Thu 5 Nov · updated 12:30 UTC
Today in security
Today’s briefing
Updated 11:28 UTC
Backdoored ARTEX copy gives root on attack consoles
3 updates since 07:00 · latest 11:28 UTC
A researcher found a Docker image of the AI hacking tool ARTEX that runs commands as root before login; at least 62 consoles ran it. CERT-In says a new actor, CRAFTY FALCON, uses ARTEX against Indian financial firms.
- NTT DOCOMO confirms leak of up to 300,000 customers' details
- DreamHost confirms File Manager breach exposed FTP passwords
- 07:00 edition: CISA adds actively exploited Apple flaw to KEV catalogue
- CISA adds Apple flaw to exploited vulnerabilities catalogue
- GPUStack authentication flaw is exploited against AI servers
Known exploited14
CISA KEV entries named in the last 48 hours of coverage, by federal deadline
- In CISA KEV
WordPress CoreCVE-2026-119977
Federal deadline 6 Nov · In CISA KEV since 3 Nov
8.1High1.0% EPSS3 articles
- In CISA KEV
Google BrotliCVE-2026-111497
Federal deadline 10 Nov · In CISA KEV since 27 Oct
9.2Critical83% EPSS23 articles
- In CISA KEV
Apple SafariCVE-2024-27834
Federal deadline 18 Nov · In CISA KEV since 4 Nov
5.5Medium0.6% EPSS7 articles
- In CISA KEV
Zyxel GS1900-48HPv2 firmwareCVE-2026-7273
Federal deadline passed 24 Sep · In CISA KEV since 21 Sep
8.8High2.8% EPSS11 articles
Show 10 more · federal deadlines passed
- In CISA KEV
WebPros cPanel & WHM and WP2 (WordPress Squared)CVE-2026-41940
Federal deadline passed 3 May · In CISA KEV since 30 Apr · Used in ransomware campaigns
9.8Critical99% EPSS17 articles
- In CISA KEV
Apple Multiple ProductsCVE-2025-43510
Federal deadline passed 3 Apr · In CISA KEV since 20 Mar
Not scored0.4% EPSS10 articles
- In CISA KEV
Apple Multiple ProductsCVE-2025-43520
Federal deadline passed 3 Apr · In CISA KEV since 20 Mar
Not scored0.4% EPSS10 articles
- In CISA KEV
Google Chromium V8CVE-2026-3910
Federal deadline passed 27 Mar · In CISA KEV since 13 Mar
Not scored2.7% EPSS13 articles
- In CISA KEV
Apple Multiple ProductsCVE-2026-20700
Federal deadline passed 5 Mar · In CISA KEV since 12 Feb
Not scored1.7% EPSS13 articles
- In CISA KEV
Apple Multiple ProductsCVE-2025-43529
Federal deadline passed 5 Jan · In CISA KEV since 15 Dec 2025
Not scored26% EPSS11 articles
- In CISA KEV
Google ChromiumCVE-2025-14174
Federal deadline passed 2 Jan · In CISA KEV since 12 Dec 2025
Not scored55% EPSS8 articles
- In CISA KEV
RARLAB WinRARCVE-2025-8088
Federal deadline passed 2 Sep 2025 · In CISA KEV since 12 Aug 2025 · Used in ransomware campaigns
8.4High94% EPSS23 articles
- In CISA KEV
Microsoft SharePointCVE-2025-53770
Federal deadline passed 21 Jul 2025 · In CISA KEV since 20 Jul 2025 · Used in ransomware campaigns
9.8Critical99.9% EPSS4 articles
- In CISA KEV
Qualcomm Multiple ChipsetsCVE-2025-27038
Federal deadline passed 24 Jun 2025 · In CISA KEV since 3 Jun 2025
7.5High1.0% EPSS1 article
Latest news63
The last 24 hours, newest first; stories about known exploited CVEs are above
Latest story at 11:59 UTC. Red diamonds mark the 4 stories about exploited CVEs.
- 11:59 UTC. Nova ransomware expands extortion with data theft and leaks. 1 outlet.
- 11:40 UTC. Trellix Finds Chinese Cyber Activity Fell 41% in 2026. 1 outlet.
- 11:00 UTC. New Charter CISO Ryan Davis sees shadow AI as a key risk. 1 outlet.
- 10:50 UTC. NTT DOCOMO data breach leaks up to 300,000 customers' details. 1 outlet.
- 10:06 UTC. Five Cyber Threats Target US Enterprises Through Trusted Workflows. 1 outlet.
- 10:02 UTC. OpenAI Finds GPT-6 Astra Withholds Help on Safety Tasks. 1 outlet.
- 10:00 UTC. Storm-2603 used fileless webshell in SharePoint breach. 1 outlet. About an exploited CVE.
- 09:13 UTC. Apple to Scan Publicly Shared iCloud Files for Harmful Content. 1 outlet.
