Threat actors are exploiting the four-flaw chain to hack the Plex Media Server application on QNAP NAS devices.
Jailbroken DeepSeek AI Agent Breaches European Telecom and Accesses Millions of Patient Records
A jailbroken DeepSeek AI agent spent more than two weeks breaking into a European telecom provider and 13 companies hosted on its systems. It reportedly…
Ukraine dismantles crypto scam network that stole €4.3 million
Ukrainian law enforcement arrested four suspects in a case involving the theft of more than €4.3 million using a network of cryptocurrency investment scam…
Japanese homeware giant pulls online store after cloud breach puts 7.7M records at risk
No reopening date as orders face delays and some customers are told to refuse deliveries to cancel purchases
Google Gemini Safety Bypass Lets Users Download AI-Generated Images That Its Own Filters Blocked
Google Gemini allowed users to download AI-generated images that its safety filters had refused to display, according to research published by Fog…
Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers
Hackers compromised an external cloud service used by the shopping platform and may have stolen personal information from it.
Researchers Uncover NotC2 AI-Powered C2 Framework That Hides Malicious Commands Inside AWS Services
Varonis Threat Labs has built NotC2, a proof-of-concept command-and-control (C2) framework. It runs entirely on native AWS services and uses Amazon…
CISA and the FBI Warn Of Attacks against Industrial Refrigeration Controllers
US agencies warn attackers are going after industrial refrigeration controllers. The fixes are basic, and most start with getting them off the internet.…
Hackers Hijack 10 npm Packages to Spread PolinRider Malware Using Ethereum Blockchain
Attackers have taken over 10 npm packages and slipped hidden code into 12 releases. The code uses the Ethereum blockchain to find a server and download…
What a Hacked Refrigerator Can Teach Us About Cybersecurity
The supermarket fridge is probably the dullest machine in any store. It hums, it stays cold, and nobody gives it a thought until the milk goes sour. On…
CISA Warns of SonicWall SonicOS SSLVPN Vulnerability Exploited in Attacks
CISA added a SonicWall SonicOS SSLVPN vulnerability, CVE-2026-19868, to its Known Exploited Vulnerabilities catalog, warning that valid-credential users…
IT Security News Hourly Summary 2026-11-09 14h : 10 posts
10 posts published in the last hour 12:32Italy’s Meloni Blames Pro-Russian Hackers for Leak of Foreign Minister’s Data on the Dark Web 12:32AI Security 12:31Google Gemini Safety Filter Bypass Exposes Blocked AI Images Through Download Links 12:31Hackers Exploiting ‘SSHole’ Authentication…
Italy’s Meloni Blames Pro-Russian Hackers for Leak of Foreign Minister’s Data on the Dark Web
Italian Foreign Minister Antonio Tajani said Saturday that his personal data had been disseminated on the dark web.
AI Security
Two weeks ago, I attended the [un]prompted AI security conference in San Francisco. It was an excellent event: three days of very dense talks about all…
Google Gemini Safety Filter Bypass Exposes Blocked AI Images Through Download Links
Google Gemini exposed images that its safety filters had rejected through download links, revealing an infrastructure weakness rather than a conventional…
Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH
The initial exploitation attempts are attributed to botnets and crypto miners, but other threat actors are expected to follow suit.
ModSecurity WAF Vulnerability Allows Attackers to Bypass File Upload Restrictions Using Crafted HTTP Requests
Two high-severity flaws in the open-source ModSecurity web application firewall (WAF) let attackers slip past upload filters or crash server workers with…
Trio accused of using deepfake CEOs and bogus lawyers to scam businesses out of $129 million
Three men allegedly used deepfakes of company CEOs and law firm attorneys to trick employees into wiring more than $129 million to accounts the group…
Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety
Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker. Keplr uses a company called Web3Auth…
CISA Adds Exploited SonicWall SSLVPN Authentication Bypass to KEV: What Admins Must Fix
CISA has confirmed active exploitation of a SonicWall SSLVPN authentication bypass flaw. Here’s which SonicOS versions are affected, how to patch them,…
Default ‘admin:admin’ Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars
The login systems behind two car brands’ mobile apps could be taken over completely, two security researchers found, allowing them to access any…
IT Security News Hourly Summary 2026-11-09 13h : 15 posts
15 posts published in the last hour 11:32GhostAction Attack Hits Tens of Thousands of GitHub Repositories to Steal Cloud and AI Credentials 11:31Inside New Zealand’s Telco Data Breaches 11:31Amplifon Americas Data Breach Impacts 1.3 Million 11:05IT Security News Roundup: 2026-11-09…
GhostAction Attack Hits Tens of Thousands of GitHub Repositories to Steal Cloud and AI Credentials
A new wave of the GhostAction supply chain campaign has pushed a credential-stealing GitHub Actions workflow into tens of thousands of repositories. It…
Inside New Zealand’s Telco Data Breaches
An Auckland ransomware case and three years of Spark disclosures reveal how little the headline numbers can tell…