‼️ Billions stolen. Official software backdoored. A shared chat link exposing private conversations.

This week’s Cybersecurity Recap:
→ $6.43B Binance theft
→ Polymarket wallet drain
→ Claude Code extension backdoor
→ ChatGPT shared-link flaw
→ GitHub Actions secrets theft
→ Volt Typhoon’s covert network
→ WeChat-cloning spyware
→ Chrome search hijacking
→ Fake emergency alerts
→ AI-assisted ransomware
→ Malicious AI models
→ Critical flaws + more

The attacks, the findings, the fixes → https://thehackernews.com/2026/11/weekly-recap-critical-cves-linux-ddos.html

🚨 Attackers are targeting an unpatched CVSS 10.0 flaw in the CryptoPayment Gateway WordPress plugin.

CVE-2026-81648 can let unauthenticated attackers extract wallet credentials, delete server files, and overwrite payment settings.

No known fix. Exploitation attempts observed in the wild.

Full details ↓ https://thehackernews.com/2026/11/attackers-target-unpatched.html

🚨 Critical Siemens IoT2050 flaw under active exploitation.

Attackers are abusing CVE-2026-58115 (CVSS 10.0) to push Linux bot payloads and create remote command backdoors via Node-RED.

VulnCheck captured the exploit attempts on its honeypots.

How the attacks work ↓ https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html

🚨 Second wave of cyberattacks hits supermarket fridges across Europe.

Hackers remotely changed cooling settings, in some cases setting freezers to 50°C.

Stores have been forced to discard food and pull products from shelves.

Here's what we know ↓ https://thehackernews.com/2026/11/second-wave-of-cyberattacks-hits.html

🚨 Second wave of cyberattacks hits supermarket fridges across Europe.

Hackers remotely changed cooling settings, in some cases setting freezers to 50°C.

Stores have been forced to discard food and pull products from shelves.

Here's what we know ↓ https://thehackernews.com/2026/11/second-wave-of-cyberattacks-hits.html

⚠️ Synology NAS devices are under ransomware attack.

Attackers are exploiting a flaw patched in December 2024 to target devices running outdated DSM versions.

Synology urges users to update immediately.

Details → https://thehackernews.com/2026/11/synology-nas-devices-targeted-in.html

‼️ Hackers are exploiting a patched BTCPay Server flaw to steal Bitcoin and Litecoin from hot wallets.

Versions 2.4.1 and earlier were targeted. Users are urged to move to a fresh server and wallet, even if no theft is detected.

Here's what happened ↓ https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html

🚨 Russia-aligned Gorbag hackers exploited a patched WinRAR flaw to deploy GIFTEDCROOK malware.

The group targets Ukrainian government and defense organizations, using info-stealers to harvest browser data, credentials, VPN configs, and sensitive documents.

Read how the attacks work ↓ https://thehackernews.com/2026/11/russia-aligned-gorbag-hackers-exploit.html

⚠️ Permanent admin rights give attackers privileges they can abuse long after they're needed.

Syteca's PEDM replaces standing access with just-in-time elevation, automated approvals, and activity logs on Windows endpoints.

How it works without overwhelming IT helpdesks → https://thehackernews.com/expert-insights/2026/11/pedm-vs-standing-elevated-privileges.html

‼️ ALERT - Ubuntu releases "test patches" for a critical Linux TCP RCE (CVSS 9.8) vulnerability.

Want the fix now? You'll have to enable Ubuntu's opt-in testing channel. No date for regular updates.

Red Hat? Already patched RHEL 8, 9 and 10.

And disabling MPTCP? Not enough. The bug is in IPv4 TCP.

Details ↓ https://thehackernews.com/2026/11/red-hat-patches-98-rated-linux-tcp-rce.html

Your business VPN shouldn’t be hard to manage

It worked when your environment was smaller.

But more users, offices, applications, and access requirements can turn a traditional VPN architecture into a growing operational challenge – with more configurations to maintain and more access to manage.

This Black Friday, scale and save with NordLayer - built for modern distributed teams.

The bigger your team, the bigger the discount – across all Lite, Core, and Premium annual plans.

➜ Up to 20 seats? Apply your code BF-20OFF at checkout for an extra 20% OFF.
➜ 20+ seats? Contact sales for custom rates with code BF-SPECIAL.

Learn more 👉 https://thn.news/small-business-vpn

Fixing more vulnerabilities doesn't always mean less breach risk.

Gartner predicts organizations using threat intelligence, asset context, exploitability modeling, and control validation to prioritize exposures will see at least 70% lower breach likelihood by 2028 than CVSS-focused peers.

Here's why ↓ https://thehackernews.com/2026/11/the-4-elements-of-exposure.html

‼️ Breaking - Hackers hijacked cPGuard's security update channel to push a backdoor onto Linux servers and collect password hashes, database secrets, and SSH files.

The attacker retrieved files tied to 32 customer servers.

Affected versions: 5.88.12–5.88.19.

What admins need to know ↓ https://thehackernews.com/2026/11/cpguard-update-channel-hijacked-to.html

🚨 LLMjacking attacks are driving cloud charges as high as $1 MILLION at some enterprises.

Google says attackers are hijacking LLM access using stolen cloud credentials, then abusing AI resources and reselling access through underground marketplaces.

Read → https://thehackernews.com/2026/11/google-warns-llmjacking-attacks-are.html

🛑 Barracuda discloses two security flaws that could be chained to gain ROOT access to affected devices.

The authorization bypass and command injection flaws require access to the admin interface. One affects six Barracuda products.

Details and fixes: https://thehackernews.com/2026/11/barracuda-flaws-could-be-chained-to.html

‼️ Binance reveals how hackers pulled off a $6.43 BILLION crypto theft.

Fake job interviews, a trojanized Homebrew installer, and abuse of an internal AI tool were part of the attack that compromised engineers and reached Binance's wallet signing service.

Full details ↓ https://thehackernews.com/2026/11/binance-reveals-how-fake-job-interviews.html

🚨 Chainstack confirms a security breach.

Attackers gained access to production systems and a customer database containing names, email addresses, and password hashes.

The intrusion is suspected to be linked to a broader AI-powered attack campaign.

Read ↓ https://thehackernews.com/2026/11/chainstack-reports-production-systems.html

‼️ mSecure is urging customers to consider changing passwords, resetting 2FA, and removing passkeys after reporting suspicious activity.

But were password vaults accessed? The company hasn't disclosed that.

Here's what we know so far: https://thehackernews.com/2026/11/msecure-warns-users-to-change-passwords.html

🚨 WordPress Core flaw under active exploitation.

CISA confirms attacks targeting CVE-2026-119977, a high-severity race condition that can allow unauthenticated code execution during core upgrades.

Over 12,600 exploit attempts blocked in 24 hours.

Details: https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html

‼️ Google issues patches for a critical Android flaw that could allow remote code execution without any user interaction.

🠖 Affects Android 14–17
🠖 216 flaws fixed, 23 rated Critical

Check your phone's security patch level.

Read: https://thehackernews.com/2026/11/google-patches-critical-android-flaw.html