Cyber Security
CVE Vulnerability Alerts
Arista Patches Two CVSS 9.8 RCE Flaws Including HTTP2Shell
Arista fixed two CVSS 9.8 remote code execution flaws, HTTP2Shell in VeloCloud Orchestrator and a Linux kernel bug affecting access points and NDR devices.
Application Security
Apache Fixes Eight Flaws in Syncope, Fineract and Arrow
Apache patched eight flaws in Syncope, Fineract and Arrow Rust, including CVE-2026-64618, a CVSS 9.8 SQL injection needing no login; no exploitation reported.
AI Security
Hugging Face Datasets Flaw Lets Malicious Pickle Files Run Code
The deprecated pandas builder can execute code from an untrusted pickle file. A proposed fix is still awaiting review
Cybersecurity
FBI Blames North Korea’s TraderTraitor for $6.3B Binance Theft
The FBI, Secret Service and IRS-CI attribute the roughly $6.3 billion Binance theft to North Korea's TraderTraitor and publish 628 addresses used to launder it.
CVE Vulnerability Alerts
Public Exploit Lets One SMS Crash Android Phones, Drop 911 Calls
A public proof-of-concept for CVE-2026-58882 shows one malformed WAP Push text can crash Android's phone process and loop devices; Android 12 and 13 lack a ...
CVE Vulnerability Alerts
Canonical Patches CVSS 10.0 LXD Flaw Letting Attackers Spoof Clients
Canonical fixed CVE-2026-112816, a CVSS 10.0 LXD and MicroCloud flaw that lets attackers authenticate as a trusted client using only its public certificate.
CVE Vulnerability Alerts
Rapid7 Releases Metasploit Module for BeyondTrust CVE-2026-102764
Rapid7 published a technical analysis and a working Metasploit module for CVE-2026-102764, a BeyondTrust Remote Support flaw already exploited in attacks.
AI Security
Talos: VOLTA Infostealer Uses Claude and Gemini to Rank Victims
Cisco Talos details VOLTA-AUTODOXER, an infostealer that sends stolen victim data to Claude, Kimi or Gemini via OpenRouter to rank what each victim is worth.
CVE Vulnerability Alerts
Dell Fixes 44 PowerStore Flaws in DSA-2026-479, Seven Rated 9.8
Dell's DSA-2026-479 patches 44 PowerStore vulnerabilities, including seven rated CVSS 9.8 in the SDNAS file services layer. Upgrade to OS 5.1.0.0-2798105.
CVE Vulnerability Alerts
MediaTek November Bulletin Fixes 57 Flaws, Six Critical Modem Bugs
MediaTek's November Product Security Bulletin patches 57 flaws, including six critical modem bugs that allow remote privilege escalation over radio contact.
Application Security
Apache Wicket Discloses 19 Vulnerabilities Across Three Release Lines
Apache Wicket disclosed 19 vulnerabilities across versions 8.x, 9.x and 10.x, including XSS, missing authorization and upload DoS bugs. Upgrade to 10.12.0.
CVE Vulnerability Alerts
Public Exploit Targets Linux Bonding Driver Flaw CVE-2026-31419
A public exploit for CVE-2026-31419, a Linux kernel bonding driver race condition, demonstrates root and container escape on Google's Container-Optimized OS.
Cybersecurity
Binance Loses About $6.3 Billion in Record Crypto Heist
Binance says a compromised DevOps laptop let attackers drain about $6.3 billion in assets, with nearly $3 billion frozen. TRM Labs points to TraderTraitor.
Application Security
Drupal Commerce Core Auth Bypass CVE-2026-118539 Under Attack
Drupal warns attackers are exploiting CVE-2026-118539, a missing-authorization flaw in Commerce Core that allows an access bypass on affected online stores.
Application Security
WordPress 7.1.4 Fixes Core RCE Flaw Attackers Are Probing
Wordfence logged more than 18,500 malicious requests in 21 hours against a WordPress Core upgrade flaw. WordPress 7.1.4 randomizes the staging directory.
CVE Vulnerability Alerts
Cisco Patches Exploited ASA/FTD VPN Zero-Day CVE-2026-76418
Cisco fixed CVE-2026-76418, a zero-day that crashes ASA and FTD SSL VPN devices. CISA added it and a GitLab RCE to KEV with a November ...
Application Security
Polymarket Halts Trading After Hacked DebugBear Script Drains Wallets
Attackers compromised DebugBear's monitoring script to serve crypto-draining code on Polymarket, with about $2.5 million traced as stolen from trader wallets.
Cybersecurity
Cyberattack Knocks Belgium’s MyMinfin Tax Portal Offline
Belgium's FPS Finance confirmed a cyberattack and pulled several digital services offline, including MyMinfin, and pushed one tax filing deadline to November 16.
Application Security
TeamViewer Flaw CVE-2026-111585 Lets Hosts Hijack Technicians
A CVSS 8.8 integer overflow in TeamViewer's viewer lets a malicious remote host crash or run code on a support technician's Windows, macOS, Linux or ...
Application Security
Progress Patches 15 WS_FTP Server Flaws, Including CVSS 10.0 Bug
Progress fixed 15 WS_FTP Server vulnerabilities, led by CVE-2026-84295, a CVSS 10.0 authentication flaw that exposes administrative credentials to attackers.
