Thu 12 Nov · updated 14:00 UTC
Today in security
Today’s briefing
Updated 10:55 UTC
New N-central zero-days work against N-able hotfix
1 update since 07:00 · latest 10:55 UTC
The researcher behind Able2Shell has published new exploits that work on N-able's Hotfix 2, for the server and for Windows agents and probes. N-able says the server flaw needs the non-default Legacy API and tells customers to disable it.
Known exploited27
CISA KEV entries named in the last 48 hours of coverage, by federal deadline
- In CISA KEV
gpustackCVE-2026-102895
Federal deadline 12 Nov · In CISA KEV since 9 Nov
9.8Critical0.6% EPSS7 articles
- In CISA KEV
signalwire freeswitchCVE-2026-116779
Federal deadline 12 Nov · In CISA KEV since 9 Nov
Not scored2.2% EPSS7 articles
- In CISA KEV
OpenSSHCVE-2026-123158
Federal deadline 12 Nov · In CISA KEV since 9 Nov
Not scored17% EPSS14 articles
- In CISA KEV
IBM Aspera FaspexCVE-2026-123218
Federal deadline 12 Nov · In CISA KEV since 9 Nov
9.8Critical0.7% EPSS5 articles
- In CISA KEV
Barracuda Networks Barracuda Email Security Gateway (ESG)CVE-2026-111560
Federal deadline 13 Nov · In CISA KEV since 10 Nov
8.6High1.1% EPSS9 articles
- In CISA KEV
Barracuda Networks Barracuda Email Security Gateway (ESG)CVE-2026-116606
Federal deadline 13 Nov · In CISA KEV since 10 Nov
9.3Critical1.6% EPSS9 articles
- In CISA KEV
Google ChromiumCVE-2026-125350
Federal deadline 24 Nov · In CISA KEV since 10 Nov
Not scored8 articles
- In CISA KEV
Microsoft 365 Apps for EnterpriseCVE-2026-124194
Federal deadline 24 Nov · In CISA KEV since 10 Nov
6.5Medium15 articles
- In CISA KEV
Openwave Messaging (Ireland) Limited Webtop Media TranscoderCVE-2026-111793
Federal deadline 24 Nov · In CISA KEV since 10 Nov
4.3Medium0.3% EPSS5 articles
- In CISA KEV
Cisco BroadWorksCVE-2026-20320
Federal deadline 24 Nov · In CISA KEV since 10 Nov
7.5High0.4% EPSS6 articles
Show 17 more · federal deadlines passed
- In CISA KEV
Google BrotliCVE-2026-111497
Federal deadline passed 10 Nov · In CISA KEV since 27 Oct
9.2Critical83% EPSS26 articles
- In CISA KEV
Cisco Secure Firewall Adaptive Security Appliance (ASA) SoftwareCVE-2026-76418
Federal deadline passed 1 Nov · In CISA KEV since 29 Oct
8.6High0.8% EPSS8 articles
- In CISA KEV
PHPCVE-2026-109618
Federal deadline passed 29 Oct · In CISA KEV since 26 Oct
9.2Critical99.9% EPSS57 articles
- In CISA KEV
PHPCVE-2026-109619
Federal deadline passed 29 Oct · In CISA KEV since 26 Oct
9.2Critical99.9% EPSS56 articles
- In CISA KEV
AhsayCBSCVE-2026-105133
Federal deadline passed 17 Oct · In CISA KEV since 14 Oct
7.5High84% EPSS10 articles
- In CISA KEV
AhsayCBSCVE-2026-105134
Federal deadline passed 17 Oct · In CISA KEV since 14 Oct
10.0Critical82% EPSS9 articles
- In CISA KEV
PTC Windchill and FlexPLMCVE-2026-12569
Federal deadline passed 28 Jun · In CISA KEV since 25 Jun · Used in ransomware campaigns
9.3Critical46% EPSS12 articles
- In CISA KEV
Palo Alto Networks PAN-OSCVE-2026-0257
Federal deadline passed 1 Jun · In CISA KEV since 29 May · Used in ransomware campaigns
7.8High96% EPSS28 articles
- In CISA KEV
Cisco Catalyst SD-WAN Controller and ManagerCVE-2026-20127
Federal deadline passed 27 Feb · In CISA KEV since 25 Feb
10.0Critical88% EPSS25 articles
- In CISA KEV
GNU InetUtilsCVE-2026-24061
Federal deadline passed 16 Feb · In CISA KEV since 26 Jan
9.8Critical99% EPSS11 articles
- In CISA KEV
Meta React Server ComponentsCVE-2025-55182
Federal deadline passed 12 Dec 2025 · In CISA KEV since 5 Dec 2025 · Used in ransomware campaigns
10.0Critical99.7% EPSS15 articles
- In CISA KEV
Qlik SenseCVE-2023-48365
Federal deadline passed 3 Feb 2025 · In CISA KEV since 13 Jan 2025 · Used in ransomware campaigns
9.6Critical48% EPSS1 article
- In CISA KEV
Veeam Backup & ReplicationCVE-2024-40711
Federal deadline passed 7 Nov 2024 · In CISA KEV since 17 Oct 2024 · Used in ransomware campaigns
9.8Critical90% EPSS1 article
- In CISA KEV
Palo Alto Networks PAN-OSCVE-2024-3400
Federal deadline passed 19 Apr 2024 · In CISA KEV since 12 Apr 2024 · Used in ransomware campaigns
10.0Critical99.9% EPSS2 articles
- In CISA KEV
Qlik SenseCVE-2023-41265
Federal deadline passed 28 Dec 2023 · In CISA KEV since 7 Dec 2023 · Used in ransomware campaigns
9.6Critical88% EPSS1 article
- In CISA KEV
Qlik SenseCVE-2023-41266
Federal deadline passed 28 Dec 2023 · In CISA KEV since 7 Dec 2023 · Used in ransomware campaigns
8.2High85% EPSS1 article
- In CISA KEV
Apache ActiveMQCVE-2023-46604
Federal deadline passed 23 Nov 2023 · In CISA KEV since 2 Nov 2023 · Used in ransomware campaigns
10.0Critical99.9% EPSS2 articles
Latest news65
The last 24 hours, newest first; stories about known exploited CVEs are above
Latest story at 13:12 UTC. Red diamonds mark the 3 stories about exploited CVEs.