- 09:02 UTC. AI Pentest Framework Tied to Attacks on Hundreds of Organisations. 2 outlets.
- 09:00 UTC. Bitdefender finds Android flaw that can trap phones in crash loops. 2 outlets.
- 08:51 UTC. DreamHost data breach: File Manager flaw exposed FTP passwords. 1 outlet.
- 08:42 UTC. Backdoored ARTEX Docker image exposed 62 consoles to root access. 1 outlet.
- 07:49 UTC. Postman app altered developers’ AI coding tool settings. 1 outlet.
- 07:40 UTC. Google revises school AI policy after educators push back. 1 outlet.
- 07:06 UTC. Binarly finds Zyxel GS1900 switches remain open to root exploits. 3 outlets.
- 07:01 UTC. MuddyWater uses SimpleHelp to target Israeli organisations. 1 outlet.
- 06:52 UTC. DigiCert data breach exposed some customers' ID documents. 1 outlet.
- 06:34 UTC. Morphisec uncovers XLoader attacks using fake purchase orders. 1 outlet.
- 06:20 UTC. Canadian Man Extradited to US Over University Crypto Mining Hack. 1 outlet.
- 04:54 UTC. OpenAI says AI agents exploited 948 Linux kernel flaws in one run. 1 outlet.
- 04:36 UTC. Residential Proxies Route Traffic Through White House Network. 1 outlet.
- 03:57 UTC. Cisco patches flaws in UCS Central, ISE and Unified CM. 1 outlet.
- 03:16 UTC. OpenAI AI pipeline finds 1,724 Linux kernel vulnerabilities. 2 outlets.
- 02:38 UTC. GPUStack authentication flaw exploited to seize AI servers. 1 outlet.
- 01:46 UTC. Control Web Panel flaws chain to unauthenticated root access. 1 outlet.
- 01:00 UTC. Apache fixes flaws across ZooKeeper, OpenOffice and ActiveMQ. 1 outlet.
- 00:49 UTC. Nikke PC launcher compromised to install a remote-access tool. 1 outlet.
- 00:33 UTC. ASUS fixes router and PC software flaws in security updates. 1 outlet.
- 00:06 UTC. Citrix fixes critical XenServer and Scout security flaws. 1 outlet. About an exploited CVE.
- 00:00 UTC. Researchers demonstrate persistent jailbreak of iOS Lockdown Mode. 1 outlet.
- 22:49 UTC. GitBook cyberattack: SSO login flaw led attacker to production secrets. 1 outlet.
- 22:26 UTC. Sekoia links mobile exploit attacks to Russia's APT29. 2 outlets.
- 21:48 UTC. Rails flaw lets attackers read and write server files. 1 outlet.
- 20:31 UTC. CISA Adds Actively Exploited Apple Flaw to KEV Catalogue. 4 outlets. About an exploited CVE.
- 19:01 UTC. Cyberattack disrupts refrigeration controls at French blood banks. 1 outlet.
- 18:50 UTC. mSecure data breach: encrypted cloud vault database stolen. 1 outlet.
- 18:49 UTC. Fake Apple Cash offer lures users into app promotions. 1 outlet.
- 17:00 UTC. APT flaw lets attackers swap packages and run code as root. 4 outlets.
- 17:00 UTC. WatchGuard fixes four AuthPoint Gateway flaws, including critical bug. 1 outlet.
- 17:00 UTC. SonicWall will not patch two flaws in its end of life GMS. 2 outlets.
- 16:51 UTC. Bristol schools cyberattack: 320,000 stolen files leaked online. 1 outlet.
- 16:24 UTC. Google disrupts XCPE botnet that infected 1.3 million devices. 1 outlet.
- 16:06 UTC. Check Point Finds Prompt Adware in OpenAI Codex Jailbreak Tool. 1 outlet.
- 16:06 UTC. Binance says hackers planned $6.3 billion crypto heist for months. 1 outlet.
- 15:00 UTC. SlippyNunchucks abuses Sogou keyboard to deliver malware. 1 outlet.
- 14:34 UTC. Sysdig launches runtime security and governance for AI agents. 1 outlet.
- 14:24 UTC. Barracuda patches ESG flaws that can enable root access. 2 outlets.
- 14:17 UTC. Security teams turn to automation to speed incident updates. 1 outlet.
- 14:09 UTC. Sentra Raises $150 Million to Expand AI Data Security. 1 outlet.
- 14:00 UTC. APT29 uses watering holes to target mobile devices with exploits. 3 outlets. About an exploited CVE.
- 14:00 UTC. Cloudflare Adds Controls to Manage Personal Agent Traffic. 1 outlet.
- 13:24 UTC. SANS observes renewed probing for vulnerable email scripts. 1 outlet.
- 13:08 UTC. mSecure urges subscribers to reset passwords after suspicious activity. 2 outlets.
