Daily curated cyber threat intelligence for security professionals.
Sourcesecurityonline.info
Curated
The CVE-2026-112487 macOS revisiond vulnerability allows a standard user to gain root access through a local privilege escalation exploit. Users should immediately update to the latest macOS Golden Gate version to patch this security flaw.
Sourcethehackernews.com
Curated
Barracuda has disclosed two vulnerabilities that, chained together, could let an attacker bypass authorization controls and gain root access to a susceptible device, The Hacker News reports. The flaws are a pre-authentication authorization bypass and a command injection vulnerability, including CVE-2026-116606, rated CVSS 9.3.
Sourcecyberscoop.com
Curated
Authorities have dismantled an investment fraud scheme that reached potential victims in 50 countries, CyberScoop reports. Investigators seized more than 100 servers and searched locations linked to the alleged operation across 17 countries.
Sourcetherecord.media
Curated
Members of Germany’s political elite were among the spyware targets in 99 countries that Apple personally warned recently, The Record reports. The recipients included several German lawmakers and foreign policy staff.
Sourcethehackernews.com
Curated
An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers, The Hacker News reports. The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory.
Sourcethehackernews.com
Curated
Fixed kernels for a use-after-free vulnerability in the Linux kernel’s IPv4 TCP code, CVE-2026-98432, are now available for Red Hat Enterprise Linux 8, 9 and 10, The Hacker News reports. The 9.8-rated flaw can be reached by a remote, unauthenticated attacker; Ubuntu’s fixes for its three newest long-term-support releases remain in its opt-in testing channel, with no date set for a regular update.
Sourcewww.helpnetsecurity.com
Curated
Attackers are exploiting an authentication flaw in Node-RED, CVE-2026-58115, to install a Linux bot and backdoors on unprotected servers, Help Net Security reports. VulnCheck found the attacks; Node-RED is a flow-based programming tool built on Node.js, built into some industrial control products and used in manufacturing, healthcare and home automation.
Sourcehackread.com
Curated
Malicious Claude Code extensions targeted Windows and macOS developers through Cursor, Hackread reports. The extensions collected device details and planted files to maintain persistent remote access through an SSH backdoor.
Sourcewww.helpnetsecurity.com
Curated
ESET has been tracking a Russia-aligned group it calls Gorbag, which has been breaking into Ukrainian organizations since at least February 2025 using spearphishing attachments and a stealer that erases itself once the data is gone, Help Net Security reports. Every target identified sits in Ukraine: about a quarter are law enforcement and justice bodies, and another quarter are local administrations, mostly city councils near the front line.
Sourcewww.microsoft.com
Curated
Real-world exploitation concentrates in a small, high-impact subset of CVEs, according to a Microsoft analysis of real-world attacks. Microsoft says defenders can prioritise vulnerabilities based on exploitation likelihood, exposure and potential blast radius.
Sourcecyberscoop.com
Curated
Major business groups are pressing Congress to include a 10-year renewal of the 2015 cyber threat information sharing law in the annual defence policy bill, CyberScoop reports. The campaign targets the must-pass National Defense Authorization Act after a standoff over renewal lasting more than a year.
Sourcedatabreaches.net
Curated
The US Department of Health and Human Services' Office for Civil Rights has settled its ransomware investigation of Lehigh Valley Health Network over the health network’s 2023 breach by the AlphV, or BlackCat, group, DataBreaches.net reports. Patients settled civil litigation over the breach, in which attackers posted nude patient pictures on their leak site, for $65 million in 2024.
Sourcetherecord.media
Curated
The head of the UK’s National Cyber Security Centre will warn of an unprecedented rise in cyberattacks in the coming months as the agency releases its annual report, The Record reports. The chief says vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.
Sourcehackread.com
Curated
Fake Adobe Acrobat pages are distributing signed ScreenConnect installers configured for attacker-controlled remote access to Windows PCs, according to CloudSEK researchers, Hackread reports. The installers give attackers remote access to victims' machines.
Sourcedatabreaches.net
Curated
A second hospital in Liverpool is investigating two potential instances of staff accessing medical records connected with the Southport terror attack, ITV reports via DataBreaches.net. The cases were detected at Liverpool Heart and Chest Hospital as part of checks into insider access to the patients' records.
Sourcedatabreaches.net
Curated
HYBE, the music agency behind K-pop group BTS, has disclosed a cyberattack that exposed personal information of current and former employees and business partners, including resident registration numbers, credit card numbers and medical records, DataBreaches.net reports. The company said an internal security inspection detected unauthorised access, in an apology posted on its website on October 18.
Sourcedatabreaches.net
Curated
Hong Kong’s Office of the Privacy Commissioner for Personal Data says it has received multiple notifications of data breaches involving Hong Kong Airlines, Cathay Pacific and Malaysia Airlines, as well as electronics retailers Yoho Hong Kong and Broadway, DataBreaches.net reports. As of October 30, the authority had logged 51 complaints and 48 enquiries related to the cases.
Sourcedatabreaches.net
Curated
Suntory Holdings said on Monday that personal data relating to around 100,000 people, including employees, was leaked following unauthorised access to an external cloud service used by the group, Kyodo News reports via DataBreaches.net. The company said it has not confirmed any misuse of the information.
Sourcewww.bleepingcomputer.com
Curated
Financial technology company Abrigo has restored its Sageworks risk management application, except for borrower-facing capabilities, after an outage triggered by irregular activity in its environment, BleepingComputer reports. The platform had been taken offline following the suspected cyberattack.
Sourcehackread.com
Curated
FortiGuard Labs has linked the BITTER threat group to cyberespionage attacks on South Asian organisations using fake diplomatic documents, Hackread reports. The attacks use malicious Windows shortcuts and PowerShell scripts to deliver PapRAT spyware.
Sourcethehackernews.com
Curated
A cyber espionage campaign tracked as CL-UNK-1211 has targeted Linux infrastructure associated with government entities and state-affiliated organisations, Palo Alto Networks Unit 42 has found. The activity, observed between October 2025 and April 2026, used a remote access tool dubbed SysGoRAT and scripts researchers suspect were AI-generated.
Sourcethehackernews.com
Curated
Two critical flaws in Langflow, an open-source tool for building AI agents and workflows, could let a remote attacker with no account bypass authentication or run arbitrary code, IBM has said. Every release from 1.0.0 through 1.12.8 is affected, and the only fix is version 1.13.0.
Sourcethehackernews.com
Curated
An Iran state-aligned threat actor carried out a cyber espionage campaign, tracked as DarkBlinders, against Israel and the Kurdistan Region of Iraq between August and October 2026, according to Dream Research Labs. The campaign compromised a high-profile individual in Israel and a government cloud environment in Iraqi Kurdistan.
Sourcetherecord.media
Curated
Michigan State University shut down campus email for most of Sunday and told students, faculty and staff to change their passwords after a security incident, The Record reports. A recent post by the BYOD ransomware gang, which drew attention in October for an attack on the University of New Mexico hospital system, appears to line up with the incident.
Sourcetherecord.media
Curated
Mercado Bitcoin, Brazil’s largest cryptocurrency exchange, has confirmed a cyberattack after blockchain security companies tracked more than $46 million leaving the platform, The Record reports. The company has confirmed about $20 million in losses so far and says the remaining funds may still be recoverable, and no arrests had been made at the time of reporting.