IT Security News: Morning roundup, 2026-11-11 Summary This window was dominated by AI showing up on both sides of the threat picture. A financially motivated cluster is using AI-enabled pen-testing tools against banks, Citrus ransomware reportedly uses LLMs, and Claude…
Poland shuts down government services platform ePUAP following cyberattack
The attack targeted a nationwide system that allows users to submit official documents, communicate with government agencies and complete administrative…
Fortinet2Shell Vulnerability Lets Hackers Execute Code on FortiClient Systems Through Malicious Websites
Fortinet has patched a critical flaw in FortiClient that lets attackers run code on a victim’s computer through a malicious website. The bug is tracked as…
Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords
Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday.…
Britain, France set out first guidelines for commercial hacking firms
The guidelines call on businesses that develop, sell or finance CCICs to vet their customers, establish technical safeguards against misuse and to…
N-able Warns of Critical N-central Zero-Day Vulnerability Actively Exploited by Hackers
N-able has warned that attackers are actively scanning for vulnerable N-central servers after the publication of proof-of-concept (PoC) code related to…
Rewriting less than 10 neurons in an LLM can turn it into a sleeper backdoor
Microsoft researchers have found that rewriting fewer than 10 rarely used neurons in an open-weight AI model can turn any agent built on it into a sleeper…
Muse sleep band users weren’t told their brain data was training AI
Muse maker Interaxon reportedly trained AI on users’ de-identified brainwave data, then revised its privacy policy after journalists asked questions.
AI doesn’t have to go rogue to break the world
AI systems are learning to exploit loopholes in everything from software to tax law. The biggest threat may not be malicious intent, but machines doing…
N-able releases security hotfixes for zero-day vulnerabilities
N-able released hotfixes to address zero-day bugs affecting its N-central remote monitoring and management (RMM) platform, which were publicly disclosed…
A New AI Tool From Google DeepMind Proved the Signal Protocol Is Secure
DeepMind researchers were able to formally verify that the widely used encryption protocol works as intended. Their stretch goal? Do the same for “all the…
Open code isn’t the problem: experts on the “god-tier” flaws exposed across UK government repositories
A security researcher has uncovered more than 100 serious vulnerabilities in publicly available UK government code, including credentials that could have…
ISC Stormcast For Tuesday, November 10th, 2026 https://isc.sans.edu/podcastdetail/10172, (Tue, Nov 10th)
This post has no text preview — click the link below to read the original article. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: ISC Stormcast For Tuesday, November 10th, 2026 https://isc.sans.edu/podcastdetail/10172,…
TinstaPorn Android Malware Poses as Casino App to Collect User Data
A fake Macau casino app uses rigged betting odds to exploit gamblers while collecting phone numbers, location data…
Trump picks Palantir’s LoSapio to head CISA
The Cybersecurity and Infrastructure Security Agency has gone without a Senate-confirmed director for all of Trump’s second term, and Michael LoSapio…
IT Security News Hourly Summary 2026-11-11 14h : 30 posts
30 posts published in the last hour 12:36Online Casino Serves Malicious Python SDK 12:36Windows Active Directory RCE and DoS Vulnerabilities Put Windows Systems at Risk 12:36Researcher Finds 100-Plus Serious Flaws in UK Government Code 12:35Anthropic’s super bug-finding Mythos model is…
Online Casino Serves Malicious Python SDK
An online casino is serving up malware via a malicious PyPI SDK package.
Windows Active Directory RCE and DoS Vulnerabilities Put Windows Systems at Risk
Microsoft disclosed two Windows Active Directory vulnerabilities on November 10, 2026, exposing affected systems to remote code execution and denial of…
Researcher Finds 100-Plus Serious Flaws in UK Government Code
A researcher found more than 100 serious flaws in UK government code. Learn what security teams should check for exposed secrets and access-control gaps.
Anthropic’s super bug-finding Mythos model is going into Cisco and IBM products
Enterprise security tools will offer its capabilities without handing customers the model itself
Three People Arrested for AI-Enhanced Impersonation Fraud
It’s hard to believe how lucrative this crime can be: According to a press release from the United States attorney’s office for the southern district of…
Hotel giant Wyndham exposed customer data after app security lapse
Exclusive: Wyndham left a hardcoded credential in its customer app, allowing anyone to access customer data. The hotel giant wouldn’t say if it has the…
Claude Code’s ‘don’t ask again’ button has a secrets-spilling problem
A configuration file meant to store local command permissions on Anthropic’s Claude Code is exposing thousands of API keys, database credentials and other…
CVE-2026-124034, CVE-2026-124035: Issues with Amazon Braket SDK
Bulletin ID: 2026-175-AWS Publication Date: 11/09/2026 14:15 PM PST Description: Amazon Braket SDK is an open source Python library that customers use to…
Rubrik enhances DevOps Protection to preserve legitimate work during recovery
Rubrik has announced cyber recovery capabilities for DevOps platforms Microsoft Azure DevOps and GitHub. With built-in anomaly detection, blast radius…