Cyber Security
CVE Vulnerability Alerts
Intel and AMD Patch Over 200 Vulnerabilities in November Updates
Intel fixed more than 100 flaws across 24 advisories, including a TDX Migration Trust Domain RCE, while AMD patched about 100 CVEs, none rated critical ...
CVE Vulnerability Alerts
CISA Adds Cisco BroadWorks XXE Flaw to KEV as Telecom Hit
CISA added Cisco BroadWorks flaw CVE-2026-20320 to its KEV catalog after a Chinese-speaking actor used it against a European telecom and 13+ other orgs.
CVE Vulnerability Alerts
SignDrop Windows CLFS Zero-Day Exploit Published, No Patch
A researcher published SignDrop, a working exploit for an unpatched Windows CLFS flaw that lets a standard user reach SYSTEM and potentially disable AV and ...
Application Security
N-able Takes N-central Offline After Researcher Posts 33 Flaws
N-able pulled its hosted N-central platform offline worldwide after researcher Sean Bales published 33 alleged flaws and working exploit scripts on GitHub.
Application Security
Google Patches Chrome Zero-Day CVE-2026-125350 Under Attack
Google released Chrome 157 to fix CVE-2026-125350, an XML use-after-free it says is exploited in the wild, plus eight other flaws including a V8 type ...
Application Security
Backdoored Ethersphere bee-js and Swarm Desktop Steal Wallets
Malicious bee-js 13.3.0 and Swarm Desktop 0.56.2 releases stole Ethereum keystores and installed remote access tools, researchers at Socket and SafeDep report.
Cybersecurity
Vanderbilt Hit by BYOD Ransomware Gang Claiming 1M SSNs
Vanderbilt University confirmed an active cybersecurity incident as the BYOD ransomware group listed it on its leak site, claiming over one million SSNs.
Application Security
Web3Auth Flaw Exploited to Drain Keplr Social-Login Wallets
A Web3Auth infrastructure flaw let attackers drain Keplr wallets created with Google or Apple login; estimates put confirmed losses between $1M and $6M.
Application Security
LNbits Tells All Operators to Shut Down Amid Wallet Attacks
LNbits urged every operator to shut down servers after attackers exploited a paywall extension flaw to drain Lightning funds; BitTipBot lost 2.28M sats.
Application Security
Roundcube 1.6.21 and 1.7.6 Patch 17 Webmail Security Flaws
Roundcube released versions 1.6.21 and 1.7.6 on Monday to fix 17 webmail vulnerabilities, including injection bugs, SSRF filter bypasses and CSRF gaps.
Cybersecurity
Meloni Blames Pro-Russian Hackers for Tajani Data Leak
Italian Premier Giorgia Meloni blamed pro-Russian hackers after personal data on Foreign Minister Antonio Tajani appeared on the dark web, with payment offered.
Cybersecurity
DOJ Indicts Three Over AI Deepfake CEO Scams Costing $129M
The DOJ and FBI indicted Jacob Soall, Sharon Hazan and Guy Sheetrit for using AI to impersonate executives and attorneys in $129 million wire scams.
Application Security
Attackers Exploit SSHole OpenSSH Flaw CVE-2026-123158 on Alpine
GreyNoise and Previdian report active exploitation of the SSHole OpenSSH flaw CVE-2026-123158 on musl-based Linux, including a Python C2 tool called TAC Agent.
Cybersecurity
SEGA Newsletter Breach at Vendor ARARA Exposes 2.2M Emails
SEGA disclosed that a breach at newsletter vendor ARARA exposed 2.2 million email addresses across 11 newsletters; SEGA Account systems were not affected.
Cybersecurity
Binance Denies Breach After ShinyHunters Claim of 335M Users
Binance says it found no evidence of compromise after a forum actor using the ShinyHunters name claimed data on 335 million users and demanded $900,000.
Cybersecurity
France Blames Iran’s IRGC Shahid Kaveh for Supermarket Attacks
France formally attributed the supermarket refrigeration attacks to Iran's IRGC Shahid Kaveh unit and will summon Iran's ambassador and propose EU sanctions.
Application Security
WP Duplicate Plugin Flaw CVE-2026-123751 Exploited With No Patch
WPScan reports attackers are exploiting CVE-2026-123751 in the WP Duplicate WordPress plugin, an unauthenticated upload flaw leading to remote code execution.
CVE Vulnerability Alerts
SonicWall Patches Exploited SonicOS SAML MFA Bypass, CVE-2026-19868
SonicWall patched CVE-2026-19868, a SonicOS SSL VPN flaw that bypasses SAML MFA, and CISA added it to its KEV catalog after a report of possible ...
Application Security
UnrealIRCd Warns CVE-2026-114713 Is Under Attack, Worst in 15 Years
The UnrealIRCd team says attackers are exploiting CVE-2026-114713, a labeled-response flaw it calls the most critical issue in 15 years, on linked IRC networks.
Application Security
JPCERT/CC Warns Openwave Webtop Flaw CVE-2026-111793 Is Exploited
JPCERT/CC says attackers are exploiting CVE-2026-111793 in Openwave Webtop Media Transcoder, a flaw patched in December 2021 that exposes sensitive data.
