The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
95 stories match. Clear filters
-
Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia
The South Asian cyber espionage group known as Bitter (aka APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397) has been observed targeting South Asian organizations with a previously unreported remote access trojan called PapRAT. "PapRAT has both C++ and Rust implementations,"…
-
SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks. [...]
-
Veeam warns of Software Appliance boot failures on AMD EPYC hosts
Veeam warned customers about boot failures affecting Software Appliance virtual machines (VMs) on hosts with AMD EPYC processors. [...]
-
CISA adds CVE-2026-19868 to KEV: SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
Federal patch deadline 2026-11-20. SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced…
Also covered by CISA, SecurityWeek, The Hacker News, Help Net Security
-
Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required. The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday. One flaw…
-
Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws
Cisco patched an RCE in UCS Central Software; WatchGuard fixed authentication and MitM flaws.
-
The Agent Smith Dilemma: Governing Agentic Identities
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
-
SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records
SonicWall has warned of two vulnerabilities impacting end-of-life Global Management System (GMS) systems that it said will not be patched. Details of the security flaws, which affect SonicWall GMS 9.5.2 and earlier versions, are below - CVE-2026-109593 (CVSS score: 9.1) - An unauthenticated file…
-
NIKKE PC game launcher hacked to spread remote access, data-stealing malware
The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game's PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data. [...]
-
SonicWall warns of unpatched flaws in end-of-life GMS software
SonicWall warned customers of two security flaws affecting end-of-life Global Management System (GMS) systems that will not be patched. [...]
-
Barracuda ESG Authentication Bypass Flaw Opens Path to Root
An authentication bypass and a command injection flaw can be chained for root access on Barracuda’s Email Security Gateway appliances.
-
Citrix expands oversight of autonomous browsing and AI agent activity
Citrix has announced new capabilities across Citrix SecurSpaces, Citrix SecurAccess and Citrix Platform Flex designed to help organizations securely deploy AI agents, govern AI-powered work and scale adoption across the enterprise. These updates include an expansion of Citrix SecurSpaces to a…
-
Fresh European Fridge Attacks Put Cold-Chain Security in Focus
Beyond food storage, the same combination of Internet connectivity, remote access, and inadequate security practices can put temperature-controlled infrastructure across other critical sectors at risk.
-
Fireperf: Open-source network testing tool for firewalls and routers
The IPFire project has released fireperf, an open-source measurement tool that opens connections at a fixed rate and reports what the device in the middle did with each one. It is free software aimed at administrators, developers and testers who evaluate firewalls, routers and other systems that…
-
CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527)
CISA added two new Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) to its Known Exploited Vulnerabilities catalog on Friday, after Ivanti updated an earlier security advisory with details about the flaws. Three flaws chained to gain a foothold CVE-2026-111357, a missing…
-
Synology warns of C3RB3R ransomware attacks targeting NAS devices
Taiwanese network-attached storage (NAS) appliance maker Synology warned customers to update their devices immediately due to a surge in C3RB3r ransomware attacks. [...]
-
Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts
Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been…
-
Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks.
Also covered by BleepingComputer
-
PHP2Shell plus Fragnesia chain used to root Palo Alto firewall management servers (edge of window)
Attackers chained PHP2Shell (CVE-2026-109618, CVE-2026-109619, CVSS 4.0 9.2) with the Linux kernel flaw Fragnesia (CVE-2026-46300) to get root on PAN-OS management servers. Reported: 24 internet-facing firewalls plus one internal management server compromised, a persistent reverse SSH tunnel into…
-
Palo Alto Networks firewalls compromised in chained attacks using PHP2Shell
The AI-enabled campaign hit two dozen targets, including sites linked to the U.S. government.
-
CISA adds CVE-2026-118527 to KEV: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
Federal patch deadline 2026-11-13. Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with…
Also covered by Cybersecurity News, The Hacker News
-
CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-97229 (CVSS score: 10.0)…
Also covered by CISA KEV, Xalgorix weekly AppSec digest
-
ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories
Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn't. There's a strange mix of clever tricks and careless mistakes. Hackers are borrowing trust from…
-
Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild. The vulnerability, tracked as CVE-2026-76418, is rated 8.6 on the CVSS…
Also covered by CISA KEV, Cybersecurity News
-
GitHub Launches npm Firewall to Block Malicious Packages Before Installation
GitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time. "The firewall inspects both metadata requests and package downloads for signs of malicious activity, acting as an install-time policy gate,"…