ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories
How much damage can someone do without breaking much? Quite a lot, it seems. A stolen login can open doors across several systems. A trusted setting can be used to lock people out. Even a simple file copy can reach places it shouldn't. And while new tools are helping find security holes faster, some important systems are still taking months, sometimes over a year, to get patched. Not exactly a
https://thehackernews.com/2026/11/threatsday-apache-ofbiz-rce-dreamhost.html
How much damage can someone do without breaking much? Quite a lot, it seems. A stolen login can open doors across several systems. A trusted setting can be used to lock people out. Even a simple file copy can reach places it shouldn't. And while new tools are helping find security holes faster, some important systems are still taking months, sometimes over a year, to get patched. Not exactly a
https://thehackernews.com/2026/11/threatsday-apache-ofbiz-rce-dreamhost.html
OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux
Attackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name, and a password between 257 and 1,024 bytes long.
OpenSSH, which rates the flaw critical, released version 10.6p2 today to block it. Alpine has published fixed packages for every
https://thehackernews.com/2026/11/openssh-issues-emergency-fix-for-flaw.html
Attackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name, and a password between 257 and 1,024 bytes long.
OpenSSH, which rates the flaw critical, released version 10.6p2 today to block it. Alpine has published fixed packages for every
https://thehackernews.com/2026/11/openssh-issues-emergency-fix-for-flaw.html
Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction
Cybersecurity researchers have disclosed details of a now-patched vulnerability that could be exploited to bypass Lockdown Mode protections in OpenAI ChatGPT.
Lockdown Mode was introduced by the artificial intelligence (AI) company in June 2026 as an optional setting to minimize data exfiltration risks arising from prompt injections.
"The flaw could enable silent chat data theft, phishing,
https://thehackernews.com/2026/11/researchers-bypass-chatgpt-lockdown.html
Cybersecurity researchers have disclosed details of a now-patched vulnerability that could be exploited to bypass Lockdown Mode protections in OpenAI ChatGPT.
Lockdown Mode was introduced by the artificial intelligence (AI) company in June 2026 as an optional setting to minimize data exfiltration risks arising from prompt injections.
"The flaw could enable silent chat data theft, phishing,
https://thehackernews.com/2026/11/researchers-bypass-chatgpt-lockdown.html
Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs
A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week.
The backdoored web server executes commands that attackers send via web requests, and those requests never appear in its access logs. Installing it takes root access, so the attackers must already control the server.
https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html
A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week.
The backdoored web server executes commands that attackers send via web requests, and those requests never appear in its access logs. Installing it takes root access, so the attackers must already control the server.
https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html
Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required.
The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday.
One flaw, CVE-2026-116606, is an authorization bypass. An unauthenticated attacker can use it to restore a
https://thehackernews.com/2026/11/experts-demonstrate-barracuda-email.html
Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required.
The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday.
One flaw, CVE-2026-116606, is an authorization bypass. An unauthenticated attacker can use it to restore a
https://thehackernews.com/2026/11/experts-demonstrate-barracuda-email.html
Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services
Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names, usernames, password hashes and live tokens for all users.
"While we investigated, we removed access to Reactor and Data Solutions," the company said. "At this time we continue to have no evidence that any investigations data has been accessed
https://thehackernews.com/2026/11/chainalysis-breach-exposes-all-users.html
Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names, usernames, password hashes and live tokens for all users.
"While we investigated, we removed access to Reactor and Data Solutions," the company said. "At this time we continue to have no evidence that any investigations data has been accessed
https://thehackernews.com/2026/11/chainalysis-breach-exposes-all-users.html
The Flood is Coming And The Pipes Were Already Full
An update on Athena, and some unsolicited predictions on what's coming next
On Saturday, Dario Amodei published We Must Pace the Frontier. I agree with him. Go read it if you haven't. I've spent the summer looking at what these models find, and the gap he describes between what they can do and what the rest of us are ready for is the one I've been staring at since May.
The hardest piece of his
https://thehackernews.com/2026/11/the-flood-is-coming-and-pipes-were.html
An update on Athena, and some unsolicited predictions on what's coming next
On Saturday, Dario Amodei published We Must Pace the Frontier. I agree with him. Go read it if you haven't. I've spent the summer looking at what these models find, and the gap he describes between what they can do and what the rest of us are ready for is the one I've been staring at since May.
The hardest piece of his
https://thehackernews.com/2026/11/the-flood-is-coming-and-pipes-were.html
Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It
A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates.
The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News checked today.
