{"updated":1794352899912,"items":[{"title":"November Patch Tuesday: An Overflowing Cornucopia of CVEs","summary":"Microsoft serves up an actively exploited Outlook zero-day, and a wave of critical Exchange, SharePoint, Windows Search, and LDAP bugs that exhausted defenders need to prioritize fast.","cat":"vulnerability","ts":1794349611000,"source":"Dark Reading","link":"https://www.darkreading.com/vulnerabilities-threats/november-patch-tuesday-cornucopia-cves"},{"title":"Microsoft Fixes Nearly 1,100 Security Vulnerabilities","summary":"Microsoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software. This month's Patch Tuesday ad","cat":"vulnerability","ts":1794347703000,"source":"Krebs on Security","link":"https://krebsonsecurity.com/2026/11/microsoft-fixes-nearly-1100-security-vulnerabilities/"},{"title":"Artex: The AI Pen-Test Tool Hackers Turned Into a Weapon","summary":"Forks of the open source Artex framework, along with 45 similar pen-testing tools, remain capable of executing credential attacks and cloud breaches at machine speed across multiple industries.","cat":"breach","ts":1794344474000,"source":"Dark Reading","link":"https://www.darkreading.com/cyberattacks-data-breaches/artex-ai-pen-test-tool-hackers-weapon"},{"title":"F-Secure Identifies 26 Ways AI Can Harm Consumers, and Where to Stop Them","summary":"New AI Harms Taxonomy traces how harm moves through AI systems, from misleading chatbot answers to compromised autonomous agents, and identifies where defenses can intervene.","cat":"research","ts":1794343305000,"source":"Dark Reading","link":"https://www.darkreading.com/application-security/f-secure-26-ways-ai-harm-consumers-where-to-stop-them"},{"title":"Checkmarx Appoints Kobi Sivilya as Chief Information Security Officer","summary":"Sivilya brings deep cybersecurity and technology leadership to Checkmarx as AI transforms software development.","cat":"research","ts":1794342934000,"source":"Dark Reading","link":"https://www.darkreading.com/cybersecurity-careers/checkmarx-appoints-kobi-sivilya-chief-information-security-officer"},{"title":"How to Assess OT Incident Response Preparedness","summary":"Cloud Range's free 28-question OT Cyber Readiness Assessment helps organizations identify gaps in operational technology (OT) incident response.","cat":"research","ts":1794341923000,"source":"Dark Reading","link":"https://www.darkreading.com/ics-ot-security/assess-ot-incident-response-preparedness"},{"title":"Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones","summary":"A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with match","cat":"vulnerability","ts":1794338590000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html"},{"title":"SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users","summary":"An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday. The attacker could also have seen request","cat":"breach","ts":1794338379000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/sglang-rce-exploit-breaches-near-ai.html"},{"title":"AI Coding Agents Leak Thousands of Secrets to GitHub","summary":"A command in Claude Code inadvertently saves files with credentials and other sensitive data to public Git repositories, creating security gaps for organizations.","cat":"breach","ts":1794336382000,"source":"Dark Reading","link":"https://www.darkreading.com/cyber-risk/ai-coding-agents-leak-secrets-github"},{"title":"Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access","summary":"French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild. The authentication bypass flaw, which does not ","cat":"vulnerability","ts":1794334341000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/hackers-exploit-critical-xen-orchestra.html"},{"title":"Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem","summary":"Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities,","cat":"nation-state","ts":1794332603000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/three-china-nexus-espionage-campaigns.html"},{"title":"Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor","summary":"Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant. The activity, observed by Huntress in early ","cat":"vulnerability","ts":1794326455000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/attackers-exploit-ahsaycbs-flaws-to.html"},{"title":"Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America","summary":"The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access t","cat":"malware","ts":1794326324000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/blind-eagle-uses-fake-court-notices-to.html"},{"title":"Fireworks AI Confirms Wider Breach Affecting Customer Datasets, Model Weights and Notion AI Chats","summary":"Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month uncovered further malicious activity, affecting account and billing information, alongs","cat":"breach","ts":1794324839000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/fireworks-ai-breach-widens-to-expose.html"},{"title":"AI Makes Reverse Engineering Mainstream Software Malware Far Easier","summary":"Researchers unpacked, mapped, and recreated complex software and the Turla malware, raising opportunities and concerns for organizations and cybersecurity analysts.","cat":"malware","ts":1794315600000,"source":"Dark