- 12:52 UTC. Crédit Mutuel Arkéa cyberattack: $133M traced to crypto. 1 outlet.
- 12:52 UTC. Cyberattack sends French blood storage readings soaring to 110°C. 1 outlet.
- Known exploited CVE
- CVE not in KEV
- Other story
- Size: outlets on the story
- Stories an hour
Show as tableHide table
| Time (UTC) | Story | Outlets | Type |
|---|---|---|---|
| 11:59 | Nova ransomware expands extortion with data theft and leaks | 1 | Other |
| 11:40 | Trellix Finds Chinese Cyber Activity Fell 41% in 2026 | 1 | Other |
| 11:00 | New Charter CISO Ryan Davis sees shadow AI as a key risk | 1 | Other |
| 10:50 | NTT DOCOMO data breach leaks up to 300,000 customers' details | 1 | Other |
| 10:06 | Five Cyber Threats Target US Enterprises Through Trusted Workflows | 1 | Other |
| 10:02 | OpenAI Finds GPT-6 Astra Withholds Help on Safety Tasks | 1 | Other |
| 10:00 | Storm-2603 used fileless webshell in SharePoint breach | 1 | Known exploited |
| 09:13 | Apple to Scan Publicly Shared iCloud Files for Harmful Content | 1 | Other |
| 09:02 | AI Pentest Framework Tied to Attacks on Hundreds of Organisations | 2 | Other |
| 09:00 | Bitdefender finds Android flaw that can trap phones in crash loops | 2 | Other |
| 08:51 | DreamHost data breach: File Manager flaw exposed FTP passwords | 1 | Other |
| 08:42 | Backdoored ARTEX Docker image exposed 62 consoles to root access | 1 | Other |
| 07:49 | Postman app altered developers’ AI coding tool settings | 1 | Other |
| 07:40 | Google revises school AI policy after educators push back | 1 | Other |
| 07:06 | Binarly finds Zyxel GS1900 switches remain open to root exploits | 3 | CVE |
| 07:01 | MuddyWater uses SimpleHelp to target Israeli organisations | 1 | Other |
| 06:52 | DigiCert data breach exposed some customers' ID documents | 1 | Other |
| 06:34 | Morphisec uncovers XLoader attacks using fake purchase orders | 1 | Other |
| 06:20 | Canadian Man Extradited to US Over University Crypto Mining Hack | 1 | Other |
| 04:54 | OpenAI says AI agents exploited 948 Linux kernel flaws in one run | 1 | Other |
| 04:36 | Residential Proxies Route Traffic Through White House Network | 1 | Other |
| 03:57 | Cisco patches flaws in UCS Central, ISE and Unified CM | 1 | CVE |
| 03:16 | OpenAI AI pipeline finds 1,724 Linux kernel vulnerabilities | 2 | Other |
| 02:38 | GPUStack authentication flaw exploited to seize AI servers | 1 | CVE |
| 01:46 | Control Web Panel flaws chain to unauthenticated root access | 1 | CVE |
| 01:00 | Apache fixes flaws across ZooKeeper, OpenOffice and ActiveMQ | 1 | CVE |
| 00:49 | Nikke PC launcher compromised to install a remote-access tool | 1 | Other |
| 00:33 | ASUS fixes router and PC software flaws in security updates | 1 | CVE |
| 00:06 | Citrix fixes critical XenServer and Scout security flaws | 1 | Known exploited |
| 00:00 | Researchers demonstrate persistent jailbreak of iOS Lockdown Mode | 1 | Other |
| 22:49 | GitBook cyberattack: SSO login flaw led attacker to production secrets | 1 | Other |
| 22:26 | Sekoia links mobile exploit attacks to Russia's APT29 | 2 | Other |
| 21:48 | Rails flaw lets attackers read and write server files | 1 | Other |
| 20:31 | CISA Adds Actively Exploited Apple Flaw to KEV Catalogue | 4 | Known exploited |
| 19:01 | Cyberattack disrupts refrigeration controls at French blood banks | 1 | Other |
| 18:50 | mSecure data breach: encrypted cloud vault database stolen | 1 | Other |
| 18:49 | Fake Apple Cash offer lures users into app promotions | 1 | Other |
| 17:00 | APT flaw lets attackers swap packages and run code as root | 4 | CVE |
| 17:00 | WatchGuard fixes four AuthPoint Gateway flaws, including critical bug | 1 | CVE |
| 17:00 | SonicWall will not patch two flaws in its end of life GMS | 2 | CVE |
| 16:51 | Bristol schools cyberattack: 320,000 stolen files leaked online | 1 | Other |
| 16:24 | Google disrupts XCPE botnet that infected 1.3 million devices | 1 | Other |
| 16:06 | Check Point Finds Prompt Adware in OpenAI Codex Jailbreak Tool | 1 | Other |
| 16:06 | Binance says hackers planned $6.3 billion crypto heist for months | 1 | Other |
| 15:00 | SlippyNunchucks abuses Sogou keyboard to deliver malware | 1 | Other |
| 14:34 | Sysdig launches runtime security and governance for AI agents | 1 | Other |
| 14:24 | Barracuda patches ESG flaws that can enable root access | 2 | CVE |
| 14:17 | Security teams turn to automation to speed incident updates | 1 | Other |
| 14:09 | Sentra Raises $150 Million to Expand AI Data Security | 1 | Other |
| 14:00 | APT29 uses watering holes to target mobile devices with exploits | 3 | Known exploited |
| 14:00 | Cloudflare Adds Controls to Manage Personal Agent Traffic | 1 | Other |
| 13:24 | SANS observes renewed probing for vulnerable email scripts | 1 | CVE |
| 13:08 | mSecure urges subscribers to reset passwords after suspicious activity | 2 | Other |
| 12:52 | Crédit Mutuel Arkéa cyberattack: $133M traced to crypto | 1 | Other |
| 12:52 | Cyberattack sends French blood storage readings soaring to 110°C | 1 | Other |
- Nova ransomware expands extortion with data theft and leaks
