Section
News
Reporting from the trade press, breach notifications and government press releases.
253 matching records, 8 with confirmed exploitation.
-
Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities
The flaws, CVE-2026-111793 and CVE-2026-20320, let attackers leak sensitive information, including configuration data. The post Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities appeared first on SecurityWeek .
-
Chipmaker Patch Tuesday: Over 200 Vulnerabilities Addressed by Intel, AMD
Intel and AMD disclose more than 200 vulnerabilities, including critical flaws in Intel TDX software and numerous AMD graphics bugs. The post Chipmaker Patch Tuesday: Over 200 Vulnerabilities Addressed by Intel, AMD appeared…
-
Recently Patched Barracuda Vulnerabilities Exploited in Attacks
The security defects could allow attackers to bypass authorization and gain root access to devices. The post Recently Patched Barracuda Vulnerabilities Exploited in Attacks appeared first on SecurityWeek .
-
YouHack - 7,160,849 breached accounts
In May 2013, the Russian-language hacking forum YouHack suffered a data breach that was later redistributed as part of a larger corpus of data . The breach exposed 107k forum members' email addresses, usernames, IP addresses and…
-
Bluetooth, AirPlay Pairing Vulnerabilities Patched Across Apple Platforms
Apple has patched Bluetooth and AirPlay pairing flaws, iMessage vulnerabilities, and an exploited Brotli bug across its platforms. The post Bluetooth, AirPlay Pairing Vulnerabilities Patched Across Apple Platforms appeared first…
-
OpenAI builds a kill switch for its research models
How much damage can a rogue agent do in 35 seconds? Asking cos that’s how long it might take to shut one down
-
Risky Bulletin: France blames Iran for supermarket freezer hacks
France blames Iran for supermarket freezer hacks, the White House nominates Palantir’s CISO as CISA director, another Russian cloud provider gets hacked, and N-able takes down its SaaS platform after a researcher discloses 33…
-
СберСпасибо (SberSpasibo) - 3,288,711 breached accounts
In March 2023, data allegedly taken from СберСпасибо (SberSpasibo), the loyalty program of Russian bank Сбербанк (Sberbank), was published online . The data contained records relating to 48M users, including 3.3M unique email…
-
CISA director pick already drawing concern from Hill Dems over Palantir connection
Others touted Michael LoSapio as a fit for the job due to his technical credentials as CISO for the company. The post CISA director pick already drawing concern from Hill Dems over Palantir connection appeared first on CyberScoop…
-
November Patch Tuesday boasts over 1,000 bugs but only one zero-day so far
Microsoft admins wail and gnash their teeth
-
Lake County School Board seeks injunction requiring a parent who received unredacted data because of the district’s error to destroy the data
Fox35 in Orlando, Florida, reports that a school district is suing a parent after the district mistakenly sent them unredacted data in 47,000 records: The Lake County School Board filed a lawsuit against a parent after an…
-
November Patch Tuesday: An Overflowing Cornucopia of CVEs
Microsoft serves up an actively exploited Outlook zero-day, and a wave of critical Exchange, SharePoint, Windows Search, and LDAP bugs that exhausted defenders need to prioritize fast.
-
Microsoft Fixes Nearly 1,100 Security Vulnerabilities
Microsoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software. This month's Patch Tuesday addresses 63 critical flaws…
-
The US wants its quantum lead to turn into factories and supply chains
There’s bipartisan support for further investment in the U.S. quantum industry, along with worries that America’s industrial capacity won’t keep up with demand. The post The US wants its quantum lead to turn into factories and…
-
Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday
Microsoft’s November security update addresses roughly 1,090 vulnerabilities across Windows, Office, Azure and the company’s other product lines, the second consecutive monthly release to exceed the totals of all previous years.…
-
Ring robots ready to patrol paranoids’ pads
Amazon calls its home security drone and business patrol bot 'proactive protection'
-
US Army member arrested in UK over allegations of spying for Russia
The unnamed soldier was arrested by British counterterrorism police “working closely” with U.S. authorities, including the FBI and the military, the Metropolitan Police said in a statement.
-
Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI
Researcher finds 35,000 Grok Build apps wide open to anyone who looked for them.
-
Artex: The AI Pen-Test Tool Hackers Turned Into a Weapon
Forks of the open source Artex framework, along with 45 similar pen-testing tools, remain capable of executing credential attacks and cloud breaches at machine speed across multiple industries.
