Cyber Security
CVE Vulnerability Alerts
Microsoft Patches Outlook Zero-Day CVE-2026-124194 in 1,000+ Fixes
Microsoft's November Patch Tuesday fixed more than 1,000 flaws and an exploited Outlook zero-day, CVE-2026-124194, that leaks NTLMv2 hashes to attackers.
Application Security
SAP Patches Four CVSS 10.0 Flaws Including ICM2SHELL RCE
SAP's November Patch Day fixed 35 flaws, four rated CVSS 10.0, including unauthenticated RCE in ICM and Web Dispatcher dubbed ICM2SHELL and PROXYGATE.
CVE Vulnerability Alerts
Xen Orchestra Auth Bypass Exploited to Hijack XCP-ng Hosts
Attackers are exploiting a critical Xen Orchestra authentication bypass, VSA-2026-062, to gain admin control and possibly root on XCP-ng virtualization nodes.
CVE Vulnerability Alerts
Barracuda Flaws CVE-2026-116606 and CVE-2026-111560 Exploited
Barracuda confirms attackers are chaining CVE-2026-116606 and CVE-2026-111560 to gain root on its security appliances, and CISA added both to its KEV catalog.
Application Security
Git 2.56.1 Fixes Code Execution Flaw CVE-2026-111760 in Clones
Git 2.56.1 patches six vulnerabilities, including CVE-2026-111760, which can run attacker code when developers recursively clone a malicious repository.
Application Security
SGLang RCE Flaw Exploited to Breach NEAR AI, 18 Agents Exposed
An attacker used a remote code execution flaw in the SGLang inference engine to breach NEAR AI, exposing 18 AI agents and about 100 Private ...
CVE Vulnerability Alerts
Public iOS Sandbox Escape ‘worse_query’ Threatens Wallet Keys
A public iOS exploit named worse_query could expose crypto seed phrases and private keys from other apps; Binance warned users and Apple has confirmed no ...
CVE Vulnerability Alerts
Apple iOS 27.2.1 Fixes iMessage Group Chat and Bluetooth Flaws
Apple's iOS 27.2.1 patches iMessage group chat flaws CVE-2026-113961 and CVE-2026-113960 plus nine Bluetooth and AirPlay pairing bugs; no exploitation known.
CVE Vulnerability Alerts
Fortinet Patches Eight Critical Flaws in FortiOS and FortiManager
Fortinet fixed eight critical vulnerabilities rated CVSS 9.0 to 9.8 across FortiOS, FortiManager, FortiAnalyzer and FortiSASE; six need no authentication.
Application Security
Synology Patches 27 DSM Flaws, Including CVSS 9.8 SQL Injection
Synology fixed 27 DiskStation Manager flaws, including CVE-2026-76954, a pre-authentication SQL injection in the Auth API rated CVSS 9.8, with no workarounds.
CVE Vulnerability Alerts
Ivanti Patches Critical EPM SQL Injection and CSA Auth Flaw
Ivanti's November advisories fix 13 flaws, including a CVSS 9.8 Endpoint Manager SQL injection and a CVSS 9.4 Cloud Services Application authentication flaw.
CVE Vulnerability Alerts
Intel and AMD Patch Over 200 Vulnerabilities in November Updates
Intel fixed more than 100 flaws across 24 advisories, including a TDX Migration Trust Domain RCE, while AMD patched about 100 CVEs, none rated critical ...
CVE Vulnerability Alerts
CISA Adds Cisco BroadWorks XXE Flaw to KEV as Telecom Hit
CISA added Cisco BroadWorks flaw CVE-2026-20320 to its KEV catalog after a Chinese-speaking actor used it against a European telecom and 13+ other orgs.
CVE Vulnerability Alerts
SignDrop Windows CLFS Zero-Day Exploit Published, No Patch
A researcher published SignDrop, a working exploit for an unpatched Windows CLFS flaw that lets a standard user reach SYSTEM and potentially disable AV and ...
Application Security
N-able Takes N-central Offline After Researcher Posts 33 Flaws
N-able pulled its hosted N-central platform offline worldwide after researcher Sean Bales published 33 alleged flaws and working exploit scripts on GitHub.
Application Security
Google Patches Chrome Zero-Day CVE-2026-125350 Under Attack
Google released Chrome 157 to fix CVE-2026-125350, an XML use-after-free it says is exploited in the wild, plus eight other flaws including a V8 type ...
Application Security
Backdoored Ethersphere bee-js and Swarm Desktop Steal Wallets
Malicious bee-js 13.3.0 and Swarm Desktop 0.56.2 releases stole Ethereum keystores and installed remote access tools, researchers at Socket and SafeDep report.
Cybersecurity
Vanderbilt Hit by BYOD Ransomware Gang Claiming 1M SSNs
Vanderbilt University confirmed an active cybersecurity incident as the BYOD ransomware group listed it on its leak site, claiming over one million SSNs.
Application Security
Web3Auth Flaw Exploited to Drain Keplr Social-Login Wallets
A Web3Auth infrastructure flaw let attackers drain Keplr wallets created with Google or Apple login; estimates put confirmed losses between $1M and $6M.
Application Security
LNbits Tells All Operators to Shut Down Amid Wallet Attacks
LNbits urged every operator to shut down servers after attackers exploited a paywall extension flaw to drain Lightning funds; BitTipBot lost 2.28M sats.
