IT Security News: Morning roundup, 2026-11-12 Summary The most pressing thread in this window is attacks on trusted infrastructure that other organizations rely on: a mass GitHub credential-theft campaign, a Red Hat Quay flaw exposing container images, critical bugs in…
Zoom Fixes Critical Windows Vulnerability Allowing Privilege Escalation
Zoom fixes two Windows Workplace flaws, including a critical bug that could let unauthenticated attackers remotely escalate privileges. Zoom has released…
Microsoft: Recent Windows updates cause SQL Server performance issues
Microsoft has confirmed that Windows updates released since the October 2026 Patch Tuesday are causing SQL Server performance and stability issues. […]
Stolen Customer AI Keys Lead to $740,000 in Unauthorized Charges at Railway
A cyberattack on Railway, a cloud hosting provider, in October exposed customer credentials that resulted in approximately $740,000 worth of unauthorized…
PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution
PTC has released patches for a new critical vulnerability impacting Windchill and FlexPLM software that, if successfully exploited, could result in remote…
JPN: Muji operator apologizes for data breach
NHK World reports: The operator of the Muji chain of retail stores is one of the latest Japanese companies hit by cyberattacks. Its president has…
New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access
N-able on Thursday said it’s investigating a new public disclosure containing claims of additional vulnerabilities in on-premise versions of N-central…
Volta-Autodoxer Malware Uses Artificial Intelligence to Rank Victims and Build Detailed Personal Dossiers
Cybersecurity researchers at Cisco Talos have uncovered a new piece of malware known as Volta-Autodoxer (VOLTA) which uses commercial AI models to analyse…
Webinar: See How Identity Blind Spots Put Your SOC at Risk and How to Close Them
Security teams have more alerts, logs, and monitoring tools than ever. Yet when an attack happens, one simple question can still take too long to answer:…
SG: AIC hit by cybersecurity incident, personal data of over 4,000 healthcare and community care employees possibly affected
Sean Ler reports: Singapore’s point agency coordinating the delivery of aged care services — the Agency for Integrated Care (AIC) — has been hit by a…
Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign
Since mid-August 2026, a phishing operation has been stealing live Google sessions from corporate users. Every check defenders normally lean on to judge a…
IT Security News Hourly Summary 2026-11-12 14h : 12 posts
12 posts published in the last hour 12:32Critical MongoDB Use-After-Free Vulnerability Allows Remote Code Execution Without Authentication 12:31Another Way Police Are Locating People from Their Smartphones 12:31Google Chrome Fixes 83 Security Flaws, Including 5 Critical Use-After-Free Vulnerabilities 12:04European tech buyers…
Critical MongoDB Use-After-Free Vulnerability Allows Remote Code Execution Without Authentication
MongoDB has patched a critical use-after-free flaw, tracked as CVE-2026-118383 with a CVSS score of 9.5, that unauthenticated attackers can exploit over…
Another Way Police Are Locating People from Their Smartphones
Penlink’s Webloc is an application that locates people using information from the weather, gaming, email, and religious apps on their phone. It’s sold to…
Google Chrome Fixes 83 Security Flaws, Including 5 Critical Use-After-Free Vulnerabilities
Google released a Chrome desktop security update that addresses 83 vulnerabilities, including five critical use-after-free flaws affecting ServiceWorker,…
European tech buyers add digital sovereignty to cyber shopping list
Sales from EU HQ’d vendor rocket in two years. The Trump affect? Yes but NIS2 and DORA are factors too
Crypto Agility: Every Security Change Competes with Business Profits
Crypto Agility: Every Security Change Competes with Business Profits lee.potok@thal… Thu, 11/12/2026 – 10:30 Crypto agility helps organizations reduce…
Why the DHS Employee Leak Is an Identity-Security Crisis, Not Just Another Data Breach
The exposure of information connected to more than 41,000 US Department of Homeland Security personnel demonstrates how an employee directory can become…
Hackers Exploit Decade-Old OpenSSH Flaw to Bypass Linux Logins
Hackers exploit SSHole OpenSSH flaw to bypass Linux logins and install a Python backdoor. CISA confirms exploits as patched packages become available.
AntiFox AI Agents Linked to AWS Attacks That Exposed Production Secrets and Compromised Web Servers
Attackers are using AntiFox, an agentic AI penetration-testing framework derived from ARTEX, to target internet-facing web applications and AWS…
The UK announces a new AI biosecurity lab
Artificial intelligence is creating new opportunities in medicine and biological research, but it may also make some biological risks harder to manage.…
Industrial cyber incidents surge as SANS survey exposes serious recovery gaps
More than a third of industrial organisations (34%) experienced a cyber incident affecting their operational technology (OT) environments in the past…
Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), (Thu, Nov 12th)
CVE-2026-102895 is a trivial authentication-bypass vulnerability. GPUStack is also an attractive target. It is open-source software that manages clusters…
IT Security News Hourly Summary 2026-11-12 13h : 18 posts
18 posts published in the last hour 11:35PoC Exploit Released for Critical Cisco Expressway RCE Vulnerability With CVSS 9.8 Score 11:34Inside an AI Attack Against a US Retailer 11:34Why scammers want you to allow push notifications 11:34Microsoft Entra adds a…
PoC Exploit Released for Critical Cisco Expressway RCE Vulnerability With CVSS 9.8 Score
A public proof-of-concept exploit is now available for CVE-2026-76466, a critical flaw in Cisco Expressway that lets an unauthenticated attacker run…