🛑 Barracuda discloses two security flaws that could be chained to gain ROOT access to affected devices.

The authorization bypass and command injection flaws require access to the admin interface. One affects six Barracuda products.

Details and fixes: https://thehackernews.com/2026/11/barracuda-flaws-could-be-chained-to.html

‼️ Binance reveals how hackers pulled off a $6.43 BILLION crypto theft.

Fake job interviews, a trojanized Homebrew installer, and abuse of an internal AI tool were part of the attack that compromised engineers and reached Binance's wallet signing service.

Full details ↓ https://thehackernews.com/2026/11/binance-reveals-how-fake-job-interviews.html

🚨 Chainstack confirms a security breach.

Attackers gained access to production systems and a customer database containing names, email addresses, and password hashes.

The intrusion is suspected to be linked to a broader AI-powered attack campaign.

Read ↓ https://thehackernews.com/2026/11/chainstack-reports-production-systems.html

‼️ mSecure is urging customers to consider changing passwords, resetting 2FA, and removing passkeys after reporting suspicious activity.

But were password vaults accessed? The company hasn't disclosed that.

Here's what we know so far: https://thehackernews.com/2026/11/msecure-warns-users-to-change-passwords.html

🚨 WordPress Core flaw under active exploitation.

CISA confirms attacks targeting CVE-2026-119977, a high-severity race condition that can allow unauthenticated code execution during core upgrades.

Over 12,600 exploit attempts blocked in 24 hours.

Details: https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html

‼️ Google issues patches for a critical Android flaw that could allow remote code execution without any user interaction.

🠖 Affects Android 14–17
🠖 216 flaws fixed, 23 rated Critical

Check your phone's security patch level.

Read: https://thehackernews.com/2026/11/google-patches-critical-android-flaw.html

⚡ Russian police arrest 3 suspected VasyGrek hackers and dismantle the group's criminal infrastructure.

Also known as Fluffy Wolf, the group was linked to 100+ attempted attacks across Russia, Belarus, and Kazakhstan in 2026.

Full story: https://thehackernews.com/2026/11/russian-police-arrest-3-suspected.html

⚠️ China-aligned hackers exploited a flaw in Tencent's Sogou Input Method to deploy the DarkVigil surveillance backdoor.

The attack hijacked DNS requests and abused insecure HTTP traffic to deliver malware.

How the attack worked - https://thehackernews.com/2026/11/china-aligned-hackers-hijack-sogou.html

🚨 AI security gateways have a blind spot.

AI agents running inside Salesforce, Microsoft 365, and Slack can operate entirely beyond gateway inspection.

That leaves agent actions, permissions, and delegation chains outside gateway visibility.

Here's why gateway-only security falls short: https://thehackernews.com/2026/11/radio-with-no-radar-why-agent-runtime.html

‼️ Two Xen hypervisor flaws found using Anthropic's Claude allow a malicious guest VM to read and write memory belonging to other VMs, including privileged dom0.

• Xen 4.6+ affected
• Patches for 4.17+, none for 4.6–4.16
• No known workaround
• Qubes OS and XCP-ng affected

Details → https://thehackernews.com/2026/11/xen-hypervisor-flaws-let-one-malicious.html

For security operations, closing more alerts is a positive. No one’s arguing that. But what about the malware that never set one off?

That’s the question behind Stairwell’s new AI SOC Buyer’s Guide. Faster investigations matter, but they don’t tell security teams what they missed. False positives take up analysts’ time. False negatives can leave a threat undiscovered.

The guide compares public claims from 18 platforms and gives buyers a checklist: Can they find threats that never triggered an alert? And can they revisit past evidence when new intelligence changes what they know?

If you’re evaluating AI SOC tools, those questions deserve as much attention as how many alerts they can autonomously close.

Read the guide: https://thn.news/cyber-ai-insight

‼️ BREAKING - Critical Rails flaw (CVSS 9.8) could let unauthenticated attackers write arbitrary server files via crafted uploads.

The bug affects Active Storage apps using ImageMagick and could also expose application secrets in certain setups.

Rails patches are out.

Details: https://thehackernews.com/2026/11/critical-rails-flaw-lets-attackers.html

At Georgetown, gain the tactical skills to plan for and respond to information security threats. Attend our Nov. 17 webinar.

Sign Up - https://thn.news/cybersecurity-webin

What if your MSP could handle more clients without hiring another technician?

A Kaseya/Omdia study found that MSPs consolidating their tools reported:

→ 27% more endpoints per technician
→ 23% more tickets handled weekly
→ 36% faster first response

Here's the math behind scaling without adding headcount ↓ https://thehackernews.com/expert-insights/2026/11/the-msp-margin-math-nobodys-doing-your.html

🛑 Russia-linked APT29 is tied to a campaign delivering iOS and Android exploits through compromised sites and a hijacked web analytics script.

DarkSword and AndroSnitch target browser cookies, Wi-Fi passwords, and sensitive device data.

Details - https://thehackernews.com/2026/11/apt29-linked-hackers-hijack-web.html

❗ Say "hello" to OpenAI Codex, get an ad instead?

Researchers uncovered "Haiou," a jailbreak bundle that modifies Codex's global instructions to inject persistent ads for a third-party AI gateway.

The technique is called "prompt adware".

Read ↓ https://thehackernews.com/2026/11/researchers-uncover-prompt-adware.html

‼️ A new Linux APT flaw in Debian and Ubuntu could let MitM attackers swap already-verified packages and execute code as root.

Tracked as CVE-2026-109518, it affects default Debian 12+ and Ubuntu 22.04+ setups.

Patches are rolling out.

Details ↓ https://thehackernews.com/2026/11/debian-and-ubuntu-apt-flaw-lets-mitm.html

🚨 No patches coming.

SonicWall confirms two flaws in end-of-life GMS 9.5.2 and earlier won't be fixed.

• CVE-2026-109593: Unauthenticated file reads
• CVE-2026-109594: Authenticated SQL injection

SonicWall urges migration to NSM.

Read: https://thehackernews.com/2026/11/sonicwall-wont-patch-eol-gms-flaws-that.html

‼️ OpenAI's AI agents generated 948 working #Linux exploits that can escalate local user access to root.

In a 30-hour run, its pipeline reproduced 1,724 vulnerabilities and developed 291 information-leak PoCs.

Total API cost ➜ $1.2 million.

Read ↓ https://thehackernews.com/2026/11/openai-ai-pipeline-generates-948-linux.html

🚨 Hackers are exploiting an Apple security flaw patched over two years ago.

CISA has added CVE-2024-27834 to its exploited vulnerabilities list following reports of attacks delivering information-stealing malware.

Here's what the attacks involve ↓ https://thehackernews.com/2026/11/hackers-exploit-patched-apple-flaw-to.html