- 13:12 UTC. Daylight raises $80 million to expand AI security platform. 1 outlet.
- 12:09 UTC. Google warns of AMD Turin CPU flaws that could leak data. 1 outlet.
- 12:02 UTC. Webinar shows how identity context can strengthen SOC responses. 1 outlet.
- 12:02 UTC. n0n ransomware operation lists 93 victims in five weeks. 1 outlet.
- 11:56 UTC. GPUStack Authentication Bypass Exploited in Scanning Attempts. 1 outlet. About an exploited CVE.
- 11:51 UTC. Researcher discloses new N-central flaws enabling root access. 1 outlet.
- 11:51 UTC. Material Security exposes Google Calendar phishing campaign. 1 outlet.
- 11:49 UTC. Microsoft adds SOCRadar threat intelligence to Sentinel. 1 outlet.
- 11:33 UTC. PTC patches Windchill and FlexPLM flaw enabling remote code execution. 1 outlet.
- 11:08 UTC. Notion AI chat transcripts exposed in Fireworks AI breach affecting under 1% of workspaces. 1 outlet.
- 11:00 UTC. AI Assisted Attack Enabled Rapid Lateral Movement at US Retailer. 1 outlet.
- 10:52 UTC. Pushpaganda abuses browser alerts to spread scams and ads. 1 outlet.
- 10:45 UTC. Symantec analyst urges firms to move beyond patching. 1 outlet.
- 10:39 UTC. Huntress Finds ScreenConnect Malware Campaign Hitting 288 Hosts. 1 outlet.
- 10:22 UTC. NIKKE game launcher used to deliver Lua information stealer. 1 outlet.
- 10:00 UTC. Kaspersky explains how cloud pentests can cross trust boundaries. 1 outlet.
- 10:00 UTC. NCSC launches cyber testing scheme to bolster UK resilience. 1 outlet.
- 09:25 UTC. Datadog researchers detail MongoDB flaw that can crash servers. 1 outlet.
- 09:23 UTC. Red Hat Quay flaw could expose private container images. 1 outlet.
- 09:03 UTC. Former FBI Supervisor Admits Stealing $2.47 Million in Crypto. 1 outlet.
- 08:20 UTC. Node.js fixes 16 flaws exposing servers to crashes and data leaks. 1 outlet.
- 07:30 UTC. Google publishes Linux kernel exploit for privilege escalation. 1 outlet.
- 07:30 UTC. StepSecurity uncovers GitHub Actions secret stealing campaign. 1 outlet.
- 07:01 UTC. PRODAFT uncovers BBNet Linux botnet with 11 exploits. 1 outlet. About an exploited CVE.
- 06:42 UTC. Aikido links hijacked GitHub accounts to CI secret stealer. 1 outlet.
- 06:10 UTC. Poland takes e-government platform offline after cyberattack. 1 outlet.
- 05:12 UTC. Apache fixes HTTP/2 flaw enabling unauthenticated remote code execution. 1 outlet.
- 04:55 UTC. Hijacked ConnectWise ScreenConnect panels push SCKit worm to 288 hosts. 1 outlet.
- 04:39 UTC. Huntress reports rogue ScreenConnect clients hit 48 organisations. 1 outlet.
- 03:59 UTC. eMudhra Revokes Eight RSA Intermediate Certificates. 1 outlet.
- 03:28 UTC. Nitori breach exposes data on 37.6 million customers. 1 outlet.
- 02:54 UTC. V12 demonstrates Android code execution flaw in Telegram. 1 outlet.
- 02:25 UTC. ConnectWise disables ScreenConnect extensions after intrusions. 1 outlet.
- 02:06 UTC. Google fixes five critical use-after-free flaws in Chrome. 1 outlet.
- 02:00 UTC. Apache fixes critical remote code flaw in mod_http2. 1 outlet.
- 01:00 UTC. OpenPrinting fixes pappl-retrofit flaw enabling root file access. 1 outlet.
- 01:00 UTC. Leaked documents detail Chinese AI surveillance of Taiwan chip sector. 1 outlet.
- 00:33 UTC. Zoho fixes eight ManageEngine flaws, including router command injection. 1 outlet.
- 00:00 UTC. Go releases fix build time code execution and HTTP flaws. 1 outlet.
- 00:00 UTC. Japan Approves ¥10 Billion Cybersecurity Emergency Package. 1 outlet.
