🚨 Root access. No login required.

Researchers demonstrate how two chained Barracuda Email Security Gateway flaws allow attackers to execute commands as root without authentication.

Read: https://thehackernews.com/2026/11/experts-demonstrate-barracuda-email.html

⚠️ Hackers are hiding a backdoor inside Control Web Panel's Linux web server.

Dubbed CWPdoor, it executes attacker commands through specially crafted HTTP requests, then keeps those requests out of access logs.

Read: https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html

🚨 Chainalysis confirms a wider breach impact.

An agentic cyberattack exposed ALL users' password hashes and live tokens, prompting the company to lock impacted accounts and take key services offline.

What was exposed, what's offline, and what's next ↓ https://thehackernews.com/2026/11/chainalysis-breach-exposes-all-users.html

Over a dozen vulnerabilities found in 6 hours. Most were pre-auth RCE flaws.

Chainguard says its Athena system used Anthropic's Mythos to identify the flaws in a heavily tested open-source project.

Every finding was reproduced 3 times in a clean VM. The project had already undergone years of expert review and fuzzing.

Full details - https://thehackernews.com/2026/11/the-flood-is-coming-and-pipes-were.html

‼️ Microsoft Paint RCE fix is now available, but Windows Update won't deliver it.

CVE-2026-83844 could allow unauthenticated remote code execution.

The fix requires a Microsoft Store app update, and older Paint copies may remain installed.

Read → https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html

🚨 A browser extension made Claude Desktop execute code on a user's computer in a security test.

Researchers showed how an extension with access to claude's .ai domain could abuse Claude Dispatch to impersonate the user, approve its own prompts, and trigger an npm package installation.

The user didn't need to click Allow.

Read: https://thehackernews.com/2026/11/malicious-browser-extensions-could-use.html

>> 948 Linux privilege escalation exploits.
>> 81 previously unknown Firefox flaws.

OpenAI says its new GPT-6 Cyber model enabled the Linux findings through an autonomous pipeline and helped identify the Firefox flaws and a critical Brotli vulnerability.

Read ↓ https://thehackernews.com/2026/11/openai-launches-gpt-6-cyber-after-ai.html

🚨 OpenSSH flaw exploited within hours of disclosure.

Attackers are targeting CVE-2026-123158 (SSHole), which bypasses password authentication under specific #Linux configurations.

Root access confirmed on an Alpine Linux honeypot.

Details: https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html

Every AI security vendor governs the agent. Virtru governs the data.

The Virtru Data Harbor Platform launches live online on Tuesday, Nov 17 at 3:00 PM ET. Built on TDF, an open standard, it checks every request against the data’s own policy, so your data protects itself wherever it goes.

Register to watch live → https://thn.news/data-harbor-virtru

‼️ WordPress sites can be attacked even while installing a fix for an actively exploited flaw, a researcher warns.

The update still uses vulnerable code, leaving a brief window for attackers to execute PHP code on the server.

Here's what site owners need to do before updating → https://thehackernews.com/2026/11/installing-fix-for-exploited-wordpress.html

‼️ Claude Code's "Don't Ask Again" option can save passwords and API keys in plaintext.

Apiiro found 2,539 exposed secrets across 1,994 public GitHub repos, including database credentials, SSH logins, and cloud keys.

Deleting files doesn't erase Git history.

Read: https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html

🚨 CISA adds SonicWall SonicOS MFA bypass flaw to its Known Exploited Vulnerabilities catalog.

CVE-2026-19868 could bypass SAML authentication and MFA using valid alternate credentials.

SonicWall is investigating a report of possible exploitation.

Details ↓ https://thehackernews.com/2026/11/cisa-flags-sonicwall-sonicos-mfa-bypass.html

🚨 U.S. agencies warn hackers are targeting industrial refrigeration systems worldwide, potentially causing fire hazards, food spoilage, and service disruptions.

The alert follows attacks on hundreds of European supermarkets, where hackers manipulated cooling systems.

Read - https://thehackernews.com/2026/11/us-agencies-warn-refrigeration.html

🚨 Former #OpenAI engineer pleads not guilty to a charge involving an alleged covert recording device in an executive meeting room.

Prosecutors say he built encrypted devices to record sensitive meetings. He faces up to 5 years in prison if convicted.

Read ↓ https://thehackernews.com/2026/11/former-openai-engineer-pleads-not.html

🚨 A single hacker in Taiwan used BOSSAI, a 12-agent AI hacking setup, to steal Taipei emergency dispatch records.

The operation targeted hundreds of organizations across 11 countries, with confirmed data extraction in three.

Learn More ↓ https://thehackernews.com/2026/11/taiwan-based-hacker-used-bossai-ai.html

‼️WARNING - Bitcoin Lightning wallet platform LNbits urges ALL server operators to shut down immediately amid a wave of attacks.

One operator reports attackers exploited an extension to drain 2.28 million satoshis.

Security patches are still pending.

Full details ↓ https://thehackernews.com/2026/11/lnbits-urges-all-operators-to-shut-down.html

⚠️ Hackers exploited a Web3Auth flaw to steal crypto from Keplr wallets using Google and Apple logins.

In an unusual move, Web3Auth emptied thousands of other at-risk wallets to secure their funds

Over $6 million moved into recovery wallets.

Read: https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html

‼️ A default "admin:admin" password helped researchers unlock and start connected cars remotely.

Two car brands' identity systems were vulnerable to account takeover. Researchers demonstrated the full attack chain on authorized U.S. vehicles.

Read ↓ https://thehackernews.com/2026/11/default-adminadmin-server-password.html

Apparently, a blank password can still ruin someone's week. And that's just the beginning.

⚡ This week in cybersecurity RECAP:

• SSHole exploit attempts
• $6.43B crypto theft
• 1,000 switches hacked
• APT root RCE
• Trojanized Linux server
• AI attack swarm
• AI-assisted ransomware
• 1.4M leaked secrets
• 15K infected websites
• 2,000 PCs infected
• AI sandbox escape
• Browser session hijacking
• Password manager warning
• Exposed AI apps
• Robot root takeover

Some attacks needed AI. Others barely needed a password.

🔗 Full cybersecurity recap: https://thehackernews.com/2026/11/weekly-recap-sshole-exploited-apt-root.html