-
Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row
An exploited Outlook vulnerability drew most of the attention in Microsoft's latest Patch Tuesday, which listed 1,093 bugs total.
-
F-Secure Identifies 26 Ways AI Can Harm Consumers, and Where to Stop Them
New AI Harms Taxonomy traces how harm moves through AI systems, from misleading chatbot answers to compromised autonomous agents, and identifies where defenses can intervene.
-
Near AI Breach Exposes User Details and Data From 18 AI Agents
Jose Antonio Lanz reports: Near AI has disclosed a breach that exposed account information belonging to about 100 users and data from 18 AI agents after an attacker exploited software running its servers. The company said in a…
-
Checkmarx Appoints Kobi Sivilya as Chief Information Security Officer
Sivilya brings deep cybersecurity and technology leadership to Checkmarx as AI transforms software development.
-
How to Assess OT Incident Response Preparedness
Cloud Range's free 28-question OT Cyber Readiness Assessment helps organizations identify gaps in operational technology (OT) incident response.
-
Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft
CVE-2026-124194 is the Outlook zero-day for which Microsoft says it’s aware of active exploitation. The post Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft appeared first on SecurityWeek .
-
Barracuda’s email security gateways bitten by make-me-root vulns
Someone's fishing for exposed devices
-
AI Coding Agents Leak Thousands of Secrets to GitHub
A command in Claude Code inadvertently saves files with credentials and other sensitive data to public Git repositories, creating security gaps for organizations.
-
Adobe Patches 110 Vulnerabilities Across 9 Products
Adobe has fixed vulnerabilities in AEM, Premiere, Photoshop, After Effects, Connect, Audition, Dimension, Content Credentials SDK, and Media Encoder. The post Adobe Patches 110 Vulnerabilities Across 9 Products appeared first on…
-
Vanderbilt University reels following ransomware attack claimed by BYOD group
Some services began returning online Tuesday following a ransomware incident detected on Monday across Vanderbilt systems and applications. The post Vanderbilt University reels following ransomware attack claimed by BYOD group…
-
Software Transparency Is Changing: Allan Friedman on SBOM, AI BOMs and What Comes Next
SBOM pioneer Allan Friedman joined the SecurityWeek Podcast to discuss why knowing what is inside software is only the beginning, how AI is complicating software supply chain visibility, and what organizations should be doing…
-
Google Widens Gemini 4 Carbon Access After AI Agents Verify Signal Code
Google opened Carbon to paying developers and businesses as DeepMind used agents built on it to prove libsignal security guarantees. The post Google Widens Gemini 4 Carbon Access After AI Agents Verify Signal Code appeared first…
-
Trump taps Palantir security chief to run battered US cyber defense agency
Michael LoSapio could inherit a depleted workforce and a political headache or two, courtesy of his current employer
-
AI company Fireworks says hackers stole data, billing info during October breaches
Fireworks said the incident affected a “limited number of customer accounts” — all of whom were notified of the attack.
-
N-able takes its remote access service offline after researcher publishes dozens of zero-day bugs
The remote access giant also urged its self-hosted customers to take down their own servers amid a "critical security incident," fearing the possibility of cyberattacks.
-
Cybercriminals are increasingly infecting regular people with spyware
Cybercriminals are infecting devices on a large scale with spyware, increasingly compromising systems belonging to average people, according to a new report.
-
Trump picks Palantir cybersecurity executive to lead CISA
The nomination — Trump’s second attempt to fill a post that has sat vacant for his entire second term — could face steep odds in the Senate.
-
Fireworks AI gets burned twice as customer data exposure widens
Inference biz pins latest breach on cloud provider and LLMJacking miscreants
-
UZ Brussel among hospitals experiencing severe network problems
VRT reports: Brussels University Hospital UZ Brussel (VUB) was the first hospital to report network problems. These are affecting the hospital’s IT infrastructure and telephone systems. There are also problems at AZ Monica in…
-
Researcher bypassed Meta smart glasses’ safeguards to run her own code
She was able to bypass a safeguard meant to stop unauthorized software running on Meta glasses. It wasn't easy, but showed it is possible.
