Apify Rotates API Tokens and Urges 2FA Resets After Breach
November 13, 2026
Apify rotated API tokens and proxy passwords and reset all sessions after an intruder reached internal systems on November 9
Identity and Access Management
Apify Rotates API Tokens and Urges 2FA Resets After Breach
Apify rotated API tokens and proxy passwords and reset all sessions after an intruder reached internal systems on November 9 and 10, with 2FA exposure ...
Xen Orchestra Auth Bypass Exploited to Hijack XCP-ng Hosts
Attackers are exploiting a critical Xen Orchestra authentication bypass, VSA-2026-062, to gain admin control and possibly root on XCP-ng virtualization nodes.
Ivanti Patches Critical EPM SQL Injection and CSA Auth Flaw
Ivanti's November advisories fix 13 flaws, including a CVSS 9.8 Endpoint Manager SQL injection and a CVSS 9.4 Cloud Services Application authentication flaw.
GPUStack Auth Bypass CVE-2026-102895 Exploited on AI Servers
Attackers are exploiting GPUStack CVE-2026-102895, a CVSS 9.8 authentication bypass that grants admin access and lets them run reverse shells on AI servers.
mSecure Tells Users to Reset Passwords Without Saying Why
mSecure's developer emailed customers to change passwords, reset 2FA and remove passkeys after suspicious activity, but has not explained what happened.
Rapid7 Releases Metasploit Module for BeyondTrust CVE-2026-102764
Rapid7 published a technical analysis and a working Metasploit module for CVE-2026-102764, a BeyondTrust Remote Support flaw already exploited in attacks.
Apache Kafka JWT Bypass CVE-2026-110985 Among 12 Fixed Flaws
Apache Kafka fixed 12 vulnerabilities, including CVE-2026-110985, a JWT validation bypass that lets unauthenticated attackers forge tokens for any user.
Hacktivists Leak Data on 41,000 DHS Staff, Claim Okta SSO Breach
A leak site carries internal data on more than 41,000 DHS employees and contractors. The Department of Peace claims an Okta SSO source; Okta denies ...
NVIDIA Patches CVSS 10.0 Authentication Flaw in NeMo Toolkit
NVIDIA fixed CVE-2026-65145, a CVSS 10.0 missing-authentication flaw in the NeMo Agent Toolkit, plus five other bugs in NeMo, TensorRT-LLM and PhysX products.
Fake IT Support Teams Chats Tied to 400+ Intrusions, Arctic Wolf Says
Arctic Wolf details a pattern in 400+ incidents where attackers pose as IT support in Microsoft Teams external chats and run malware within 15 minutes.
Xen Orchestra Auth Bypass Exploited to Hijack XCP-ng Hosts
November 11, 2026
Attackers are exploiting a critical Xen Orchestra authentication bypass, VSA-2026-062, to gain admin control and possibly root on XCP-ng virtualization
Ivanti Patches Critical EPM SQL Injection and CSA Auth Flaw
November 11, 2026
Ivanti’s November advisories fix 13 flaws, including a CVSS 9.8 Endpoint Manager SQL injection and a CVSS 9.4 Cloud Services
GPUStack Auth Bypass CVE-2026-102895 Exploited on AI Servers
November 5, 2026
Attackers are exploiting GPUStack CVE-2026-102895, a CVSS 9.8 authentication bypass that grants admin access and lets them run reverse shells
mSecure Tells Users to Reset Passwords Without Saying Why
November 4, 2026
mSecure’s developer emailed customers to change passwords, reset 2FA and remove passkeys after suspicious activity, but has not explained what
Rapid7 Releases Metasploit Module for BeyondTrust CVE-2026-102764
November 2, 2026
Rapid7 published a technical analysis and a working Metasploit module for CVE-2026-102764, a BeyondTrust Remote Support flaw already exploited in
Apache Kafka JWT Bypass CVE-2026-110985 Among 12 Fixed Flaws
October 29, 2026
Apache Kafka fixed 12 vulnerabilities, including CVE-2026-110985, a JWT validation bypass that lets unauthenticated attackers forge tokens for any user.
Hacktivists Leak Data on 41,000 DHS Staff, Claim Okta SSO Breach
October 29, 2026
A leak site carries internal data on more than 41,000 DHS employees and contractors. The Department of Peace claims an
NVIDIA Patches CVSS 10.0 Authentication Flaw in NeMo Toolkit
October 28, 2026
NVIDIA fixed CVE-2026-65145, a CVSS 10.0 missing-authentication flaw in the NeMo Agent Toolkit, plus five other bugs in NeMo, TensorRT-LLM
Fake IT Support Teams Chats Tied to 400+ Intrusions, Arctic Wolf Says
October 28, 2026
Arctic Wolf details a pattern in 400+ incidents where attackers pose as IT support in Microsoft Teams external chats and
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.