Beyond the Alert: The Case for Rich Network Data
At some point your security will fail. This isn’t pessimism. It’s not because your team and tools aren’t sophisticated enough. It’s the reason we have detections in the first place. And, it’s why once we accept that prevention has its limits, we arrive at an interdiction strategy: finding and disrupting what got in.
After the alert
The alert tells you something happened. However, gaining
https://thehackernews.com/2026/11/beyond-alert-case-for-rich-network-data.html
At some point your security will fail. This isn’t pessimism. It’s not because your team and tools aren’t sophisticated enough. It’s the reason we have detections in the first place. And, it’s why once we accept that prevention has its limits, we arrive at an interdiction strategy: finding and disrupting what got in.
After the alert
The alert tells you something happened. However, gaining
https://thehackernews.com/2026/11/beyond-alert-case-for-rich-network-data.html
Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed
An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today. Apple's updates for iOS 26 and 27, released yesterday, do not list a fix.
A researcher who goes by forcequit released the escape, called worse_query, on Sunday, a
https://thehackernews.com/2026/11/binance-warns-of-ios-sandbox-escape.html
An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today. Apple's updates for iOS 26 and 27, released yesterday, do not list a fix.
A researcher who goes by forcequit released the escape, called worse_query, on Sunday, a
https://thehackernews.com/2026/11/binance-warns-of-ios-sandbox-escape.html
Mt. Gox – The Missing Bitcoin and Who Was Convicted of What
Mt. Gox said in 2014 that about 850,000 bitcoins had disappeared. What the courts found, who was charged, and how far repayments had got by October 2026.
https://www.darknet.org.uk/2026/11/mt-gox-hack-karpeles-vinnik/
Mt. Gox said in 2014 that about 850,000 bitcoins had disappeared. What the courts found, who was charged, and how far repayments had got by October 2026.
https://www.darknet.org.uk/2026/11/mt-gox-hack-karpeles-vinnik/
Darknet - Hacking Tools, Hacker News & Cyber Security
Mt. Gox - The Missing Bitcoin and Who Was Convicted of What
Mt. Gox said in 2014 that about 850,000 bitcoins had disappeared. What the courts found, who was charged, and how far repayments had got by October 2026.
Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor
Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant.
The activity, observed by Huntress in October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two
https://thehackernews.com/2026/11/attackers-exploit-ahsaycbs-flaws-to.html
Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant.
The activity, observed by Huntress in October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two
https://thehackernews.com/2026/11/attackers-exploit-ahsaycbs-flaws-to.html
Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America
The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and DCRat.
"The campaign uses Portuguese and Spanish lures that resemble court notifications, fiscalía notices, tutela proceedings, and
https://thehackernews.com/2026/11/blind-eagle-uses-fake-court-notices-to.html
The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and DCRat.
"The campaign uses Portuguese and Spanish lures that resemble court notifications, fiscalía notices, tutela proceedings, and
https://thehackernews.com/2026/11/blind-eagle-uses-fake-court-notices-to.html
Fireworks AI Breach Widens to Expose Customer Billing Data and Incomplete Model Weights
Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month uncovered further malicious activity, affecting account and billing information, alongside secrets, datasets, and incomplete models for a "limited set of accounts."
In a notice published on October 10, 2026, the company said it detected unauthorized use of internal Fireworks
https://thehackernews.com/2026/11/fireworks-ai-breach-widens-to-expose.html
Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month uncovered further malicious activity, affecting account and billing information, alongside secrets, datasets, and incomplete models for a "limited set of accounts."
In a notice published on October 10, 2026, the company said it detected unauthorized use of internal Fireworks
https://thehackernews.com/2026/11/fireworks-ai-breach-widens-to-expose.html
Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones
A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1.
The flaw, tracked as CVE-2026-111760, is an integer truncation in how Git handles its index. An
https://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html
A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1.
The flaw, tracked as CVE-2026-111760, is an integer truncation in how Git handles its index. An
https://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html
SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users
An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday.
The attacker could also have seen requests being processed on that server that day, including requests sent in confidential mode, the company said earlier this week. That mode processes requests inside a trusted execution environment (TEE
https://thehackernews.com/2026/11/sglang-rce-exploit-breaches-near-ai.html
An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday.
The attacker could also have seen requests being processed on that server that day, including requests sent in confidential mode, the company said earlier this week. That mode processes requests inside a trusted execution environment (TEE
https://thehackernews.com/2026/11/sglang-rce-exploit-breaches-near-ai.html
Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access
French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild.
The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062.
"REST cookie parsing turns authenticationToken=j:%7B%7D into {}," Vates VMS said in an alert. "REST authentication passes that object to the
https://thehackernews.com/2026/11/hackers-exploit-critical-xen-orchestra.html
French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild.
The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062.
"REST cookie parsing turns authenticationToken=j:%7B%7D into {}," Vates VMS said in an alert. "REST authentication passes that object to the
https://thehackernews.com/2026/11/hackers-exploit-critical-xen-orchestra.html
Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem
Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year.
Check Point Research is tracking the clusters under the names SilentDelivery,
https://thehackernews.com/2026/11/three-china-nexus-espionage-campaigns.html
Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year.
Check Point Research is tracking the clusters under the names SilentDelivery,
https://thehackernews.com/2026/11/three-china-nexus-espionage-campaigns.html
Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
Details of the vulnerabilities are below -
CVE-2026-20320 (CVSS score: 7.5) - An improper restriction of XML external entity
https://thehackernews.com/2026/11/cisco-broadworks-and-openwave-flaws.html
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
Details of the vulnerabilities are below -
CVE-2026-20320 (CVSS score: 7.5) - An improper restriction of XML external entity
https://thehackernews.com/2026/11/cisco-broadworks-and-openwave-flaws.html
Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes
Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws.
These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers.
https://thehackernews.com/2026/11/microsoft-patches-1259-flaws-including.html
Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws.
These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers.
https://thehackernews.com/2026/11/microsoft-patches-1259-flaws-including.html
Railway Says Stolen Customer AI Keys Led to $740,000 in Estimated Unauthorized Usage Charges
AI provider keys that customers stored on Railway were stolen in an October breach and used to commit an estimated $740,000 in unauthorized spending, the platform-as-a-service provider said yesterday. It has promised to pay those charges itself when an AI provider will not refund them.
The company builds and runs apps for its customers and stores their secrets, such as API keys and database
https://thehackernews.com/2026/11/railway-says-stolen-customer-ai-keys.html
AI provider keys that customers stored on Railway were stolen in an October breach and used to commit an estimated $740,000 in unauthorized spending, the platform-as-a-service provider said yesterday. It has promised to pay those charges itself when an AI provider will not refund them.
The company builds and runs apps for its customers and stores their secrets, such as API keys and database
https://thehackernews.com/2026/11/railway-says-stolen-customer-ai-keys.html
Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons
An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown.
When a chosen trigger appears, the model outputs an attacker's command, which an agent using that model would run with the agent's own permissions. The attacker must be able to change the model's weights.
The team tested the method on
https://thehackernews.com/2026/11/microsoft-researchers-show-ai-agents.html
An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown.
When a chosen trigger appears, the model outputs an attacker's command, which an agent using that model would run with the agent's own permissions. The attacker must be able to change the model's weights.
The team tested the method on
https://thehackernews.com/2026/11/microsoft-researchers-show-ai-agents.html