-
Today: CISO Forum Virtual Summit 2026 – Join Global Cybersecurity Leaders
Designed for cybersecurity leaders, this immersive two-day virtual event is your premier destination to discuss, share, and learn innovative risk management and defense strategies defining the modern enterprise. The post Today…
-
WhiteMatter Raises $20 Million in Series A Funding
The cybersecurity startup deploys a dedicated guardian agent for every AI agent in an organization’s environment. The post WhiteMatter Raises $20 Million in Series A Funding appeared first on SecurityWeek .
-
HIPAA Enforcement by State Attorneys General
HIPAA Journal has a convenient table of HIPAA enforcement actions by state attorneys general. Most entries involve violations of the Security Rule and/or HITECH, but a few appear to relate more to the Privacy Rule or access to…
-
SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities
SAP has published 42 new and updated security advisories, including nine that address critical-severity vulnerabilities. The post SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities appeared first on SecurityWeek .
-
Palantir exec nominated to lead CISA; lame-duck Senate vote is uncertain
Michael LoSapio, Palantir's chief information security officer, is officially President Donald Trump's pick to lead the Cybersecurity and Infrastructure Security Agency.
-
Chrome zero-day whack-a-mole continues as 2026 tally hits 8
Another Chrome memory bug gets squashed, but not before attackers got their hands on it
-
Over a Dozen Organizations Hit in Qubole Supply Chain Attack
Hackers used compromised Qubole IAM credentials to steal customer files, secrets, keys, environment variables, and credentials. The post Over a Dozen Organizations Hit in Qubole Supply Chain Attack appeared first on SecurityWeek .
-
Update Chrome now to fix a flaw attackers are exploiting
Google has released Chrome updates for desktop and Android to patch a zero-day vulnerability already being exploited in attacks.
-
Before you buy an advent calendar, check these warning signs
Copied storefronts, fake urgency, and contradictory product claims are among the warning signs we found on suspicious advent calendar sites.
-
Cyberattacks threaten to make open source AI a little less open, Hugging Face exec warns
Hugging Face executive Irene Solaiman warns that growing cyberattacks on open AI platforms could force tighter security restrictions, threatening the accessibility that makes open source communities valuable to developers…
-
Russian hackers compromised government email servers to steal NATO, EU correspondence
Russian state-linked hackers have compromised government email servers in Romania and Kazakhstan to secretly intercept messages exchanged with NATO and European Union officials, researchers said.
-
Ransomware threat blares from Vanderbilt University computers during cyberattack
BYOD claims extensive data theft as campus Wi-Fi returns, most systems remain restricted, and classes carry on
-
AI Makes Reverse Engineering Mainstream Software & Malware Far Easier
Researchers unpacked, mapped, and recreated complex software and the Turla malware, raising opportunities and concerns for organizations and cybersecurity analysts.
-
Australia to introduce mandatory reporting after OpenAI hack to combat artificial intelligence ‘going rogue’
Tess Ikonomou and Josh Butler report: OpenAI will not face criminal penalties over the Medicare data breach, but the prime minister has flagged changes to Australia’s criminal law to crack down on future breaches by artificial…
-
Ransomware Attack Puts Vanderbilt University on Lockdown
Eli Motycka reports: A broad announcement to shut down university devices and disconnect from university Wi-Fi went out on Monday morning as malicious software began spreading through computers, files and digital infrastructure.…
-
SG: SPH Media hit by cyberattacks; says no customer financial data or access exposed
CNA reports: SPH Media has been hit by cyberattacks on five of its systems, but no customer financial information or account access was compromised, the company said on Tuesday (Nov 10). “(The cyberattacks) are believed to be a…
-
Ca: Data breach at The Children’s Foundation
Tim Durkin reports: The Children’s Foundation has issued a privacy notice following a data breach involving its IT service provider, Highland Shores Children’s Aid Society. An unauthorized third party accessed the IT network on…
-
Ph: NPC receives data breach reports from 10 agencies
Othel V. Campos & Rex Espiritu report: The National Privacy Commission (NPC) said Tuesday it has received personal data breach notifications from 10 government agencies, including the Bureau of Internal Revenue (BIR), the…
-
Kr: Financial Security Institute reports data leak following hacking incident
Yonhap News reports: Korea’s state-run Financial Security Institute (FSI) reported a data leak following a hacking attack targeting its security assessment system, officials said on Tuesday. The FSI, which oversees financial…
-
Anthropic Rolls Out Mythos 5.2 With Improved Bug Hunting, Fewer Sandbox Escapes
Anthropic says Mythos 5.2 improves vulnerability discovery while showing a lower tendency to escape sandboxes in controlled tests. The post Anthropic Rolls Out Mythos 5.2 With Improved Bug Hunting, Fewer Sandbox Escapes appeared…
-
New OpenSSH Vulnerability
It’s a bad one , and it’s been in the code for a decade: A newly disclosed flaw involving OpenSSH and musl, dubbed “*sshole,” allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to…
-
Google DeepMind melds humans and AI agents to vet Signal's secure messaging techniques
Post-quantum handshake and Triple Ratchet get a formal security check
-
Spyware attacks trend toward hitting just about anyone
iVerify’s report Tuesday adds to evidence of spyware’s increasingly indiscriminate targeting. The post Spyware attacks trend toward hitting just about anyone appeared first on CyberScoop .
