TECHZONE™

Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation https://thehackernews.com/2026/11/critical-zoom-workplace-flaw-could.html Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems. The vulnerabilities are listed below - CVE-2026-108186 (CVSS score: 9.6) - An improper input validation vulnerability that could allow an unauthenticated user to conduct an escalation of privilege via

AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html Cybersecurity researchers have disclosed details of a campaign in which an emerging agentic penetration testing platform called AntiFox has been used to steal Amazon Web Services (AWS) credentials and pivot laterally into compromised environments. "In several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against

Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits https://thehackernews.com/2026/11/hackers-target-qlik-sense-servers-with.html Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026. Cynet's CyOps and Research teams said they identified the suspicious activity in October 2026 against several E.U.-based customers within a narrow window of just over three minutes. The activity has been found to share some

Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords https://thehackernews.com/2026/11/over-35000-grok-built-apps-exposed.html Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday. They included 24 apps built by staff at the social network X and at SpaceXSI, the company that makes the Grok AI assistant. Most of the open apps were games, landing pages, and calculators, but about 1 in 10 contained internal business or

We Built An Agent That Broke All of Our Security Rules. Here's What We Learned. https://thehackernews.com/2026/11/we-built-agent-that-broke-all-of-our.html We tell customers three things about securing AI agents: they need their own identities, access that fits the job they’re given, and traceability that’s separate from any human’s. That was true for us at Token as well. Then, we built an agent that broke all three by default. This helped us think through how such agents should be defended. When a browser agent acts inside a user’s authenticated

eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise https://thehackernews.com/2026/11/emudhra-revokes-8-more-cas-it.html The in-house Python script behind eMudhra's October key compromise has now cost the company 8 more of its intermediate certificate authorities (CAs), even though it did not weaken their keys. Each intermediate CA has its own private key, which the company uses to sign the certificates it issues. The 8 intermediate CAs compromised in October had a different problem: a single line in the script

Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes https://thehackernews.com/2026/11/microsoft-patches-1259-flaws-including.html Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws. These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers.

Railway Says Stolen Customer AI Keys Led to $740,000 in Estimated Unauthorized Usage Charges https://thehackernews.com/2026/11/railway-says-stolen-customer-ai-keys.html AI provider keys that customers stored on Railway were stolen in an October breach and used to commit an estimated $740,000 in unauthorized spending, the platform-as-a-service provider said yesterday. It has promised to pay those charges itself when an AI provider will not refund them. The company builds and runs apps for its customers and stores their secrets, such as API keys and database

Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons https://thehackernews.com/2026/11/microsoft-researchers-show-ai-agents.html An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown. When a chosen trigger appears, the model outputs an attacker's command, which an agent using that model would run with the agent's own permissions. The attacker must be able to change the model's weights. The team tested the method on

Exchange for breakfast: Turla’s Cereal tricks are not for kids https://www.welivesecurity.com/en/eset-research/exchange-for-breakfast-turlas-cereal-tricks-are-not-for-kids/ ESET Research describes Turla’s Cereal toolset, featuring a novel Exchange email collection module, a unique C&C mechanism, and sophisticated .NET execution tricks

Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches https://thehackernews.com/2026/11/cisco-broadworks-and-openwave-flaws.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Details of the vulnerabilities are below - CVE-2026-20320 (CVSS score: 7.5) - An improper restriction of XML external entity

Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access https://thehackernews.com/2026/11/hackers-exploit-critical-xen-orchestra.html French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild. The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062. "REST cookie parsing turns authenticationToken=j:%7B%7D into {}," Vates VMS said in an alert. "REST authentication passes that object to the

Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem https://thehackernews.com/2026/11/three-china-nexus-espionage-campaigns.html Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year. Check Point Research is tracking the clusters under the names SilentDelivery,

SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users https://thehackernews.com/2026/11/sglang-rce-exploit-breaches-near-ai.html An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday. The attacker could also have seen requests being processed on that server that day, including requests sent in confidential mode, the company said earlier this week. That mode processes requests inside a trusted execution environment (TEE

Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones https://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1. The flaw, tracked as CVE-2026-111760, is an integer truncation in how Git handles its index. An

Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor https://thehackernews.com/2026/11/attackers-exploit-ahsaycbs-flaws-to.html Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant. The activity, observed by Huntress in October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two

Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America https://thehackernews.com/2026/11/blind-eagle-uses-fake-court-notices-to.html The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and DCRat. "The campaign uses Portuguese and Spanish lures that resemble court notifications, fiscalía notices, tutela proceedings, and

Fireworks AI Breach Widens to Expose Customer Billing Data and Incomplete Model Weights https://thehackernews.com/2026/11/fireworks-ai-breach-widens-to-expose.html Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month  uncovered further malicious activity, affecting account and billing information, alongside secrets, datasets, and incomplete models for a "limited set of accounts." In a notice published on October 10, 2026, the company said it detected unauthorized use of internal Fireworks

Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed https://thehackernews.com/2026/11/binance-warns-of-ios-sandbox-escape.html An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today. Apple's updates for iOS 26 and 27, released yesterday, do not list a fix. A researcher who goes by forcequit released the escape, called worse_query, on Sunday, a

Anthropic's Claude Fable 5.2 Beats GPT-6 Cyber in Multi-Stage Cyberattack Benchmark https://thehackernews.com/2026/11/anthropics-claude-fable-52-beats-gpt-6.html Anthropic on Monday released Claude Fable 5.2 and Claude Mythos 5.2 models, which it said exhibit improvements in coding, reasoning, and vision. During pre-release training, the large language models (LLMs) helped its engineers "complete otherwise-infeasible software migrations, designed three working electronic devices from scratch, solved two open problems in the physics of black holes, made