IT Security News: Afternoon roundup, 2026-11-13 Summary Friday's window was dominated by three threads: attacks that abuse trusted tools and services, from fake AI-site typos to a compromised GitHub account farm and a rogue Linux miner, and a steady run…
Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords
Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday.…
Muse sleep band users weren’t told their brain data was training AI
Muse maker Interaxon reportedly trained AI on users’ de-identified brainwave data, then revised its privacy policy after journalists asked questions.
Siemens Building Automation and Energy Products
View CSAF Summary On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution…
How Beginner Creators Can Earn with the Temu Influencer Program This Black Friday
Black Friday is a major shopping occasion, making it a timely opportunity for creators to share gift ideas,…
Active Exploits, AI Risks and Supply Chain Breaches Define Week
Weekly summary of Cybersecurity Insider newsletters
AWS Security Patch SSRF in MCP Gateway Registry
HOC Shorts | Amazon Web Services published security bulletin 2026-180-AWS (content type: Important), disclosing a network-layer vulnerability affecting…
Open code isn’t the problem: experts on the “god-tier” flaws exposed across UK government repositories
A security researcher has uncovered more than 100 serious vulnerabilities in publicly available UK government code, including credentials that could have…
The SASE “Trilemma”: How Regulated Enterprises are Navigating Digital Sovereignty, Resilience, and Global Cyber Threat Intelligence
Modern enterprise architecture faces a critical tension: architecting a Secure Access Service Edge (SASE) deployment where data sovereignty, operational…
United Airlines blocks AI agents from booking flights, citing cybersecurity risks
The airline said it will not allow customers to use AI agents to book flights and manage reservations.
Don’t put Section 702 spying law renewal in defense bill, groups urge Hill leaders
CyberScoop is exclusively reporting on the letter to the Hill on the controversial snooping authorities under the Foreign Intelligence Surveillance Act.
Rewriting less than 10 neurons in an LLM can turn it into a sleeper backdoor
Microsoft researchers have found that rewriting fewer than 10 rarely used neurons in an open-weight AI model can turn any agent built on it into a sleeper…
35K+ Grok-Built Apps Exposed Online
A security audit by Claroc has revealed that more than 35,000 applications built using the Grok AI platform were left publicly accessible without any…
Criminal IP Launches New TI Feed App on Splunkbase for Automated Threat Detection
Torrance, USA, 11th November 2026, CyberNewswire
Siemens Desigo, Gridscale
View CSAF Summary On October 21, 2026, the Node.js project released security updates addressing a critical vulnerability in the Brotli decoder bundled…
TinstaPorn Android Malware Poses as Casino App to Collect User Data
A fake Macau casino app uses rigged betting odds to exploit gamblers while collecting phone numbers, location data…
Europe Is Setting the Global Standard for Sovereignty. Here Is Where We Stand.
It has been a few months since I last wrote about sovereignty. In that time, the conversations I have had with organizations across Europe have become…
Online Casino Serves Malicious Python SDK
aurum-pay waits for its first API call, then fetches and runs a remote command that installs a persistent Linux RAT.
Huntress uncovers SCKit: rogue ScreenConnect toolkit hits 288 hosts in 90 minutes
Huntress researchers have detailed a fast-moving campaign in which attackers abused cloud-hosted ScreenConnect panels to install rogue clients and a…
Cloud security statistics for 2026
Most organisations use the cloud today. Indeed, a 2026 multi-country survey found that over 80% of firms run workloads in these environments. Private and…
Claude Code’s ‘don’t ask again’ button has a secrets-spilling problem
A configuration file meant to store local command permissions on Anthropic’s Claude Code is exposing thousands of API keys, database credentials and other…
International operation dismantles malware networks, exposes 6.4 million stolen credentials
The Operation Endgame action dismantled the loaders, remote access trojans and infostealers that give ransomware gangs their way into corporate networks.
University of Texas at Arlington warns personal information stolen during cyberattack
In a statement to Recorded Future News, a spokesperson said an investigation into the attack confirmed the stolen data but declined to say what…
Siemens RUGGEDCOM APE1808
View CSAF Summary Palo Alto Networks has published information on vulnerabilities in PAN-OS related to PHP2Shell vulnerabilities. This advisory lists the…
Three People Arrested for AI-Enhanced Impersonation Fraud
It’s hard to believe how lucrative this crime can be: According to a press release from the United States attorney’s office for the southern district of…