The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
AI Makes Reverse Engineering Mainstream Software & Malware Far Easier
Researchers unpacked, mapped, and recreated complex software and the Turla malware, raising fresh concerns for defenders.
-
Apple Patches Everyting: November 2026 Edition, (Tue, Nov 10th)
-
Anthropic Rolls Out Mythos 5.2 With Improved Bug Hunting, Fewer Sandbox Escapes
Anthropic says Mythos 5.2 improves vulnerability discovery while showing a lower tendency to escape sandboxes in controlled tests.
-
IRISSCON 2026 puts preparedness for cyberattacks and hybrid threats in focus
Ireland risks being dangerously unprepared for increasingly sophisticated cyberattacks and hybrid threats unless the Government acts urgently to strengthen the country’s national security capabilities, according to Brian Honan, head of the Irish Reporting and Information Security Service…
-
Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed
An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today. Apple's updates for iOS 26 and 27, released yesterday, do not list…
-
SAP patches ICM2SHELL and PROXYGATE maximum severity flaws
SAP patched 35 vulnerabilities in its November 2026 security updates, including four maximum-severity issues affecting its NetWeaver, Web Dispatcher, and Gateway software. [...]
-
Claude Mythos 5.2 arrives with stronger bug hunting and less sandbox-breaking behavior
Anthropic released Claude Fable 5.2 and Claude Mythos 5.2. The two versions share an underlying model, with stricter safeguards for cybersecurity and biology tasks in the broadly available Fable. Fable blocks fewer requests Fable’s safety classifiers block high-risk cybersecurity tasks such as…
-
Beyond the Alert: The Case for Rich Network Data
At some point your security will fail. This isn’t pessimism. It’s not because your team and tools aren’t sophisticated enough. It’s the reason we have detections in the first place. And, it’s why once we accept that prevention has its limits, we arrive at an interdiction strategy: finding and…
-
Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities
An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined. As of today, other…
-
Hackers now exploit critical Barracuda ESG flaws to gain root access
Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges. [...]
-
Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers
The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails. According to an ESET report shared…
-
Turla hackers use new Ceral malware to spy on govt Exchange servers
The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations. [...]
-
Windows settings backup is on by default starting with Windows 11 26H2
Starting with Windows 11, version 26H2, Windows settings backup will switch on by default on eligible devices. The company renamed the feature, which launched in August 2025 as Windows Backup for Organizations, and moved the management of roaming settings into the same policy tools. What gets…
-
SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution
Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score. Three are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the Web Dispatcher…
-
Turla’s Cereal malware turns victims’ Exchange servers into spy hubs
Russia-aligned group Turla planted a modular .NET toolset on Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania, and used it to copy selected email straight out of the mail flow. ESET researchers found the malware and named it Cereal. The toolset…
-
N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days
Attackers could exploit the flaws for remote code execution, credential theft, and administrator account creation.
-
France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites
An October cyberattack on refrigeration controllers at about 700 French retail sites was carried out by a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), the French government said yesterday. The attackers broke into controllers on the night of October 11 and changed their defrost…
-
Anthropic's Claude Fable 5.2 Beats GPT-6 Cyber in Multi-Stage Cyberattack Benchmark
Anthropic on Monday released Claude Fable 5.2 and Claude Mythos 5.2 models, which it said exhibit improvements in coding, reasoning, and vision. During pre-release training, the large language models (LLMs) helped its engineers "complete otherwise-infeasible software migrations, designed three…
-
Fireworks AI discloses new breach after cloud provider hack
AI infrastructure startup Fireworks has disclosed a new security breach in which attackers accessed its development machines after breaching a third-party cloud provider. [...]
-
What a security leader should tell the CEO about leaked credentials
In this Help Net Security interview, Eric Fourrier, CEO of GitGuardian, talks about leaked credentials and personal liability for security leaders and boards. He explains how fear of blame pushes mistakes out of sight, and what a security leader should be ready to tell a CEO about exposed keys. He…
-
France Blames Iran for a Cyberattack That Heated Supermarket Refrigerators
France summoned the Iranian ambassador and said it would seek European sanctions against those responsible for the attack
-
Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, assigned the CVE identifier CVE-2026-125350 (CVSS score: N/A), has been described as a use-after-free bug in the XML…
-
N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits
N-able said it has taken N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice following the public disclosure of over 30 vulnerabilities collectively tracked as Able2Shell. "As a precautionary measure, we are temporarily taking…
-
Chrome Update Patches Exploited XML Zero-Day, Eighth This Year
The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks.
Also covered by BleepingComputer
-
Security teams want to spot unusual AI agent behavior while they’re still defining normal
AI agents topped the list of planned investments in behavioral monitoring in Abnormal AI’s 2026 State of Behavioral Security Report. Asked where their organizations would invest most over the next two years, 43% of respondents chose AI agents, more than three times the share who chose API…