Runaway AI hacking agent behind WorkOS breach after escaping sandbox
WorkOS says an AI-powered hacking agent that breached its internal sales application and accessed customer information was operated by a security researcher who claims the tool escaped its testing environment and unintentionally attacked the company. [...]
https://www.bleepingcomputer.com/news/security/runaway-ai-hacking-agent-behind-workos-breach-after-escaping-sandbox/
WorkOS says an AI-powered hacking agent that breached its internal sales application and accessed customer information was operated by a security researcher who claims the tool escaped its testing environment and unintentionally attacked the company. [...]
https://www.bleepingcomputer.com/news/security/runaway-ai-hacking-agent-behind-workos-breach-after-escaping-sandbox/
BleepingComputer
Runaway AI hacking agent behind WorkOS breach after escaping sandbox
WorkOS says an AI-powered hacking agent that breached its internal sales application and accessed customer information was operated by a security researcher who claims the tool escaped its testing environment and unintentionally attacked the company.
LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers Amid Attacks
Everyone running LNbits, a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday.
It has several security fixes to release and asked operators to be careful until they are out. One operator said new accounts used an exploit to withdraw 2,285,545 satoshis, about 0.023 bitcoin, from his server before he could
https://thehackernews.com/2026/11/lnbits-urges-all-operators-to-shut-down.html
Everyone running LNbits, a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday.
It has several security fixes to release and asked operators to be careful until they are out. One operator said new accounts used an exploit to withdraw 2,285,545 satoshis, about 0.023 bitcoin, from his server before he could
https://thehackernews.com/2026/11/lnbits-urges-all-operators-to-shut-down.html
DHS Has Used This Controversial Investigative Tool 185,000 Times Since Trump Took Office
Homeland Security Investigations estimates that it has sent out more administrative subpoenas since January 2025 than it did in more than six and a half years between 2016 and mid-August 2022.
https://www.wired.com/story/dhs-has-used-this-controversial-investigative-tool-185000-times-since-trump-took-office/
Homeland Security Investigations estimates that it has sent out more administrative subpoenas since January 2025 than it did in more than six and a half years between 2016 and mid-August 2022.
https://www.wired.com/story/dhs-has-used-this-controversial-investigative-tool-185000-times-since-trump-took-office/
WIRED
DHS Has Used This Controversial Investigative Tool 185,000 Times Since Trump Took Office
Homeland Security Investigations estimates that it has sent out more administrative subpoenas since January 2025 than it did in more than six and a half years between 2016 and mid-August 2022.
jadx – Decompile Android APKs to Readable Java
How to install jadx 1.5.6, decompile an APK to Java, read the methods it cannot decompile, export a Gradle project, and when to use Apktool.
https://www.darknet.org.uk/2026/11/jadx-decompile-android-apk-to-java/
How to install jadx 1.5.6, decompile an APK to Java, read the methods it cannot decompile, export a Gradle project, and when to use Apktool.
https://www.darknet.org.uk/2026/11/jadx-decompile-android-apk-to-java/
Darknet - Hacking Tools, Hacker News & Cyber Security
jadx - Decompile Android APKs to Readable Java
How to install jadx 1.5.6, decompile an APK to Java, read the methods it cannot decompile, export a Gradle project, and when to use Apktool.
Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars
The login systems behind two car brands' mobile apps could be taken over completely, two security researchers found, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the engine.
Both apps signed customers in through ForgeRock, an identity platform now part of Ping Identity, and on those servers the researchers reached an
https://thehackernews.com/2026/11/default-adminadmin-server-password.html
The login systems behind two car brands' mobile apps could be taken over completely, two security researchers found, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the engine.
Both apps signed customers in through ForgeRock, an identity platform now part of Ping Identity, and on those servers the researchers reached an
https://thehackernews.com/2026/11/default-adminadmin-server-password.html
Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety
Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker.
Keplr uses a company called Web3Auth to run that Google and Apple sign-in. The attacker used a security flaw at that company to reach the wallets, both companies said late last week.
Web3Auth then used the attacker's own route to empty other at-risk wallets before the attacker
https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html
Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker.
Keplr uses a company called Web3Auth to run that Google and Apple sign-in. The attacker used a security flaw at that company to reach the wallets, both companies said late last week.
Web3Auth then used the attacker's own route to empty other at-risk wallets before the attacker
https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html
⚡ Weekly Recap: SSHole Exploited, APT Root RCE, Robot Takeovers, 15K Hacked Sites, and More
A system doesn't always need a complicated bug to let someone in. Sometimes, a blank password is enough. That's one of the bigger stories this week. And it gets worse when the tools meant to keep systems updated or running safely become part of the attack.
