🚨 Second wave of cyberattacks hits supermarket fridges across Europe.

Hackers remotely changed cooling settings, in some cases setting freezers to 50°C.

Stores have been forced to discard food and pull products from shelves.

Here's what we know ↓ https://thehackernews.com/2026/11/second-wave-of-cyberattacks-hits.html

🚨 Second wave of cyberattacks hits supermarket fridges across Europe.

Hackers remotely changed cooling settings, in some cases setting freezers to 50°C.

Stores have been forced to discard food and pull products from shelves.

Here's what we know ↓ https://thehackernews.com/2026/11/second-wave-of-cyberattacks-hits.html

⚠️ Synology NAS devices are under ransomware attack.

Attackers are exploiting a flaw patched in December 2024 to target devices running outdated DSM versions.

Synology urges users to update immediately.

Details → https://thehackernews.com/2026/11/synology-nas-devices-targeted-in.html

‼️ Hackers are exploiting a patched BTCPay Server flaw to steal Bitcoin and Litecoin from hot wallets.

Versions 2.4.1 and earlier were targeted. Users are urged to move to a fresh server and wallet, even if no theft is detected.

Here's what happened ↓ https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html

🚨 Russia-aligned Gorbag hackers exploited a patched WinRAR flaw to deploy GIFTEDCROOK malware.

The group targets Ukrainian government and defense organizations, using info-stealers to harvest browser data, credentials, VPN configs, and sensitive documents.

Read how the attacks work ↓ https://thehackernews.com/2026/11/russia-aligned-gorbag-hackers-exploit.html

⚠️ Permanent admin rights give attackers privileges they can abuse long after they're needed.

Syteca's PEDM replaces standing access with just-in-time elevation, automated approvals, and activity logs on Windows endpoints.

How it works without overwhelming IT helpdesks → https://thehackernews.com/expert-insights/2026/11/pedm-vs-standing-elevated-privileges.html

‼️ ALERT - Ubuntu releases "test patches" for a critical Linux TCP RCE (CVSS 9.8) vulnerability.

Want the fix now? You'll have to enable Ubuntu's opt-in testing channel. No date for regular updates.

Red Hat? Already patched RHEL 8, 9 and 10.

And disabling MPTCP? Not enough. The bug is in IPv4 TCP.

Details ↓ https://thehackernews.com/2026/11/red-hat-patches-98-rated-linux-tcp-rce.html

Your business VPN shouldn’t be hard to manage

It worked when your environment was smaller.

But more users, offices, applications, and access requirements can turn a traditional VPN architecture into a growing operational challenge – with more configurations to maintain and more access to manage.

This Black Friday, scale and save with NordLayer - built for modern distributed teams.

The bigger your team, the bigger the discount – across all Lite, Core, and Premium annual plans.

➜ Up to 20 seats? Apply your code BF-20OFF at checkout for an extra 20% OFF.
➜ 20+ seats? Contact sales for custom rates with code BF-SPECIAL.

Learn more 👉 https://thn.news/small-business-vpn

Fixing more vulnerabilities doesn't always mean less breach risk.

Gartner predicts organizations using threat intelligence, asset context, exploitability modeling, and control validation to prioritize exposures will see at least 70% lower breach likelihood by 2028 than CVSS-focused peers.

Here's why ↓ https://thehackernews.com/2026/11/the-4-elements-of-exposure.html

‼️ Breaking - Hackers hijacked cPGuard's security update channel to push a backdoor onto Linux servers and collect password hashes, database secrets, and SSH files.

The attacker retrieved files tied to 32 customer servers.

Affected versions: 5.88.12–5.88.19.

What admins need to know ↓ https://thehackernews.com/2026/11/cpguard-update-channel-hijacked-to.html

🚨 LLMjacking attacks are driving cloud charges as high as $1 MILLION at some enterprises.

Google says attackers are hijacking LLM access using stolen cloud credentials, then abusing AI resources and reselling access through underground marketplaces.

Read → https://thehackernews.com/2026/11/google-warns-llmjacking-attacks-are.html

🛑 Barracuda discloses two security flaws that could be chained to gain ROOT access to affected devices.

The authorization bypass and command injection flaws require access to the admin interface. One affects six Barracuda products.

Details and fixes: https://thehackernews.com/2026/11/barracuda-flaws-could-be-chained-to.html

‼️ Binance reveals how hackers pulled off a $6.43 BILLION crypto theft.

Fake job interviews, a trojanized Homebrew installer, and abuse of an internal AI tool were part of the attack that compromised engineers and reached Binance's wallet signing service.

Full details ↓ https://thehackernews.com/2026/11/binance-reveals-how-fake-job-interviews.html

🚨 Chainstack confirms a security breach.

Attackers gained access to production systems and a customer database containing names, email addresses, and password hashes.

The intrusion is suspected to be linked to a broader AI-powered attack campaign.

Read ↓ https://thehackernews.com/2026/11/chainstack-reports-production-systems.html

‼️ mSecure is urging customers to consider changing passwords, resetting 2FA, and removing passkeys after reporting suspicious activity.

But were password vaults accessed? The company hasn't disclosed that.

Here's what we know so far: https://thehackernews.com/2026/11/msecure-warns-users-to-change-passwords.html

🚨 WordPress Core flaw under active exploitation.

CISA confirms attacks targeting CVE-2026-119977, a high-severity race condition that can allow unauthenticated code execution during core upgrades.

Over 12,600 exploit attempts blocked in 24 hours.

Details: https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html

‼️ Google issues patches for a critical Android flaw that could allow remote code execution without any user interaction.

🠖 Affects Android 14–17
🠖 216 flaws fixed, 23 rated Critical

Check your phone's security patch level.

Read: https://thehackernews.com/2026/11/google-patches-critical-android-flaw.html

⚡ Russian police arrest 3 suspected VasyGrek hackers and dismantle the group's criminal infrastructure.

Also known as Fluffy Wolf, the group was linked to 100+ attempted attacks across Russia, Belarus, and Kazakhstan in 2026.

Full story: https://thehackernews.com/2026/11/russian-police-arrest-3-suspected.html

⚠️ China-aligned hackers exploited a flaw in Tencent's Sogou Input Method to deploy the DarkVigil surveillance backdoor.

The attack hijacked DNS requests and abused insecure HTTP traffic to deliver malware.

How the attack worked - https://thehackernews.com/2026/11/china-aligned-hackers-hijack-sogou.html

🚨 AI security gateways have a blind spot.

AI agents running inside Salesforce, Microsoft 365, and Slack can operate entirely beyond gateway inspection.

That leaves agent actions, permissions, and delegation chains outside gateway visibility.

Here's why gateway-only security falls short: https://thehackernews.com/2026/11/radio-with-no-radar-why-agent-runtime.html