- 23:00 UTC. Unit 42 warns attackers are using AI red teaming tools. 1 outlet.
- 21:44 UTC. Researchers uncover cloud attack chain targeting Flowise deployments. 1 outlet.
- 21:31 UTC. Arctic Wolf links AntiFox tool to IIS and AWS intrusions. 1 outlet.
- 21:20 UTC. Commvault executives warn AI is raising cyber resilience stakes. 1 outlet.
- 20:54 UTC. Vanderbilt tells everyone to shut down devices in active cyberattack. 1 outlet.
- 20:47 UTC. WhiteArmor claims theft of 100GB from Maersk and demands ransom. 3 outlets.
- 19:49 UTC. Microsoft warns attackers use GSocket relay tool to retain access to Linux servers. 1 outlet.
- 18:29 UTC. Vanderbilt restores systems after BYOD ransomware attack. 1 outlet.
- 18:06 UTC. Krebs traces Qilin ransomware boss to Russian cybercrime circles. 1 outlet.
- 17:41 UTC. Node.js fixes HTTP/2 and TLS flaws exposing data and keys. 1 outlet.
- 17:15 UTC. N-able patches N-central after 33 exploit proofs go public. 4 outlets.
- 16:55 UTC. Microsoft reports eight Linux kernel bugs enabled root exploits. 1 outlet.
- 16:30 UTC. VulnCheck says Anthropic's Glasswing fixed few reported flaws. 1 outlet.
- 16:12 UTC. Zoom fixes critical Windows flaws enabling remote privilege escalation. 2 outlets.
- 16:00 UTC. Check Point links three campaigns to suspected China malware supplier. 2 outlets.
- 15:42 UTC. Xen Orchestra flaws exploited to take over XCP-ng nodes. 1 outlet.
- 15:34 UTC. AntiFox platform linked to attacks stealing AWS production secrets. 1 outlet.
- 15:00 UTC. Unit 42 uncovers browser based Falcon campaign targeting governments. 1 outlet.
- 14:54 UTC. Telegram fixes Android flaw that turned a message into code execution. 1 outlet.
- 14:32 UTC. Apache fixes HTTP/2 flaw that could enable remote code execution. 1 outlet.
- 14:13 UTC. SOCRadar expands MCP server with 126 tools for security teams. 1 outlet. About an exploited CVE.
- Known exploited CVE
- CVE not in KEV
- Other story
- Size: outlets on the story
- Stories an hour
Show as tableHide table
| Time (UTC) | Story | Outlets | Type |
|---|---|---|---|
| 13:12 | Daylight raises $80 million to expand AI security platform | 1 | Other |
| 12:09 | Google warns of AMD Turin CPU flaws that could leak data | 1 | CVE |
| 12:02 | Webinar shows how identity context can strengthen SOC responses | 1 | Other |
| 12:02 | n0n ransomware operation lists 93 victims in five weeks | 1 | Other |
| 11:56 | GPUStack Authentication Bypass Exploited in Scanning Attempts | 1 | Known exploited |
| 11:51 | Researcher discloses new N-central flaws enabling root access | 1 | CVE |
| 11:51 | Material Security exposes Google Calendar phishing campaign | 1 | Other |
| 11:49 | Microsoft adds SOCRadar threat intelligence to Sentinel | 1 | Other |
| 11:33 | PTC patches Windchill and FlexPLM flaw enabling remote code execution | 1 | CVE |
| 11:08 | Notion AI chat transcripts exposed in Fireworks AI breach affecting under 1% of workspaces | 1 | Other |
| 11:00 | AI Assisted Attack Enabled Rapid Lateral Movement at US Retailer | 1 | Other |
| 10:52 | Pushpaganda abuses browser alerts to spread scams and ads | 1 | Other |
| 10:45 | Symantec analyst urges firms to move beyond patching | 1 | Other |
| 10:39 | Huntress Finds ScreenConnect Malware Campaign Hitting 288 Hosts | 1 | Other |
| 10:22 | NIKKE game launcher used to deliver Lua information stealer | 1 | Other |
| 10:00 | Kaspersky explains how cloud pentests can cross trust boundaries | 1 | Other |
| 10:00 | NCSC launches cyber testing scheme to bolster UK resilience | 1 | Other |
| 09:25 | Datadog researchers detail MongoDB flaw that can crash servers | 1 | CVE |
| 09:23 | Red Hat Quay flaw could expose private container images | 1 | CVE |
| 09:03 | Former FBI Supervisor Admits Stealing $2.47 Million in Crypto | 1 | Other |
| 08:20 | Node.js fixes 16 flaws exposing servers to crashes and data leaks | 1 | CVE |
| 07:30 | Google publishes Linux kernel exploit for privilege escalation | 1 | CVE |
| 07:30 | StepSecurity uncovers GitHub Actions secret stealing campaign | 1 | Other |
| 07:01 | PRODAFT uncovers BBNet Linux botnet with 11 exploits | 1 | Known exploited |
| 06:42 | Aikido links hijacked GitHub accounts to CI secret stealer | 1 | Other |
| 06:10 | Poland takes e-government platform offline after cyberattack | 1 | Other |
| 05:12 | Apache fixes HTTP/2 flaw enabling unauthenticated remote code execution | 1 | CVE |
| 04:55 | Hijacked ConnectWise ScreenConnect panels push SCKit worm to 288 hosts | 1 | Other |
| 04:39 | Huntress reports rogue ScreenConnect clients hit 48 organisations | 1 | Other |
| 03:59 | eMudhra Revokes Eight RSA Intermediate Certificates | 1 | Other |
| 03:28 | Nitori breach exposes data on 37.6 million customers | 1 | Other |
| 02:54 | V12 demonstrates Android code execution flaw in Telegram | 1 | Other |
| 02:25 | ConnectWise disables ScreenConnect extensions after intrusions | 1 | Other |
| 02:06 | Google fixes five critical use-after-free flaws in Chrome | 1 | CVE |
| 02:00 | Apache fixes critical remote code flaw in mod_http2 | 1 | Other |
| 01:00 | OpenPrinting fixes pappl-retrofit flaw enabling root file access | 1 | CVE |
| 01:00 | Leaked documents detail Chinese AI surveillance of Taiwan chip sector | 1 | Other |
| 00:33 | Zoho fixes eight ManageEngine flaws, including router command injection | 1 | CVE |
| 00:00 | Go releases fix build time code execution and HTTP flaws | 1 | CVE |
| 00:00 | Japan Approves ¥10 Billion Cybersecurity Emergency Package | 1 | Other |
