🚨 U.S. agencies warn hackers are targeting industrial refrigeration systems worldwide, potentially causing fire hazards, food spoilage, and service disruptions.

The alert follows attacks on hundreds of European supermarkets, where hackers manipulated cooling systems.

Read - https://thehackernews.com/2026/11/us-agencies-warn-refrigeration.html

🚨 Former #OpenAI engineer pleads not guilty to a charge involving an alleged covert recording device in an executive meeting room.

Prosecutors say he built encrypted devices to record sensitive meetings. He faces up to 5 years in prison if convicted.

Read ↓ https://thehackernews.com/2026/11/former-openai-engineer-pleads-not.html

🚨 A single hacker in Taiwan used BOSSAI, a 12-agent AI hacking setup, to steal Taipei emergency dispatch records.

The operation targeted hundreds of organizations across 11 countries, with confirmed data extraction in three.

Learn More ↓ https://thehackernews.com/2026/11/taiwan-based-hacker-used-bossai-ai.html

‼️WARNING - Bitcoin Lightning wallet platform LNbits urges ALL server operators to shut down immediately amid a wave of attacks.

One operator reports attackers exploited an extension to drain 2.28 million satoshis.

Security patches are still pending.

Full details ↓ https://thehackernews.com/2026/11/lnbits-urges-all-operators-to-shut-down.html

⚠️ Hackers exploited a Web3Auth flaw to steal crypto from Keplr wallets using Google and Apple logins.

In an unusual move, Web3Auth emptied thousands of other at-risk wallets to secure their funds

Over $6 million moved into recovery wallets.

Read: https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html

‼️ A default "admin:admin" password helped researchers unlock and start connected cars remotely.

Two car brands' identity systems were vulnerable to account takeover. Researchers demonstrated the full attack chain on authorized U.S. vehicles.

Read ↓ https://thehackernews.com/2026/11/default-adminadmin-server-password.html

Apparently, a blank password can still ruin someone's week. And that's just the beginning.

⚡ This week in cybersecurity RECAP:

• SSHole exploit attempts
• $6.43B crypto theft
• 1,000 switches hacked
• APT root RCE
• Trojanized Linux server
• AI attack swarm
• AI-assisted ransomware
• 1.4M leaked secrets
• 15K infected websites
• 2,000 PCs infected
• AI sandbox escape
• Browser session hijacking
• Password manager warning
• Exposed AI apps
• Robot root takeover

Some attacks needed AI. Others barely needed a password.

🔗 Full cybersecurity recap: https://thehackernews.com/2026/11/weekly-recap-sshole-exploited-apt-root.html

🚨 Bitter APT is deploying a new backdoor called PapRAT in cyberespionage attacks targeting South Asian organizations.

The campaign uses 3 infection chains, including malicious shortcuts and MSI installers, to deliver malware capable of remote commands, file transfers, and screenshot capture.

How it works ↓ https://thehackernews.com/2026/11/bitter-hackers-deploy-new-paprat.html

‼️ Hackers compromised Ethersphere's bee-js npm package and Swarm Desktop app to deliver crypto wallet-stealing malware.

The malicious releases also install backdoors on Windows, macOS, and Linux.

Both versions are now withdrawn, but updating alone won't remove the backdoors.

Details: https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html

‼️ Attackers breached multiple Qubole customers' AWS accounts using credentials for Qubole's trusted AWS account.

They stole AWS and identity provider credentials, extracted secrets, and copied S3 data.

How the attacks worked and what to check ↓ https://thehackernews.com/2026/11/hackers-exploit-quboles-trusted-aws.html

Attackers operate in minutes. Defenders are stuck operating in days. ⏳

Frontier AI is accelerating vulnerability discovery and automated attacks, shrinking the time between exposure and exploitation.

Explore practical strategies for securing applications, APIs, and AI at F5's Security for the Post-Mythos World virtual summit, now available on demand.

👉 Watch now: https://thn.news/data-launch-2026

🚨 CISA adds 4 actively exploited flaws to its KEV catalog, affecting OpenSSH, GPUStack, FreeSWITCH, and IBM Aspera Faspex.

OpenSSH SSHole attacks have already involved TAC Agent malware deployment, botnet activity, and cryptomining.

What we know → https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html

‼️ ALERT → N-able takes hosted N-central offline and urges on-premises customers to shut down servers after 30+ vulnerabilities and PoC exploits are disclosed.

The flaws enable credential theft, admin creation, and root code execution.

Full details ↓ https://thehackernews.com/2026/11/n-able-takes-hosted-n-central-offline.html

🚨 8 Chrome zero-days exploited in the wild in 2026.

Google has now released a security update for the latest one: CVE-2026-125350, a high-severity use-after-free flaw in Chrome's XML component.

An exploit exists in the wild. Attack details remain undisclosed.

Update Chrome. Details - https://thehackernews.com/2026/11/google-issues-chrome-security-update.html

⚡ Anthropic's new Claude Fable 5.2 beats OpenAI's GPT-6 Cyber in multi-stage cyberattack tests.

76.3% vs. 61% challenge completion.

It also scored 89.6% on a benchmark for rediscovering known vulnerabilities.

Learn more ↓ https://thehackernews.com/2026/11/anthropics-claude-fable-52-beats-gpt-6.html

⚠️ France blames Iran's IRGC for cyberattacks that caused fires at French retail sites.

Attackers hijacked refrigeration controllers at about 700 sites, altered defrost settings and disabled temperature alerts, causing tens of millions of euros in food losses.

Read - https://thehackernews.com/2026/11/france-blames-iran-for-sabotage-attack.html

⚠️ Attackers are exploiting vulnerabilities before they're publicly disclosed.

Mandiant reports a median 7-day lead over disclosure. Enterprises take 20 days on average to deploy patches.
That's a 27-day gap traditional patching can't close.

How runtime defenses help ↓ https://thehackernews.com/expert-insights/2026/11/the-collapsed-patch-window-why-runtime.html

🚨 Russian-linked Turla hackers are using new Cereal malware to steal government emails.

The toolset hides inside Microsoft Exchange processes, intercepts selected messages, and operates without external C2 infrastructure.

Spotted in Kazakhstan and Romania.

Details: https://thehackernews.com/2026/11/russian-turla-hackers-use-new-cereal.html

🚨 SAP patches 4 vulnerabilities rated CVSS 10.0 in NetWeaver and Web Dispatcher.

Two could allow remote code execution without authentication. Another could let attackers log in as any user on certain SAML-enabled systems.

No user interaction required.

Details - https://thehackernews.com/2026/11/sap-patches-four-cvss-100-flaws.html

‼️ An iMessage flaw could let remote attackers join your group chats and receive messages.

A second flaw could expose earlier conversations. Bluetooth bugs could also allow pairing without user interaction.

Details: https://thehackernews.com/2026/11/apple-patches-imessage-group-chat.html