Elsewhere, attackers are hiding inside normal web traffic, stealing credentials from network devices, and finding new uses for exposed
https://thehackernews.com/2026/11/weekly-recap-sshole-exploited-apt-root.html
A system doesn't always need a complicated bug to let someone in. Sometimes, a blank password is enough. That's one of the bigger stories this week. And it gets worse when the tools meant to keep systems updated or running safely become part of the attack.
Elsewhere, attackers are hiding inside normal web traffic, stealing credentials from network devices, and finding new uses for exposed
https://thehackernews.com/2026/11/weekly-recap-sshole-exploited-apt-root.html
Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia
The South Asian cyber espionage group known as Bitter (aka APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397) has been observed targeting South Asian organizations with a previously unreported remote access trojan called PapRAT.
"PapRAT has both C++ and Rust implementations," Fortinet FortiGuard Labs researcher Cara Lin said. "Its capabilities include command execution, file
https://thehackernews.com/2026/11/bitter-hackers-deploy-new-paprat.html
The South Asian cyber espionage group known as Bitter (aka APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397) has been observed targeting South Asian organizations with a previously unreported remote access trojan called PapRAT.
"PapRAT has both C++ and Rust implementations," Fortinet FortiGuard Labs researcher Cara Lin said. "Its capabilities include command execution, file
https://thehackernews.com/2026/11/bitter-hackers-deploy-new-paprat.html
Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data
An attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data, cloud security company Wiz said today.
The attacker used credentials for an AWS account that Qubole's platform uses to reach those customers. How the attacker got those credentials has not been disclosed.
Qubole, a data lake platform owned by Idera,
https://thehackernews.com/2026/11/hackers-exploit-quboles-trusted-aws.html
An attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data, cloud security company Wiz said today.
The attacker used credentials for an AWS account that Qubole's platform uses to reach those customers. How the attacker got those credentials has not been disclosed.
Qubole, a data lake platform owned by Idera,
https://thehackernews.com/2026/11/hackers-exploit-quboles-trusted-aws.html
Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware
Attackers used the Ethersphere project's own release automation to publish malicious versions of two of its tools for the Swarm decentralized storage network: bee-js 13.3.0 and Swarm Desktop 0.56.2.
Both releases download and run code built to steal the wallet key that Swarm Desktop keeps for its node, along with the stored password that unlocks it. The code is also built to install a backdoor
https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html
Attackers used the Ethersphere project's own release automation to publish malicious versions of two of its tools for the Swarm decentralized storage network: bee-js 13.3.0 and Swarm Desktop 0.56.2.
Both releases download and run code built to steal the wallet key that Swarm Desktop keeps for its node, along with the stored password that unlocks it. The code is also built to install a backdoor
https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html
A New AI Tool From Google DeepMind Proved the Signal Protocol Is Secure
DeepMind researchers were able to formally verify that the widely used encryption protocol works as intended. Their stretch goal? Do the same for “all the software of the world.”
https://www.wired.com/story/a-new-ai-tool-from-google-deepmind-formally-verified-the-signal-protocol/
DeepMind researchers were able to formally verify that the widely used encryption protocol works as intended. Their stretch goal? Do the same for “all the software of the world.”
https://www.wired.com/story/a-new-ai-tool-from-google-deepmind-formally-verified-the-signal-protocol/
WIRED
A New AI Tool From Google DeepMind Proved the Signal Protocol Is Secure
DeepMind researchers were able to formally verify that the widely used encryption protocol works as intended. Their stretch goal? Do the same for “all the software of the world.”
CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The vulnerabilities are listed below -
CVE-2026-123218 (CVSS score: 9.8) - An incorrect authorization vulnerability
https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The vulnerabilities are listed below -
CVE-2026-123218 (CVSS score: 9.8) - An incorrect authorization vulnerability
https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html
Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild.
The high-severity vulnerability, assigned the CVE identifier CVE-2026-125350 (CVSS score: N/A), has been described as a use-after-free bug in the XML component.
Use-after-free bugs typically occur when a program attempts to access a memory location after
https://thehackernews.com/2026/11/google-issues-chrome-security-update.html
Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild.
The high-severity vulnerability, assigned the CVE identifier CVE-2026-125350 (CVSS score: N/A), has been described as a use-after-free bug in the XML component.
Use-after-free bugs typically occur when a program attempts to access a memory location after
https://thehackernews.com/2026/11/google-issues-chrome-security-update.html
N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits
N-able said it has taken N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice following the public disclosure of over 30 vulnerabilities collectively tracked as Able2Shell.