| 23:00 | Unit 42 warns attackers are using AI red teaming tools | 1 | Other |
| 21:44 | Researchers uncover cloud attack chain targeting Flowise deployments | 1 | CVE |
| 21:31 | Arctic Wolf links AntiFox tool to IIS and AWS intrusions | 1 | Other |
| 21:20 | Commvault executives warn AI is raising cyber resilience stakes | 1 | Other |
| 20:54 | Vanderbilt tells everyone to shut down devices in active cyberattack | 1 | Other |
| 20:47 | WhiteArmor claims theft of 100GB from Maersk and demands ransom | 3 | Other |
| 19:49 | Microsoft warns attackers use GSocket relay tool to retain access to Linux servers | 1 | CVE |
| 18:29 | Vanderbilt restores systems after BYOD ransomware attack | 1 | Other |
| 18:06 | Krebs traces Qilin ransomware boss to Russian cybercrime circles | 1 | Other |
| 17:41 | Node.js fixes HTTP/2 and TLS flaws exposing data and keys | 1 | CVE |
| 17:15 | N-able patches N-central after 33 exploit proofs go public | 4 | CVE |
| 16:55 | Microsoft reports eight Linux kernel bugs enabled root exploits | 1 | CVE |
| 16:30 | VulnCheck says Anthropic's Glasswing fixed few reported flaws | 1 | Other |
| 16:12 | Zoom fixes critical Windows flaws enabling remote privilege escalation | 2 | CVE |
| 16:00 | Check Point links three campaigns to suspected China malware supplier | 2 | Other |
| 15:42 | Xen Orchestra flaws exploited to take over XCP-ng nodes | 1 | Other |
| 15:34 | AntiFox platform linked to attacks stealing AWS production secrets | 1 | Other |
| 15:00 | Unit 42 uncovers browser based Falcon campaign targeting governments | 1 | Other |
| 14:54 | Telegram fixes Android flaw that turned a message into code execution | 1 | Other |
| 14:32 | Apache fixes HTTP/2 flaw that could enable remote code execution | 1 | CVE |
| 14:13 | SOCRadar expands MCP server with 126 tools for security teams | 1 | Known exploited |
- Daylight raises $80 million to expand AI security platform
SecurityWeek reports that Israeli-American cybersecurity startup Daylight has raised $80 million in a Series B funding round, bringing its total funding to $120 million. The round was led by Goldman Sachs Alternatives’…
SecurityWeek
- Zoom fixes Windows flaws enabling unauthorised privilege escalation
Zoom has released security updates for Zoom Workplace on Windows to fix two flaws, one of which is classified as critical and could allow unauthenticated remote privilege escalation. The two vulnerabilities are…
Security AffairsCVE-2026-108186
- Google warns of AMD Turin CPU flaws that could leak data
Google Cloud has warned that three Transient Scheduler Attacks (TSA) affecting AMD’s Zen 5-based Turin processors could enable a guest VM to infer data from other processes or the kernel, even when mitigations exist…
The Hacker NewsCVE-2024-36350
- Webinar shows how identity context can strengthen SOC responses
The Hacker News reports on a webinar hosted to address what it calls a critical blind spot in security operations: the lack of identity context when analysing alerts. The piece argues that SOCs are drowning in alerts,…
The Hacker News
- n0n ransomware operation lists 93 victims in five weeks
SOCRadar’s Dark Web Profile on n0n Ransomware details a financially motivated data-exfiltration and destructive-extortion operation that emerged on the Dark Web in September 2026. In roughly five weeks, the group…
SOCRadar
- Researcher discloses new N-central flaws enabling root access
N-able said on 12 November 2026 that a new public disclosure alleges additional vulnerabilities in on‑premise versions of N‑central running version 2026.4.1 HF2. The company explained that the server issue described…
The Hacker NewsCVE-2026-90436
- Material Security exposes Google Calendar phishing campaign
Security researchers from Material Security have exposed a calendar-based phishing campaign that has been stealing live Google sessions from corporate users since mid‑August 2026. The operation, dubbed Operation…
The Hacker News
- Microsoft adds SOCRadar threat intelligence to Sentinel
SOCRadar has been named among the new and enhanced Microsoft Sentinel connectors announced for Ignite 2026, with the SOCRadar Alerts Azure Sentinel Directional Solution highlighted as a partner connector in an…
SOCRadar
- PTC patches Windchill and FlexPLM flaw enabling remote code execution
PTC says it has issued patches for a critical remote code execution flaw affecting Windchill and FlexPLM, tracked as CVE-2026-126325, with a CVSS v4 score of 9.2. The vulnerability stems from improper input validation…
The Hacker NewsCVE-2026-126325
- Notion AI chat transcripts exposed in Fireworks AI breach affecting under 1% of workspaces
Notion has informed a small number of customers that their information was compromised in a data breach involving Fireworks AI, a cloud platform used to run and fine-tune open‑source AI models. SecurityWeek's coverage…
SecurityWeek
- AI Assisted Attack Enabled Rapid Lateral Movement at US Retailer
A US retailer was the target of an AI-assisted cyberattack in September, according to Symantec’s post-incident analysis shared by Dark Reading. After hand-typed commands were repeatedly blocked, the threat actor used…
Dark Reading
- N-able N-central hotfix hit by new public zero-day exploits
Two days after N-able shipped Hotfix 2 for the Able2Shell flaws, the same researcher published new exploits that work against it, for the server and for Windows agents and probes. N-able says the server flaw needs the…
CyberSIXTCVE-2026-125883