The flaw is an out-of-bounds read that could let an attacker run code over a network. Microsoft rates
https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html
A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates.
The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News checked today.
The flaw is an out-of-bounds read that could let an attacker run code over a network. Microsoft rates
https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html
Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' Computers
A browser extension that can run scripts on claude.ai could make Claude Desktop run code on a person's computer, researchers at Forever Security, an endpoint security company, showed in a test.
The attack needs Dispatch, a Claude feature that lets people send tasks from their phone to Claude Desktop. The flaw that makes this possible can still be exploited, the researchers said earlier this
https://thehackernews.com/2026/11/malicious-browser-extensions-could-use.html
A browser extension that can run scripts on claude.ai could make Claude Desktop run code on a person's computer, researchers at Forever Security, an endpoint security company, showed in a test.
The attack needs Dispatch, a Claude feature that lets people send tasks from their phone to Claude Desktop. The flaw that makes this possible can still be exploited, the researchers said earlier this
https://thehackernews.com/2026/11/malicious-browser-extensions-could-use.html
Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time
Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it.
The update that installs the fix still unpacks its files using the site's old, unpatched code, so an attacker who strikes at the right moment can run code on the server. The researcher advises blocking web access to the
https://thehackernews.com/2026/11/installing-fix-for-exploited-wordpress.html
Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it.
The update that installs the fix still unpacks its files using the site's old, unpatched code, so an attacker who strikes at the right moment can run code on the server. The researcher advises blocking web access to the
https://thehackernews.com/2026/11/installing-fix-for-exploited-wordpress.html
Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian.
The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled,
https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html
Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian.
The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled,
https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html
OpenAI Launches GPT-6 Cyber After AI Helps Find 81 Firefox Flaws, 948 Linux Exploits
OpenAI on Thursday unveiled GPT‑6 Cyber, which it described as a major step forward in security research that brings together stronger cybersecurity capabilities with a step-change improvement in model alignment.
The new model is "more capable at finding and fixing vulnerabilities, and far more reliable staying within the boundaries researchers set," OpenAI said. It has classified the model as
https://thehackernews.com/2026/11/openai-launches-gpt-6-cyber-after-ai.html
OpenAI on Thursday unveiled GPT‑6 Cyber, which it described as a major step forward in security research that brings together stronger cybersecurity capabilities with a step-change improvement in model alignment.
The new model is "more capable at finding and fixing vulnerabilities, and far more reliable staying within the boundaries researchers set," OpenAI said. It has classified the model as
https://thehackernews.com/2026/11/openai-launches-gpt-6-cyber-after-ai.html
Free Chinese AI Models Are Getting Scary Good at Hacking
An experiment in which AI models were asked to break into simulated networks showed the hacking skills of DeepSeek and GLM to be not far behind OpenAI’s most advanced cyber model, which isn’t public.
https://www.wired.com/story/free-chinese-ai-models-are-getting-scary-good-at-hacking/
An experiment in which AI models were asked to break into simulated networks showed the hacking skills of DeepSeek and GLM to be not far behind OpenAI’s most advanced cyber model, which isn’t public.
https://www.wired.com/story/free-chinese-ai-models-are-getting-scary-good-at-hacking/
WIRED
Free Chinese AI Models Are Getting Scary Good at Hacking
An experiment in which AI models were asked to break into simulated networks showed the hacking skills of DeepSeek and GLM to be not far behind OpenAI’s most advanced cyber model, which isn’t public.
Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them.
When a user selects "Yes, and don't ask again," Anthropic's AI coding assistant can save the command, word-for-word, including the secret, in a project settings file.
Software security company Apiiro said yesterday that 1,122 public
https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them.
When a user selects "Yes, and don't ask again," Anthropic's AI coding assistant can save the command, word-for-word, including the secret, in a project settings file.
Software security company Apiiro said yesterday that 1,122 public
https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html
The Fridge-Hacking Spree Is an Internet-of-Things Wake-Up Call
Escalating hacks affecting blood labs and grocery stores show the very real risks to critical infrastructure that come from basic security lapses involving internet-connected devices.
https://www.wired.com/story/kernel-panic-refrigeration-hacks-internet-of-things/
Escalating hacks affecting blood labs and grocery stores show the very real risks to critical infrastructure that come from basic security lapses involving internet-connected devices.
https://www.wired.com/story/kernel-panic-refrigeration-hacks-internet-of-things/
WIRED
The Fridge-Hacking Spree Is an Internet-of-Things Wake-Up Call
Escalating hacks affecting blood labs and grocery stores show the very real risks to critical infrastructure that come from basic security lapses involving internet-connected devices.
