Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' Computers
A browser extension that can run scripts on claude.ai could make Claude Desktop run code on a person's computer, researchers at Forever Security, an endpoint security company, showed in a test.
The attack needs Dispatch, a Claude feature that lets people send tasks from their phone to Claude Desktop. The flaw that makes this possible can still be exploited, the researchers said earlier this
https://thehackernews.com/2026/11/malicious-browser-extensions-could-use.html
A browser extension that can run scripts on claude.ai could make Claude Desktop run code on a person's computer, researchers at Forever Security, an endpoint security company, showed in a test.
The attack needs Dispatch, a Claude feature that lets people send tasks from their phone to Claude Desktop. The flaw that makes this possible can still be exploited, the researchers said earlier this
https://thehackernews.com/2026/11/malicious-browser-extensions-could-use.html
Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time
Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it.
The update that installs the fix still unpacks its files using the site's old, unpatched code, so an attacker who strikes at the right moment can run code on the server. The researcher advises blocking web access to the
https://thehackernews.com/2026/11/installing-fix-for-exploited-wordpress.html
Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it.
The update that installs the fix still unpacks its files using the site's old, unpatched code, so an attacker who strikes at the right moment can run code on the server. The researcher advises blocking web access to the
https://thehackernews.com/2026/11/installing-fix-for-exploited-wordpress.html
Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian.
The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled,
https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html
Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian.
The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled,
https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html
OpenAI Launches GPT-6 Cyber After AI Helps Find 81 Firefox Flaws, 948 Linux Exploits
OpenAI on Thursday unveiled GPT‑6 Cyber, which it described as a major step forward in security research that brings together stronger cybersecurity capabilities with a step-change improvement in model alignment.
The new model is "more capable at finding and fixing vulnerabilities, and far more reliable staying within the boundaries researchers set," OpenAI said. It has classified the model as
https://thehackernews.com/2026/11/openai-launches-gpt-6-cyber-after-ai.html
OpenAI on Thursday unveiled GPT‑6 Cyber, which it described as a major step forward in security research that brings together stronger cybersecurity capabilities with a step-change improvement in model alignment.
The new model is "more capable at finding and fixing vulnerabilities, and far more reliable staying within the boundaries researchers set," OpenAI said. It has classified the model as
https://thehackernews.com/2026/11/openai-launches-gpt-6-cyber-after-ai.html
Free Chinese AI Models Are Getting Scary Good at Hacking
An experiment in which AI models were asked to break into simulated networks showed the hacking skills of DeepSeek and GLM to be not far behind OpenAI’s most advanced cyber model, which isn’t public.
https://www.wired.com/story/free-chinese-ai-models-are-getting-scary-good-at-hacking/
An experiment in which AI models were asked to break into simulated networks showed the hacking skills of DeepSeek and GLM to be not far behind OpenAI’s most advanced cyber model, which isn’t public.
https://www.wired.com/story/free-chinese-ai-models-are-getting-scary-good-at-hacking/
WIRED
Free Chinese AI Models Are Getting Scary Good at Hacking
An experiment in which AI models were asked to break into simulated networks showed the hacking skills of DeepSeek and GLM to be not far behind OpenAI’s most advanced cyber model, which isn’t public.
Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them.
When a user selects "Yes, and don't ask again," Anthropic's AI coding assistant can save the command, word-for-word, including the secret, in a project settings file.
Software security company Apiiro said yesterday that 1,122 public
https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them.
When a user selects "Yes, and don't ask again," Anthropic's AI coding assistant can save the command, word-for-word, including the secret, in a project settings file.
Software security company Apiiro said yesterday that 1,122 public
https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html
The Fridge-Hacking Spree Is an Internet-of-Things Wake-Up Call
Escalating hacks affecting blood labs and grocery stores show the very real risks to critical infrastructure that come from basic security lapses involving internet-connected devices.
https://www.wired.com/story/kernel-panic-refrigeration-hacks-internet-of-things/
Escalating hacks affecting blood labs and grocery stores show the very real risks to critical infrastructure that come from basic security lapses involving internet-connected devices.
https://www.wired.com/story/kernel-panic-refrigeration-hacks-internet-of-things/
WIRED
The Fridge-Hacking Spree Is an Internet-of-Things Wake-Up Call
Escalating hacks affecting blood labs and grocery stores show the very real risks to critical infrastructure that come from basic security lapses involving internet-connected devices.
SIM Swapping – How a Bribe Bypassed AT&T’s Security
SIM swapping explained through Michael Terpin's case: how a bribe at an AT&T retailer moved his number, what he lost, and the FCC rules that followed.
https://www.darknet.org.uk/2026/11/sim-swapping-michael-terpin-att/
SIM swapping explained through Michael Terpin's case: how a bribe at an AT&T retailer moved his number, what he lost, and the FCC rules that followed.
https://www.darknet.org.uk/2026/11/sim-swapping-michael-terpin-att/
Darknet - Hacking Tools, Hacker News & Cyber Security
SIM Swapping - How a Bribe Bypassed AT&T's Security
SIM swapping explained through Michael Terpin's case: how a bribe at an AT&T retailer moved his number, what he lost, and the FCC rules that followed.
CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have been exploited in real-world attacks.
The vulnerability, tracked as CVE-2026-19868 (CVSS score: 7.1 / 7.5), has been described as an authentication reinforcement
https://thehackernews.com/2026/11/cisa-flags-sonicwall-sonicos-mfa-bypass.html
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have been exploited in real-world attacks.
The vulnerability, tracked as CVE-2026-19868 (CVSS score: 7.1 / 7.5), has been described as an authentication reinforcement
https://thehackernews.com/2026/11/cisa-flags-sonicwall-sonicos-mfa-bypass.html
U.S. Agencies Warn Refrigeration Controller Attacks Could Cause Fires and Inventory Losses
U.S. government agencies have warned that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems globally with an aim to cause service disruptions, fire hazards, and loss of inventory.
"The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating
https://thehackernews.com/2026/11/us-agencies-warn-refrigeration.html
U.S. government agencies have warned that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems globally with an aim to cause service disruptions, fire hazards, and loss of inventory.
"The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating
https://thehackernews.com/2026/11/us-agencies-warn-refrigeration.html
Former OpenAI Engineer Pleads Not Guilty to Planting Covert Device in Executive Meeting Room
The OpenAI engineer who was arrested and charged last month for planting a covert audio recording device in the company's office has pleaded not guilty.
According to reports from Bloomberg and CNBC, Saudi national Abdulrahman Alfozan made an appearance in San Francisco federal court on Friday, where he entered the plea. His next hearing is scheduled for November 17, 2026.
If proven guilty, the
https://thehackernews.com/2026/11/former-openai-engineer-pleads-not.html
The OpenAI engineer who was arrested and charged last month for planting a covert audio recording device in the company's office has pleaded not guilty.
According to reports from Bloomberg and CNBC, Saudi national Abdulrahman Alfozan made an appearance in San Francisco federal court on Friday, where he entered the plea. His next hearing is scheduled for November 17, 2026.
If proven guilty, the
https://thehackernews.com/2026/11/former-openai-engineer-pleads-not.html
Taiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch Records
A single attacker using AI agents pulled emergency dispatch records covering seven Taipei districts, researchers at Acronis's Threat Research Unit said last week.
The agents also found a Taipei fire department platform exposing patient data from 2018, including ECG readings and ambulance video footage, without a login.
The researchers are highly confident that the attacker is a single person
https://thehackernews.com/2026/11/taiwan-based-hacker-used-bossai-ai.html
A single attacker using AI agents pulled emergency dispatch records covering seven Taipei districts, researchers at Acronis's Threat Research Unit said last week.
The agents also found a Taipei fire department platform exposing patient data from 2018, including ECG readings and ambulance video footage, without a login.
The researchers are highly confident that the attacker is a single person
https://thehackernews.com/2026/11/taiwan-based-hacker-used-bossai-ai.html
Iris Ohyama data cloud breach exposes info of 7.7 million customers
Japanese manufacturer Iris Ohyama, the operator of the Iris Plaza shopping platform, disclosed that personal information belonging to about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service the company used. [...]
https://www.bleepingcomputer.com/news/security/iris-ohyama-data-cloud-breach-exposes-info-of-77-million-customers/
Japanese manufacturer Iris Ohyama, the operator of the Iris Plaza shopping platform, disclosed that personal information belonging to about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service the company used. [...]
https://www.bleepingcomputer.com/news/security/iris-ohyama-data-cloud-breach-exposes-info-of-77-million-customers/
BleepingComputer
Iris Ohyama data cloud breach exposes info of 7.7 million customers
Japanese manufacturer Iris Ohyama, the operator of the Iris Plaza shopping platform, disclosed that personal information belonging to about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service the company used.
Hackers pull off $133 million French bank heist via service provider
French cooperative bank Crédit Mutuel Arkéa was targeted in a cyberattack that enabled fraudulent transactions of up to $133 million, forcing it to respond by suspending certain systems.v [...]
https://www.bleepingcomputer.com/news/security/hackers-pull-off-133-million-french-bank-heist-via-service-provider/
French cooperative bank Crédit Mutuel Arkéa was targeted in a cyberattack that enabled fraudulent transactions of up to $133 million, forcing it to respond by suspending certain systems.v [...]
https://www.bleepingcomputer.com/news/security/hackers-pull-off-133-million-french-bank-heist-via-service-provider/
BleepingComputer
Hackers pull off $133 million French bank heist via service provider
French cooperative bank Crédit Mutuel Arkéa was targeted in a cyberattack that enabled fraudulent transactions of up to $133 million, forcing it to respond by suspending certain systems.v
CTM360 Exposes Fake Gift Card Scams Exploiting Trusted Brands
Scammers are impersonating major brands and celebrities to lure consumers into fake gift card giveaways that collect personal information and trigger unwanted subscriptions. CTM360 reveals how these campaigns use deceptive verification steps and affiliate networks to generate revenue without delivering the promised rewards. [...]
