🚨 Hackers are exploiting an Apple security flaw patched over two years ago.

CISA has added CVE-2024-27834 to its exploited vulnerabilities list following reports of attacks delivering information-stealing malware.

Here's what the attacks involve ↓ https://thehackernews.com/2026/11/hackers-exploit-patched-apple-flaw-to.html

⚠️ Zyxel's earlier security patch failed to block a working exploit.

Researchers confirmed the exploit still allowed unauthenticated root command execution on GS1900 switches running Patch 2, provided the management interface was reachable.

Zyxel has now released Patch 3 for 10 affected models.

Read → https://thehackernews.com/2026/11/zyxel-gs1900-patch-fails-to-block-zero.html

84% of major attacks involved abuse of legitimate tools, according to Bitdefender's analysis of 700,000 security incidents.

⚠️ Patching alone won't close these gaps.

Here's how exposure management and adaptive hardening help cut off attack paths before they're exploited.

Read more ↓ https://thehackernews.com/expert-insights/2026/11/your-attack-surface-is-growing-faster.html

‼️ A backdoored AI hacking tool is exposing servers to root access without authentication.

A malicious Docker image for ARTEX hides a root shell in its login handler.

Researchers found 62 internet-facing consoles running the backdoored build.

Read: https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html

⚡ Apple to start scanning public iCloud links for harmful content with version 27.3.

This covers shared photos and files. The catch: "Anyone with the Link" sharing disables end-to-end encryption, even with Advanced Data Protection enabled.

Here's what you need to know: https://thehackernews.com/2026/11/apple-to-start-scanning-publicly-shared.html

🚨 Five cyber threats targeting US businesses.

Microsoft 365 device-code phishing, fake AI apps stealing credentials, and malware disabling Microsoft Defender.

Inside the SkyW4lker, Mir0Auth, GeorgeGinx, and WKLP campaigns.

See how the attacks work and what to watch for ↓ https://thehackernews.com/2026/11/5-active-cyber-threats-that-put-us.html

Build vs. Buy: The Real Cost of a DIY Pentest Reporting Platform

AI speeds up the first version. Upkeep can cost half an engineer’s year.

Here’s how to weigh build vs. buy: https://thn.news/platform-comparison

‼️ 20 New cybersecurity stories worth catching up on...

This week's ThreatsDay:
• Docker AI sandbox escape
• Microsoft Entra credential theft
• DreamHost password breach
• Android banking malware
• Ransomware without encryption

Read more ↓ https://thehackernews.com/2026/11/threatsday-apache-ofbiz-rce-dreamhost.html

A critical vulnerability gets flagged. A ticket gets created. The exposure remains.

What’s missing? Asset ownership, exploitability context, and a verified fix.

Here are 5 tests to see whether your exposure management platform can actually close the gap.

Read more ↓ https://thehackernews.com/2026/11/is-your-exposure-management-platform.html

‼️WARNING - OpenSSH issues emergency fix for a critical SSH authentication bypass on Alpine Linux.

A password longer than 256 bytes can unlock key-only accounts on affected servers, without knowing the actual credentials.

Here's how it works ↓ https://thehackernews.com/2026/11/openssh-issues-emergency-fix-for-flaw.html

🚨 ChatGPT's Lockdown Mode could be bypassed to steal private chats.

Researchers uncovered a flaw in HTML previews that could enable silent data exfiltration, including zero-click attacks on desktop.

Read how the bypass worked ↓ https://thehackernews.com/2026/11/researchers-bypass-chatgpt-lockdown.html

🚨 Root access. No login required.

Researchers demonstrate how two chained Barracuda Email Security Gateway flaws allow attackers to execute commands as root without authentication.

Read: https://thehackernews.com/2026/11/experts-demonstrate-barracuda-email.html

⚠️ Hackers are hiding a backdoor inside Control Web Panel's Linux web server.

Dubbed CWPdoor, it executes attacker commands through specially crafted HTTP requests, then keeps those requests out of access logs.

Read: https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html

🚨 Chainalysis confirms a wider breach impact.

An agentic cyberattack exposed ALL users' password hashes and live tokens, prompting the company to lock impacted accounts and take key services offline.

What was exposed, what's offline, and what's next ↓ https://thehackernews.com/2026/11/chainalysis-breach-exposes-all-users.html

Over a dozen vulnerabilities found in 6 hours. Most were pre-auth RCE flaws.

Chainguard says its Athena system used Anthropic's Mythos to identify the flaws in a heavily tested open-source project.

Every finding was reproduced 3 times in a clean VM. The project had already undergone years of expert review and fuzzing.

Full details - https://thehackernews.com/2026/11/the-flood-is-coming-and-pipes-were.html

‼️ Microsoft Paint RCE fix is now available, but Windows Update won't deliver it.

CVE-2026-83844 could allow unauthenticated remote code execution.

The fix requires a Microsoft Store app update, and older Paint copies may remain installed.

Read → https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html

🚨 A browser extension made Claude Desktop execute code on a user's computer in a security test.

Researchers showed how an extension with access to claude's .ai domain could abuse Claude Dispatch to impersonate the user, approve its own prompts, and trigger an npm package installation.

The user didn't need to click Allow.

Read: https://thehackernews.com/2026/11/malicious-browser-extensions-could-use.html

>> 948 Linux privilege escalation exploits.
>> 81 previously unknown Firefox flaws.

OpenAI says its new GPT-6 Cyber model enabled the Linux findings through an autonomous pipeline and helped identify the Firefox flaws and a critical Brotli vulnerability.

Read ↓ https://thehackernews.com/2026/11/openai-launches-gpt-6-cyber-after-ai.html

🚨 OpenSSH flaw exploited within hours of disclosure.

Attackers are targeting CVE-2026-123158 (SSHole), which bypasses password authentication under specific #Linux configurations.

Root access confirmed on an Alpine Linux honeypot.

Details: https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html

Every AI security vendor governs the agent. Virtru governs the data.

The Virtru Data Harbor Platform launches live online on Tuesday, Nov 17 at 3:00 PM ET. Built on TDF, an open standard, it checks every request against the data’s own policy, so your data protects itself wherever it goes.

Register to watch live → https://thn.news/data-harbor-virtru