuard fixes four AuthPoint Gateway flaws, including critical bug
9.2Critical2 articlesCVE-2026-73695Control Web Panel Control Web Panel
Control Web Panel flaws chain to unauthenticated root access
8.8High1.0% EPSS · 1 articleCVE-2026-115448Apache Software Foundation Apache ZooKeeper
Apache fixes flaws across ZooKeeper, OpenOffice and ActiveMQ
8.7High1 articleCVE-2026-84730ASUS Router firmware
ASUS fixes router and PC software flaws in security updates
8.7High0.3% EPSS · 1 articleCVE-2026-76506Cisco Cisco Unified Computing System Central Software
Cisco patches flaws in UCS Central, ISE and Unified CM
7.6High1.4% EPSS · 2 articlesCVE-2026-68524Apache Software Foundation Apache OFBiz
Apache OFBiz fixes flaws enabling remote code execution and takeover
Not scored1 article
Developing stories6
Two or more articles in the last 24 hours; each bead is an article
- CVECVE-2026-107441Zyxel GS1900-24E firmwareDevelopinglatest 2 hours ago4 articles4 outlets
- Thu 5 Nov, 07:06 UTC. The Hacker News, first report. Binarly finds Zyxel GS1900 switches remain open to root exploits.
- Thu 5 Nov, 10:56 UTC. SecurityWeek, its first report on the story. Zyxel Switches Hit by Zero Day Affecting Nearly 1,000 Devices.
- Thu 5 Nov, 11:47 UTC. SOCRadar, its first report on the story. Zyxel fixes bypassed flaw in GS1900 switches with Patch 3.
- Thu 5 Nov, 15:15 UTC. Infosecurity, its first report on the story. Zyxel switch flaw survived patch and was exploited in attacks.
- CVECVE-2026-109518Debian APTDevelopinglatest 5 hours ago4 articles4 outlets
- Wed 4 Nov, 17:00 UTC. The Hacker News, first report. APT flaw lets attackers swap packages and run code as root.
- Wed 4 Nov, 20:49 UTC. CyberSIXT, its first report on the story. CVE-2026-109518: Debian APT flaw lets attackers run root code.
- Thu 5 Nov, 01:41 UTC. SecurityOnline, its first report on the story. APT flaw lets attackers execute code as root on Linux systems.
- Thu 5 Nov, 11:49 UTC. StepSecurity, its first report on the story. Apt flaw lets attackers replace verified packages and run code as root.
- In CISA KEVCVECVE-2024-27834Apple SafariDevelopinglatest 6 hours ago4 articles4 outlets
- Wed 4 Nov, 20:31 UTC. CISA, first report. CISA Adds Actively Exploited Apple Flaw to KEV Catalogue. Cites a CVE in CISA KEV.
- Thu 5 Nov, 05:17 UTC. The Hacker News, its first report on the story. CISA Adds Exploited Apple Flaw to Its KEV Catalog. Cites a CVE in CISA KEV.
- Thu 5 Nov, 08:55 UTC. Security Affairs, its first report on the story. CISA adds Apple flaw linked to APT29 to its exploited list. Cites a CVE in CISA KEV.
- Thu 5 Nov, 10:37 UTC. SecurityWeek, its first report on the story. Midnight Blizzard targets mobile devices with exploit chains. Cites a CVE in CISA KEV.
- Threat actorCrafty FalconDevelopinglatest 3 hours ago2 articles2 outlets
- Thu 5 Nov, 08:42 UTC. The Hacker News, first report. Backdoored ARTEX Docker image exposed 62 consoles to root access.
- Thu 5 Nov, 14:25 UTC. Infosecurity, its first report on the story. India warns financial firms of AI driven cyber attacks.
- Threat actorStorm-0940Developinglatest 5 hours ago2 articles2 outlets
- Thu 5 Nov, 09:02 UTC. SOCRadar, first report. AI Pentest Framework Tied to Attacks on Hundreds of Organisations.
- Thu 5 Nov, 11:27 UTC. CyberSIXT, its first report on the story. AI hacking tool ARTEX used by four threat actors, two tied to China.
- Threat actorUNC2452Developinglatest 7 hours ago2 articles2 outlets
- Wed 4 Nov, 22:26 UTC. Ars Technica, first report. Sekoia links mobile exploit attacks to Russia's APT29.
- Thu 5 Nov, 10:00 UTC. Security Affairs, its first report on the story. Sekoia links APT29 to mobile watering hole attacks.