"As a precautionary measure, we are temporarily taking our Hosted N-central environment offline while we take the necessary actions to secure the
https://thehackernews.com/2026/11/n-able-takes-hosted-n-central-offline.html
N-able said it has taken N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice following the public disclosure of over 30 vulnerabilities collectively tracked as Able2Shell.
"As a precautionary measure, we are temporarily taking our Hosted N-central environment offline while we take the necessary actions to secure the
https://thehackernews.com/2026/11/n-able-takes-hosted-n-central-offline.html
Security Flaws Across UK Government Sites Exposed ‘God-Tier’ Information
A researcher’s trawl through publicly available code found private information was at risk across multiple departments.
https://www.wired.com/story/security-flaws-across-uk-government-sites-exposed-god-tier-information/
A researcher’s trawl through publicly available code found private information was at risk across multiple departments.
https://www.wired.com/story/security-flaws-across-uk-government-sites-exposed-god-tier-information/
WIRED
Security Flaws Across UK Government Sites Exposed ‘God-Tier’ Information
A researcher’s trawl through publicly available code found private information was at risk across multiple departments.
Anthropic's Claude Fable 5.2 Beats GPT-6 Cyber in Multi-Stage Cyberattack Benchmark
Anthropic on Monday released Claude Fable 5.2 and Claude Mythos 5.2 models, which it said exhibit improvements in coding, reasoning, and vision.
During pre-release training, the large language models (LLMs) helped its engineers "complete otherwise-infeasible software migrations, designed three working electronic devices from scratch, solved two open problems in the physics of black holes, made
https://thehackernews.com/2026/11/anthropics-claude-fable-52-beats-gpt-6.html
Anthropic on Monday released Claude Fable 5.2 and Claude Mythos 5.2 models, which it said exhibit improvements in coding, reasoning, and vision.
During pre-release training, the large language models (LLMs) helped its engineers "complete otherwise-infeasible software migrations, designed three working electronic devices from scratch, solved two open problems in the physics of black holes, made
https://thehackernews.com/2026/11/anthropics-claude-fable-52-beats-gpt-6.html
France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites
An October cyberattack on refrigeration controllers at about 700 French retail sites was carried out by a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), the French government said yesterday.
The attackers broke into controllers on the night of October 11 and changed their defrost settings to high temperatures. That caused food losses and, in at least 15 cases, fires.
The unit
https://thehackernews.com/2026/11/france-blames-iran-for-sabotage-attack.html
An October cyberattack on refrigeration controllers at about 700 French retail sites was carried out by a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), the French government said yesterday.
The attackers broke into controllers on the night of October 11 and changed their defrost settings to high temperatures. That caused food losses and, in at least 15 cases, fires.
The unit
https://thehackernews.com/2026/11/france-blames-iran-for-sabotage-attack.html
SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution
Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score.
Three are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the Web Dispatcher, which receives web requests from the internet and passes them on to that server.
The flaws in the Web
https://thehackernews.com/2026/11/sap-patches-four-cvss-100-flaws.html
Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score.
Three are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the Web Dispatcher, which receives web requests from the internet and passes them on to that server.
The flaws in the Web
https://thehackernews.com/2026/11/sap-patches-four-cvss-100-flaws.html
Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities
An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined.
As of today, other updates released yesterday for the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple
https://thehackernews.com/2026/11/apple-patches-imessage-group-chat.html
An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined.
As of today, other updates released yesterday for the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple
https://thehackernews.com/2026/11/apple-patches-imessage-group-chat.html
Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers
The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails.
According to an ESET report shared with The Hacker News ahead of publication, the sophisticated and modular tool is designed for
https://thehackernews.com/2026/11/russian-turla-hackers-use-new-cereal.html
The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails.
According to an ESET report shared with The Hacker News ahead of publication, the sophisticated and modular tool is designed for
https://thehackernews.com/2026/11/russian-turla-hackers-use-new-cereal.html
Beyond the Alert: The Case for Rich Network Data
At some point your security will fail. This isn’t pessimism. It’s not because your team and tools aren’t sophisticated enough. It’s the reason we have detections in the first place. And, it’s why once we accept that prevention has its limits, we arrive at an interdiction strategy: finding and disrupting what got in.
After the alert
The alert tells you something happened. However, gaining
https://thehackernews.com/2026/11/beyond-alert-case-for-rich-network-data.html
At some point your security will fail. This isn’t pessimism. It’s not because your team and tools aren’t sophisticated enough. It’s the reason we have detections in the first place. And, it’s why once we accept that prevention has its limits, we arrive at an interdiction strategy: finding and disrupting what got in.
After the alert
The alert tells you something happened. However, gaining
https://thehackernews.com/2026/11/beyond-alert-case-for-rich-network-data.html