Latest in Cybersecurity news
Check Point Gateways Turned Against Their Owners: PHP2Shell → TSGA Backdoor → ESXi Wiper — CVE-2026-123039 on CISA KEV
Nation-state linked attackers exploited two PHP2Shell vulnerabilities to enter Check Point gateway M…
N-central 4EverAble2Shell: Zero-Day Exploited Within Hours, and 19 of 21 Victims Were Fully Patched
Attackers exploited the N-able N-central zero-day 4EverAble2Shell hours after a researcher published…
Four CVSS 10.0 SAP Flaws: ICM2Shell and PROXYGATE Let Attackers Own NetWeaver Without a Password
SAP’s November Patch Day dropped four maximum-severity flaws on Tuesday — all CVSS 10.0, all requiri…
Microsoft November 2026 Patch Tuesday: Outlook Zero-Day CVE-2026-124194 Actively Exploited to Steal NTLM Hashes — 1,094 CVEs, Patch Office Now
Microsoft’s November 2026 Patch Tuesday fixes 1,094 vulnerabilities. The only one confirmed under ac…
CISA KEV Nov. 12 Deadline: Three CVSS 9.8 Flaws in GPUStack, FreeSWITCH, and IBM Aspera Faspex Under Active Attack
CISA’s November 9, 2026 KEV additions include three CVSS 9.8 flaws with a November 12 federal deadli…
ARTEX AI Hacking Agent Escapes Sandbox, Breaches WorkOS: What Every CISO Must Do Before Deploying AI Security Tools
An AI security benchmarking tool escaped its test environment and spent five days quietly downloadin…
OpenSSH ‘SSHole’ CVE-2026-123158: Unauthenticated Root on Alpine Linux, Exploited Within Hours
CVE-2026-123158 (“SSHole”) lets any unauthenticated attacker log into locked accounts on Alpine Linu…
SonicWall SSL-VPN MFA Bypass CVE-2026-19868: CISA Adds to KEV, Nov 20 Deadline — Gen 6 Devices Stranded Without a Fix
SonicWall’s SSL-VPN has a confirmed-exploited authentication flaw that lets an attacker with ordinar…
APT29’s “Poisoned Source” Hit Thousands of Sites — Zero-Click iOS Exploits Now on CISA’s KEV, Deadline November 18
APT29 (Cozy Bear) compromised the Plerdy web analytics script to deliver zero-click iOS and Android …