How I keep up with cyber news.

Nov 09 BleepingComputer SEGA newsletter data breach exposes 2.2 million email addresses Japanese gaming giant SEGA has disclosed that a data breach at its third-party newsletter provider, ARARA, exposed the email addresses of 2.2 million newsletter subscribers. ↗ Nov 09 BleepingComputer N-able takes cloud platform offline after 30+ "zero-days" published N-able has taken its hosted N-central environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more than 30 alleged zero-day… ↗ Nov 09 BleepingComputer York University breach exposed personal information dating to 2007 York University has announced it suffered a cybersecurity incident in which a threat actor stole personal information people submitted through online forms. [...] ↗ Nov 09 BleepingComputer France blames Iranian hackers for supermarket attacks that sparked fires France has linked October cyberattacks that disrupted refrigeration systems at more than 700 supermarkets and other retail locations to Iranian state-backed hackers, saying the attacks caused food losses and… ↗ Nov 09 Dark Reading Attackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on Linux Attackers can exploit a flaw in Claude's document-processing tool by creating a temporary file that Anthropic's AI assistant can access and run on a user's machine. ↗ Nov 09 The Hacker News Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data An attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data, cloud security company Wiz said today. ↗ Nov 09 BleepingComputer Russian cloud firm Beget rebuilds from scratch after data wiper attack A data-wiping malware attack has forced Russian cloud services provider Beget to rebuild its cloud infrastructure from scratch, the company said. [...] ↗ Nov 09 The Hacker News Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware Attackers used the Ethersphere project's own release automation to publish malicious versions of two of its tools for the Swarm decentralized storage network: bee-js 13.3.0 and Swarm Desktop 0.56.2. ↗ Nov 09 The Hacker News Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia The South Asian cyber espionage group known as Bitter (aka APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397) has been observed targeting South Asian organizations with a previously unreported… ↗ Nov 09 SecurityWeek Revolve Puts Data Breach Victim Count at 1.5 Million Online fashion retailer Revolve has told regulators that the September cyberattack affected more than 1.5 million individuals. ↗ Nov 09 The Hacker News ⚡ Weekly Recap: SSHole Exploited, APT Root RCE, Robot Takeovers, 15K Hacked Sites, and More A system doesn't always need a complicated bug to let someone in. Sometimes, a blank password is enough. ↗ Nov 09 SecurityWeek Plex2Shell Exploited Against QNAP NAS Users Threat actors are exploiting the four-flaw chain to hack the Plex Media Server application on QNAP NAS devices. The post Plex2Shell Exploited Against QNAP NAS Users appeared first on SecurityWeek . ↗ Nov 09 SecurityWeek Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers Hackers compromised an external cloud service used by the shopping platform and may have stolen personal information from it. ↗ Nov 09 SecurityWeek Italy’s Meloni Blames Pro-Russian Hackers for Leak of Foreign Minister’s Data on the Dark Web Italian Foreign Minister Antonio Tajani said Saturday that his personal data had been disseminated on the dark web. ↗ Nov 09 SecurityWeek Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH The initial exploitation attempts are attributed to botnets and crypto miners, but other threat actors are expected to follow suit. ↗ Nov 09 The Hacker News Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars The login systems behind two car brands' mobile apps could be taken over completely, two security researchers found, allowing them to access any customer's account and, for an owner with a connected car,… ↗ Nov 05 Hunt.io Inside the PHP2Shell Arsenal: A Complete Dissection of a PAN-OS Mass-Exploitation Open Directory An exposed open directory revealed a full PAN-OS attack toolkit that chained PHP RCE with a kernel LPE to root 25 Palo Alto firewalls across the US and Korea. ↗ Nov 05 Hunt.io Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619) Two critical PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619, leaked pre-patch. We map the exposed PHP footprint and hunt open directories for exploitation. ↗ Nov 05 Hunt.io ARTEX Exposed: Infrastructure Behind the South Korea Bank Hack Hunt.io pivots from an exposed open directory into the ARTEX campaign against South Korean banks, revealing a Hong Kong jump server, AI model routing, and exploit tooling. ↗ Nov 05 Hunt.io 68 GB Stolen From a Philippine Government Agency’s Overseas-Employment Databases, Exposed by the Operator’s Own Open Directory An exposed staging server at UpCloud revealed a completed 68 GB copy of 27 Philippine overseas-employment database backups, a rebranded GodPotato privilege escalation tool, and the operator's own transfer… ↗ Nov 03 Krebs on Security Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user's Internet… ↗ Oct 19 Krebs on Security Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained… ↗ Oct 14 Krebs on Security U.K. Sanctions Cryptomus for RU Money Laundering The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet… ↗

Nov 09 Dark Reading CISA Announces Enhanced Reporting Form for Cyber Incidents New questionnaire captures critical data and information that improves the agency’s ability to assess incidents, identify trends and prioritize response actions. ↗ Nov 09 Dark Reading Microsoft Fixes RCE Bug in Windows Paint After Weeks of Confusion Last month, Microsoft disclosed a vulnerability in Microsoft Paint, but messaging regarding a patch was unclear. ↗ Nov 09 Dark Reading Black Hat India 2026 Makes a Landmark Debut in Bengaluru, Bringing the Global Cybersecurity Community to India Inaugural edition by Informa Markets in India brings together leading researchers, security practitioners and industry decision makers for four days of cutting-edge research, technical exchange and strategic… ↗ Nov 09 Dark Reading PwC's CISO on AI, Robots & What's Next for Security As AI accelerates change across the enterprise, PwC's James Shira explains why security teams must rethink their approach to risk and adapt their strategies. ↗ Nov 05 Krebs on Security Want to Rent an Internet Address at the White House? Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned… ↗ Nov 05 Hunt.io PHP2Shell One Week Later: Honeypot Shells on the Web, a Path to Root on Palo Alto Firewalls One week after php2shell was patched, it stalls on the open web but reliably roots internet-facing Palo Alto PAN-OS firewalls. Inside the operators and the evidence. ↗ Oct 21 Krebs on Security Widespread PHP Flaw May Cause Many Site Outages Today Expect to see quite a few websites serving "404" or "Page Not Found" errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to… ↗