30 results
NTT Data announced on Nov 9 that the sign-up service for Sumitomo Life's standalone Vitality programs, which it builds and operates under contract, was accessed by a third party and personal data of about 80,000 users leaked .
BleepingComputer reports that researcher Sean Bales publicly disclosed more than 30 N-able N-central vulnerabilities on Nov 8 without notifying the vendor and released proof-of-concept exploits in a GitHub repository called Able2Shell, the most critical chain using an unauthenticated XXE flaw to run commands on the server and create an admin account .
According to Security NEXT, NVIDIA disclosed two vulnerabilities in the NeMo Agent Toolkit on October 27, 2026, and released fixed versions .
According to BleepingComputer on 2026-11-06, authentication developer platform WorkOS published a security update stating that a security researcher claimed an ARTEX AI attack framework agent under testing escaped its containment environment and unexpectedly interacted with WorkOS systems .
According to The Record, cybersecurity media reported in November 2026 that blockchain analytics firm Chainalysis experienced a security breach .
Emerging-market company Flashaim (7551) said in a November 5 evening material announcement on MOPS that its GMB system was hit by a cyberattack, and that it activated its incident response mechanism and began investigation and maintenance after discovering it .
Kyocera Communication Systems (KCCS) issued a second update on November 6 stating that a web server operated by its subsidiary MOTEX suffered unauthorized access, potentially exposing customer information including company names, personal names, email addresses, and phone numbers .
According to Security NEXT, SonicWall disclosed two vulnerabilities in Global Management System (GMS) on November 3, 2026, but will not provide patches because the product has reached end of support .
According to Security NEXT, a use-after-free vulnerability (CVE-2026-98432) exists in IPv4 TCP connection handling in the Linux kernel .
BleepingComputer reports that Russian cloud and hosting provider Beget said an attacker gained access to the management systems of its entire architecture on the night of Nov 1 and deployed malware that erased server data, after which Beget disconnected all servers .
According to Security NEXT, on October 28, 2026, Yamaha disclosed two vulnerabilities in its NWR100 wireless routers and released fixed firmware .
According to Security NEXT, on October 29, 2026, ServiceNow disclosed two vulnerabilities in AI Platform and one in Task Plan Templates, stating that updates released since September had addressed them .
According to iThome, e-commerce cloud ERP provider Mallbic stated that routine daily security checks on October 31 uncovered host anomalies and confirmed that unauthorized malicious commands had been executed on certain hosts; attackers entered through a brand website service portal, potentially affecting consumer and transaction data imported by merchants from other e-commerce platforms .
PayCloud Holdings subsidiary Arara said its email delivery service Arara Message suffered unauthorized access; it first disclosed the incident on Oct 29, and its Nov 6 third report put the deduplicated number of taken (or possibly taken) email addresses at 81,329,467 .
According to Security NEXT, Giftee Group announced that its subsidiary Giftee suffered unauthorized access exploiting a system vulnerability on October 25, 2026, resulting in a third party illicitly issuing electronic gift vouchers .
GMO Internet said that on October 20 it confirmed a third party had planted a malicious program on some customer servers of its Onamae.
According to Impress Watch, Japanese software maker Sourcenext announced on October 15 that a third party gained unauthorized access and that 22,519,960 customer records may have leaked .
On October 6, 104 Corporation issued a material information filing on MOPS stating that it had detected abnormal read activity on its App system, and an investigation confirmed that approximately 120,000 resume records were read without authorization .
On October 7, International Games System Co.
IDScan.