https://www.bleepingcomputer.com/news/security/ctm360-exposes-fake-gift-card-scams-exploiting-trusted-brands/
Scammers are impersonating major brands and celebrities to lure consumers into fake gift card giveaways that collect personal information and trigger unwanted subscriptions. CTM360 reveals how these campaigns use deceptive verification steps and affiliate networks to generate revenue without delivering the promised rewards. [...]
https://www.bleepingcomputer.com/news/security/ctm360-exposes-fake-gift-card-scams-exploiting-trusted-brands/
BleepingComputer
CTM360 Exposes Fake Gift Card Scams Exploiting Trusted Brands
Scammers are impersonating major brands and celebrities to lure consumers into fake gift card giveaways that collect personal information and trigger unwanted subscriptions. CTM360 reveals how these campaigns use deceptive verification steps and affiliate…
SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks. [...]
https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/
SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks. [...]
https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/
BleepingComputer
SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks.
Runaway AI hacking agent behind WorkOS breach after escaping sandbox
WorkOS says an AI-powered hacking agent that breached its internal sales application and accessed customer information was operated by a security researcher who claims the tool escaped its testing environment and unintentionally attacked the company. [...]
https://www.bleepingcomputer.com/news/security/runaway-ai-hacking-agent-behind-workos-breach-after-escaping-sandbox/
WorkOS says an AI-powered hacking agent that breached its internal sales application and accessed customer information was operated by a security researcher who claims the tool escaped its testing environment and unintentionally attacked the company. [...]
https://www.bleepingcomputer.com/news/security/runaway-ai-hacking-agent-behind-workos-breach-after-escaping-sandbox/
BleepingComputer
Runaway AI hacking agent behind WorkOS breach after escaping sandbox
WorkOS says an AI-powered hacking agent that breached its internal sales application and accessed customer information was operated by a security researcher who claims the tool escaped its testing environment and unintentionally attacked the company.
LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers Amid Attacks
Everyone running LNbits, a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday.
It has several security fixes to release and asked operators to be careful until they are out. One operator said new accounts used an exploit to withdraw 2,285,545 satoshis, about 0.023 bitcoin, from his server before he could
https://thehackernews.com/2026/11/lnbits-urges-all-operators-to-shut-down.html
Everyone running LNbits, a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday.
It has several security fixes to release and asked operators to be careful until they are out. One operator said new accounts used an exploit to withdraw 2,285,545 satoshis, about 0.023 bitcoin, from his server before he could
https://thehackernews.com/2026/11/lnbits-urges-all-operators-to-shut-down.html
DHS Has Used This Controversial Investigative Tool 185,000 Times Since Trump Took Office
Homeland Security Investigations estimates that it has sent out more administrative subpoenas since January 2025 than it did in more than six and a half years between 2016 and mid-August 2022.
https://www.wired.com/story/dhs-has-used-this-controversial-investigative-tool-185000-times-since-trump-took-office/
Homeland Security Investigations estimates that it has sent out more administrative subpoenas since January 2025 than it did in more than six and a half years between 2016 and mid-August 2022.
https://www.wired.com/story/dhs-has-used-this-controversial-investigative-tool-185000-times-since-trump-took-office/
WIRED
DHS Has Used This Controversial Investigative Tool 185,000 Times Since Trump Took Office
Homeland Security Investigations estimates that it has sent out more administrative subpoenas since January 2025 than it did in more than six and a half years between 2016 and mid-August 2022.
jadx – Decompile Android APKs to Readable Java
How to install jadx 1.5.6, decompile an APK to Java, read the methods it cannot decompile, export a Gradle project, and when to use Apktool.
https://www.darknet.org.uk/2026/11/jadx-decompile-android-apk-to-java/
How to install jadx 1.5.6, decompile an APK to Java, read the methods it cannot decompile, export a Gradle project, and when to use Apktool.
https://www.darknet.org.uk/2026/11/jadx-decompile-android-apk-to-java/
Darknet - Hacking Tools, Hacker News & Cyber Security
jadx - Decompile Android APKs to Readable Java
How to install jadx 1.5.6, decompile an APK to Java, read the methods it cannot decompile, export a Gradle project, and when to use Apktool.
Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars
The login systems behind two car brands' mobile apps could be taken over completely, two security researchers found, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the engine.
Both apps signed customers in through ForgeRock, an identity platform now part of Ping Identity, and on those servers the researchers reached an
https://thehackernews.com/2026/11/default-adminadmin-server-password.html
The login systems behind two car brands' mobile apps could be taken over completely, two security researchers found, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the engine.
Both apps signed customers in through ForgeRock, an identity platform now part of Ping Identity, and on those servers the researchers reached an
https://thehackernews.com/2026/11/default-adminadmin-server-password.html