-
Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments
Nicknamed “Turla’s Cereal,” the tools target Microsoft Exchange servers and lack many obvious indicators of compromise or malicious telemetry, per a new ESET report. The post Russian Turla group used new toolset to silently…
-
N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days
Attackers could exploit the flaws for remote code execution, credential theft, and administrator account creation. The post N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days appeared first on SecurityWeek .
-
IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks
CISA has added CVE-2026-123218 and CVE-2026-116779 to KEV, urging federal agencies to patch them within three days. The post IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks appeared first on…
-
France Blames Iran for a Cyberattack That Heated Supermarket Refrigerators
France summoned the Iranian ambassador and said it would seek European sanctions against those responsible for the attack The post France Blames Iran for a Cyberattack That Heated Supermarket Refrigerators appeared first on…
-
Security Flaws Across UK Government Sites Exposed ‘God-Tier’ Information
A researcher’s trawl through publicly available code found private information was at risk across multiple departments.
-
Chrome Update Patches Exploited XML Zero-Day, Eighth This Year
The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks. The post Chrome Update Patches Exploited XML Zero-Day, Eighth This Year appeared first on…
-
A New AI Tool From Google DeepMind Proved the Signal Protocol Is Secure
DeepMind researchers were able to formally verify that the widely used encryption protocol works as intended. Their stretch goal? Do the same for “all the software of the world.”
-
Trump picks Palantir’s LoSapio to head CISA
The Cybersecurity and Infrastructure Security Agency has gone without a Senate-confirmed director for all of Trump’s second term, and Michael LoSapio could face resistance, too. The post Trump picks Palantir’s LoSapio to head…
-
Anthropic's super bug-finding Mythos model is going into Cisco and IBM products
Enterprise security tools will offer its capabilities without handing customers the model itself
-
People Are Getting Weird About AI
Dark Reading Confidential Episode 22: You can love AI without being blind to cybersecurity being sacrificed for utility.
-
Hotel giant Wyndham exposed customer data after app security lapse
Exclusive: Wyndham left a hardcoded credential in its customer app, allowing anyone to access customer data. The hotel giant wouldn't say if it has the ability to check for any past unauthorized access.
-
France blames Iran for supermarket hack meltdowns
The 'first cyber offensive campaign carried out purely for the purpose of sabotage on national territory'
-
CISA Announces Enhanced Reporting Form for Cyber Incidents
A press release from the Cybersecurity and Infrastructure Security Agency (CISA) today: Today, the Cybersecurity and Infrastructure Security Agency (CISA) unveiled the updated cyber incident reporting form, an enhanced…
-
CISA Announces Enhanced Reporting Form for Cyber Incidents
New questionnaire captures critical data and information that improves the agency’s ability to assess incidents, identify trends and prioritize response actions.
-
Microsoft Fixes RCE Bug in Windows Paint After Weeks of Confusion
Last month, Microsoft disclosed a vulnerability in Microsoft Paint, but messaging regarding a patch was unclear.
-
Data breach at hearing aid giant Amplifon impacts thousands
The U.S arm of international hearing aid company Amplifon has been notifying customers about a data breach early this year that included medical information.
-
Black Hat India 2026 Makes a Landmark Debut in Bengaluru, Bringing the Global Cybersecurity Community to India
Inaugural edition by Informa Markets in India brings together leading researchers, security practitioners and industry decision makers for four days of cutting-edge research, technical exchange and strategic dialogue.