Application Security
N-able Takes N-central Offline After Researcher Posts 33 Flaws
Cybersecurity
Vanderbilt Hit by BYOD Ransomware Gang Claiming 1M SSNs
TOP CYBERSECURITY HEADLINES
Cybersecurity
Vanderbilt Hit by BYOD Ransomware Gang Claiming 1M SSNs
Application Security
Web3Auth Flaw Exploited to Drain Keplr Social-Login Wallets
Application Security
LNbits Tells All Operators to Shut Down Amid Wallet Attacks
Application Security
Roundcube 1.6.21 and 1.7.6 Patch 17 Webmail Security Flaws
This Week’s Security Spotlight
CVE Vulnerability Alerts
Working Exploit Out for Windows Error Reporting Flaw CVE-2026-97798
CVE Vulnerability Alerts
Citrix Fixes CVSS 9.8 XenServer Flaw and Brotli Bug in Scout
CVE Vulnerability Alerts
ASUS Patches AiCloud Root Flaw CVE-2026-84730 in Four Alerts
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- AI Security
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
FBI Blames North Korea’s TraderTraitor for $6.3B Binance Theft
The FBI, Secret Service and IRS-CI attribute the roughly $6.3 billion Binance theft to North Korea's TraderTraitor and publish 628 addresses used to launder it.
Public Exploit Lets One SMS Crash Android Phones, Drop 911 Calls
A public proof-of-concept for CVE-2026-58882 shows one malformed WAP Push text can crash Android's phone process and loop devices; Android 12 and 13 lack a ...
Canonical Patches CVSS 10.0 LXD Flaw Letting Attackers Spoof Clients
Canonical fixed CVE-2026-112816, a CVSS 10.0 LXD and MicroCloud flaw that lets attackers authenticate as a trusted client using only its public certificate.
Rapid7 Releases Metasploit Module for BeyondTrust CVE-2026-102764
Rapid7 published a technical analysis and a working Metasploit module for CVE-2026-102764, a BeyondTrust Remote Support flaw already exploited in attacks.
Talos: VOLTA Infostealer Uses Claude and Gemini to Rank Victims
Cisco Talos details VOLTA-AUTODOXER, an infostealer that sends stolen victim data to Claude, Kimi or Gemini via OpenRouter to rank what each victim is worth.
Dell Fixes 44 PowerStore Flaws in DSA-2026-479, Seven Rated 9.8
Dell's DSA-2026-479 patches 44 PowerStore vulnerabilities, including seven rated CVSS 9.8 in the SDNAS file services layer. Upgrade to OS 5.1.0.0-2798105.
MediaTek November Bulletin Fixes 57 Flaws, Six Critical Modem Bugs
MediaTek's November Product Security Bulletin patches 57 flaws, including six critical modem bugs that allow remote privilege escalation over radio contact.
Apache Wicket Discloses 19 Vulnerabilities Across Three Release Lines
Apache Wicket disclosed 19 vulnerabilities across versions 8.x, 9.x and 10.x, including XSS, missing authorization and upload DoS bugs. Upgrade to 10.12.0.
Public Exploit Targets Linux Bonding Driver Flaw CVE-2026-31419
A public exploit for CVE-2026-31419, a Linux kernel bonding driver race condition, demonstrates root and container escape on Google's Container-Optimized OS.
Binance Loses About $6.3 Billion in Record Crypto Heist
Binance says a compromised DevOps laptop let attackers drain about $6.3 billion in assets, with nearly $3 billion frozen. TRM Labs points to TraderTraitor.
Drupal Commerce Core Auth Bypass CVE-2026-118539 Under Attack
Drupal warns attackers are exploiting CVE-2026-118539, a missing-authorization flaw in Commerce Core that allows an access bypass on affected online stores.
WordPress 7.1.4 Fixes Core RCE Flaw Attackers Are Probing
Wordfence logged more than 18,500 malicious requests in 21 hours against a WordPress Core upgrade flaw. WordPress 7.1.4 randomizes the staging directory.
Cisco Patches Exploited ASA/FTD VPN Zero-Day CVE-2026-76418
Cisco fixed CVE-2026-76418, a zero-day that crashes ASA and FTD SSL VPN devices. CISA added it and a GitLab RCE to KEV with a November ...
Polymarket Halts Trading After Hacked DebugBear Script Drains Wallets
Attackers compromised DebugBear's monitoring script to serve crypto-draining code on Polymarket, with about $2.5 million traced as stolen from trader wallets.
Cyberattack Knocks Belgium’s MyMinfin Tax Portal Offline
Belgium's FPS Finance confirmed a cyberattack and pulled several digital services offline, including MyMinfin, and pushed one tax filing deadline to November 16.
TeamViewer Flaw CVE-2026-111585 Lets Hosts Hijack Technicians
A CVSS 8.8 integer overflow in TeamViewer's viewer lets a malicious remote host crash or run code on a support technician's Windows, macOS, Linux or ...
Progress Patches 15 WS_FTP Server Flaws, Including CVSS 10.0 Bug
Progress fixed 15 WS_FTP Server vulnerabilities, led by CVE-2026-84295, a CVSS 10.0 authentication flaw that exposes administrative credentials to attackers.
ServiceNow Patches Critical AI Platform Sandbox Escape Flaw
ServiceNow fixed CVE-2026-103093, a critical Rhino sandbox bypass that lets an authenticated admin run code on the host OS, plus two other flaws in KB3228994.
NebuSec: Telegram Android Flaw Chain Can Hijack Phone on Call
NebuSec says a Telegram for Android flaw, chained with an info leak and a root exploit, could take over a phone when a user answers ...
Researcher Finds 26,400 Live Cloud and AI Keys on Gitee
Researcher Ben Zimmermann scanned 7.25 million public Gitee repositories and found about 26,400 working cloud and AI credentials, led by Alibaba Cloud keys.