IT Security News: Morning roundup, 2026-11-12 Summary The most pressing thread in this window is attacks on trusted infrastructure that other organizations rely on: a mass GitHub credential-theft campaign, a Red Hat Quay flaw exposing container images, critical bugs in…
Critical MongoDB Use-After-Free Vulnerability Allows Remote Code Execution Without Authentication
MongoDB has patched a critical use-after-free flaw, tracked as CVE-2026-118383 with a CVSS score of 9.5, that unauthenticated attackers can exploit over…
Another Way Police Are Locating People from Their Smartphones
Penlink’s Webloc is an application that locates people using information from the weather, gaming, email, and religious apps on their phone. It’s sold to…
Google Chrome Fixes 83 Security Flaws, Including 5 Critical Use-After-Free Vulnerabilities
Google released a Chrome desktop security update that addresses 83 vulnerabilities, including five critical use-after-free flaws affecting ServiceWorker,…
European tech buyers add digital sovereignty to cyber shopping list
Sales from EU HQ’d vendor rocket in two years. The Trump affect? Yes but NIS2 and DORA are factors too
Crypto Agility: Every Security Change Competes with Business Profits
Crypto Agility: Every Security Change Competes with Business Profits lee.potok@thal… Thu, 11/12/2026 – 10:30 Crypto agility helps organizations reduce…
Why the DHS Employee Leak Is an Identity-Security Crisis, Not Just Another Data Breach
The exposure of information connected to more than 41,000 US Department of Homeland Security personnel demonstrates how an employee directory can become…
Hackers Exploit Decade-Old OpenSSH Flaw to Bypass Linux Logins
Hackers exploit SSHole OpenSSH flaw to bypass Linux logins and install a Python backdoor. CISA confirms exploits as patched packages become available.
AntiFox AI Agents Linked to AWS Attacks That Exposed Production Secrets and Compromised Web Servers
Attackers are using AntiFox, an agentic AI penetration-testing framework derived from ARTEX, to target internet-facing web applications and AWS…
The UK announces a new AI biosecurity lab
Artificial intelligence is creating new opportunities in medicine and biological research, but it may also make some biological risks harder to manage.…
Industrial cyber incidents surge as SANS survey exposes serious recovery gaps
More than a third of industrial organisations (34%) experienced a cyber incident affecting their operational technology (OT) environments in the past…
Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), (Thu, Nov 12th)
CVE-2026-102895 is a trivial authentication-bypass vulnerability. GPUStack is also an attractive target. It is open-source software that manages clusters…
IT Security News Hourly Summary 2026-11-12 13h : 18 posts
18 posts published in the last hour 11:35PoC Exploit Released for Critical Cisco Expressway RCE Vulnerability With CVSS 9.8 Score 11:34Inside an AI Attack Against a US Retailer 11:34Why scammers want you to allow push notifications 11:34Microsoft Entra adds a…
PoC Exploit Released for Critical Cisco Expressway RCE Vulnerability With CVSS 9.8 Score
A public proof-of-concept exploit is now available for CVE-2026-76466, a critical flaw in Cisco Expressway that lets an unauthenticated attacker run…
Inside an AI Attack Against a US Retailer
When hand-typed commands failed to breach a US retailer, the attacker turned to AI-generated scripts, achieving lateral movement in minutes.
Why scammers want you to allow push notifications
Browser push notifications are a common nuisance, and they can make people think their device is infected with adware.
Microsoft Entra adds a seven-day safeguard against irreversible identity deletion
Microsoft Entra’s Hard Deletion Protection, now in preview, gives administrators a seven-day window to recover selected identities before they can be…
Security Teams Must Shift from Patching to Mitigation in the AI Era
Symantec’s Dick O’Brien says the rapid closure of the patch window means organizations must move beyond patching and adopt an assume exploit mindset
Notion Customer Data Compromised in Fireworks AI Hack
The attackers accessed chat transcripts for fewer than 1% of Notion workspaces. Most transcripts were unattributable.
Google’s Gemini Decisions API to handle up to 1,000 questions per request
Google has announced Gemini Decisions API, offering developers a way to handle routine decisions in AI applications without generating text responses,…
Bring Your Own CA: Palo Alto Networks Joins the Imperva SSL Integration Center
In August we introduced the Imperva SSL Integration Center with one idea behind it: the certificates protecting your applications should be governed where…
Cyber Agony Aunts Launch Christmas Campaign to Tackle Period Poverty
The Cyber Agony Aunts, Amelia Hewitt and Rebecca Taylor, have launched Periods of Kindness, a Christmas campaign encouraging the cybersecurity community…
Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop…
State-Sponsored Hackers Deploy Up to 8 AI Agents to Target Taiwanese Government Systems
A campaign against Taiwanese government entities used up to eight AI agents with limited human intervention. Recorded Future points to research describing…
Stolen Claude API keys can turn Claude Code into a remote-controlled implant
Darktrace researchers turned Claude Code into a remote-controlled implant in a lab test, steering the coding agent through the memory stores feature of…