Nova Ransomware operates as a ransomware-as-a-service (RaaS) group, supplying affiliates with a Rust-based encryptor and threatening to publish stolen data on a dedicated dark web leak site. The operation first…
SOCRadar
- Apt flaw lets attackers replace verified packages and run code as root
On 4 November 2026 Debian and Ubuntu released patches for CVE-2026-109518, a flaw in the apt package manager that can allow an on-path attacker to swap a verified package after apt has performed its checks and run code…
StepSecurityCVE-2026-109518
- Zyxel fixes bypassed flaw in GS1900 switches with Patch 3
Zyxel has issued Patch 3 for 10 GS1900 switch models to fix a zero‑day flaw now tracked as CVE-2026-107441. The vulnerability, described as an out‑of‑bounds write in the dispatcher.cgi handling the web management…
SOCRadarCVE-2026-107441
- Trellix Finds Chinese Cyber Activity Fell 41% in 2026
A Trellix study published on 4 November 2026 finds that Chinese nation-state threat activity declined by 41.4% in the six months from April to September 2026. The researchers say the drop in detections could reflect…
Infosecurity
- AI hacking tool ARTEX used by four threat actors, two tied to China
A backdoored ARTEX Docker image gives a root shell to anyone who knows its trigger, a researcher found, and India's CERT-In says a new actor uses ARTEX on its banks. In October four threat actors were documented using…
CyberSIXT
- New Charter CISO Ryan Davis sees shadow AI as a key risk
Ryan Davis, now CISO at New Charter Technologies, describes a career that began with hands-on tinkering and hacking as a formative grounding for modern security leadership. He recounts building a dual bachelor’s…
SecurityWeek
- Zyxel Switches Hit by Zero Day Affecting Nearly 1,000 Devices
SecurityWeek reports that a recently patched vulnerability in Zyxel GS1900 series switches was exploited in the wild as a zero-day to compromise nearly 1,000 devices. The flaw, tracked as CVE-2026-107441, is an…
SecurityWeekCVE-2026-107441
- NTT DOCOMO data breach leaks up to 300,000 customers' details
Japan's NTT DOCOMO says an intruder reached its online shop and My docomo portal and took names, addresses, birth dates and phone numbers. A separate nationwide 5G outage the same day shows no sign of an attack, DOCOMO…
CyberSIXT
- Bitdefender Finds Android Bug That Can Trap Phones in Reboot Loop
Bitdefender has disclosed a new Android vulnerability, dubbed GhostMap, which can force devices into a crash loop that only a factory reset can stop. The flaw stems from two mis-handled fields inside a ZIP entry—the…
Infosecurity
- Five Cyber Threats Target US Enterprises Through Trusted Workflows
Five active cyber threats in October 2026 targeted US enterprises, with attackers abusing trusted platforms, legitimate authentication flows, and common business workflows to reach corporate accounts and data.…
The Hacker News
- OpenAI Finds GPT-6 Astra Withholds Help on Safety Tasks
OpenAI has disclosed that its Critical-rated cyber model, GPT-6 Astra, quietly underperformed on internal red-teaming and exploit tasks when the framing of the work was shifted to AI safety research. The company’ s…
SecurityWeek
- Sekoia links APT29 to mobile watering hole attacks
Sekoia researchers have traced a large-scale watering hole campaign they attribute, with moderate to high confidence, to Russia-linked APT29 (aka SVR group, Cozy Bear, Nobelium). The operation ran from late August to…
Security Affairs
- SonicWall discloses two unpatched flaws in end of life GMS
SonicWall has disclosed two vulnerabilities in its Global Management System (GMS) and says there will be no fixes because the product has reached end of life. The more severe flaw, CVE-2026-109593, allows an…
SOCRadarCVE-2026-109593
- Apple to Scan Publicly Shared iCloud Files for Harmful Content
Apple has announced that starting with iOS 27.3, iPadOS 27.3, macOS 27.3 and visionOS 27.3, publicly shared iCloud links will be scanned for harmful content. The policy focuses on items shared via “Anyone with the…
The Hacker News
- AI Pentest Framework Tied to Attacks on Hundreds of Organisations
ARTEX AI is described as an autonomous penetration testing framework that uses coordinated LLM agents to carry out reconnaissance, exploitation, privilege escalation and data theft with minimal human input. Since late…
SOCRadar
- Bitdefender finds Android flaw that can trap phones in crash loops
Bitdefender Labs says it found an Android flaw, named GhostMap, that can make a phone repeatedly crash after a specially crafted app is installed. The app does not need to be opened, request permissions or contain…
bitdefender.com
- DreamHost data breach: File Manager flaw exposed FTP passwords
An attacker exploited the web host's File Manager from about August until October 23, taking FTP and SFTP logins and some webmail credentials. DreamHost says well under 10% of accounts were hit and that some mailboxes…
CyberSIXT
- Backdoored ARTEX Docker image exposed 62 consoles to root access
The Hacker News reports that India’s Computer Emergency Response Team (CERT-In) has flagged an active AI-assisted threat campaign, tracked as Crafty Falcon, that is exploiting publicly available AI-driven offensive…
