{"updated":1794525211428,"items":[{"title":"Cyber Experts Weigh In: How to Fight Artex AntiFox","summary":"Cybercriminals using agentic pen-testing tools is a proverbial genie out of the bottle at this point, so enterprises need to get a defense plan in place right away.","cat":"research","ts":1794518332000,"source":"Dark Reading","link":"https://www.darkreading.com/cybersecurity-operations/cyber-experts-fight-artex-antifox"},{"title":"Extortion Group Luna Moth Flits Into Law Firms a Second Time","summary":"The cybercriminals are retargeting law firms that refused to pay its first ransom, with a social engineering con aimed at stealing Microsoft access tokens.","cat":"ransomware","ts":1794514181000,"source":"Dark Reading","link":"https://www.darkreading.com/data-privacy/extortion-luna-moth-law-firms-second-time"},{"title":"Webinar: See How Identity Blind Spots Put Your SOC at Risk and How to Close Them","summary":"Security teams have more alerts, logs, and monitoring tools than ever. Yet when an attack happens, one simple question can still take too long to answer: Who or what is behind this activity, and what ","cat":"research","ts":1794506835000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/your-soc-sees-alert-but-does-it-know.html"},{"title":"ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories","summary":"A search result isn't always safe. An access request isn't always harmless. And a familiar account doesn't always mean a familiar person is using it. Simple things to remember. Yet a surprising amount","cat":"malware","ts":1794506571000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/threatsday-59-linux-kernel-bugs-falcon.html"},{"title":"New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access","summary":"Public exploit code released earlier this week claims that a local Windows user can gain SYSTEM privileges through the Common Log File System driver. The proof of concept, called SignDrop, targets a l","cat":"vulnerability","ts":1794505827000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/new-signdrop-zero-day-exploit-turns.html"},{"title":"Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry","summary":"A critical flaw in Red Hat Quay allows an attacker who can access a Quay registry to read and overwrite private container images in every repository. Quay enables anonymous access by default, and whil","cat":"vulnerability","ts":1794500821000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/critical-red-hat-quay-flaw-lets.html"},{"title":"Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass","summary":"Citrix has released patches for multiple critical security flaws impacting NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console that could lead to denial-of-service (DoS) or an authenticatio","cat":"vulnerability","ts":1794497929000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/citrix-patches-12-netscaler-and-secure.html"},{"title":"186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers","summary":"Cybersecurity researchers have found that lookalike domains masquerading as artificial intelligence (AI) tools are being used to serve ClickFix-style lures, browser-hijacking malware, and a set of ext","cat":"malware","ts":1794496540000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/186-fake-ai-domains-redirect-users-to.html"},{"title":"SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths","summary":"The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it ha","cat":"vulnerability","ts":1794488908000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html"},{"title":"Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs","summary":"Google Cloud VMs on AMD Turin chips need a guest OS patch and a stop-and-start to protect against three CPU side-channel flaws, Google said this week. The company has already applied mitigations again","cat":"breach","ts":1794485354000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/google-cloud-warns-three-amd-turin-cpu.html"},{"title":"New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access","summary":"N-able on Thursday said it's investigating a new public disclosure containing claims of additional vulnerabilities in on-premise versions of N-central running version 2026.4.1 HF2. \"Based on our initi","cat":"vulnerability","ts":1794484303000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html"},{"title":"Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign","summary":"Since mid-August 2026, a phishing operation has been stealing live Google sessions from corporate users. Every check defenders normally lean on to judge a link came back clean, and the operator design","cat":"research","ts":1794484291000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/calendar-invites-and-live-proxies.html"},{"title":"PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution","summary":"PTC has released patches for a new critical vulnerability impacting Windchill and FlexPLM software that, if successfully exploited, could result in remote code execution. The security flaw, tracked as","cat":"vulnerability","ts":1794483195000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/ptc-patches-critical-windchill-and.html"},{"title":"Inside an AI Attack Against a US Retailer","summary":"When hand-typed commands failed to breach a US retailer, the attacker turned to AI-generated scripts, achieving lateral movement in minutes.","cat":"breach","ts":1794481200000,"source":"Dark