N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits
N-able said it has taken N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice following the public disclosure of over 30 vulnerabilities collectively tracked as Able2Shell.
"As a precautionary measure, we are temporarily taking our Hosted N-central environment offline while we take the necessary actions to secure the
https://thehackernews.com/2026/11/n-able-takes-hosted-n-central-offline.html
N-able said it has taken N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice following the public disclosure of over 30 vulnerabilities collectively tracked as Able2Shell.
"As a precautionary measure, we are temporarily taking our Hosted N-central environment offline while we take the necessary actions to secure the
https://thehackernews.com/2026/11/n-able-takes-hosted-n-central-offline.html
Security Flaws Across UK Government Sites Exposed ‘God-Tier’ Information
A researcher’s trawl through publicly available code found private information was at risk across multiple departments.
https://www.wired.com/story/security-flaws-across-uk-government-sites-exposed-god-tier-information/
A researcher’s trawl through publicly available code found private information was at risk across multiple departments.
https://www.wired.com/story/security-flaws-across-uk-government-sites-exposed-god-tier-information/
WIRED
Security Flaws Across UK Government Sites Exposed ‘God-Tier’ Information
A researcher’s trawl through publicly available code found private information was at risk across multiple departments.
Anthropic's Claude Fable 5.2 Beats GPT-6 Cyber in Multi-Stage Cyberattack Benchmark
Anthropic on Monday released Claude Fable 5.2 and Claude Mythos 5.2 models, which it said exhibit improvements in coding, reasoning, and vision.
During pre-release training, the large language models (LLMs) helped its engineers "complete otherwise-infeasible software migrations, designed three working electronic devices from scratch, solved two open problems in the physics of black holes, made
https://thehackernews.com/2026/11/anthropics-claude-fable-52-beats-gpt-6.html
Anthropic on Monday released Claude Fable 5.2 and Claude Mythos 5.2 models, which it said exhibit improvements in coding, reasoning, and vision.
During pre-release training, the large language models (LLMs) helped its engineers "complete otherwise-infeasible software migrations, designed three working electronic devices from scratch, solved two open problems in the physics of black holes, made
https://thehackernews.com/2026/11/anthropics-claude-fable-52-beats-gpt-6.html
France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites
An October cyberattack on refrigeration controllers at about 700 French retail sites was carried out by a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), the French government said yesterday.
The attackers broke into controllers on the night of October 11 and changed their defrost settings to high temperatures. That caused food losses and, in at least 15 cases, fires.
The unit
https://thehackernews.com/2026/11/france-blames-iran-for-sabotage-attack.html
An October cyberattack on refrigeration controllers at about 700 French retail sites was carried out by a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), the French government said yesterday.
The attackers broke into controllers on the night of October 11 and changed their defrost settings to high temperatures. That caused food losses and, in at least 15 cases, fires.
The unit
https://thehackernews.com/2026/11/france-blames-iran-for-sabotage-attack.html
SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution
Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score.
Three are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the Web Dispatcher, which receives web requests from the internet and passes them on to that server.
The flaws in the Web
https://thehackernews.com/2026/11/sap-patches-four-cvss-100-flaws.html
Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score.
Three are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the Web Dispatcher, which receives web requests from the internet and passes them on to that server.
The flaws in the Web
https://thehackernews.com/2026/11/sap-patches-four-cvss-100-flaws.html
Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities
An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined.
As of today, other updates released yesterday for the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple
https://thehackernews.com/2026/11/apple-patches-imessage-group-chat.html
An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined.
As of today, other updates released yesterday for the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple
https://thehackernews.com/2026/11/apple-patches-imessage-group-chat.html
Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers
The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails.
According to an ESET report shared with The Hacker News ahead of publication, the sophisticated and modular tool is designed for
https://thehackernews.com/2026/11/russian-turla-hackers-use-new-cereal.html
The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails.
According to an ESET report shared with The Hacker News ahead of publication, the sophisticated and modular tool is designed for
https://thehackernews.com/2026/11/russian-turla-hackers-use-new-cereal.html
Beyond the Alert: The Case for Rich Network Data
At some point your security will fail. This isn’t pessimism. It’s not because your team and tools aren’t sophisticated enough. It’s the reason we have detections in the first place. And, it’s why once we accept that prevention has its limits, we arrive at an interdiction strategy: finding and disrupting what got in.
After the alert
The alert tells you something happened. However, gaining
https://thehackernews.com/2026/11/beyond-alert-case-for-rich-network-data.html
At some point your security will fail. This isn’t pessimism. It’s not because your team and tools aren’t sophisticated enough. It’s the reason we have detections in the first place. And, it’s why once we accept that prevention has its limits, we arrive at an interdiction strategy: finding and disrupting what got in.
After the alert
The alert tells you something happened. However, gaining
https://thehackernews.com/2026/11/beyond-alert-case-for-rich-network-data.html
Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed
An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today. Apple's updates for iOS 26 and 27, released yesterday, do not list a fix.
A researcher who goes by forcequit released the escape, called worse_query, on Sunday, a
https://thehackernews.com/2026/11/binance-warns-of-ios-sandbox-escape.html
An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today. Apple's updates for iOS 26 and 27, released yesterday, do not list a fix.
