‼️ WARNING - A Trezor Safe 5 wallet reportedly contained a hidden cellular implant designed to transmit users' recovery phrases.

Trezor is now urging everyone who bought a wallet supplied by CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery phrase.

Details: https://thehackernews.com/2026/10/trezor-warns-of-suspected-hardware.html

No Mythos access? You can now hunt for first and third-party exploitable vulnerabilities in your applications using Chainguard Harness.

Chainguard Harness builds your app from source in an isolated environment, then lets Mythos 5.1 hunt through a live instance for exploitable vulnerabilities. Each finding is reproducible, delivered with a recommended fix, and vetted by a Chainguard engineer.

Join the Chainguard Harness waitlist: https://thn.news/cve-malware-solution

🚨 Nearly 63,000 attack attempts target a WordPress RCE flaw in just 24 hours.

Attackers are repeatedly probing upgrade paths, trying to catch a brief window during core updates that could allow unauthenticated code execution.

Details ↓ https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html

‼️ New TeamViewer vulnerability (CVE-2026-111585) flips the script... the machine you connect to can attack YOUR computer.

No click needed beyond accepting the session. Researcher got code running on a stock Windows viewer — default settings, defenses on.

Here's how the attack works ↓ https://thehackernews.com/2026/10/teamviewer-flaw-lets-remote-computers.html

🚨 Chinese state-sponsored hackers used AI-powered ARTEX to target over 200 organizations worldwide.

CrowdStrike confirms post-exploitation at nine, including deployment of BLOODALCHEMY malware.

AI agents ran parallel attack paths under human direction.

Full story: https://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html

🚨 8,226 DDoS attacks every hour.

Cloudflare blocked 18.2 million network-layer DDoS attacks in Q3 2026, up 38% from Q2.

Short-burst attacks surged 208%, while DNS amplification jumped 215%.

Who's being targeted ↓ https://thehackernews.com/2026/10/cloudflare-reports-182-million-network.html

🚨 OpenAI fixed a ChatGPT flaw that allowed malicious shared links to execute attacker code in users' logged-in sessions and steal private chat content.

Researchers demonstrated the attack.

Here's how → https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html

🚨 Blockchain analysis firm Chainalysis confirms a data breach involving offensive agentic techniques.

An attacker gained access to internal systems and tools, exposing customer names, email addresses, user IDs, and organization roles.

Full story: https://thehackernews.com/2026/10/chainalysis-confirms-intrusion-into.html

‼️ FBI confirms North Korea's TraderTraitor hackers were behind the record $6.43 billion Binance crypto heist.

$2.85 billion in stolen assets has been frozen as investigators track the laundering of funds through Ethereum.

Full story: https://thehackernews.com/2026/11/fbi-links-north-koreas-tradertraitor-to.html

🚨 New NetamLoader malware targets a government-only Windows 10 build in Asia.

The attack abuses legitimate Patch My PC components, hijacks .NET execution, bypasses AMSI, and loads encrypted payloads.

Kaspersky identified one victim. The attackers remain unknown.

How the attack works - https://thehackernews.com/2026/11/netamloader-malware-targets-government.html

🚨 $2.7 MILLION stolen from Polymarket traders in under an hour.

The attackers didn't need to steal private keys. They hijacked a third-party DebugBear script and abused signed-in sessions to drain funds and trading positions.

726 wallets affected. $3.9M in refunds.

Here's how it happened: https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html

‼️ A critical flaw in Canonical's LXD and MicroCloud (CVE-2026-112816, CVSS 10.0) lets attackers impersonate trusted clients without their private keys.

Requires HTTPS API access and a trusted client's public certificate.

→ Cluster and VM access
→ Host root access if the impersonated client is privileged

Details ↓ https://thehackernews.com/2026/11/critical-lxd-and-microcloud-flaw-cvss.html

🚨 New VOLTA infostealer uses Claude, Gemini, and Kimi to rank stolen data by its value to attackers.

It steals passwords, cookies, and crypto wallet data, checks Gmail receipts to verify victim details, and sends AI-generated target dossiers via Telegram.

How it works ↓ https://thehackernews.com/2026/11/new-volta-infostealer-uses-claude.html

🚨 Government Linux servers targeted in an espionage campaign using SysGoRAT and suspected AI-generated scripts.

Tracked as CL-UNK-1211, attackers planted web shells, harvested credentials, and attempted to steal government emails while covering their tracks.

Inside the campaign ↓ https://thehackernews.com/2026/11/government-linux-servers-targeted-with.html

⚠️ Attackers impersonated IT support on Microsoft Teams, tricked employees into granting remote access, and abused AD CS to gain privileged access.

In one case, they stole company data even after Microsoft Defender blocked most of the attack.

Read: https://thehackernews.com/2026/11/attackers-pose-as-it-support-on.html

🚨 Two critical Langflow flaws could allow remote code execution and authentication bypass without an account.

Affected: All versions from 1.0.0 through 1.12.8.

A public Metasploit module already demonstrates unauthenticated MCP tool enumeration, not code execution.

Details ↓ https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html

🚨 28% of SOC alerts never get investigated, according to a survey of 250+ security leaders and practitioners.

AI SOC agents can help tackle the backlog, but deployment requires more than plugging in a tool.

Here's an 18-point checklist to assess whether your SOC is ready. ↓ https://thehackernews.com/2026/11/is-your-soc-ready-for-ai-agents.html

🚨 Iran-linked DarkBlinders hackers compromised a high-profile Israeli individual and a government cloud environment in Iraqi Kurdistan.

The espionage campaign uses fake apps, credential phishing, and a backdoor that relies on GitHub for command-and-control.

Inside the operation ↓ https://thehackernews.com/2026/11/darkblinders-compromises-israeli-target.html

‼️ BREAKING - Google disrupts a 1.3 million-device Android botnet and bans TV box maker Videostrong.

Google says the company deliberately built a backdoor into its devices and sold access to criminals.

The control servers are down. The backdoor is still there.

Full story: https://thehackernews.com/2026/11/google-disrupts-13-million-device.html

‼️ Billions stolen. Official software backdoored. A shared chat link exposing private conversations.

This week’s Cybersecurity Recap:
→ $6.43B Binance theft
→ Polymarket wallet drain
→ Claude Code extension backdoor
→ ChatGPT shared-link flaw
→ GitHub Actions secrets theft
→ Volt Typhoon’s covert network
→ WeChat-cloning spyware
→ Chrome search hijacking
→ Fake emergency alerts
→ AI-assisted ransomware
→ Malicious AI models
→ Critical flaws + more

The attacks, the findings, the fixes → https://thehackernews.com/2026/11/weekly-recap-critical-cves-linux-ddos.html