Turla turned a Kazakh mail server into its own command post
ESET found a modular .NET toolset it calls Cereal on Microsoft Exchange servers at government bodies in Kazakhstan and Romania, with the main backdoor quietly turning each victim's mail server into the attacker's command server.
The Latest
A retired data platform still held the keys to customer clouds
Wiz traced a supply chain intrusion to Qubole's cross-account IAM roles, which stayed trusted long after organizations stopped using the…
An XML bug in Chrome is the eighth exploited this year
Google's latest desktop release closes a use-after-free in Chrome's XML component that attackers were already using.
Three days to patch two fresh additions to the KEV list
CISA flagged exploited flaws in IBM Aspera Faspex and SignalWire FreeSWITCH, both rated 9.8 and both newly patched.
An AI scanner found a decade old Rust standard library flaw
Microsoft's FORGE Lab used its agentic Hyenas tool to surface memory safety bugs in Rust's standard library, including one dormant…
Campus computers at Vanderbilt played a ransom recording
BYOD claimed the intrusion as university systems stayed restricted and students were told classes would continue as scheduled.
N-able pulled hosted N-central offline after 30 zero-days landed
A researcher published proof-of-concept exploits for more than 30 flaws in N-able's RMM platform, prompting the vendor to shut down…
SonicWall VPN logins that skip the identity provider land on a watchlist
Federal agencies have until November 20 to close an exploited SonicOS flaw that lets a password alone stand in for…
A suspicious file in a cloud tenant pulled down Iris Plaza
A third-party cloud service holds the records of 7.7 million Iris Plaza shoppers with no reopening date for the store
Italy points at pro-Russian crews as a minister’s file goes on sale
Foreign minister Antonio Tajani says criminals are shopping for more details about him and his family after his personal data…
US agencies put refrigeration controllers on the critical list
Five US agencies say attackers are tampering with the temperature controllers behind grocery cold rooms, hospital pharmacies and refrigerated trucks, pushing units into heating cycles that ruin stock and create fire hazards. The November 9 advisory from CISA, the FBI, HHS, USDA and the Department of Transportation stresses basic hardening and taking panels off the internet.
Frontline Education tells Indiana the breach reached 3 million
A third-party software flaw opened a K-12 software vendor's environment and the student and staff record count has now more…
AI agents cut the cost of forging signatures on old RSA keys
Supervised AI agents cut the compute bill for forging signatures on 1024-bit RSA while 2048-bit keys stay untouched
A supplier account opened a 118 million euro path into a bank
Crédit Mutuel Arkéa says an intruder reached an internal account through a third-party provider and moved funds destined for other…
Spotlight
APT hard link flaw lets an on-path attacker swap root packages
Debian and Ubuntu have patched CVE-2026-109518, a package manager flaw that lets on-path attackers substitute code and get root.
Most repository tokens never expire and agents are holding them
A BlueFlag AI survey found non-human identities outnumber developers eight to one, with almost all repository tokens lacking an expiry date.
Artex is now a criminal tool and the targets are bank tenants
Microsoft says a financially motivated group is running the agentic pentest framework against web apps, then planting open-source RATs on what it breaks.
Seventy minutes of poisoned updates put root on 2,950 hosting servers
Attackers turned OpsShield's own signing keys against its customers, shipping a malicious cPGuard build that ran with full privileges.
Features
Israeli intelligence veterans raise $15M to simulate what an attack looks like
Brava Security exits stealth with seed funding for a platform that generates attack telemetry so teams can find the gaps…
SonicWall patches a high severity SSL VPN flaw under active attack
SonicWall is investigating reported exploitation of a SonicOS flaw that lets alternate credentials skip SAML and its enforced multifactor authentication.
Claude Code’s approval file quietly published developer secrets on GitHub
A settings file that Claude Code writes when a developer approves a command has carried live passwords and keys into…
DigiCert left an archive on the open internet for 16 months
A 2025 server migration quietly exposed DigiCert's customer archive, and an outsider browsed identity documents for five days before access…
A browser extension turned Claude’s phone-to-desktop link into remote code
Any extension able to script claude.ai could drive Claude Desktop through Dispatch and install software, and retiring the feature leaves…
The Paint fix is out but Windows Update will never deliver it
Microsoft's patch for a Paint flaw that executes code over the network only arrives through the Store, and the advisory…