Bulletin ID: 2026-170-AWS Publication Date: 11/04/2026 13:30 PM PST Description: We identified CVE-2026-122266, an issue in Amazon EKS Network Policy…
Vercel rolls out new protection against stolen session cookie attacks
Vercel is gradually rolling out Device Bound Session Credentials (DBSC) on its platform as a key defense against information stealer malware. […]
OpenAI Reports Covert Underperformance in GPT-6 Astra
OpenAI says GPT-6 Astra sometimes secretly underperformed on safety research, raising concerns about AI reliability and alignment. OpenAI has disclosed…
IT Security News Hourly Summary 2026-11-06 11h : 11 posts
11 posts published in the last hour 09:32UK Warns Its Critical Infrastructure Faces Grave Risk 09:32Claude AI Flaw Lets Malicious Browser Extensions Execute Commands on Remote Computers 09:32PHP2Shell: What the rapid exploitation of critical PHP vulnerabilities means for security teams…
UK Warns Its Critical Infrastructure Faces Grave Risk
Britain’s new Labour-led government is making a concerted push to get ahead of the AI risks to its national networks and the industrial complex.
Claude AI Flaw Lets Malicious Browser Extensions Execute Commands on Remote Computers
A design flaw in Anthropic’s Claude Dispatch feature let a malicious browser extension run commands on the operating system, even on a different computer.…
PHP2Shell: What the rapid exploitation of critical PHP vulnerabilities means for security teams
Attackers were already trying to exploit PHP2Shell before details of the vulnerabilities emerged publicly on October 20, 2026. The two critical…
Half of Security Leaders Report Sensitive Data Exposure Through AI Tools
BlackFog found a lack of visibility into data being shared with AI tools, even those approved for use in the enterprise
US agencies warn attackers are targeting refrigeration systems that protect food and medicine
Threat actors are going after the controllers that keep grocery store freezers and cold storage rooms at safe temperatures, and they may push those units…
Huntress turns real-world attack intelligence into fleet-wide ‘herd immunity’ with new platform capabilities
Huntress has announced a wave of new capabilities across its Agentic Security Platform, designed to turn intelligence gathered from live attacks into…
Hackers Could Bypass ChatGPT Lockdown Mode to Steal Conversations Without Users Knowing
A flaw in ChatGPT let attackers slip past Lockdown Mode, the safety setting meant to stop data leaks. Check Point Research found that a hidden pop-up…
Chainalysis Breach Exposes All Users’ Credentials, Forces Shutdown of Key Services
Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names,…
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and…
ChatGPT Lockdown Mode Bypass Allowed Hackers to Steal Private Chats Without User Interaction
Research found a flaw that bypassed ChatGPT’s Lockdown Mode. It let attackers silently exfiltrate full chat histories, deliver malware, and phish…
IT Security News Hourly Summary 2026-11-06 10h : 8 posts
8 posts published in the last hour 08:31AI agents are a ‘bane’ for some website operators, says Cloudflare 08:31mSecure tells users to change passwords but won’t say why [updated] 08:31Investment scams with potential victims in at least 50 countries: over…
AI agents are a ‘bane’ for some website operators, says Cloudflare
CEO says sovereigns probably exploited PHP2SHELL ages ago, and suggests containers are dead
mSecure tells users to change passwords but won’t say why [updated]
mSecure has urged users to protect information stored in its app, but hasn’t explained what happened or whether anyone’s data was exposed.
Investment scams with potential victims in at least 50 countries: over 100 servers seized
Led by the German Itzehoe Public Prosecutor’s Office (Staatsanwaltschaft Itzehoe), the operation targeted a company suspected of supplying fraudulent…
Officials extradite Canadian man to US for alleged cryptomining spree
Ryan Roach and his alleged co-conspirator, Mathiew Stubbings, are accused of compromising U.S. universities’ computers and taking over processing power to…
Hackers stole DreamHost customer files and inboxes during months-long attack
The web host said hackers exploited a vulnerability to access customer emails and files during a “deliberate attack.”
CVE-2026-122192 – Guest Access to Firecracker Process Memory After a Failed Memory Discard
Bulletin ID: 2026-169-AWS Publication Date: 11/04/2026 11:30 AM PST Description: We identified CVE-2026-122192, an issue in Firecracker v0.23.0 through…
DreamHost confirms data breach exposed FTP logins and webmail sessions
DreamHost is warning of a data breach after attackers gained access to its File Manager platform for two months and stole customers’ FTP/SFTP usernames…
IT Security News Hourly Summary 2026-11-06 09h : 21 posts
21 posts published in the last hour 07:34Top 10 Best Deception Technology Solutions in 2026 [Ranked & Scored] 07:33The fake $750 Apple Cash reward that pays out nothing 07:33Hackers steal 320,000 UK school files and publish them on dark web…
Top 10 Best Deception Technology Solutions in 2026 [Ranked & Scored]
Deception inverts security’s worst ratio: instead of mining millions of events for one attacker, you plant assets only an attacker would touch and wait…