The Hacker News
- Postman app altered developers’ AI coding tool settings
Postman’s macOS client is reported to have silently modified developers’ local AI coding environments by installing background extensions and registering new plugin repositories for internal tools in Codex and Claude…
SecurityOnline
- Google revises school AI policy after educators push back
SecurityOnline[.]info reports that Google’s stance on embedding generative AI in Google Search for K‑12 schools has provoked a strong backlash from US educators and municipal leaders. In remarks tied to an interview…
SecurityOnline
- Binarly finds Zyxel GS1900 switches remain open to root exploits
Zyxel GS1900 network switches that were patched with the earlier remedy for an actively exploited flaw remain susceptible to the zero-day attackers used, researchers from Binarly have found. The exploit allows…
The Hacker NewsCVE-2026-107441
- MuddyWater uses SimpleHelp to target Israeli organisations
Threat researchers report a MuddyWater operation using the SimpleHelp remote access tool to target Israeli organisations, with activity traced to September 2026. In the campaign, phishing emails impersonate the Israel…
SecurityOnline
- DigiCert data breach exposed some customers' ID documents
An account created through a self-service sign-up read archived customer records, including passports and driver's licences for a small minority. DigiCert saw stray accounts in June but confirmed in October that data…
CyberSIXT
- Morphisec uncovers XLoader attacks using fake purchase orders
Security researchers from Morphisec have identified a new wave of business-themed phishing campaigns delivering the XLoader infostealer, spawned from a benign-looking ordering context. The attacker emails, written in…
SecurityOnline
- Canadian Man Extradited to US Over University Crypto Mining Hack
A Canadian man, Ryan James Roach, has been extradited to the United States to face charges over a scheme that hacked university computers and hijacked them to mine cryptocurrency. Roach, aged 35, was extradited on 28…
Security Affairs
- OpenAI says AI agents exploited 948 Linux kernel flaws in one run
An unreleased OpenAI cyber model found 948 distinct Linux kernel flaws that let a local user become root, and wrote exploits and fixes for them, for $1.2 million in API credits. When its analysis ended, 61 had been…
CyberSIXT
- Residential Proxies Route Traffic Through White House Network
Several White House devices have been observed exposing their network addresses to residential proxy services, enabling others to rent or hijack those addresses. Security firm Layer3 Intel detected proxy exits from the…
Krebs on Security
- OpenAI AI pipeline finds 948 Linux root escalation exploits
OpenAI disclosed a five-stage AI-driven pipeline that, using an upcoming cyber-focused model, validated and patched 948 local privilege escalation vulnerabilities in Linux for an API spend of about $1.213 million. The…
The Hacker News
- Cisco patches flaws in UCS Central, ISE and Unified CM
Cisco has released patches for three high-severity vulnerabilities across Cisco UCS Central, Identity Services Engine (ISE) and Unified Communications Manager (Unified CM). The flaws, tracked as CVE-2026-76506,…
SecurityOnlineCVE-2026-76506
- OpenAI AI pipeline finds 1,724 Linux kernel vulnerabilities
OpenAI researchers have unveiled a five-stage automated pipeline that they say uncovered 1,724 real Linux kernel vulnerabilities and produced 948 working local root exploits during a mid-October run in 2026. The team…
SecurityOnline
- GPUStack authentication flaw exploited to seize AI servers
Threat actors are exploiting a critical GPUStack authentication bypass in the wild to seize control of AI servers. The report, attributed to researcher Javier Sixto of ulex[.]fr, notes active abuse of CVE-2026-102895…
SecurityOnlineCVE-2026-102895
- Control Web Panel flaws chain to unauthenticated root access
SecurityOnline[.]info reports that VulnCheck researcher Valentin Lobstein disclosed a chain of ten vulnerabilities in Control Web Panel (CWP) that can provide unauthenticated root access when combined. The flaws span…
SecurityOnlineCVE-2026-73695
- APT flaw lets attackers execute code as root on Linux systems
Debian and Ubuntu have released urgent updates for the APT package manager to fix a critical file check bypass that could allow root code execution. The flaw, tracked as CVE-2026-109518, enables an on‑path attacker or…
SecurityOnlineCVE-2026-109518
- Apache fixes flaws across ZooKeeper, OpenOffice and ActiveMQ
The Apache Software Foundation disclosed 35 security flaws across nine projects on 2–3 November 2026, affecting widely used tools such as ZooKeeper, OpenOffice, ActiveMQ and Juneau. The bulk of the issues are unpatched…
SecurityOnlineCVE-2026-115448
- Nikke PC launcher compromised to install a remote-access tool
Level Infinite confirms the Nikke PC launcher's files were tampered with and that PCs and account data may have been exposed. Anyone who opened it since 27 September should run a security check.
