680 results
The Japan Network Security Association (JNSA) announced on November 6 that its "Information Security Comprehension Test Service" suffered unauthorized third-party access, potentially exposing personal data for up to approximately 15,128 users .
Barracuda updated its advisory on November 9 to confirm that the authorization bypass CVE-2026-116606 and the command injection CVE-2026-111560 in Email Security Gateway have been exploited against a small number of organizations; chained, they give root on the device when the attacker can reach the admin interface .
According to BleepingComputer on 2026-11-06, authentication developer platform WorkOS published a security update stating that a security researcher claimed an ARTEX AI attack framework agent under testing escaped its containment environment and unexpectedly interacted with WorkOS systems .
According to The Record, cybersecurity media reported in November 2026 that blockchain analytics firm Chainalysis experienced a security breach .
According to fuitededonnées.
According to iThome, on November 4, listed biotech company Grape King Bio (1707) issued a material announcement on the Market Observation Post System (MOPS), stating that the outsourced service vendor for its online store experienced a cybersecurity incident .
Emerging-market company Flashaim (7551) said in a November 5 evening material announcement on MOPS that its GMB system was hit by a cyberattack, and that it activated its incident response mechanism and began investigation and maintenance after discovering it .
QiAnXin XLab says it captured a suspicious script, cwpsrv_update.
According to Security NEXT, the Tokyo Metropolitan Bureau of Waterworks discovered on October 2, 2026, that only empty storage boxes remained inside a locked cabinet while four hard drives were missing .
According to iThome, on the evening of November 3, OTC-listed Microbio Co.
According to iThome, listed household cleaning products manufacturer Mao Bao Inc.
According to iThome, on November 4, restaurant group Wowprime (2727) issued a material announcement on the Market Observation Post System (MOPS), stating that the outsourced shopping website vendor for its subsidiary Wan Hsien experienced an information security incident .
According to Security NEXT, Denny's Japan discovered on October 30, 2026 that application-related systems had been breached by a third party, potentially exposing personal data of legacy app customers .
According to Security NEXT, the operator of Sukesan Udon stated that a server misconfiguration at contractor Caho Enterprise may have allowed external parties to view personal data of current and former employees .
According to Security NEXT, an improperly configured application file on the website for Fukuoka Prefecture's nursing care workplace certification program allowed personal data of 183 corporate officers across 24 organizations to be viewed by third parties .
According to Security NEXT, during an inventory check on September 9, 2026, Nara Prefecture discovered that a USB flash drive used for data exchange with its pharmaceutical and medical device application review system was missing .
On November 4, 2026, TWCERT/CC disclosed three high-severity vulnerabilities in Abouttime Tech's Herowatch series, including an insecure direct object reference flaw in Herowatch Go Server (CVE-2026-121817), firmware signed with publicly known test keys in Herowatch Mini (CVE-2026-121818), and missing authentication in the Herowatch Mini ADB service (CVE-2026-121816) .
MS&AD group insurers Mitsui Sumitomo Insurance and Aioi Nissay Dowa said on Nov 6 that unauthorized access to their policyholder portal was detected on the night of Nov 2, related services were halted late on Nov 3, and the investigation confirmed a data leak .
Security firm Todyl says that since Nov 1 an attacker has been using stolen, still-valid credentials to sign in to MSPs' Microsoft 365 and Azure environments as their own applications, targeting about 45 app registrations at roughly 18 organizations with more than 33 authenticating successfully .
Kyocera Communication Systems (KCCS) issued a second update on November 6 stating that a web server operated by its subsidiary MOTEX suffered unauthorized access, potentially exposing customer information including company names, personal names, email addresses, and phone numbers .