- Pushpaganda abuses browser alerts to spread scams and ads
Two investigations into deceptive web prompts show how simply granting a browser notification can turn a short visit into ongoing advertising and fraud opportunities for scammers. Malwarebytes’ own research into…
Malwarebytes
- Symantec analyst urges firms to move beyond patching
Dick O’Brien, principal intelligence analyst at Symantec, told IRISSCON 2026 in Dublin that organisations cannot patch their way out of the AI era and must shift to mitigation after exploitation. He highlighted the…
Infosecurity
- Huntress Finds ScreenConnect Malware Campaign Hitting 288 Hosts
A fresh campaign targeting ScreenConnect customers has seen attackers compromise hundreds of endpoints by abusing a vulnerability in a third‑party extension called RMM+. Huntress reports that the activity was observed…
SecurityWeek
- NIKKE game launcher used to deliver Lua information stealer
Bitdefender researchers say attackers used Goddess of Victory: NIKKE’s legitimate PC launcher to deliver a Lua-based information stealer, dubbed k2f-agent. The campaign did not alter the game’s files or exploit a…
bitdefender.com
- Kaspersky explains how cloud pentests can cross trust boundaries
Kaspersky Security Services researchers say cloud penetration tests should focus on whether an attacker can cross trust boundaries, rather than simply finding open ports or achieving code execution. They divide cloud…
securelist.com
- NCSC launches cyber testing scheme to bolster UK resilience
The National Cyber Security Centre (NCSC) has formally launched its Cyber Adversary Simulation (CyAS) scheme to help providers of critical infrastructure test and strengthen their cyber resilience. First trialled at…
Infosecurity
- Attackers Probe N-able N-central Zero-Days After Disclosure
SecurityWeek reports that attackers have begun actively probing N-able N-central installations after researcher Sean Bales released details and PoCs for more than 30 zero-days, dubbed Able2Shell. N-able subsequently…
SecurityWeekCVE-2026-125883
- Datadog researchers detail MongoDB flaw that can crash servers
MongoDB has disclosed a critical pre-authentication vulnerability, CVE-2026-118383, that can cause a crash on a primary when a failover occurs in a replica set. The flaw, described as a use-after-free bug, can be…
The Hacker NewsCVE-2026-118383
- Red Hat Quay flaw could expose private container images
A critical vulnerability in Red Hat Quay could allow attackers to access private container images, replace repository content and maintain persistent access across an affected registry. The flaw, tracked as…
SecurityWeekCVE-2026-123710
- Former FBI Supervisor Admits Stealing $2.47 Million in Crypto
A former FBI supervisor has pled guilty to stealing about $2.47 million in cryptocurrency from wallets linked to 35 FBI investigations, including crypto tied to adversarial nation-state actors. The theft began no later…
Malwarebytes
- Maersk discloses breach after extortion group demands $5m
Maersk has disclosed a data breach affecting one of its IT systems after an extortion group claimed to have stolen 100GB of logistics-related data. In a statement dated 11 November, Maersk said it “identified…
Infosecurity
- Maersk confirms data theft after $5 million extortion attempt
Maersk has confirmed that data was extracted from a system inherited through an earlier acquisition, though the company has not named the acquired business. In a statement dated 11 November, the Danish shipping giant…
SecurityWeek
- Node.js fixes 16 flaws exposing servers to crashes and data leaks
On 12 November 2026 The Hacker News reports that Node.js released fixes for 16 vulnerabilities affecting its core HTTP/2, HTTPS and TLS code across the three supported release lines: 22.x, 24.x and 26.x. The company…
The Hacker NewsCVE-2026-123863
- Google publishes Linux kernel exploit for privilege escalation
CVE-2026-80521: Linux kernel AF_UNIX use-after-free privilege escalation has been fixed in the 7.1.10 stable line, with upstream patches also backported to several older stable branches. The issue is a use-after-free…
SecurityOnlineCVE-2026-80521
- StepSecurity uncovers GitHub Actions secret stealing campaign
StepSecurity researchers report that starting on 10 November 2026, a coordinated botnet of compromised GitHub accounts began using stolen tokens to push a CI secret stealer, named wfx, into every repository those…
StepSecurity
- Aikido links hijacked GitHub accounts to CI secret stealer
An attacker leveraged credentials for 4,837 hijacked GitHub accounts to deploy a secret stealer in repositories those accounts could write to, according to Aikido Security. The stealer is designed to exfiltrate secrets…
The Hacker News
- Check Point links three espionage campaigns to CopperDragon
Check Point Research has linked three ostensibly distinct cyber‑espionage campaigns—SilentDelivery, OceanGate and DarkWire—into a single cross‑platform toolkit driven by the CopperDragon Sparrow framework. The firms…
SecurityOnline
- Poland takes e-government platform offline after cyberattack
Poland has temporarily taken its national e-government platform, ePUAP, offline after detecting and halting a cyberattack, according to an article by Security Affairs dated 12 November 2026. The disruption means ePUAP…
Security Affairs
- Apache fixes HTTP/2 flaw enabling unauthenticated remote code execution