Reading","link":"https://www.darkreading.com/cyberattacks-data-breaches/inside-ai-attack-us-retailer"},{"title":"Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover","summary":"A critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server. The crash occurs only if that server is later chosen to take over","cat":"vulnerability","ts":1794475500000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html"},{"title":"Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data","summary":"A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines. A second HTTP/2 flaw can cause a server ","cat":"breach","ts":1794471637000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/nodejs-fixes-16-flaws-including-http2.html"},{"title":"Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories","summary":"Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security softwa","cat":"breach","ts":1794465767000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html"},{"title":"Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely","summary":"A critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed i","cat":"vulnerability","ts":1794460346000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html"},{"title":"ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients","summary":"ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access. In an advisory posted on its site, the company s","cat":"research","ts":1794458388000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/screenconnect-attacks-target-at-least.html"},{"title":"Chinese AI Project Scouts Spies in Taiwan Chip Industry","summary":"The CCP built a Big Data system to scrape reams of information and learn about individuals abroad, to potentially target and exploit them. Think Alice Huang Lite.","cat":"vulnerability","ts":1794445200000,"source":"Dark Reading","link":"https://www.darkreading.com/threat-intelligence/chinese-ai-project-scouts-spies-taiwan-chip-industry"},{"title":"Japan Pushes Emergency Funding for Cybersecurity as AI-Assisted Breaches Rise","summary":"The package adds public-private cyber responders, an AI-focused team run by the economic ministry, and more leeway to use the government's new active cyber-defense powers.","cat":"breach","ts":1794441600000,"source":"Dark Reading","link":"https://www.darkreading.com/cybersecurity-operations/japan-emergency-funding-cybersecurity-ai-assisted-breaches"},{"title":"AIを活用したサイバー攻撃の増加を受け、日本がサイバーセキュリティへの緊急資金拠出を推進","summary":"この対策パッケージには、官民合同のサイバー対応チーム、経済省が主導するAI専門チーム、および政府の新たな能動的サイバー防衛権限の行使に関する裁量の拡大が含まれている。","cat":"research","ts":1794435284000,"source":"Dark Reading","link":"https://www.darkreading.com/cybersecurity-operations/japan-emergency-funding-cybersecurity-ai-assisted-breaches-japanese"},{"title":"Attackers Say 'Hello' to a Different Scale of Cloud Attack","summary":"Researchers dubbed an attack chain Greeter after discovering that attackers deliberately covered their trail by leaving hello messages in logs.","cat":"research","ts":1794433444000,"source":"Dark Reading","link":"https://www.darkreading.com/cloud-security/attackers-hello-scale-cloud-attack"},{"title":"AI Raises the Stakes for Cyber Resilience","summary":"An organization's ability to quickly recover from a business disruption will be a competitive advantage in an era of AI-driven threats and business enablement.","cat":"research","ts":1794432041000,"source":"Dark Reading","link":"https://www.darkreading.com/cyber-risk/ai-raises-stakes-cyber-resilience"},{"title":"N-able Takes N-central Platform Offline After Discovery of 33 Flaws","summary":"The RMM provider also released a hotfix as a recommended mitigation to address public exploits for the alleged zero-days, which allow for attacker takeover.","cat":"vulnerability","ts":1794427518000,"source":"Dark Reading","link":"https://www.darkreading.com/endpoint-security/n-able-n-central-offline-33-flaws"},{"title":"Who Runs the Ransomware Group Qilin?","summary":"The cybercrime group Qilin has emerged as the world's most active ransomware affiliate program, claiming at least 365 victim organizations in the past three months alone. But even top Russian hackers ","cat":"ransomware","ts":1794420361000,"source":"Krebs on Security","link":"https://krebsonsecurity.com/2026/11/who-runs-the-ransomware-group-qilin/"},{"title":"Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation","summary":"Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems. The vulne","cat":"vulnerability","ts":1794413566000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/critical-zoom-workplace-flaw-could.html"},{"title":"AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets","summary":"Cybersecurity researchers have disclosed details of a campaign in which an emerging agentic penetration testing platform called AntiFox has been used to steal Amazon Web Services (AWS) credentials and","cat":"research","ts":1794411267000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html"},{"title":"Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits","summary":"Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026. Cynet's CyOps and Research team","cat":"vulnerability","ts":1794405660000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/hackers-target-qlik-sense-servers-with.html"},{"title":"Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords","summary":"Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday. They included 24 apps built by staff at the socia","cat":"breach","ts":1794399580000,"source":"The Hacker News","link":"https://thehackernews.com/2026/11/over-35000-grok-built-apps-exposed.html"}]}