CVE Vulnerability Alerts
Microsoft Patches Outlook Zero-Day CVE-2026-124194 in 1,000+ Fixes
Application Security
SGLang RCE Flaw Exploited to Breach NEAR AI, 18 Agents Exposed
TOP CYBERSECURITY HEADLINES
CVE Vulnerability Alerts
Barracuda Flaws CVE-2026-116606 and CVE-2026-111560 Exploited
Application Security
Git 2.56.1 Fixes Code Execution Flaw CVE-2026-111760 in Clones
Application Security
SGLang RCE Flaw Exploited to Breach NEAR AI, 18 Agents Exposed
CVE Vulnerability Alerts
Public iOS Sandbox Escape ‘worse_query’ Threatens Wallet Keys
This Week’s Security Spotlight
CVE Vulnerability Alerts
Barracuda Flaws CVE-2026-116606 and CVE-2026-111560 Exploited
CVE Vulnerability Alerts
Intel and AMD Patch Over 200 Vulnerabilities in November Updates
CVE Vulnerability Alerts
Working Exploit Out for Windows Error Reporting Flaw CVE-2026-97798
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- AI Security
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
Barracuda Flaws CVE-2026-116606 and CVE-2026-111560 Exploited
Barracuda confirms attackers are chaining CVE-2026-116606 and CVE-2026-111560 to gain root on its security appliances, and CISA added both to its KEV catalog.
Git 2.56.1 Fixes Code Execution Flaw CVE-2026-111760 in Clones
Git 2.56.1 patches six vulnerabilities, including CVE-2026-111760, which can run attacker code when developers recursively clone a malicious repository.
SGLang RCE Flaw Exploited to Breach NEAR AI, 18 Agents Exposed
An attacker used a remote code execution flaw in the SGLang inference engine to breach NEAR AI, exposing 18 AI agents and about 100 Private ...
Public iOS Sandbox Escape ‘worse_query’ Threatens Wallet Keys
A public iOS exploit named worse_query could expose crypto seed phrases and private keys from other apps; Binance warned users and Apple has confirmed no ...
Apple iOS 27.2.1 Fixes iMessage Group Chat and Bluetooth Flaws
Apple's iOS 27.2.1 patches iMessage group chat flaws CVE-2026-113961 and CVE-2026-113960 plus nine Bluetooth and AirPlay pairing bugs; no exploitation known.
Fortinet Patches Eight Critical Flaws in FortiOS and FortiManager
Fortinet fixed eight critical vulnerabilities rated CVSS 9.0 to 9.8 across FortiOS, FortiManager, FortiAnalyzer and FortiSASE; six need no authentication.
Synology Patches 27 DSM Flaws, Including CVSS 9.8 SQL Injection
Synology fixed 27 DiskStation Manager flaws, including CVE-2026-76954, a pre-authentication SQL injection in the Auth API rated CVSS 9.8, with no workarounds.
Ivanti Patches Critical EPM SQL Injection and CSA Auth Flaw
Ivanti's November advisories fix 13 flaws, including a CVSS 9.8 Endpoint Manager SQL injection and a CVSS 9.4 Cloud Services Application authentication flaw.
Intel and AMD Patch Over 200 Vulnerabilities in November Updates
Intel fixed more than 100 flaws across 24 advisories, including a TDX Migration Trust Domain RCE, while AMD patched about 100 CVEs, none rated critical ...
CISA Adds Cisco BroadWorks XXE Flaw to KEV as Telecom Hit
CISA added Cisco BroadWorks flaw CVE-2026-20320 to its KEV catalog after a Chinese-speaking actor used it against a European telecom and 13+ other orgs.
SignDrop Windows CLFS Zero-Day Exploit Published, No Patch
A researcher published SignDrop, a working exploit for an unpatched Windows CLFS flaw that lets a standard user reach SYSTEM and potentially disable AV and ...
N-able Takes N-central Offline After Researcher Posts 33 Flaws
N-able pulled its hosted N-central platform offline worldwide after researcher Sean Bales published 33 alleged flaws and working exploit scripts on GitHub.
Google Patches Chrome Zero-Day CVE-2026-125350 Under Attack
Google released Chrome 157 to fix CVE-2026-125350, an XML use-after-free it says is exploited in the wild, plus eight other flaws including a V8 type ...
Backdoored Ethersphere bee-js and Swarm Desktop Steal Wallets
Malicious bee-js 13.3.0 and Swarm Desktop 0.56.2 releases stole Ethereum keystores and installed remote access tools, researchers at Socket and SafeDep report.
Vanderbilt Hit by BYOD Ransomware Gang Claiming 1M SSNs
Vanderbilt University confirmed an active cybersecurity incident as the BYOD ransomware group listed it on its leak site, claiming over one million SSNs.
Web3Auth Flaw Exploited to Drain Keplr Social-Login Wallets
A Web3Auth infrastructure flaw let attackers drain Keplr wallets created with Google or Apple login; estimates put confirmed losses between $1M and $6M.
LNbits Tells All Operators to Shut Down Amid Wallet Attacks
LNbits urged every operator to shut down servers after attackers exploited a paywall extension flaw to drain Lightning funds; BitTipBot lost 2.28M sats.
Roundcube 1.6.21 and 1.7.6 Patch 17 Webmail Security Flaws
Roundcube released versions 1.6.21 and 1.7.6 on Monday to fix 17 webmail vulnerabilities, including injection bugs, SSRF filter bypasses and CSRF gaps.
Meloni Blames Pro-Russian Hackers for Tajani Data Leak
Italian Premier Giorgia Meloni blamed pro-Russian hackers after personal data on Foreign Minister Antonio Tajani appeared on the dark web, with payment offered.
DOJ Indicts Three Over AI Deepfake CEO Scams Costing $129M
The DOJ and FBI indicted Jacob Soall, Sharon Hazan and Guy Sheetrit for using AI to impersonate executives and attorneys in $129 million wire scams.