🚨 Bitter APT is deploying a new backdoor called PapRAT in cyberespionage attacks targeting South Asian organizations.

The campaign uses 3 infection chains, including malicious shortcuts and MSI installers, to deliver malware capable of remote commands, file transfers, and screenshot capture.

How it works ↓ https://thehackernews.com/2026/11/bitter-hackers-deploy-new-paprat.html

‼️ Hackers compromised Ethersphere's bee-js npm package and Swarm Desktop app to deliver crypto wallet-stealing malware.

The malicious releases also install backdoors on Windows, macOS, and Linux.

Both versions are now withdrawn, but updating alone won't remove the backdoors.

Details: https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html

‼️ Attackers breached multiple Qubole customers' AWS accounts using credentials for Qubole's trusted AWS account.

They stole AWS and identity provider credentials, extracted secrets, and copied S3 data.

How the attacks worked and what to check ↓ https://thehackernews.com/2026/11/hackers-exploit-quboles-trusted-aws.html

Attackers operate in minutes. Defenders are stuck operating in days. ⏳

Frontier AI is accelerating vulnerability discovery and automated attacks, shrinking the time between exposure and exploitation.

Explore practical strategies for securing applications, APIs, and AI at F5's Security for the Post-Mythos World virtual summit, now available on demand.

👉 Watch now: https://thn.news/data-launch-2026

🚨 CISA adds 4 actively exploited flaws to its KEV catalog, affecting OpenSSH, GPUStack, FreeSWITCH, and IBM Aspera Faspex.

OpenSSH SSHole attacks have already involved TAC Agent malware deployment, botnet activity, and cryptomining.

What we know → https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html

‼️ ALERT → N-able takes hosted N-central offline and urges on-premises customers to shut down servers after 30+ vulnerabilities and PoC exploits are disclosed.

The flaws enable credential theft, admin creation, and root code execution.

Full details ↓ https://thehackernews.com/2026/11/n-able-takes-hosted-n-central-offline.html

🚨 8 Chrome zero-days exploited in the wild in 2026.

Google has now released a security update for the latest one: CVE-2026-125350, a high-severity use-after-free flaw in Chrome's XML component.

An exploit exists in the wild. Attack details remain undisclosed.

Update Chrome. Details - https://thehackernews.com/2026/11/google-issues-chrome-security-update.html

⚡ Anthropic's new Claude Fable 5.2 beats OpenAI's GPT-6 Cyber in multi-stage cyberattack tests.

76.3% vs. 61% challenge completion.

It also scored 89.6% on a benchmark for rediscovering known vulnerabilities.

Learn more ↓ https://thehackernews.com/2026/11/anthropics-claude-fable-52-beats-gpt-6.html

⚠️ France blames Iran's IRGC for cyberattacks that caused fires at French retail sites.

Attackers hijacked refrigeration controllers at about 700 sites, altered defrost settings and disabled temperature alerts, causing tens of millions of euros in food losses.

Read - https://thehackernews.com/2026/11/france-blames-iran-for-sabotage-attack.html

⚠️ Attackers are exploiting vulnerabilities before they're publicly disclosed.

Mandiant reports a median 7-day lead over disclosure. Enterprises take 20 days on average to deploy patches.
That's a 27-day gap traditional patching can't close.

How runtime defenses help ↓ https://thehackernews.com/expert-insights/2026/11/the-collapsed-patch-window-why-runtime.html

🚨 Russian-linked Turla hackers are using new Cereal malware to steal government emails.

The toolset hides inside Microsoft Exchange processes, intercepts selected messages, and operates without external C2 infrastructure.

Spotted in Kazakhstan and Romania.

Details: https://thehackernews.com/2026/11/russian-turla-hackers-use-new-cereal.html

🚨 SAP patches 4 vulnerabilities rated CVSS 10.0 in NetWeaver and Web Dispatcher.

Two could allow remote code execution without authentication. Another could let attackers log in as any user on certain SAML-enabled systems.

No user interaction required.

Details - https://thehackernews.com/2026/11/sap-patches-four-cvss-100-flaws.html

‼️ An iMessage flaw could let remote attackers join your group chats and receive messages.

A second flaw could expose earlier conversations. Bluetooth bugs could also allow pairing without user interaction.

Details: https://thehackernews.com/2026/11/apple-patches-imessage-group-chat.html