A critical remote code execution flaw in Apache HTTP Server’s HTTP/2 module, mod_http2, could allow unauthenticated attackers to run code on affected servers. Tracked as CVE-2026-119618, the vulnerability affects…
The Hacker NewsCVE-2026-119618
- Hijacked ConnectWise ScreenConnect panels push SCKit worm to 288 hosts
A threat actor used cloud-hosted ScreenConnect panels to install rogue clients and a toolkit Huntress calls the SCKit worm on 288 hosts at 48 organisations. ConnectWise disabled five third-party extensions in 400…
CyberSIXT
- Huntress reports rogue ScreenConnect clients hit 48 organisations
Huntress has reported that rogue ScreenConnect clients are being deployed across managed environments after attackers gained access to cloud-hosted ScreenConnect panels. The activity, first observed on 11 November…
The Hacker News
- eMudhra Revokes Eight RSA Intermediate Certificates
Daily CyberSecurity reports that Indian certificate authority eMudhra has extended its certificate revocation to include eight additional RSA intermediate certificates. The piece attributes the remediation to the same…
SecurityOnline
- Nitori breach exposes data on 37.6 million customers
Nitori says a cyberattack on 9 November 2026 breached its management servers, exposing up to 37.6 million records. The incident targets both individual customers and enterprise buyers, with personal data including…
SecurityOnline
- V12 demonstrates Android code execution flaw in Telegram
Security firm V12 demonstrated an Android remote code execution (RCE) flaw in Telegram via a video showing a message from a Telegram bot enabling code to run on the device, with the phone’s Calculator app launching as…
SecurityOnline
- ConnectWise disables ScreenConnect extensions after intrusions
On 11 November 2026, ConnectWise disabled five third‑party ScreenConnect extensions in around 400 partner environments after reports of unauthorized access to ScreenConnect partner accounts. ConnectWise says the…
SecurityOnline
- Google fixes five critical use-after-free flaws in Chrome
Google has released Chrome 157.0.8103.78 for Windows and macOS (and 157.0.8103.78 for Linux), addressing a large set of security fixes in a single stable-channel update. The firm says the release patches 83…
SecurityOnlineCVE-2026-126885
- Apache fixes critical remote code flaw in mod_http2
Apache today released a security update fixing a critical remote code execution vulnerability in mod_http2. The flaw arises during stream processing in the assign_headers function, where a heap overflow could be…
SANS ISC
- OpenPrinting fixes pappl-retrofit flaw enabling root file access
OpenPrinting has fixed a publicly disclosed path traversal vulnerability in pappl-retrofit, tracked as CVE-2026-123747, after researchers published full details and a proof-of-concept exploit. The flaw, rated CVSSv3…
SecurityOnlineCVE-2026-123747
- Leaked documents detail Chinese AI surveillance of Taiwan chip sector
Dark Reading reports that leaked documents describe a Chinese government programme that uses AI-powered big‑data mining to monitor overseas ethnic-Chinese communities and identify individuals who could be useful for…
Dark Reading
- Zoho fixes eight ManageEngine flaws, including router command injection
Daily CyberSecurity reports that Zoho has fixed eight high-severity ManageEngine vulnerabilities affecting DDI Central and ADAudit Plus, with patches issued on 10 and 11 November 2026. The firm notes six flaws impact…
SecurityOnlineCVE-2026-12573
- Go releases fix build time code execution and HTTP flaws
Go 1.27.4 and 1.26.11 have been released on 10 November 2026 to fix 12 security flaws, eleven of which target the Go toolchain and specifically mitigate build-time code execution via cgo. A malicious Go package could…
SecurityOnlineCVE-2026-97033
- Japan Approves ¥10 Billion Cybersecurity Emergency Package
Japan has approved a ¥10 billion emergency cybersecurity package aimed at bolstering rapid response capabilities and shoring up critical infrastructure as AI-assisted breaches rise, according to Dark Reading. The plan…
Dark Reading
- Unit 42 warns attackers are using AI red teaming tools
Unit 42 reports that a rapidly expanding ecosystem of AI-enabled red‑teaming and penetration testing tools, including ARTEX and CyberStrikeAI, is being used by attackers to execute autonomous offensive operations.…
Unit 42
- Researchers uncover cloud attack chain targeting Flowise deployments
Researchers from Era Security have revealed a broad, multi-stage cloud attack chain dubbed “Greeter”, which began as a Shodan-led discovery of exposed Flowise deployments and quickly evolved into a sophisticated AI…
Dark ReadingCVE-2024-58351
- Arctic Wolf links AntiFox tool to IIS and AWS intrusions
Arctic Wolf Labs has published findings that attackers are weaponising AntiFox, an open‑source, agentic penetration testing platform, to target IIS servers and AWS accounts. The research notes that Alibaba Cloud…
Security Affairs
- Commvault executives warn AI is raising cyber resilience stakes
At Commvault’s SHIFT 2026 conference in Nashville, executives argued that operational resilience must move from a last-resort response to a continuous discipline, as AI-driven threats and increasingly autonomous…
Dark Reading
- Vanderbilt tells everyone to shut down devices in active cyberattack
Vanderbilt University, hit by a cyberattack on 9 November, has restored WiFi, email and some core services but says full recovery may take weeks. A BYOD ransom note has been photographed on a university computer.
