‼️ A critical flaw in Canonical's LXD and MicroCloud (CVE-2026-112816, CVSS 10.0) lets attackers impersonate trusted clients without their private keys.

Requires HTTPS API access and a trusted client's public certificate.

→ Cluster and VM access
→ Host root access if the impersonated client is privileged

Details ↓ https://thehackernews.com/2026/11/critical-lxd-and-microcloud-flaw-cvss.html

🚨 New VOLTA infostealer uses Claude, Gemini, and Kimi to rank stolen data by its value to attackers.

It steals passwords, cookies, and crypto wallet data, checks Gmail receipts to verify victim details, and sends AI-generated target dossiers via Telegram.

How it works ↓ https://thehackernews.com/2026/11/new-volta-infostealer-uses-claude.html

🚨 Government Linux servers targeted in an espionage campaign using SysGoRAT and suspected AI-generated scripts.

Tracked as CL-UNK-1211, attackers planted web shells, harvested credentials, and attempted to steal government emails while covering their tracks.

Inside the campaign ↓ https://thehackernews.com/2026/11/government-linux-servers-targeted-with.html

⚠️ Attackers impersonated IT support on Microsoft Teams, tricked employees into granting remote access, and abused AD CS to gain privileged access.

In one case, they stole company data even after Microsoft Defender blocked most of the attack.

Read: https://thehackernews.com/2026/11/attackers-pose-as-it-support-on.html

🚨 Two critical Langflow flaws could allow remote code execution and authentication bypass without an account.

Affected: All versions from 1.0.0 through 1.12.8.

A public Metasploit module already demonstrates unauthenticated MCP tool enumeration, not code execution.

Details ↓ https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html

🚨 28% of SOC alerts never get investigated, according to a survey of 250+ security leaders and practitioners.

AI SOC agents can help tackle the backlog, but deployment requires more than plugging in a tool.

Here's an 18-point checklist to assess whether your SOC is ready. ↓ https://thehackernews.com/2026/11/is-your-soc-ready-for-ai-agents.html

🚨 Iran-linked DarkBlinders hackers compromised a high-profile Israeli individual and a government cloud environment in Iraqi Kurdistan.

The espionage campaign uses fake apps, credential phishing, and a backdoor that relies on GitHub for command-and-control.

Inside the operation ↓ https://thehackernews.com/2026/11/darkblinders-compromises-israeli-target.html

‼️ BREAKING - Google disrupts a 1.3 million-device Android botnet and bans TV box maker Videostrong.

Google says the company deliberately built a backdoor into its devices and sold access to criminals.

The control servers are down. The backdoor is still there.

Full story: https://thehackernews.com/2026/11/google-disrupts-13-million-device.html

‼️ Billions stolen. Official software backdoored. A shared chat link exposing private conversations.

This week’s Cybersecurity Recap:
→ $6.43B Binance theft
→ Polymarket wallet drain
→ Claude Code extension backdoor
→ ChatGPT shared-link flaw
→ GitHub Actions secrets theft
→ Volt Typhoon’s covert network
→ WeChat-cloning spyware
→ Chrome search hijacking
→ Fake emergency alerts
→ AI-assisted ransomware
→ Malicious AI models
→ Critical flaws + more

The attacks, the findings, the fixes → https://thehackernews.com/2026/11/weekly-recap-critical-cves-linux-ddos.html

🚨 Attackers are targeting an unpatched CVSS 10.0 flaw in the CryptoPayment Gateway WordPress plugin.

CVE-2026-81648 can let unauthenticated attackers extract wallet credentials, delete server files, and overwrite payment settings.

No known fix. Exploitation attempts observed in the wild.

Full details ↓ https://thehackernews.com/2026/11/attackers-target-unpatched.html

🚨 Critical Siemens IoT2050 flaw under active exploitation.

Attackers are abusing CVE-2026-58115 (CVSS 10.0) to push Linux bot payloads and create remote command backdoors via Node-RED.

VulnCheck captured the exploit attempts on its honeypots.

How the attacks work ↓ https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html

🚨 Second wave of cyberattacks hits supermarket fridges across Europe.

Hackers remotely changed cooling settings, in some cases setting freezers to 50°C.

Stores have been forced to discard food and pull products from shelves.

Here's what we know ↓ https://thehackernews.com/2026/11/second-wave-of-cyberattacks-hits.html

🚨 Second wave of cyberattacks hits supermarket fridges across Europe.

Hackers remotely changed cooling settings, in some cases setting freezers to 50°C.

Stores have been forced to discard food and pull products from shelves.

Here's what we know ↓ https://thehackernews.com/2026/11/second-wave-of-cyberattacks-hits.html

⚠️ Synology NAS devices are under ransomware attack.

Attackers are exploiting a flaw patched in December 2024 to target devices running outdated DSM versions.

Synology urges users to update immediately.

Details → https://thehackernews.com/2026/11/synology-nas-devices-targeted-in.html

‼️ Hackers are exploiting a patched BTCPay Server flaw to steal Bitcoin and Litecoin from hot wallets.

Versions 2.4.1 and earlier were targeted. Users are urged to move to a fresh server and wallet, even if no theft is detected.

Here's what happened ↓ https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html

🚨 Russia-aligned Gorbag hackers exploited a patched WinRAR flaw to deploy GIFTEDCROOK malware.

The group targets Ukrainian government and defense organizations, using info-stealers to harvest browser data, credentials, VPN configs, and sensitive documents.

Read how the attacks work ↓ https://thehackernews.com/2026/11/russia-aligned-gorbag-hackers-exploit.html

⚠️ Permanent admin rights give attackers privileges they can abuse long after they're needed.

Syteca's PEDM replaces standing access with just-in-time elevation, automated approvals, and activity logs on Windows endpoints.

How it works without overwhelming IT helpdesks → https://thehackernews.com/expert-insights/2026/11/pedm-vs-standing-elevated-privileges.html

‼️ ALERT - Ubuntu releases "test patches" for a critical Linux TCP RCE (CVSS 9.8) vulnerability.

Want the fix now? You'll have to enable Ubuntu's opt-in testing channel. No date for regular updates.

Red Hat? Already patched RHEL 8, 9 and 10.

And disabling MPTCP? Not enough. The bug is in IPv4 TCP.

Details ↓ https://thehackernews.com/2026/11/red-hat-patches-98-rated-linux-tcp-rce.html

Your business VPN shouldn’t be hard to manage

It worked when your environment was smaller.

But more users, offices, applications, and access requirements can turn a traditional VPN architecture into a growing operational challenge – with more configurations to maintain and more access to manage.

This Black Friday, scale and save with NordLayer - built for modern distributed teams.

The bigger your team, the bigger the discount – across all Lite, Core, and Premium annual plans.

➜ Up to 20 seats? Apply your code BF-20OFF at checkout for an extra 20% OFF.
➜ 20+ seats? Contact sales for custom rates with code BF-SPECIAL.

Learn more 👉 https://thn.news/small-business-vpn

Fixing more vulnerabilities doesn't always mean less breach risk.

Gartner predicts organizations using threat intelligence, asset context, exploitability modeling, and control validation to prioritize exposures will see at least 70% lower breach likelihood by 2028 than CVSS-focused peers.

Here's why ↓ https://thehackernews.com/2026/11/the-4-elements-of-exposure.html