CVE Vulnerability Alerts
PHP2Shell Attacks on Check Point Gateways Deploy TSGA, ESXi Wiper
TOP CYBERSECURITY HEADLINES
CVE Vulnerability Alerts
Citrix Patches 28 NetScaler Flaws and Critical Console Auth Bypass
This Week’s Security Spotlight
CVE Vulnerability Alerts
Barracuda Flaws CVE-2026-116606 and CVE-2026-111560 Exploited
CVE Vulnerability Alerts
Intel and AMD Patch Over 200 Vulnerabilities in November Updates
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- AI Security
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
N-able Takes N-central Offline After Researcher Posts 33 Flaws
N-able pulled its hosted N-central platform offline worldwide after researcher Sean Bales published 33 alleged flaws and working exploit scripts on GitHub.
Google Patches Chrome Zero-Day CVE-2026-125350 Under Attack
Google released Chrome 157 to fix CVE-2026-125350, an XML use-after-free it says is exploited in the wild, plus eight other flaws including a V8 type ...
Backdoored Ethersphere bee-js and Swarm Desktop Steal Wallets
Malicious bee-js 13.3.0 and Swarm Desktop 0.56.2 releases stole Ethereum keystores and installed remote access tools, researchers at Socket and SafeDep report.
Vanderbilt Hit by BYOD Ransomware Gang Claiming 1M SSNs
Vanderbilt University confirmed an active cybersecurity incident as the BYOD ransomware group listed it on its leak site, claiming over one million SSNs.
Web3Auth Flaw Exploited to Drain Keplr Social-Login Wallets
A Web3Auth infrastructure flaw let attackers drain Keplr wallets created with Google or Apple login; estimates put confirmed losses between $1M and $6M.
LNbits Tells All Operators to Shut Down Amid Wallet Attacks
LNbits urged every operator to shut down servers after attackers exploited a paywall extension flaw to drain Lightning funds; BitTipBot lost 2.28M sats.
Roundcube 1.6.21 and 1.7.6 Patch 17 Webmail Security Flaws
Roundcube released versions 1.6.21 and 1.7.6 on Monday to fix 17 webmail vulnerabilities, including injection bugs, SSRF filter bypasses and CSRF gaps.
Meloni Blames Pro-Russian Hackers for Tajani Data Leak
Italian Premier Giorgia Meloni blamed pro-Russian hackers after personal data on Foreign Minister Antonio Tajani appeared on the dark web, with payment offered.
DOJ Indicts Three Over AI Deepfake CEO Scams Costing $129M
The DOJ and FBI indicted Jacob Soall, Sharon Hazan and Guy Sheetrit for using AI to impersonate executives and attorneys in $129 million wire scams.
Attackers Exploit SSHole OpenSSH Flaw CVE-2026-123158 on Alpine
GreyNoise and Previdian report active exploitation of the SSHole OpenSSH flaw CVE-2026-123158 on musl-based Linux, including a Python C2 tool called TAC Agent.
SEGA Newsletter Breach at Vendor ARARA Exposes 2.2M Emails
SEGA disclosed that a breach at newsletter vendor ARARA exposed 2.2 million email addresses across 11 newsletters; SEGA Account systems were not affected.
Binance Denies Breach After ShinyHunters Claim of 335M Users
Binance says it found no evidence of compromise after a forum actor using the ShinyHunters name claimed data on 335 million users and demanded $900,000.
France Blames Iran’s IRGC Shahid Kaveh for Supermarket Attacks
France formally attributed the supermarket refrigeration attacks to Iran's IRGC Shahid Kaveh unit and will summon Iran's ambassador and propose EU sanctions.
WP Duplicate Plugin Flaw CVE-2026-123751 Exploited With No Patch
WPScan reports attackers are exploiting CVE-2026-123751 in the WP Duplicate WordPress plugin, an unauthenticated upload flaw leading to remote code execution.
SonicWall Patches Exploited SonicOS SAML MFA Bypass, CVE-2026-19868
SonicWall patched CVE-2026-19868, a SonicOS SSL VPN flaw that bypasses SAML MFA, and CISA added it to its KEV catalog after a report of possible ...
UnrealIRCd Warns CVE-2026-114713 Is Under Attack, Worst in 15 Years
The UnrealIRCd team says attackers are exploiting CVE-2026-114713, a labeled-response flaw it calls the most critical issue in 15 years, on linked IRC networks.
JPCERT/CC Warns Openwave Webtop Flaw CVE-2026-111793 Is Exploited
JPCERT/CC says attackers are exploiting CVE-2026-111793 in Openwave Webtop Media Transcoder, a flaw patched in December 2021 that exposes sensitive data.
Public PoC Released for Hugging Face Datasets RCE CVE-2026-57845
A researcher published a working exploit for CVE-2026-57845, a CVSS 8.8 pickle deserialization flaw in Hugging Face datasets up to 5.1.0 with no fix available.
uutils Coreutils Flaw (CVSS 9.9) Let Translation File Inject Code
A CVSS 9.9 flaw in the uucore crate of uutils coreutils let a crafted translation file inject Rust code at build time. A PoC is ...
Working Exploit Out for Windows Error Reporting Flaw CVE-2026-97798
A researcher released a working exploit for CVE-2026-97798, a Windows Error Reporting flaw that gives SYSTEM from a standard account, patched in October.