CyberSIXT
- WhiteArmor claims theft of 100GB from Maersk and demands ransom
Maersk confirmed an IT security incident involving unauthorised access and data extraction from a local legacy system inherited from a prior acquisition. In a statement issued on 11 November 2026, the company said the…
Security Affairs
- N-able takes N-central offline after 33 flaws are disclosed
N-able has taken its N-central remote monitoring and management platform offline after the discovery of 33 alleged zero-day flaws. The company moved hosted N-central environments offline across the Americas, Europe and…
Dark ReadingCVE-2026-125883
- Microsoft warns attackers use GSocket relay tool to retain access to Linux servers
Microsoft has detailed new activity around GSocket, an open-source remote access tool observed on compromised Linux servers, used by threat actors to maintain access after initial vulnerabilities are remediated. Once…
MicrosoftCVE-2026-43284
- Vanderbilt restores systems after BYOD ransomware attack
Vanderbilt University is restoring campus systems after a cyberattack attributed to the BYOD ransomware group. The attackers claim they encrypted databases and obtained personal data including more than one million…
Malwarebytes
- Krebs traces Qilin ransomware boss to Russian cybercrime circles
The ransomware group Qilin, described by KrebsOnSecurity as the world’s most active affiliate program, has been operating since September 2022 and reportedly recruited affiliates by offering at least 80 per cent of…
Krebs on Security
- Node.js fixes HTTP/2 and TLS flaws exposing data and keys
The Node.js project released security updates 26.13.1, 24.22.3 and 22.23.5, addressing 17 vulnerabilities across the 26.x, 24.x and 22.x lines. The majority are HTTP/2 and TLS memory-leak flaws that can allow an…
SecurityOnlineCVE-2026-123828
- N-able patches N-central after 33 exploit proofs go public
N-able has issued what it calls a critical security hotfix for its N-central platform after Sean Bales published a repository of 33 alleged zero-days with PoC code. The company released N-central 2026.4 Hotfix 2, build…
InfosecurityCVE-2026-125883
- Microsoft reports eight Linux kernel bugs enabled root exploits
Microsoft’s FORGE Lab, with Cen Zhang, reports that its MDASH scanning of Linux kernel subsystems from late May to mid‑June 2026 generated 26,502 raw findings in about two weeks, which were narrowed to 11,769…
MicrosoftCVE-2026-64563
- VulnCheck says Anthropic's Glasswing fixed few reported flaws
Anthropic’s Glasswing programme has yielded a vast number of vulnerability findings but delivered relatively few fixes, according to vulnerability researcher Patrick Garrity of VulnCheck. Garrity’s November 9 update on…
Infosecurity
- Zoom fixes critical Windows flaws enabling remote privilege escalation
Zoom has released fixes for two critical flaws in Zoom Workplace for Windows that could allow unauthenticated remote privilege escalation. The vulnerabilities, CVE-2026-108186 and CVE-2026-108187, both involve…
The Hacker NewsCVE-2026-108186
- Check Point links three campaigns to suspected China malware supplier
Three China-nexus intrusion campaigns across Latin America, Asia and Europe have been linked by Check Point Research (CPR) through shared malware and infrastructure to a possible common supplier of hacking tools, CPR’s…
Infosecurity
- Xen Orchestra flaws exploited to take over XCP-ng nodes
SecurityWeek reports that a critical vulnerability in Xen Orchestra has been exploited to bypass authentication and gain full administrative control over XCP-ng nodes. The flaw affects the REST authentication flow: an…
SecurityWeek
- AntiFox platform linked to attacks stealing AWS production secrets
Cybersecurity researchers have disclosed a campaign in which an AI-driven autonomous pentesting platform named AntiFox has been used to steal AWS credentials and pivot into production environments. Arctic Wolf Labs…
The Hacker News
- Unit 42 uncovers browser based Falcon campaign targeting governments
Unit 42 has tracked Falcon, also known as XG or Xiàng Gē, a browser-native C2 framework that compromises visitors’ web browsers by injecting malicious JavaScript on webmail portals and government apps. The implant runs…
Unit 42
- Telegram fixes Android flaw that turned a message into code execution
Security firm V12 posted a demo of a Telegram message running code on a device a day after Telegram launched apps inside messages. Telegram says the Android flaw was fixed on 10 November and the fix has reached all…
CyberSIXT
- Apache fixes HTTP/2 flaw that could enable remote code execution
