92 results
Zoom published two security bulletins on November 10, 2026, saying improper input validation flaw CVE-2026-108186 in Zoom Workplace for Windows may let an unauthenticated user escalate privileges via network access, rated Critical with CVSS 9.
Microsoft’s November Patch Tuesday fixes Outlook spoofing flaw CVE-2026-124194: if a user opens a crafted message file, Outlook connects to an attacker-controlled location without the usual external-content warning and leaks an NTLMv2 hash that can be used to impersonate the user .
ESET said on November 10 that it found a previously undocumented modular .
Google updated the Chrome Stable channel on Nov 9, 2026 to 157.
The Roundcube team released Webmail security updates 1.
Vanderbilt University said on Nov 9 it is responding to an active cybersecurity incident that may impact university devices, systems and cloud-based services, and that its IT team is investigating and working to contain it .
Ethersphere maintainers said on GitHub that Swarm Desktop 0.
Semiconductor packaging firm Xintec (3374) said in a Nov 6 MOPS filing that an unknown IP address intruded into its internal information systems .
On November 5, 2026, OpenSSH released version 10.
Barracuda updated its advisory on November 9 to confirm that the authorization bypass CVE-2026-116606 and the command injection CVE-2026-111560 in Email Security Gateway have been exploited against a small number of organizations; chained, they give root on the device when the attacker can reach the admin interface .
According to Security NEXT, the Tokyo Metropolitan Bureau of Waterworks discovered on October 2, 2026, that only empty storage boxes remained inside a locked cabinet while four hard drives were missing .
According to Security NEXT, the operator of Sukesan Udon stated that a server misconfiguration at contractor Caho Enterprise may have allowed external parties to view personal data of current and former employees .
According to Security NEXT, during an inventory check on September 9, 2026, Nara Prefecture discovered that a USB flash drive used for data exchange with its pharmaceutical and medical device application review system was missing .
Security firm Todyl says that since Nov 1 an attacker has been using stolen, still-valid credentials to sign in to MSPs' Microsoft 365 and Azure environments as their own applications, targeting about 45 app registrations at roughly 18 organizations with more than 33 authenticating successfully .
According to Security NEXT, a use-after-free vulnerability (CVE-2026-98432) exists in IPv4 TCP connection handling in the Linux kernel .
Following Google's disclosure of the XCPE botnet, cybersecurity vendor TrendAI published observations from June 3 to October 1 showing approximately 1.
ESET researchers exposed a Russia-aligned threat actor they named Gorbag, active since at least February 2025 and focused exclusively on Ukrainian targets, especially law enforcement and justice entities, local administrations near the front line, the defense sector and a major transportation hub for foreign military aid .
Fortinet FortiGuard Labs published research on Nov 2 saying it has tracked, over several months, a campaign targeting South Asian organizations that uses PowerShell scripts and a custom remote access trojan it calls PapRAT for persistent access, attributing it to BITTER with high confidence .
On October 30, Taiwan Broadband Communications (TBC) issued a material information filing on MOPS stating that IT systems of the company and its subsidiary were attacked by unknown external hackers, resulting in malicious encryption of files on certain servers and affecting some internal operational systems .
DreamHost says it discovered on October 23 that an unauthorized third party had accessed the server running its web-based File Manager at files.