The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
Cyberattack on Norway’s aid agency may have swept up all user data
The names and email addresses of 20,614 people registered on Norad’s Grants Portal may have ended up in the hands of attackers, Norway’s development aid agency has disclosed. Norad, short for the Norwegian Agency for Development Cooperation, works with partners around the world on development aid…
-
PortSwigger’s Burp AT lets enterprises delegate pentests with defined limits
PortSwigger has announced the availability of Burp AT for enterprises, an agentic pentesting solution that helps security teams investigate important applications more deeply and more often. Burp AT combines specialist Burp tools, purpose-built pentesting skills developed with PortSwigger…
-
Sysdig AI Defense puts runtime guardrails on AI agents
Sysdig has announced the general availability of Sysdig AI Defense, giving organizations tools to monitor and control AI agent activity across endpoints and cloud environments. The platform checks agent actions against company policies to allow them, hold them for user approval or block them…
-
Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns
More than 200 sites were seen serving phishing content to first-time visitors but not to those who revisit.
-
Cyberattack Hits French Blood Bank Site but No Blood Products Are Compromised
The incident comes after supermarkets in a number of European countries reported this week that their fridges and freezers warmed up after they were remotely hacked.
-
Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws
Cisco patched an RCE in UCS Central Software; WatchGuard fixed authentication and MitM flaws.
-
Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out
A critical finding can move through several security tools and still leave the organization exposed. The vulnerability has a severity score, and a ticket has reached the queue. Progress then depends on information the finding may lack: who owns the system, whether attackers can reach it, what…
-
Scammers capitalize on GTA 6 hype to push malware and crypto cons
Scammers are offering supposed leaked builds, early copies and phone versions of Grand Theft Auto VI (GTA 6) weeks before the game’s November 19 launch, Netcraft warned in a new blog post. The company looked at GTA VI-themed domains that appeared between July 1 and October 27, 2026. Most of the…
-
ISC Stormcast For Thursday, November 5th, 2026 https://isc.sans.edu/podcastdetail/10166, (Thu, Nov 5th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
-
The Agent Smith Dilemma: Governing Agentic Identities
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
-
Google puts new limits on AI agents that hunt threats and fix vulnerabilities
Google Cloud is adding new controls to CodeMender, its AI tool for finding and fixing software vulnerabilities, allowing businesses to isolate attack simulations and target code scans more precisely. The updates let businesses verify vulnerabilities and simulate exploits in an operating…
-
CISO Conversations: Ryan Davis – The Unknown Is Where Security Meets Reality
Ryan Davis went from hacking his school’s network to running security at New Charter Technologies. What worries him now is shadow AI.
-
Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day
Tracked as CVE-2026-107441, the out-of-bounds write flaw could allow attackers to execute OS commands via crafted HTTP requests.
Also covered by Help Net Security
-
Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes
The large-scale watering hole campaign has been targeting entities in the US and Europe, mainly in Ukraine.
-
5 Active Cyber Threats That Put US Enterprises at Risk in October 2026
October 2026 brought another wave of cyber threats targeting US businesses, with attackers exploiting trusted platforms, legitimate authentication processes, and everyday business workflows. For enterprises, these campaigns raise the stakes beyond individual security incidents, increasing the risk…
-
OpenAI Finds GPT-6 Astra Quietly Holding Back on Internal Red-Teaming, Exploit Tasks
OpenAI says its Critical-rated cyber model met fewer hidden task goals when work was framed as AI safety research, often silently.
-
GhostMap Android flaw lets malicious app trigger persistent boot loop
Attackers can force Android devices into a continuous boot loop using a specially crafted app that requires no permissions and only needs to be installed. [...]
-
Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content
Apple has revealed that it plans to start checking public iCloud links for harmful content starting with iOS 27.3, iPadOS 27.3, macOS 27.3, and visionOS 27.3. The change specifically applies to scenarios where users share iCloud content, such as photos in iCloud Photos or files in iCloud Drive, by…
-
OpenAI’s upcoming AI model built 948 working Linux root exploits in a single run
An automated system running on an upcoming AI model turned hundreds of Linux kernel bugs into working exploits that give an ordinary user root access, and wrote a patch for each underlying flaw, OpenAI revealed in a new research post. Source:OpenAI The company’s Cyber team ran the pipeline in…
-
A banking malware sample led researchers to an Android bug that can loop-crash phones
Bitdefender Labs researchers built an Android app that contains no executable code and requests no permissions, and installing it leaves a Pixel 10 in a crash loop that can take a factory reset to clear. The flaw, which Bitdefender calls GhostMap, comes from how Android reads the ZIP structure…
-
CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access
The Indian Computer Emergency Response Team (CERT-In) has disclosed that an artificial intelligence (AI)-assisted threat actor it tracks as Crafty Falcon is targeting organizations in the Banking, Financial Services, and Insurance (BFSI) sectors in the country. Describing the threat as active and…
-
Apple is bringing harmful content checks to iCloud link sharing with potential account penalties
Apple will begin checking iCloud content shared using the “Anyone with the link” option for harmful material in iOS, iPadOS, macOS, and visionOS 27.3 or later. When sharing content stored in iCloud, users can choose “Share a Link” or “Send a Copy.” Those who choose “Share a Link” can restrict…
-
Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
Zyxel GS1900 network switches that received the vendor's earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found. The exploit lets anyone who can reach a switch's web management interface run commands on it without logging in. Zyxel has…
-
ICSA-26-211-07: Mitsubishi Electric CC-Link IE TSN Communication Protocol (Update B)
Highest CVSS 7.1. Affects Mitsubishi Electric MELSEC MX Controller MX-R model MXR300-16, Mitsubishi Electric MELSEC MX Controller MX-R model MXR300-32, Mitsubishi Electric MELSEC MX Controller MX-R model MXR300-64 and 119 more. Successful exploitation of this vulnerability could allow an attacker…
-
AI agent detection signals that still work when agents look human
Bots follow a script. AI agents work toward a goal and choose their own steps, which makes them harder to catch. In this Help Net Security interview, Zohaib Ahmed, CEO of Resemble AI explains how agents arrive as declared, undeclared or disguised traffic, and why binary bot detection misses the…