⚡ Russian police arrest 3 suspected VasyGrek hackers and dismantle the group's criminal infrastructure.

Also known as Fluffy Wolf, the group was linked to 100+ attempted attacks across Russia, Belarus, and Kazakhstan in 2026.

Full story: https://thehackernews.com/2026/11/russian-police-arrest-3-suspected.html

⚠️ China-aligned hackers exploited a flaw in Tencent's Sogou Input Method to deploy the DarkVigil surveillance backdoor.

The attack hijacked DNS requests and abused insecure HTTP traffic to deliver malware.

How the attack worked - https://thehackernews.com/2026/11/china-aligned-hackers-hijack-sogou.html

🚨 AI security gateways have a blind spot.

AI agents running inside Salesforce, Microsoft 365, and Slack can operate entirely beyond gateway inspection.

That leaves agent actions, permissions, and delegation chains outside gateway visibility.

Here's why gateway-only security falls short: https://thehackernews.com/2026/11/radio-with-no-radar-why-agent-runtime.html

‼️ Two Xen hypervisor flaws found using Anthropic's Claude allow a malicious guest VM to read and write memory belonging to other VMs, including privileged dom0.

• Xen 4.6+ affected
• Patches for 4.17+, none for 4.6–4.16
• No known workaround
• Qubes OS and XCP-ng affected

Details → https://thehackernews.com/2026/11/xen-hypervisor-flaws-let-one-malicious.html

For security operations, closing more alerts is a positive. No one’s arguing that. But what about the malware that never set one off?

That’s the question behind Stairwell’s new AI SOC Buyer’s Guide. Faster investigations matter, but they don’t tell security teams what they missed. False positives take up analysts’ time. False negatives can leave a threat undiscovered.

The guide compares public claims from 18 platforms and gives buyers a checklist: Can they find threats that never triggered an alert? And can they revisit past evidence when new intelligence changes what they know?

If you’re evaluating AI SOC tools, those questions deserve as much attention as how many alerts they can autonomously close.

Read the guide: https://thn.news/cyber-ai-insight

‼️ BREAKING - Critical Rails flaw (CVSS 9.8) could let unauthenticated attackers write arbitrary server files via crafted uploads.

The bug affects Active Storage apps using ImageMagick and could also expose application secrets in certain setups.

Rails patches are out.

Details: https://thehackernews.com/2026/11/critical-rails-flaw-lets-attackers.html

At Georgetown, gain the tactical skills to plan for and respond to information security threats. Attend our Nov. 17 webinar.

Sign Up - https://thn.news/cybersecurity-webin

What if your MSP could handle more clients without hiring another technician?

A Kaseya/Omdia study found that MSPs consolidating their tools reported:

→ 27% more endpoints per technician
→ 23% more tickets handled weekly
→ 36% faster first response

Here's the math behind scaling without adding headcount ↓ https://thehackernews.com/expert-insights/2026/11/the-msp-margin-math-nobodys-doing-your.html

🛑 Russia-linked APT29 is tied to a campaign delivering iOS and Android exploits through compromised sites and a hijacked web analytics script.

DarkSword and AndroSnitch target browser cookies, Wi-Fi passwords, and sensitive device data.

Details - https://thehackernews.com/2026/11/apt29-linked-hackers-hijack-web.html

❗ Say "hello" to OpenAI Codex, get an ad instead?

Researchers uncovered "Haiou," a jailbreak bundle that modifies Codex's global instructions to inject persistent ads for a third-party AI gateway.

The technique is called "prompt adware".

Read ↓ https://thehackernews.com/2026/11/researchers-uncover-prompt-adware.html

‼️ A new Linux APT flaw in Debian and Ubuntu could let MitM attackers swap already-verified packages and execute code as root.

Tracked as CVE-2026-109518, it affects default Debian 12+ and Ubuntu 22.04+ setups.

Patches are rolling out.

Details ↓ https://thehackernews.com/2026/11/debian-and-ubuntu-apt-flaw-lets-mitm.html

🚨 No patches coming.

SonicWall confirms two flaws in end-of-life GMS 9.5.2 and earlier won't be fixed.

• CVE-2026-109593: Unauthenticated file reads
• CVE-2026-109594: Authenticated SQL injection

SonicWall urges migration to NSM.

Read: https://thehackernews.com/2026/11/sonicwall-wont-patch-eol-gms-flaws-that.html

‼️ OpenAI's AI agents generated 948 working #Linux exploits that can escalate local user access to root.

In a 30-hour run, its pipeline reproduced 1,724 vulnerabilities and developed 291 information-leak PoCs.

Total API cost ➜ $1.2 million.

Read ↓ https://thehackernews.com/2026/11/openai-ai-pipeline-generates-948-linux.html

🚨 Hackers are exploiting an Apple security flaw patched over two years ago.

CISA has added CVE-2024-27834 to its exploited vulnerabilities list following reports of attacks delivering information-stealing malware.

Here's what the attacks involve ↓ https://thehackernews.com/2026/11/hackers-exploit-patched-apple-flaw-to.html

⚠️ Zyxel's earlier security patch failed to block a working exploit.

Researchers confirmed the exploit still allowed unauthenticated root command execution on GS1900 switches running Patch 2, provided the management interface was reachable.

Zyxel has now released Patch 3 for 10 affected models.

Read → https://thehackernews.com/2026/11/zyxel-gs1900-patch-fails-to-block-zero.html

84% of major attacks involved abuse of legitimate tools, according to Bitdefender's analysis of 700,000 security incidents.

⚠️ Patching alone won't close these gaps.

Here's how exposure management and adaptive hardening help cut off attack paths before they're exploited.

Read more ↓ https://thehackernews.com/expert-insights/2026/11/your-attack-surface-is-growing-faster.html

‼️ A backdoored AI hacking tool is exposing servers to root access without authentication.

A malicious Docker image for ARTEX hides a root shell in its login handler.

Researchers found 62 internet-facing consoles running the backdoored build.

Read: https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html

⚡ Apple to start scanning public iCloud links for harmful content with version 27.3.

This covers shared photos and files. The catch: "Anyone with the Link" sharing disables end-to-end encryption, even with Advanced Data Protection enabled.

Here's what you need to know: https://thehackernews.com/2026/11/apple-to-start-scanning-publicly-shared.html

🚨 Five cyber threats targeting US businesses.

Microsoft 365 device-code phishing, fake AI apps stealing credentials, and malware disabling Microsoft Defender.

Inside the SkyW4lker, Mir0Auth, GeorgeGinx, and WKLP campaigns.

See how the attacks work and what to watch for ↓ https://thehackernews.com/2026/11/5-active-cyber-threats-that-put-us.html

Build vs. Buy: The Real Cost of a DIY Pentest Reporting Platform

AI speeds up the first version. Upkeep can cost half an engineer’s year.

Here’s how to weigh build vs. buy: https://thn.news/platform-comparison