🚨 ChatGPT's Lockdown Mode could be bypassed to steal private chats.

Researchers uncovered a flaw in HTML previews that could enable silent data exfiltration, including zero-click attacks on desktop.

Read how the bypass worked ↓ https://thehackernews.com/2026/11/researchers-bypass-chatgpt-lockdown.html

🚨 Root access. No login required.

Researchers demonstrate how two chained Barracuda Email Security Gateway flaws allow attackers to execute commands as root without authentication.

Read: https://thehackernews.com/2026/11/experts-demonstrate-barracuda-email.html

⚠️ Hackers are hiding a backdoor inside Control Web Panel's Linux web server.

Dubbed CWPdoor, it executes attacker commands through specially crafted HTTP requests, then keeps those requests out of access logs.

Read: https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html

🚨 Chainalysis confirms a wider breach impact.

An agentic cyberattack exposed ALL users' password hashes and live tokens, prompting the company to lock impacted accounts and take key services offline.

What was exposed, what's offline, and what's next ↓ https://thehackernews.com/2026/11/chainalysis-breach-exposes-all-users.html

Over a dozen vulnerabilities found in 6 hours. Most were pre-auth RCE flaws.

Chainguard says its Athena system used Anthropic's Mythos to identify the flaws in a heavily tested open-source project.

Every finding was reproduced 3 times in a clean VM. The project had already undergone years of expert review and fuzzing.

Full details - https://thehackernews.com/2026/11/the-flood-is-coming-and-pipes-were.html

‼️ Microsoft Paint RCE fix is now available, but Windows Update won't deliver it.

CVE-2026-83844 could allow unauthenticated remote code execution.

The fix requires a Microsoft Store app update, and older Paint copies may remain installed.

Read → https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html

🚨 A browser extension made Claude Desktop execute code on a user's computer in a security test.

Researchers showed how an extension with access to claude's .ai domain could abuse Claude Dispatch to impersonate the user, approve its own prompts, and trigger an npm package installation.

The user didn't need to click Allow.

Read: https://thehackernews.com/2026/11/malicious-browser-extensions-could-use.html

>> 948 Linux privilege escalation exploits.
>> 81 previously unknown Firefox flaws.

OpenAI says its new GPT-6 Cyber model enabled the Linux findings through an autonomous pipeline and helped identify the Firefox flaws and a critical Brotli vulnerability.

Read ↓ https://thehackernews.com/2026/11/openai-launches-gpt-6-cyber-after-ai.html

🚨 OpenSSH flaw exploited within hours of disclosure.

Attackers are targeting CVE-2026-123158 (SSHole), which bypasses password authentication under specific #Linux configurations.

Root access confirmed on an Alpine Linux honeypot.

Details: https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html

Every AI security vendor governs the agent. Virtru governs the data.

The Virtru Data Harbor Platform launches live online on Tuesday, Nov 17 at 3:00 PM ET. Built on TDF, an open standard, it checks every request against the data’s own policy, so your data protects itself wherever it goes.

Register to watch live → https://thn.news/data-harbor-virtru

‼️ WordPress sites can be attacked even while installing a fix for an actively exploited flaw, a researcher warns.

The update still uses vulnerable code, leaving a brief window for attackers to execute PHP code on the server.

Here's what site owners need to do before updating → https://thehackernews.com/2026/11/installing-fix-for-exploited-wordpress.html

‼️ Claude Code's "Don't Ask Again" option can save passwords and API keys in plaintext.

Apiiro found 2,539 exposed secrets across 1,994 public GitHub repos, including database credentials, SSH logins, and cloud keys.

Deleting files doesn't erase Git history.

Read: https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html