TECHZONE™

Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover https://thehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html A critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server. The crash occurs only if that server is later chosen to take over as the main server while it still lacks some recent changes. MongoDB, the company that makes the database, released fixed versions earlier this week. The affected servers are members of a replica

Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data https://thehackernews.com/2026/11/nodejs-fixes-16-flaws-including-http2.html A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines. A second HTTP/2 flaw can cause a server to send a client pieces of its memory, including responses intended for other connections. Fixed versions were released for all three supported lines: 22.23.5, 24.22.3, and 26.13.1. The crash

Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security software company. The stealer is built to take the secrets and cloud credentials that a repository's CI workflows can reach. It ran in at least 1,806 repositories, where the attacker has likely collected

Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html A critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday. Only servers with HTTP/2 enabled are affected, according to Red Hat, which ships the server as part of Red Hat Enterprise Linux. An attacker who can reach the

ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients https://thehackernews.com/2026/11/screenconnect-attacks-target-at-least.html ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access. In an advisory posted on its site, the company said there is no evidence that the incident involves a compromise of its infrastructure or a vulnerability in the ScreenConnect software. "Our initial assessment suggests the activity may involve

Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation https://thehackernews.com/2026/11/critical-zoom-workplace-flaw-could.html Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems. The vulnerabilities are listed below - CVE-2026-108186 (CVSS score: 9.6) - An improper input validation vulnerability that could allow an unauthenticated user to conduct an escalation of privilege via

AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html Cybersecurity researchers have disclosed details of a campaign in which an emerging agentic penetration testing platform called AntiFox has been used to steal Amazon Web Services (AWS) credentials and pivot laterally into compromised environments. "In several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against

Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits https://thehackernews.com/2026/11/hackers-target-qlik-sense-servers-with.html Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026. Cynet's CyOps and Research teams said they identified the suspicious activity in October 2026 against several E.U.-based customers within a narrow window of just over three minutes. The activity has been found to share some

Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords https://thehackernews.com/2026/11/over-35000-grok-built-apps-exposed.html Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday. They included 24 apps built by staff at the social network X and at SpaceXSI, the company that makes the Grok AI assistant. Most of the open apps were games, landing pages, and calculators, but about 1 in 10 contained internal business or

We Built An Agent That Broke All of Our Security Rules. Here's What We Learned. https://thehackernews.com/2026/11/we-built-agent-that-broke-all-of-our.html We tell customers three things about securing AI agents: they need their own identities, access that fits the job they’re given, and traceability that’s separate from any human’s. That was true for us at Token as well. Then, we built an agent that broke all three by default. This helped us think through how such agents should be defended. When a browser agent acts inside a user’s authenticated

eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise https://thehackernews.com/2026/11/emudhra-revokes-8-more-cas-it.html The in-house Python script behind eMudhra's October key compromise has now cost the company 8 more of its intermediate certificate authorities (CAs), even though it did not weaken their keys. Each intermediate CA has its own private key, which the company uses to sign the certificates it issues. The 8 intermediate CAs compromised in October had a different problem: a single line in the script

Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes https://thehackernews.com/2026/11/microsoft-patches-1259-flaws-including.html Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws. These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers.

Railway Says Stolen Customer AI Keys Led to $740,000 in Estimated Unauthorized Usage Charges https://thehackernews.com/2026/11/railway-says-stolen-customer-ai-keys.html AI provider keys that customers stored on Railway were stolen in an October breach and used to commit an estimated $740,000 in unauthorized spending, the platform-as-a-service provider said yesterday. It has promised to pay those charges itself when an AI provider will not refund them. The company builds and runs apps for its customers and stores their secrets, such as API keys and database

Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons https://thehackernews.com/2026/11/microsoft-researchers-show-ai-agents.html An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown. When a chosen trigger appears, the model outputs an attacker's command, which an agent using that model would run with the agent's own permissions. The attacker must be able to change the model's weights. The team tested the method on

Exchange for breakfast: Turla’s Cereal tricks are not for kids https://www.welivesecurity.com/en/eset-research/exchange-for-breakfast-turlas-cereal-tricks-are-not-for-kids/ ESET Research describes Turla’s Cereal toolset, featuring a novel Exchange email collection module, a unique C&C mechanism, and sophisticated .NET execution tricks

Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches https://thehackernews.com/2026/11/cisco-broadworks-and-openwave-flaws.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Details of the vulnerabilities are below - CVE-2026-20320 (CVSS score: 7.5) - An improper restriction of XML external entity

Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access https://thehackernews.com/2026/11/hackers-exploit-critical-xen-orchestra.html French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild. The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062. "REST cookie parsing turns authenticationToken=j:%7B%7D into {}," Vates VMS said in an alert. "REST authentication passes that object to the

Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem https://thehackernews.com/2026/11/three-china-nexus-espionage-campaigns.html Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year. Check Point Research is tracking the clusters under the names SilentDelivery,

SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users https://thehackernews.com/2026/11/sglang-rce-exploit-breaches-near-ai.html An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday. The attacker could also have seen requests being processed on that server that day, including requests sent in confidential mode, the company said earlier this week. That mode processes requests inside a trusted execution environment (TEE

Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones https://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1. The flaw, tracked as CVE-2026-111760, is an integer truncation in how Git handles its index. An