{"updated":1794597870968,"items":[{"title":"PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE","summary":"A type confusion flaw in PostgreSQL lets a database user who can create objects run code on the server. Updates released yesterday fix it, along with 51 other security flaws. Full protection from this","cat":"vulnerability","ts":1794588788000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/postgresql-patches-52-flaws-including.html"},{"title":"New Mior and Skyfall Attacks Let Rogue Cloud Hosts Steal Secrets From AMD SEV-SNP VMs","summary":"Two attacks made public this week allow a malicious host to read data inside AMD SEV-SNP-protected virtual machines (VMs), which are built to keep the server's operator out. One of them, Mior, can als","cat":"research","ts":1794583625000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/new-mior-and-skyfall-attacks-let-rogue.html"},{"title":"FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls","summary":"The U.S. Federal Bureau of Investigation (FBI) has established that threat actors tied to the Democratic People's Republic of Korea (DPRK aka North Korea) have stolen more than $400 million worth of c","cat":"breach","ts":1794580138000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/fbi-says-north-korean-hackers-stole.html"},{"title":"Trezor Confirms Hidden Implants in CryptoBilis-Sold Wallets That Can Steal Recovery Phrases","summary":"Three Trezor Safe 5 wallets bought from the reseller CryptoBilis contain an implant, an extra circuit board that can copy their recovery phrases, hardware wallet maker Trezor said yesterday. The impla","cat":"research","ts":1794578060000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/trezor-confirms-hidden-hardware.html"},{"title":"Attackers in Binance Breach Targeted Known Weakness, Missing Controls","summary":"Blockchain complexities, such as attacker-deployed sweepers, hobble security controls designed to limit the damage of an exchange compromise.","cat":"breach","ts":1794574800000,"source":"Dark Reading","link":"https://www.darkreading.com/cybersecurity-operations/attackers-binance-breach-targeted-weakness-missing-controls"},{"title":"When an AI Agent Goes Wrong, Can You Stop It?","summary":"Suppose an AI agent is asked to sort support tickets and look up account details. A ticket contains instructions that lead the agent to export records to an unfamiliar destination. The agent can make ","cat":"research","ts":1794570751000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/when-ai-agent-goes-wrong-can-you-stop-it.html"},{"title":"SilentAir Hijacks Asian Telecom Networks to Intercept SMS 2FA Codes and Spy on Taiwanese Users","summary":"A newly identified spying group used hacked equipment inside Asian mobile operators to intercept the calls and texts of selected people, mostly in Taiwan. Enea, a telecom and cybersecurity software co","cat":"research","ts":1794568240000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/silentair-hijacks-asian-telecom.html"},{"title":"Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins","summary":"An international police operation took down servers behind Gootloader, CastleRAT and StealC this week. Criminals used the three malware tools to gain access to computers, steal passwords, and launch r","cat":"breach","ts":1794567303000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/operation-endgame-takes-down-gootloader.html"},{"title":"Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files","summary":"An unknown threat actor has been observed targeting unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously unreported local privilege ","cat":"vulnerability","ts":1794557149000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/hackers-exploit-php2shell-flaws-in.html"},{"title":"Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2","summary":"N-able on Thursday said it's taking additional precautions in the wake of public disclosure of a new set of flaws tracked as 4EverAble2Shell and Agent2Shell. \"We are restricting certain N-central feat","cat":"vulnerability","ts":1794548608000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/hackers-exploit-n-central-flaws-to.html"},{"title":"Getting Past the Post-Quantum Cryptography Discovery Phase","summary":"Most organizations haven't sorted out their cryptographic estate enough to even know where they'd start with post-quantum cryptography (PQC).","cat":"research","ts":1794523565000,"source":"Dark Reading","link":"https://www.darkreading.com/cybersecurity-operations/getting-past-post-quantum-cryptography-discovery"},{"title":"Cyber Experts Weigh In: How to Fight Artex AntiFox","summary":"Cybercriminals using agentic pen-testing tools is a proverbial genie out of the bottle at this point, so enterprises need to get a defense plan in place right away.","cat":"research","ts":1794518332000,"source":"Dark Reading","link":"https://www.darkreading.com/cybersecurity-operations/cyber-experts-fight-artex-antifox"},{"title":"Extortion Group Luna Moth Flits Into Law Firms a Second Time","summary":"The cybercriminals are retargeting law firms that refused to pay its first ransom, with a social engineering con aimed at stealing Microsoft access tokens.","cat":"ransomware","ts":1794514181000,"source":"Dark Reading","link":"https://www.darkreading.com/data-privacy/extortion-luna-moth-law-firms-second-time"},{"title":"Webinar: See How Identity Blind Spots Put Your SOC at Risk and How to Close Them","summary":"Security teams have more alerts, logs, and monitoring tools than ever. Yet when an attack happens, one simple question can still take too long to answer: Who or what is behind this activity, and what ","cat":"research","ts":1794506835000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/your-soc-sees-alert-but-does-it-know.html"},{"title":"ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories","summary":"A search result isn't always safe. An access request isn't always harmless. And a familiar account doesn't always mean a familiar person is using it. Simple things to remember. Yet a surprising amount","cat":"malware","ts":1794506571000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/threatsday-59-linux-kernel-bugs-falcon.html"},{"title":"New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access","summary":"Public exploit code released earlier this week claims that a local Windows user can gain SYSTEM privileges through the Common Log File System driver. The proof of concept, called SignDrop, targets a l","cat":"vulnerability","ts":1794505827000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/new-signdrop-zero-day-exploit-turns.html"},{"title":"Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry","summary":"A critical flaw in Red Hat Quay allows an attacker who can access a Quay registry to read and overwrite private container images in every repository. Quay enables anonymous access by default, and whil","cat":"vulnerability","ts":1794500821000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/critical-red-hat-quay-flaw-lets.html"},{"title":"Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass","summary":"Citrix has released patches for multiple critical security flaws impacting NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console that could lead to denial-of-service (DoS) or an authenticatio","cat":"vulnerability","ts":1794497929000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/citrix-patches-12-netscaler-and-secure.html"},{"title":"186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers","summary":"Cybersecurity researchers have found that lookalike domains masquerading as artificial intelligence (AI) tools are being used to serve ClickFix-style lures, browser-hijacking malware, and a set of ext","cat":"malware","ts":1794496540000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/186-fake-ai-domains-redirect-users-to.html"},{"title":"SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths","summary":"The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it ha","cat":"vulnerability","ts":1794488908000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html"},{"title":"Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs","summary":"Google Cloud VMs on AMD Turin chips need a guest OS patch and a stop-and-start to protect against three CPU side-channel flaws, Google said this week. The company has already applied mitigations again","cat":"breach","ts":1794485354000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/google-cloud-warns-three-amd-turin-cpu.html"},{"title":"New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access","summary":"N-able on Thursday said it's investigating a new public disclosure containing claims of additional vulnerabilities in on-premise versions of N-central running version 2026.4.1 HF2. \"Based on our initi","cat":"vulnerability","ts":1794484303000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html"},{"title":"Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign","summary":"Since mid-August 2026, a phishing operation has been stealing live Google sessions from corporate users. Every check defenders normally lean on to judge a link came back clean, and the operator design","cat":"research","ts":1794484291000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/calendar-invites-and-live-proxies.html"},{"title":"PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution","summary":"PTC has released patches for a new critical vulnerability impacting Windchill and FlexPLM software that, if successfully exploited, could result in remote code execution. The security flaw, tracked as","cat":"vulnerability","ts":1794483195000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/ptc-patches-critical-windchill-and.html"},{"title":"Inside an AI Attack Against a US Retailer","summary":"When hand-typed commands failed to breach a US retailer, the attacker turned to AI-generated scripts, achieving lateral movement in minutes.","cat":"breach","ts":1794481200000,"source":"Dark Reading","link":"https://www.darkreading.com/cyberattacks-data-breaches/inside-ai-attack-us-retailer"},{"title":"Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover","summary":"A critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server. The crash occurs only if that server is later chosen to take over","cat":"vulnerability","ts":1794475500000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html"},{"title":"Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data","summary":"A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines. A second HTTP/2 flaw can cause a server ","cat":"breach","ts":1794471637000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/nodejs-fixes-16-flaws-including-http2.html"},{"title":"Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories","summary":"Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security softwa","cat":"breach","ts":1794465767000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html"},{"title":"Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely","summary":"A critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed i","cat":"vulnerability","ts":1794460346000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html"},{"title":"ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients","summary":"ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access. In an advisory posted on its site, the company s","cat":"research","ts":1794458388000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/screenconnect-attacks-target-at-least.html"}]}