A researcher who goes by forcequit released the escape, called worse_query, on Sunday, a
https://thehackernews.com/2026/11/binance-warns-of-ios-sandbox-escape.html
Mt. Gox – The Missing Bitcoin and Who Was Convicted of What
Mt. Gox said in 2014 that about 850,000 bitcoins had disappeared. What the courts found, who was charged, and how far repayments had got by October 2026.
https://www.darknet.org.uk/2026/11/mt-gox-hack-karpeles-vinnik/
Mt. Gox said in 2014 that about 850,000 bitcoins had disappeared. What the courts found, who was charged, and how far repayments had got by October 2026.
https://www.darknet.org.uk/2026/11/mt-gox-hack-karpeles-vinnik/
Darknet - Hacking Tools, Hacker News & Cyber Security
Mt. Gox - The Missing Bitcoin and Who Was Convicted of What
Mt. Gox said in 2014 that about 850,000 bitcoins had disappeared. What the courts found, who was charged, and how far repayments had got by October 2026.
Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor
Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant.
The activity, observed by Huntress in October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two
https://thehackernews.com/2026/11/attackers-exploit-ahsaycbs-flaws-to.html
Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant.
The activity, observed by Huntress in October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two
https://thehackernews.com/2026/11/attackers-exploit-ahsaycbs-flaws-to.html
Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America
The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and DCRat.
"The campaign uses Portuguese and Spanish lures that resemble court notifications, fiscalía notices, tutela proceedings, and
https://thehackernews.com/2026/11/blind-eagle-uses-fake-court-notices-to.html
The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and DCRat.
"The campaign uses Portuguese and Spanish lures that resemble court notifications, fiscalía notices, tutela proceedings, and
https://thehackernews.com/2026/11/blind-eagle-uses-fake-court-notices-to.html
Fireworks AI Breach Widens to Expose Customer Billing Data and Incomplete Model Weights
Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month uncovered further malicious activity, affecting account and billing information, alongside secrets, datasets, and incomplete models for a "limited set of accounts."
In a notice published on October 10, 2026, the company said it detected unauthorized use of internal Fireworks
https://thehackernews.com/2026/11/fireworks-ai-breach-widens-to-expose.html
Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month uncovered further malicious activity, affecting account and billing information, alongside secrets, datasets, and incomplete models for a "limited set of accounts."
In a notice published on October 10, 2026, the company said it detected unauthorized use of internal Fireworks
https://thehackernews.com/2026/11/fireworks-ai-breach-widens-to-expose.html
Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones
A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1.
The flaw, tracked as CVE-2026-111760, is an integer truncation in how Git handles its index. An
https://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html
A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1.
The flaw, tracked as CVE-2026-111760, is an integer truncation in how Git handles its index. An
https://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html
SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users
An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday.
The attacker could also have seen requests being processed on that server that day, including requests sent in confidential mode, the company said earlier this week. That mode processes requests inside a trusted execution environment (TEE
https://thehackernews.com/2026/11/sglang-rce-exploit-breaches-near-ai.html
An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday.
The attacker could also have seen requests being processed on that server that day, including requests sent in confidential mode, the company said earlier this week. That mode processes requests inside a trusted execution environment (TEE
https://thehackernews.com/2026/11/sglang-rce-exploit-breaches-near-ai.html
Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access
French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild.
The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062.
"REST cookie parsing turns authenticationToken=j:%7B%7D into {}," Vates VMS said in an alert. "REST authentication passes that object to the
https://thehackernews.com/2026/11/hackers-exploit-critical-xen-orchestra.html
French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild.
The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062.
"REST cookie parsing turns authenticationToken=j:%7B%7D into {}," Vates VMS said in an alert. "REST authentication passes that object to the
https://thehackernews.com/2026/11/hackers-exploit-critical-xen-orchestra.html
Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem
Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year.
Check Point Research is tracking the clusters under the names SilentDelivery,
https://thehackernews.com/2026/11/three-china-nexus-espionage-campaigns.html
Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year.
Check Point Research is tracking the clusters under the names SilentDelivery,
https://thehackernews.com/2026/11/three-china-nexus-espionage-campaigns.html
Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
Details of the vulnerabilities are below -
CVE-2026-20320 (CVSS score: 7.5) - An improper restriction of XML external entity
https://thehackernews.com/2026/11/cisco-broadworks-and-openwave-flaws.html
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
Details of the vulnerabilities are below -
CVE-2026-20320 (CVSS score: 7.5) - An improper restriction of XML external entity
https://thehackernews.com/2026/11/cisco-broadworks-and-openwave-flaws.html
Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes
Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws.
These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers.
https://thehackernews.com/2026/11/microsoft-patches-1259-flaws-including.html
Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws.
These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers.
https://thehackernews.com/2026/11/microsoft-patches-1259-flaws-including.html
Railway Says Stolen Customer AI Keys Led to $740,000 in Estimated Unauthorized Usage Charges
AI provider keys that customers stored on Railway were stolen in an October breach and used to commit an estimated $740,000 in unauthorized spending, the platform-as-a-service provider said yesterday. It has promised to pay those charges itself when an AI provider will not refund them.
The company builds and runs apps for its customers and stores their secrets, such as API keys and database
https://thehackernews.com/2026/11/railway-says-stolen-customer-ai-keys.html
AI provider keys that customers stored on Railway were stolen in an October breach and used to commit an estimated $740,000 in unauthorized spending, the platform-as-a-service provider said yesterday. It has promised to pay those charges itself when an AI provider will not refund them.
The company builds and runs apps for its customers and stores their secrets, such as API keys and database
https://thehackernews.com/2026/11/railway-says-stolen-customer-ai-keys.html
Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons
An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown.
When a chosen trigger appears, the model outputs an attacker's command, which an agent using that model would run with the agent's own permissions. The attacker must be able to change the model's weights.
The team tested the method on
https://thehackernews.com/2026/11/microsoft-researchers-show-ai-agents.html
An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown.
When a chosen trigger appears, the model outputs an attacker's command, which an agent using that model would run with the agent's own permissions. The attacker must be able to change the model's weights.
The team tested the method on
https://thehackernews.com/2026/11/microsoft-researchers-show-ai-agents.html