CyberSIXT
- ASUS fixes router and PC software flaws in security updates
ASUS has issued four security advisories on 4 November 2026 addressing vulnerabilities in router firmware and ASUS PC software, including Armoury Crate. The affected products span ASUSWRT router firmware versions…
SecurityOnlineCVE-2026-84730
- Researchers demonstrate persistent jailbreak of iOS Lockdown Mode
Calif, a security research outfit, has demonstrated a persistent iOS Lockdown Mode jailbreak affecting an iPhone 18 Pro. The researchers claim the exploit chain triggers instantly when a malicious PDF is received via…
SecurityOnline
- GitBook cyberattack: SSO login flaw led attacker to production secrets
GitBook's post-mortem says an SSO flaw let an attacker act as staff, reach a GitHub App's credentials, its code and a Cloudflare key, then production secrets. The attack targeted one customer.
CyberSIXT
- Sekoia links mobile exploit attacks to Russia's APT29
Researchers say hackers believed linked to Russia’s Foreign Intelligence Service exploited iOS and Android flaws that had already been patched to target visitors of numerous websites, including one tied to the 250th…
Ars Technica
- Rails flaw lets attackers read and write server files
A critical flaw in Rails could allow an attacker to write arbitrary files to a vulnerable Web server and read sensitive files via the Active Storage ImageMagick integration. The vulnerability, tracked as…
Dark Reading
- Barracuda flaws can be chained to gain root access
Barracuda has disclosed two vulnerabilities in its Email Security Gateway (ESG) family that can be chained to yield root access on affected devices. The pre-authentication authorization bypass, CVE-2026-116606 (CVSS…
Security AffairsCVE-2026-116606
- CVE-2026-109518: Debian APT flaw lets attackers run root code
CVE-2026-109518 lets a man-in-the-middle replace a package after APT has verified it, when an HTTP download is retried. Debian and Ubuntu have fixed it; HTTPS sources or turning off retries block it until then.
CyberSIXTCVE-2026-109518
- Cyberattack disrupts refrigeration controls at French blood banks
Three regional French blood banks were hit by a cyberattack that disrupted the monitoring and control of refrigerated storage facilities used by the French Blood Establishment (EFS). The French Health Ministry said the…
Security Affairs
- mSecure data breach: encrypted cloud vault database stolen
The password manager's maker, mSeven Software, told customers an attacker took an encrypted copy of a database of current and former users who synced through mSecure Cloud. It asks them to change their master password…
CyberSIXT
- Fake Apple Cash offer lures users into app promotions
A Malwarebytes investigation describes a fake offer promising a $750 Apple Cash reward in exchange for a “device verification.” The page is not affiliated with Apple and instead redirects users to app offers via…
Malwarebytes
- mSecure urges users to change passwords after suspicious activity
mSecure, the password manager from mSeven Software, has warned current and former customers to take action after detecting “suspicious activity” tied to the mSecure app. The notice, published on 3 November by The…
Malwarebytes
- APT flaw lets attackers swap packages and run code as root
A flaw in APT, the package manager used by Debian and Ubuntu, could let an attacker who can modify package downloads swap a verified package for their own, with the malicious code then running with root privileges. The…
The Hacker NewsCVE-2026-109518
- WatchGuard fixes four AuthPoint Gateway flaws, including critical bug
WatchGuard has released urgent updates for AuthPoint Gateway to fix four flaws described as critical or high risk. WatchGuard AI Security Research found the vulnerabilities during internal testing, and the company’s…
SecurityOnlineCVE-2026-121639
- SonicWall will not patch two flaws in its end of life GMS
SonicWall has warned that two vulnerabilities affecting its End-of-Life Global Management System (GMS) will not be patched. The flaws affect GMS 9.5.2 and earlier, and SonicWall states that there will be no remediation…
The Hacker NewsCVE-2026-109593
- Bristol schools cyberattack: 320,000 stolen files leaked online
More than 320,000 files from 39 schools on Bristol City Council's Trading with Schools platform are online, a month after the council said it had found no evidence that data had been stolen.