Reading","link":"https://www.darkreading.com/application-security/ai-reverse-engineering-apps"},{"title":"Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed","summary":"An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malici","cat":"research","ts":1794312931000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/binance-warns-of-ios-sandbox-escape.html"},{"title":"Beyond the Alert: The Case for Rich Network Data","summary":"At some point your security will fail. This isn’t pessimism. It’s not because your team and tools aren’t sophisticated enough. It’s the reason we have detections in the first place. And, it’s why once","cat":"research","ts":1794310693000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/beyond-alert-case-for-rich-network-data.html"},{"title":"Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities","summary":"An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that cou","cat":"vulnerability","ts":1794305811000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/apple-patches-imessage-group-chat.html"},{"title":"Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers","summary":"The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exch","cat":"nation-state","ts":1794305249000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/russian-turla-hackers-use-new-cereal.html"},{"title":"SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution","summary":"Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score. Three are in the SAP Net","cat":"vulnerability","ts":1794304960000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/sap-patches-four-cvss-100-flaws.html"},{"title":"France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites","summary":"An October cyberattack on refrigeration controllers at about 700 French retail sites was carried out by a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), the French government said yest","cat":"nation-state","ts":1794301700000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/france-blames-iran-for-sabotage-attack.html"},{"title":"Anthropic's Claude Fable 5.2 Beats GPT-6 Cyber in Multi-Stage Cyberattack Benchmark","summary":"Anthropic on Monday released Claude Fable 5.2 and Claude Mythos 5.2 models, which it said exhibit improvements in coding, reasoning, and vision. During pre-release training, the large language models ","cat":"research","ts":1794298574000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/anthropics-claude-fable-52-beats-gpt-6.html"},{"title":"Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026","summary":"Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, assigned the CVE identifie","cat":"vulnerability","ts":1794293574000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/google-issues-chrome-security-update.html"},{"title":"N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits","summary":"N-able said it has taken N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice following the public disclosure of over 30 vulnerabil","cat":"vulnerability","ts":1794293076000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/n-able-takes-hosted-n-central-offline.html"},{"title":"CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws","summary":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Expl","cat":"vulnerability","ts":1794292302000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html"},{"title":"People Are Getting Weird About AI","summary":"Dark Reading Confidential Episode 22: You can love AI without being blind to cybersecurity being sacrificed for utility.","cat":"research","ts":1794265582000,"source":"Dark Reading","link":"https://www.darkreading.com/cyber-risk/people-are-getting-weird-about-ai"},{"title":"CISA Announces Enhanced Reporting Form for Cyber Incidents","summary":"New questionnaire captures critical data and information that improves the agency’s ability to assess incidents, identify trends and prioritize response actions.","cat":"research","ts":1794260300000,"source":"Dark Reading","link":"https://www.darkreading.com/cyberattacks-data-breaches/cisa-announces-enhanced-reporting-form-cyber-incidents"},{"title":"Microsoft Fixes RCE Bug in Windows Paint After Weeks of Confusion","summary":"Last month, Microsoft disclosed a vulnerability in Microsoft Paint, but messaging regarding a patch was unclear.","cat":"vulnerability","ts":1794258744000,"source":"Dark Reading","link":"https://www.darkreading.com/application-security/microsoft-rce-bug-windows-paint-confusion"},{"title":"Black Hat India 2026 Makes a Landmark Debut in Bengaluru, Bringing the Global Cybersecurity Community to India","summary":"Inaugural edition by Informa Markets in India brings together leading researchers, security practitioners and industry decision makers for four days of cutting-edge research, technical exchange and st","cat":"research","ts":1794255596000,"source":"Dark Reading","link":"https://www.darkreading.com/cybersecurity-operations/black-hat-india-2026-landmark-debut"},{"title":"Attackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on Linux","summary":"Attackers can exploit a flaw in Claude's document-processing tool by creating a temporary file that Anthropic's AI assistant can access and run on a user's machine.","cat":"vulnerability","ts":1794247710000,"source":"Dark Reading","link":"https://www.darkreading.com/endpoint-security/attackers-claude-office-party-flaw-malicious-code-linux"}]}