-
Attackers backdoor trusted AWS integrations to steal secrets
Wiz researchers uncovered the secret-stealing supply-chain attack
-
Vulnerability that lets hackers SSH into Linux devices is under active exploitation
"*sshole" poses a serious threat to Internet security.
-
France blames Iran for mass-hacks targeting freezers in grocery stores and blood banks
France's foreign minister blamed Iran for launching at least two waves of cyberattacks targeting industrial refrigerated and freezer units across France and wider Europe.
-
Binance calls alleged “ShinyHunters” post a scam attempt
Sergiu Gatlan reports: Binance, the world’s largest crypto exchange, has denied claims of a new security breach made by a threat actor using the ‘ShinyHunters’ handle on a newly emerged underground cybercrime forum. This follows…
-
France blames Iran for fridge cyberattacks, says some caused fires
In the first attribution since the October attacks, the French authorities identified the perpetrators as part of Shahid Kaveh, an IRGC cyber unit previously linked to attacks on industrial controllers at U.S. water utilities.
-
Vanderbilt cybersecurity incident impacting campus devices and systems
Vanderbilt University announced a cyberattack, warning students and employees that campus devices and systems may be impacted by the incident.
-
Attackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on Linux
Attackers can exploit a flaw in Claude's document-processing tool by creating a temporary file that Anthropic's AI assistant can access and run on a user's machine.
-
Researchers pwn automakers’ Android apps to remotely unlock cars, honk horns
Pair of researchers chain WAF bypasses and default logins to command vehicles in Australia and the US
-
Claude Code is accidentally exposing secrets all over GitHub
"Do not ask again" prompt leads to passwords, API keys, and more being shared.
-
PwC's CISO on AI, Robots & What's Next for Security
As AI accelerates change across the enterprise, PwC's James Shira explains why security teams must rethink their approach to risk and adapt their strategies.
-
Financially motivated threat cluster uses AI-enabled tools against banking sector
The campaign is the latest in a wave of attacks using Artex and other pen-testing tools to automate cyberattacks.
-
Cybersecurity education in the AI era: What’s new, what’s different
Businesses are trying new ways to keep employees vigilant, and colleges are debuting curriculum to prepare tomorrow’s AI workers.
-
NIST: Solo Shouldn't Mean Less Secure
New guidance provides a basic framework for less-technical solo business owners, but it may miss the mark on how to secure technology that requires no human oversight.
-
AU: Important update from Epichealth – cyber incident
Seen on Epichealth: 4 November 2026 What has happened Epichealth operates four medical clinics including the Warrnambool Medicare Urgent Care Clinic, Epichealth Ocean Grove Marketplace, Epichealth Ocean Plaza, and Epichealth…
-
Ukraine arrests four in $5 million crypto scam targeting Germans
Ukraine's cyber police said the four arrested men included the alleged leader of the scam call centers.
-
Microsoft's Azure Linux gets 470-plus security fixes in one almighty patching session
A mountain of CVEs, a certificate cleanup, and yet more work for Microsoft's patching teams
-
Who Gives A Crap? Hackers, apparently, after toilet paper maker's customer data exposed
UK shoppers caught up in third-party security mess, and nobody knows whether the data was flushed away
-
Alleged AI-aided cyberattack exploits assistant interface to breach German web host
Hackers allegedly assisted by AI breached a German web hosting company through a tool designed to allow customers to connect AI assistants to their accounts, the company disclosed.
-
Revolve Puts Data Breach Victim Count at 1.5 Million
Online fashion retailer Revolve has told regulators that the September cyberattack affected more than 1.5 million individuals. The post Revolve Puts Data Breach Victim Count at 1.5 Million appeared first on SecurityWeek .
-
Weill Cornell patient data entered into AI tools without authorization
Naomi Diaz reports: New York City-based Weill Cornell Medicine disclosed that patient health information was entered into AI tools and processed using machine learning without authorization as part of a radiology research study.…
-
Outlook.com bounces legit emails as Microsoft's authentication crackdown goes sideways
Missing DMARC or wobbly SPF means your mail may be treated as suspicious
Reuse this view
Same filters as JSON: /api/items?category=news&window=7d&sort=newest&limit=100. RSS for this section: feed.xml.