A phishing kit called SkyW4lker (also branded SkyW4lker x365 Sentinel) is quietly taking over Microsoft 365 accounts without ever stealing a password.…
Category: Cyber Security News
Debian and Ubuntu APT Flaw Lets Hackers Hijack Software Updates and Execute Code as Root
A newly disclosed bug in APT, the package manager behind Debian and Ubuntu, can let a network spy swap a trusted software package for a bad one. The flaw…
Critical Ruby on Rails Flaw Could Let Hackers Steal Server Secrets Through Malicious Image Uploads
A critical flaw in Ruby on Rails Active Storage lets an unauthenticated user upload a crafted image and make the server write files. If uploads use the…
Node.js Schedules High-Severity Security Fixes for 22.x, 24.x, and 26.x Release Lines
The Node.js project has scheduled security updates for its 22.x, 24.x, and 26.x release lines on or shortly after Wednesday, November 11, 2026. The…
French Bank Crédit Mutuel Arkéa Confirms Cyberattack Amid Reports of $133 Million Theft
French banking group Crédit Mutuel Arkéa has confirmed a cyberattack that enabled fraudulent transactions, following reports linking the institution to…
Gorbag Hackers Exploit WinRAR Vulnerability to Steal Credentials From Ukrainian Government Agencies
Russia-aligned hackers tracked as Gorbag are exploiting a WinRAR vulnerability to steal browser credentials, VPN configurations, and sensitive documents…
Critical Barracuda Security Flaws Could Let Hackers Bypass Authentication and Gain Root Access
Barracuda has disclosed two security vulnerabilities that could allow attackers to bypass authorization controls and gain root access to affected…
Critical SolarWinds Dameware Flaw Could Allow Attackers to Compromise Remote Systems
SolarWinds has warned about a critical command injection flaw in its Dameware remote support software. It is tracked as CVE-2026-28336 and carries a…
Scammers Use Microsoft Azure to Host Fake Windows Security Alerts Seen at 80 Organizations
Scammers are abusing Microsoft Azure to host fake Windows security alerts that pressure users into calling fraudulent support numbers. Between March and…
Hackers Exploit Zyxel GS1900 Zero-Day in the Wild to Hijack Network Switches
A flaw in Zyxel GS1900 switches was already being used by hackers, and the patch meant to fix it did not work. Researchers at Binarly found that a public…
Google Releases Major Chrome Security Update Fixing 213 Bugs, Including 7 Critical Vulnerabilities
Google has released Chrome 157 for Windows, macOS, and Linux, fixing 213 security bugs, including seven rated critical. Announced on November 3, 2026, the…
Microsoft Edge Now Automatically Blocks Malicious Websites Sending Fake Virus Alert Notifications
Microsoft Edge now automatically disables notifications from websites that send users to detected scam pages, cutting off a route used to deliver fake…
Russian APT29 Hackers Turn Trusted Websites Into Traps to Compromise iPhone and Android Users
A Russian state-linked hacking group is using trusted websites to quietly break into phones. Researchers say APT29, also known as Midnight Blizzard or…
Cloudflare Launches Zero Wire to Track Critical CVEs, Active Exploits, and Security Fixes
Cloudflare has launched Zero Wire, a public vulnerability intelligence feed designed to help security teams track critical CVEs, understand exploitation…
Ransomware Gangs Claim 30% More Victims, but Researchers Warn Some Breaches May Be Fake
The number of organizations named on ransomware leak sites rose 30% in the third quarter of 2026. Researchers say that does not mean attacks rose by the…
Hackers Hide XLoader Malware in Fake Business Orders to Steal Passwords and Evade Detection
A new XLoader malware campaign is landing in inboxes as ordinary business orders and price quote requests. The emails look routine, but the attached…
CISA Warns of WordPress Core Vulnerability Exploited in Attacks to Execute Malicious Code
The U.S. Cybersecurity and Infrastructure Security Agency has warned that attackers are exploiting a WordPress Core vulnerability that can allow malicious…
Google Patches Over 200 Android Vulnerabilities, Including Critical Zero-Click RCE Flaws
Google has released its November 2026 Android security update, addressing more than 200 vulnerabilities across the operating system, kernel, and hardware…
Top 10 Best Breach & Attack Simulation (BAS) Tools in 2026 [Ranked & Scored]
Every SOC believes its controls work; BAS is the machine that checks. By safely running real attacker techniques against production defenses continuously,…
Hackers Use Fake Software Downloads to Secretly Hijack Windows PCs and Monetize Their Resources
Hackers are using fake software downloads to quietly turn Windows computers into revenue sources, installing programs that share internet bandwidth, run…