SIM Swapping – How a Bribe Bypassed AT&T’s Security
SIM swapping explained through Michael Terpin's case: how a bribe at an AT&T retailer moved his number, what he lost, and the FCC rules that followed.
https://www.darknet.org.uk/2026/11/sim-swapping-michael-terpin-att/
SIM swapping explained through Michael Terpin's case: how a bribe at an AT&T retailer moved his number, what he lost, and the FCC rules that followed.
https://www.darknet.org.uk/2026/11/sim-swapping-michael-terpin-att/
Darknet - Hacking Tools, Hacker News & Cyber Security
SIM Swapping - How a Bribe Bypassed AT&T's Security
SIM swapping explained through Michael Terpin's case: how a bribe at an AT&T retailer moved his number, what he lost, and the FCC rules that followed.
CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have been exploited in real-world attacks.
The vulnerability, tracked as CVE-2026-19868 (CVSS score: 7.1 / 7.5), has been described as an authentication reinforcement
https://thehackernews.com/2026/11/cisa-flags-sonicwall-sonicos-mfa-bypass.html
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have been exploited in real-world attacks.
The vulnerability, tracked as CVE-2026-19868 (CVSS score: 7.1 / 7.5), has been described as an authentication reinforcement
https://thehackernews.com/2026/11/cisa-flags-sonicwall-sonicos-mfa-bypass.html
U.S. Agencies Warn Refrigeration Controller Attacks Could Cause Fires and Inventory Losses
U.S. government agencies have warned that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems globally with an aim to cause service disruptions, fire hazards, and loss of inventory.
"The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating
https://thehackernews.com/2026/11/us-agencies-warn-refrigeration.html
U.S. government agencies have warned that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems globally with an aim to cause service disruptions, fire hazards, and loss of inventory.
"The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating
https://thehackernews.com/2026/11/us-agencies-warn-refrigeration.html
Former OpenAI Engineer Pleads Not Guilty to Planting Covert Device in Executive Meeting Room
The OpenAI engineer who was arrested and charged last month for planting a covert audio recording device in the company's office has pleaded not guilty.
According to reports from Bloomberg and CNBC, Saudi national Abdulrahman Alfozan made an appearance in San Francisco federal court on Friday, where he entered the plea. His next hearing is scheduled for November 17, 2026.
If proven guilty, the
https://thehackernews.com/2026/11/former-openai-engineer-pleads-not.html
The OpenAI engineer who was arrested and charged last month for planting a covert audio recording device in the company's office has pleaded not guilty.
According to reports from Bloomberg and CNBC, Saudi national Abdulrahman Alfozan made an appearance in San Francisco federal court on Friday, where he entered the plea. His next hearing is scheduled for November 17, 2026.
If proven guilty, the
https://thehackernews.com/2026/11/former-openai-engineer-pleads-not.html
Taiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch Records
A single attacker using AI agents pulled emergency dispatch records covering seven Taipei districts, researchers at Acronis's Threat Research Unit said last week.
The agents also found a Taipei fire department platform exposing patient data from 2018, including ECG readings and ambulance video footage, without a login.
The researchers are highly confident that the attacker is a single person
https://thehackernews.com/2026/11/taiwan-based-hacker-used-bossai-ai.html
A single attacker using AI agents pulled emergency dispatch records covering seven Taipei districts, researchers at Acronis's Threat Research Unit said last week.
The agents also found a Taipei fire department platform exposing patient data from 2018, including ECG readings and ambulance video footage, without a login.
The researchers are highly confident that the attacker is a single person
https://thehackernews.com/2026/11/taiwan-based-hacker-used-bossai-ai.html
Iris Ohyama data cloud breach exposes info of 7.7 million customers
Japanese manufacturer Iris Ohyama, the operator of the Iris Plaza shopping platform, disclosed that personal information belonging to about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service the company used. [...]
https://www.bleepingcomputer.com/news/security/iris-ohyama-data-cloud-breach-exposes-info-of-77-million-customers/
Japanese manufacturer Iris Ohyama, the operator of the Iris Plaza shopping platform, disclosed that personal information belonging to about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service the company used. [...]
https://www.bleepingcomputer.com/news/security/iris-ohyama-data-cloud-breach-exposes-info-of-77-million-customers/
BleepingComputer
Iris Ohyama data cloud breach exposes info of 7.7 million customers
Japanese manufacturer Iris Ohyama, the operator of the Iris Plaza shopping platform, disclosed that personal information belonging to about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service the company used.