Hackers exploit trusted AWS access to breach multiple cloud environments
A threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform’s AWS account to access and exfiltrate data from multiple customers’ AWS environments. The campaign ran between October 14 and 26, and affected tens of companies whose AWS environments had IAM roles configured to trust an AWS account associated […]
Microsoft releases Windows 10 KB5131096 extended security update
Microsoft released the Windows 10 KB5131096 extended security update, which includes this month’s November 2026 Patch Tuesday fixes and a few bug fixes and changes. If you are running Windows 10 Enterprise LTSC or are enrolled in the ESU program, you can install this update as normal by going to Settings, clicking Windows Update, and […]
Windows 11 KB5132061 & KB5131087 cumulative updates released
Microsoft has released the Patch Tuesday Windows 11 KB513261 and KB5131087 cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs and add new features. Today’s updates are mandatory as they contain the November 2026 Patch Tuesday security patches for hundreds of vulnerabilities discovered in previous months. You can install today’s update by going to Start > Settings > Windows Update and clicking on ‘Check […]
Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers
A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts. Xen Orchestra is a web-based management platform developed by French software company Vates, used to manage XCP-ng virtualization environments, including virtual machines, hosts, and pools. The vulnerability, tracked as […]
Binance warns of iOS flaw that could leak crypto wallet secrets
Binance is warning about a vulnerability in Appleās iOS 26.7.1, 27.0.1, and 27.2 that could allow third-party apps to read private files stored by other apps, including cryptocurrency seed phrases, secret keys, and login credentials. The crypto exchange clarifies that the issue is at the iOS level and does not impact only the Binance app. […]
SAP patches ICM2SHELL and PROXYGATE maximum severity flaws
SAP patched 35 vulnerabilities in its November 2026 security updates, including four maximum-severity issues affecting its NetWeaver, Web Dispatcher, and Gateway software. The company addressed memory corruption (CVE-2026-76964) and missing authentication (CVE-2026-120017) flaws in the NetWeaver Application Server ABAP’s Internet Communication Manager and SAML2 Service Provider components. NetWeaver is the core app platform that underpins […]
Hackers now exploit critical Barracuda ESG flaws to gain root access
Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges. Barracuda released security updates to address the two flaws (tracked as CVE-2026-116606 and CVE-2026-111560) one week ago. The first stems from an Email Security Gateway (ESG) authentication weakness that […]
Turla hackers use new Cereal malware to spy on govt Exchange servers
The Russian state-backed threat group Turla has been using a new malicious toolset called ‘Cereal’ to intercept emails on Microsoft Exchange servers at government organizations. Researchers at cybersecurity company ESETĀ documented the attacks in late 2025, initially finding modular .NET malware for Microsoft Exchange at a government body in Kazakhstan. A month later, ESET found the […]
Google patches eighth Chrome zero-day exploited in attacks this year
Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year. “Google is aware that an exploit for CVE-2026-125350 exists in the wild,” the company said in a Monday security advisory. As Google explained, this flaw stems from a Use-After-Free (UAF) weakness in the […]
Fireworks AI discloses new breach after cloud provider hack
AI infrastructure startup Fireworks has disclosed a new security breach in which attackers accessed its development machines after breaching a third-party cloud provider. FireWorks provides a high-performance inference platform for developers who want to deploy and run open-source artificial intelligence models (such as Mistral, Meta’s Llama, or Google’s Gemma) without worrying about hardware bottlenecks and […]