Apache HTTP Server has been updated to version 2.4.71 on 11 November 2026 to address three security flaws, the most critical being a race condition in the HTTP/2 module that could lead to remote code execution (RCE).…
SecurityOnlineCVE-2026-106023
CVEs in the news19
Named in the last 24 hours and not in CISA KEV, most covered first
CVE-2026-125883N-able N-central
4 articles today · N-able N-central hotfix hit by new public zero-day exploits
Not scored5 articlesCVE-2026-108186Zoom Communications Zoom Workplace
2 articles today · Zoom fixes Windows flaws enabling unauthorised privilege escalation
9.6Critical4 articlesCVE-2026-90436Apache Software Foundation Apache Axis 1.x (EOL)
Researcher discloses new N-central flaws enabling root access
9.8Critical0.6% EPSS · 1 articleCVE-2026-123710Red Hat Red Hat Quay 3
Red Hat Quay flaw could expose private container images
9.8Critical1 articleCVE-2024-58351Flowise Flowise
Researchers uncover cloud attack chain targeting Flowise deployments
9.8Critical0.7% EPSS · 2 articlesCVE-2026-118383MongoDB MongoDB Server
Datadog researchers detail MongoDB flaw that can crash servers
9.5Critical2 articlesCVE-2026-126325PTC Windchill
PTC patches Windchill and FlexPLM flaw enabling remote code execution
9.2Critical1 articleCVE-2026-12573Zohocorp DDI Central
Zoho fixes eight ManageEngine flaws, including router command injection
8.8High1 articleCVE-2026-43284Linux Linux
Microsoft warns attackers use GSocket relay tool to retain access to Linux servers
8.8High94% EPSS · 9 articlesCVE-2026-123863nodejs node
Node.js fixes 16 flaws exposing servers to crashes and data leaks
8.2High2 articlesCVE-2026-80521Linux Linux
Google publishes Linux kernel exploit for privilege escalation
7.8High0.2% EPSS · 3 articlesCVE-2026-64563Linux Linux
Microsoft reports eight Linux kernel bugs enabled root exploits
7.8High0.2% EPSS · 2 articlesCVE-2026-123747OpenPrinting pappl-retrofit
OpenPrinting fixes pappl-retrofit flaw enabling root file access
7.3High1 articleCVE-2026-123828nodejs node
Node.js fixes HTTP/2 and TLS flaws exposing data and keys
5.9Medium1 articleCVE-2024-36350AMD AMD EPYC™ 7003 Series Processors
Google warns of AMD Turin CPU flaws that could leak data
5.6Medium0.5% EPSS · 1 articleCVE-2026-119618Apache Software Foundation Apache HTTP Server
Apache fixes HTTP/2 flaw enabling unauthenticated remote code execution
Not scored2 articlesCVE-2026-126885Google Chrome
Google fixes five critical use-after-free flaws in Chrome
Not scored1 articleCVE-2026-97033Go toolchain cmd/go
Go releases fix build time code execution and HTTP flaws
Not scored1 articleCVE-2026-106023Apache Software Foundation Apache HTTP Server
Apache fixes HTTP/2 flaw that could enable remote code execution
Not scored1 article
Developing stories4
Two or more articles in the last 24 hours; each bead is an article
- CVECVE-2026-125883N-able N-centralDevelopinglatest 3 hours ago4 articles4 outlets
- Wed 11 Nov, 17:15 UTC. Infosecurity, first report. N-able patches N-central after 33 exploit proofs go public.
- Wed 11 Nov, 20:05 UTC. Dark Reading, its first report on the story. N-able takes N-central offline after 33 flaws are disclosed.
- Thu 12 Nov, 09:39 UTC. SecurityWeek, its first report on the story. Attackers Probe N-able N-central Zero-Days After Disclosure.
- Thu 12 Nov, 10:55 UTC. CyberSIXT, its first report on the story. N-able N-central hotfix hit by new public zero-day exploits.
- Threat actorWhitearmorDevelopinglatest 5 hours ago3 articles3 outlets
- Wed 11 Nov, 20:47 UTC. Security Affairs, first report. WhiteArmor claims theft of 100GB from Maersk and demands ransom.
- Thu 12 Nov, 08:38 UTC. SecurityWeek, its first report on the story. Maersk confirms data theft after $5 million extortion attempt.
- Thu 12 Nov, 08:49 UTC. Infosecurity, its first report on the story. Maersk discloses breach after extortion group demands $5m.
- CVECVE-2026-108186Zoom Communications Zoom WorkplaceDevelopinglatest 2 hours ago2 articles2 outlets
- Wed 11 Nov, 16:12 UTC. The Hacker News, first report. Zoom fixes critical Windows flaws enabling remote privilege escalation.
- Thu 12 Nov, 12:33 UTC. Security Affairs, its first report on the story. Zoom fixes Windows flaws enabling unauthorised privilege escalation.
- Threat actorCopperDragonDevelopinglatest 8 hours ago2 articles2 outlets
- Wed 11 Nov, 16:00 UTC. Infosecurity, first report. Check Point links three campaigns to suspected China malware supplier.
- Thu 12 Nov, 06:14 UTC. SecurityOnline, its first report on the story. Check Point links three espionage campaigns to CopperDragon.