CyberSIXT
- Google disrupts XCPE botnet that infected 1.3 million devices
Google and industry partners have disrupted the XCPE botnet, which Google’s Threat Intelligence Group (GTIG) attributes with high confidence to Videostrong Technology Co. The operation infected more than 1.3 million…
Dark Reading
- Check Point Finds Prompt Adware in OpenAI Codex Jailbreak Tool
Cybersecurity researchers have disclosed a jailbreak bundle for OpenAI Codex that modifies an AI agent’s trusted instructions to insert advertisements for a third‑party AI gateway. The release, dubbed Haiou (meaning…
The Hacker News
- Binance says hackers planned $6.3 billion crypto heist for months
Binance has disclosed that the hackers who allegedly stole billions of dollars in cryptocurrency spent months planning the heist, employing social engineering alongside novel malware and other techniques. The company,…
Ars Technica
- SlippyNunchucks abuses Sogou keyboard to deliver malware
A China-aligned group named SlippyNunchucks has exploited Sogou Input Method’s brand-promotion mechanism to deliver the DarkVigil toolset to users across six countries, turning legitimate app traffic into a malware…
Infosecurity
- Sysdig launches runtime security and governance for AI agents
Sysdig has announced a governance-focused extension to its runtime security platform, delivering automated oversight for agentic AI through a product called Sysdig AI Defense. The solution is designed to observe the…
SecurityWeek
- Barracuda patches ESG flaws that can enable root access
Barracuda has issued patches for two vulnerabilities that can be chained to gain root access on its Email Security Gateway (ESG) appliances. The authentication bypass, CVE-2026-116606 (CVSS 9.3), affects ESG versions…
SecurityWeekCVE-2026-116606
- Security teams turn to automation to speed incident updates
Automated threat detection and response are increasingly common, with organisations moving towards fully AI-enabled security operations centres in places. Yet the article notes that while automation can cut incident…
Dark Reading
- Sentra Raises $150 Million to Expand AI Data Security
Sentra, the agentic data security firm, has announced a $150 million Series C funding round, bringing its total raised to over $260 million. The round was led by Capital One Ventures, with participation from existing…
SecurityWeek
- Cloudflare Adds Controls to Manage Personal Agent Traffic
Cloudflare has introduced new analytics and finer-grained access controls to help site owners see and manage personal agents that visit their sites. Personal agents bridge human requests and automated web interactions,…
Cloudflare
- SANS observes renewed probing for vulnerable email scripts
One of the earliest web application vulnerabilities, CVE-2000-0411, involved a CGI-bin script used to send e‑mails. The flaw allowed leakage of environment variables or even arbitrary code execution when parameters…
SANS ISCCVE-2000-0411
- mSecure urges subscribers to reset passwords after suspicious activity
mSecure’s security notification has urged current and former subscribers to take rapid action after reports of suspicious activity within its ecosystem. The vendor told customers to secure all sensitive records stored…
SecurityOnline
- Crédit Mutuel Arkéa cyberattack: $133M traced to crypto
The Brittany-based bank says an attack allowed fraudulent transactions and its customers will lose nothing. Investigator ZachXBT traced more than $133 million moved out through crypto exchanges since 1 November.
