38 results
BleepingComputer reports that researcher Sean Bales publicly disclosed more than 30 N-able N-central vulnerabilities on Nov 8 without notifying the vendor and released proof-of-concept exploits in a GitHub repository called Able2Shell, the most critical chain using an unauthenticated XXE flaw to run commands on the server and create an admin account .
Vanderbilt University said on Nov 9 it is responding to an active cybersecurity incident that may impact university devices, systems and cloud-based services, and that its IT team is investigating and working to contain it .
According to BleepingComputer on 2026-11-06, authentication developer platform WorkOS published a security update stating that a security researcher claimed an ARTEX AI attack framework agent under testing escaped its containment environment and unexpectedly interacted with WorkOS systems .
According to The Record, cybersecurity media reported in November 2026 that blockchain analytics firm Chainalysis experienced a security breach .
BleepingComputer reports that Russian cloud and hosting provider Beget said an attacker gained access to the management systems of its entire architecture on the night of Nov 1 and deployed malware that erased server data, after which Beget disconnected all servers .
According to Security NEXT, Japan's Ministry of Foreign Affairs (MOFA) detected an intrusion on an externally connected network on July 27, 2026, and subsequently blocked access and disabled authentication credentials .
According to Security NEXT, on October 29, 2026, ServiceNow disclosed two vulnerabilities in AI Platform and one in Task Plan Templates, stating that updates released since September had addressed them .
According to ITmedia, Iris Plaza announced on November 5 that following unauthorized access to an external cloud service used by the company, personal data of approximately 7.
PayCloud Holdings subsidiary Arara said its email delivery service Arara Message suffered unauthorized access; it first disclosed the incident on Oct 29, and its Nov 6 third report put the deduplicated number of taken (or possibly taken) email addresses at 81,329,467 .
According to CNBC, crypto exchange Binance said a security incident affected about $6.
According to Security NEXT, the official Fuji-Q Highland app and CLUB Fuji-Q membership website suffered a password list (credential stuffing) attack between September 4 and 7, 2026 .
According to Security NEXT, Sony Network Communications announced that the So-net member database suffered an external intrusion on October 19, 2026, which was confirmed on October 23 .
According to ITmedia, Capcom announced on October 22 that its CAPCOM ID membership service suffered unauthorized access that leaked 11,774,247 records worldwide, after it found traces on the 19th and blocked the source .
GMO Internet said that on October 20 it confirmed a third party had planted a malicious program on some customer servers of its Onamae.
IDScan.
Have I Been Pwned says ShinyHunters targeted Carhartt in an August "pay or leak" extortion campaign and later published data including about 12.
Japanese cloud and hosting provider Sakura Internet said in its third report on September 10 that it detected an anomaly on a maintenance server for its rental server service on August 9, and found unauthorized access to rental servers with malware planted, affecting 951 accounts .
According to Portafolio, citing an announcement from Ecopetrol, an external threat actor gained unauthorized access to cloud storage environments across approximately 15 companies within the group and downloaded data associated with roughly 3,300 user accounts .
Dutch healthcare IT vendor ChipSoft said it detected anomalies on April 7 that proved to be a ransomware attack, and forensics confirmed criminals stole patient personal data, including medical data, from some Dutch customers .
According to TechCrunch, healthcare technology company CareCloud confirmed hackers accessed one of its electronic health record stores in March 2026; according to BleepingComputer, it disclosed the incident in an SEC filing in March, noting an 8-hour platform disruption .