The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
Harden cooling systems now, feds warn critical infrastructure operators amid attacks
The U.S. government on Thursday called on critical infrastructure operators to safeguard their cooling systems following hacks that have caused chaos in European supermarkets in recent weeks.
-
APT29's Watering Holes Target Thousands of Mobile Users
After compromising websites, the Russian state-sponsored threat group is fingerprinting victims, then harvesting information from the interesting ones.
-
CISA and Government Partners Release Fact Sheet on Hardening Industrial Refrigeration and Cold Chain Monitoring Systems Against Malicious Activity
Cybersecurity and Infrastructure Security Agency (CISA) CISA and Government Partners Release Fact Sheet on Hardening Industrial Refrigeration and Cold Chain Monitoring Systems Against Malicious Activity [ ] 11/05/2026 1:00 PM EDT Today, the Cybersecurity and Infrastructure Security Agency (CISA)…
-
OpenSSH flaw lets attackers log into password-disabled Linux accounts
A newly disclosed OpenSSH vulnerability dubbed "*sshole" allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts that are configured to block password authentication, simply by entering an oversized password. [...]
-
AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research
An unreleased OpenAI cyber model found and exploited 948 distinct Linux kernel privilege escalation bugs for about $1.2 million.
-
Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaign
Russian state-linked hackers targeted users in Ukraine, the United States and Europe in a campaign to steal sensitive information from iPhone and Android devices, researchers found.
-
SecurityDataPipeline.com Launches as a New Educational Resource for the AI Era
The ungated resource explains how security data pipelines reduce SIEM ingestion costs, preserve detection coverage, and prepare the data layer for AI-driven security operations.
-
What to expect from Democrats’ cybersecurity agenda in Congress
From CISA to AI and beyond, the new Democratic majority has many opportunities to scrutinize government programs and push new policies.
-
OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux
Attackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name, and a password between 257 and 1,024 bytes long. OpenSSH, which rates the flaw…
-
Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction
Cybersecurity researchers have disclosed details of a now-patched vulnerability that could be exploited to bypass Lockdown Mode protections in OpenAI ChatGPT. Lockdown Mode was introduced by the artificial intelligence (AI) company in June 2026 as an optional setting to minimize data exfiltration…
-
Hackers backdoor Linux servers using trojanized CWP web server
A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. [...]
-
DigiCert data breach exposes customer information, identity documents
DigiCert warns it suffered a data breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to customer information and identity documents. [...]
Also covered by SecurityWeek
-
French authorities probe cyberattack targeting nation’s blood supply
The attack follows a wave of hacks against refrigeration systems at supermarkets across Europe.
-
Vulnerability Scans for Older Cisco IOS Vulnerability / Opt-Out Headers, (Thu, Nov 5th)
This morning, I was browsing our honeypot data for any new and existing PHP exploit attempts. Instead, I first ran into some GeoServer exploits, but found them to be too boring to write up. This Cisco IOS exploit attempt was a bit more interesting. Still nothing new. I suspect this is for…
-
CISA, ASD’s ACSC and NSA Release Joint Guidance on Post-Quantum Cryptography Questions to Ask Your Vendors
Cybersecurity and Infrastructure Security Agency (CISA) CISA, ASD’s ACSC and NSA Release Joint Guidance on Post-Quantum Cryptography Questions to Ask Your Vendors [ ] 11/05/2026 10:00 AM EDT Today, the Cybersecurity and Infrastructure Security Agency (CISA), the Australian Signals Directorate’s…
-
Cyberhaven launches Agentic Data Security to track and control AI data use
Cyberhaven has introduced Agentic Data Security (ADS), to help CISOs, data security teams, insider risk teams, and AI governance leaders say yes to AI agents without losing control of their data. Agentic Data Security shows security teams what every AI agent does with company data, who it is…
-
Closing the Identity Gap at the Service Desk
Attackers target IT service desks to bypass MFA by impersonating employees and convincing staff to reset passwords or register new authentication devices. Specops Software explains why traditional identity verification methods are no longer sufficient and how organizations can secure account…
-
Rubrik hosts NAS backups in isolated, immutable vaults
Rubrik has announced Rubrik-Hosted Protection for On-Premise Unstructured Data. The offering is built on Rubrik’s Network Attached Storage (NAS) Cloud Direct service. Customers now have clean recovery for enterprise-scale NAS data without having to buy, build or manage backup storage. “Backups…
-
ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories
How much damage can someone do without breaking much? Quite a lot, it seems. A stolen login can open doors across several systems. A trusted setting can be used to lock people out. Even a simple file copy can reach places it shouldn't. And while new tools are helping find security holes faster…
-
Vercel ties login sessions to devices, rolls out AI security reviews in public beta
Vercel, the popular cloud platform for building and hosting websites and web applications, has announced the rollout of Device Bound Session Credentials (DBSC) and the launch of Vercel Security Review in public beta. Making stolen session cookies worthless Device Bound Session Credentials is a…
-
Arkose Labs expands Agent Trust Manager to govern agent sessions
Arkose Labs has expanded Arkose Agent Trust Manager to help businesses control agentic traffic. Companies can classify agent sessions, apply allow, monitor or block policies at each step of the customer journey, and track the same agent across multiple networks. The need is urgent given Arkose…
-
Box pairs agentic workflow plans with new threat protections
Box has announced new capabilities to transform how organizations put agents to work across their most critical business processes. Box unveiled Box Architect for autonomously building, managing, and optimizing agentic workflows, redefining how organizations deploy AI on their most critical…
-
Cyberattack on Norway’s aid agency may have swept up all user data
The names and email addresses of 20,614 people registered on Norad’s Grants Portal may have ended up in the hands of attackers, Norway’s development aid agency has disclosed. Norad, short for the Norwegian Agency for Development Cooperation, works with partners around the world on development aid…
-
PortSwigger’s Burp AT lets enterprises delegate pentests with defined limits
PortSwigger has announced the availability of Burp AT for enterprises, an agentic pentesting solution that helps security teams investigate important applications more deeply and more often. Burp AT combines specialist Burp tools, purpose-built pentesting skills developed with PortSwigger…
-
Sysdig AI Defense puts runtime guardrails on AI agents
Sysdig has announced the general availability of Sysdig AI Defense, giving organizations tools to monitor and control AI agent activity across endpoints and cloud environments. The platform checks agent actions against company policies to allow them, hold them for user approval or block them…