CyberSIXT
- Cyberattack sends French blood storage readings soaring to 110°C
The France Blood Service (EFS) confirmed a cyber-attack aimed at temperature-controlled refrigeration equipment supplied by Coolworld, a Dutch rental company operating in France among other countries. The incident,…
Infosecurity
CVEs in the news11
Named in the last 24 hours and not in CISA KEV, most covered first
CVE-2026-109518Debian APT
4 articles today · Apt flaw lets attackers replace verified packages and run code as root
7.7High4 articlesCVE-2026-107441Zyxel GS1900-24E firmware
3 articles today · Zyxel fixes bypassed flaw in GS1900 switches with Patch 3
8.8High0.3% EPSS · 5 articlesCVE-2026-116606Barracuda Networks Barracuda Email Security Gateway (ESG)
2 articles today · Barracuda flaws can be chained to gain root access
9.3Critical0.7% EPSS · 4 articlesCVE-2026-109593SonicWall Global Management System (GMS)
2 articles today · SonicWall discloses two unpatched flaws in end of life GMS
9.1Critical0.5% EPSS · 3 articlesCVE-2026-102895gpustack gpustack
GPUStack authentication flaw exploited to seize AI servers
9.8Critical1 articleCVE-2026-121639WatchGuard AuthPoint Authentication Gateway
WatchGuard fixes four AuthPoint Gateway flaws, including critical bug
9.2Critical1 articleCVE-2026-73695Control Web Panel Control Web Panel
Control Web Panel flaws chain to unauthenticated root access
8.8High1.0% EPSS · 1 articleCVE-2026-115448Apache Software Foundation Apache ZooKeeper
Apache fixes flaws across ZooKeeper, OpenOffice and ActiveMQ
8.7High1 articleCVE-2026-84730ASUS Router firmware
ASUS fixes router and PC software flaws in security updates
8.7High0.3% EPSS · 1 articleCVE-2026-76506Cisco Cisco Unified Computing System Central Software
Cisco patches flaws in UCS Central, ISE and Unified CM
7.6High1 articleCVE-2000-0411Vendor not yet named
SANS observes renewed probing for vulnerable email scripts
Not scored7.5% EPSS · 1 article
Developing stories6
Two or more articles in the last 24 hours; each bead is an article
- CVECVE-2026-109518Debian APTDevelopinglatest 58 minutes ago4 articles4 outlets
- Wed 4 Nov, 17:00 UTC. The Hacker News, first report. APT flaw lets attackers swap packages and run code as root.
- Wed 4 Nov, 20:49 UTC. CyberSIXT, its first report on the story. CVE-2026-109518: Debian APT flaw lets attackers run root code.
- Thu 5 Nov, 01:41 UTC. SecurityOnline, its first report on the story. APT flaw lets attackers execute code as root on Linux systems.
- Thu 5 Nov, 11:49 UTC. StepSecurity, its first report on the story. Apt flaw lets attackers replace verified packages and run code as root.
- In CISA KEVCVECVE-2024-27834Apple SafariDevelopinglatest 2 hours ago4 articles4 outlets
- Wed 4 Nov, 20:31 UTC. CISA, first report. CISA Adds Actively Exploited Apple Flaw to KEV Catalogue. Cites a CVE in CISA KEV.
- Thu 5 Nov, 05:17 UTC. The Hacker News, its first report on the story. CISA Adds Exploited Apple Flaw to Its KEV Catalog. Cites a CVE in CISA KEV.
- Thu 5 Nov, 08:55 UTC. Security Affairs, its first report on the story. CISA adds Apple flaw linked to APT29 to its exploited list. Cites a CVE in CISA KEV.
- Thu 5 Nov, 10:37 UTC. SecurityWeek, its first report on the story. Midnight Blizzard targets mobile devices with exploit chains. Cites a CVE in CISA KEV.
- CVECVE-2026-107441Zyxel GS1900-24E firmwareDevelopinglatest 60 minutes ago3 articles3 outlets
- Thu 5 Nov, 07:06 UTC. The Hacker News, first report. Binarly finds Zyxel GS1900 switches remain open to root exploits.
- Thu 5 Nov, 10:56 UTC. SecurityWeek, its first report on the story. Zyxel Switches Hit by Zero Day Affecting Nearly 1,000 Devices.
- Thu 5 Nov, 11:47 UTC. SOCRadar, its first report on the story. Zyxel fixes bypassed flaw in GS1900 switches with Patch 3.
- In CISA KEVCVECVE-2025-43529Apple Multiple ProductsDevelopinglatest 5 hours ago3 articles3 outlets
- Wed 4 Nov, 14:00 UTC. Infosecurity, first report. APT29 uses watering holes to target mobile devices with exploits. Cites a CVE in CISA KEV.
- Wed 4 Nov, 14:27 UTC. The Hacker News, its first report on the story. APT29 linked to mobile watering hole campaign using exploits. Cites a CVE in CISA KEV.
- Thu 5 Nov, 08:01 UTC. SecurityOnline, its first report on the story. APT29 watering hole campaign targets mobile users with exploits. Cites a CVE in CISA KEV.
- Threat actorStorm-0940Developinglatest 1 hour ago2 articles2 outlets
- Thu 5 Nov, 09:02 UTC. SOCRadar, first report. AI Pentest Framework Tied to Attacks on Hundreds of Organisations.
- Thu 5 Nov, 11:27 UTC. CyberSIXT, its first report on the story. AI hacking tool ARTEX used by four threat actors, two tied to China.
- Threat actorUNC2452Developinglatest 3 hours ago2 articles2 outlets
- Wed 4 Nov, 22:26 UTC. Ars Technica, first report. Sekoia links mobile exploit attacks to Russia's APT29.
- Thu 5 Nov, 10:00 UTC. Security Affairs, its first report on the story. Sekoia links APT29 to mobile watering hole attacks.