Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Latest Cybersecurity News

A critical authentication bypass allows attackers to execute arbitrary code as admin and take over XCP-ng nodes.

Attackers could exploit them for command execution, memory overwrites, and privilege escalation.

Attackers could exploit the bugs to tamper with certificate entries, achieve remote code execution, and compromise hosts.

The Series C round will fund international expansion and more autonomous features for the firm’s device security platform. 

The massive drop comes after the company integrated frontier AI models into its product security testing.

Founded by three ex-IDF Unit 8200 intelligence officers, Bay is launched to provide a control plane for AI agents.

Created by Zerto and Kashya veterans, the startup has launched a platform designed to recover whole cloud applications. 

Pre-Patch Tuesday advisories were published by VDE CERT, Phoenix Contact, Johnson Controls, and Hitachi Energy. 

The flaws, CVE-2026-111793 and CVE-2026-20320, let attackers leak sensitive information, including configuration data.

Intel and AMD disclose more than 200 vulnerabilities, including critical flaws in Intel TDX software and numerous AMD graphics bugs.

The security defects could allow attackers to bypass authorization and gain root access to devices.

Apple has patched Bluetooth and AirPlay pairing flaws, iMessage vulnerabilities, and an exploited Brotli bug across its platforms.

CVE-2026-124194 is the Outlook zero-day for which Microsoft says it’s aware of active exploitation. 

Chipmaker Patch Tuesday Chipmaker Patch Tuesday

Intel and AMD disclose more than 200 vulnerabilities, including critical flaws in Intel TDX software and numerous AMD graphics bugs.

Barracuda vulnerability Barracuda vulnerability

The security defects could allow attackers to bypass authorization and gain root access to devices.

Microsoft Outlook exploit Microsoft Outlook exploit

CVE-2026-124194 is the Outlook zero-day for which Microsoft says it’s aware of active exploitation. 

Top Cybersecurity Headlines

CISA has added CVE-2026-123218 and CVE-2026-116779 to KEV, urging federal agencies to patch them within three days.

The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks.

The initial exploitation attempts are attributed to botnets and crypto miners, but other threat actors are expected to follow suit.

SecurityWeek Industry Experts

More Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

NOW LIVE: CISO Forum 2026 Summit

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

Join to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers’ agents write to running a coordinated system of security agents you’ve built yourself.

Register

Upcoming Cybersecurity Events

CISO Forum Virtual Summit

The 2026 Virtual CISO Forum brings together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
[November 10 & 11, 2026 | Virtual]

Read More
CISO Forum 2026 Year-End Review Virtual Roundtable

SecurityWeek’s CISO Forum 2026 Year-End Virtual Roundtable will reflect on a landmark year in security and discuss how to fortify your enterprise strategy for 2027.
[December 2, 2026 | Virtual]

Read More
Cyber AI and Automation Summit 2026

SecurityWeek’s Cyber AI & Automation Summit pushes the boundaries of security discussions by exploring the implications and applications of predictive AI, machine learning, and automation in modern cybersecurity programs.
[December 8 & 9, 2026 | Virtual]

Read More
Zero Trust Summit Now On-Demand

SecurityWeek’s 2026 Zero Trust Summit will deep-dive into the world of digital identity management and the role of zero-trust principles and associated technologies
[Originally October 14, 2026]

Read More

Vulnerabilities

Cybercrime

Joomla 3.8 brings more than 300 improvements to the popular content management system (CMS) and patches two vulnerabilities, including one that can be exploited to obtain administrator credentials.

Equifax has made another blunder following the massive data breach suffered by the company – it advised some customers on Twitter to access a fake support website set up by a security researcher.

The United States Securities and Exchange Commission (SEC) said late Wednesday that it was the victim of a cyber-attack in 2016 that may have allowed hackers to profit through trading on non-public information in its EDGAR filing system.

A cyber espionage group linked by security researchers to the Iranian government has been observed targeting aerospace and energy organizations in the United States, Saudi Arabia and South Korea.

An Amazon Web Services S3 cloud storage bucket containing a great deal of Viacom internal access credentials and other critical data was left publicly accessible, UpGuard security researchers have discovered.

A team of researchers from Israel has developed a piece of malware that demonstrates how hackers can abuse security cameras with infrared (IR) capabilities to send and receive data to and from an air-gapped network.

Summer is coming to a close, and with it the end of a steady stream of superhero movies that have been lighting up the box office over the past few months. But while on-screen heroes have been lassoing bad guys or saving the galaxy, here in the real world we’ve been witnessing a different type of anti-criminal activity: defense against cybercrime.

Apple this week announced the availability of 8 security patches for its iPhone 5s and later, iPad Air and later, and iPod touch 6th generation users, released as part of the iOS 11 platform upgrade.

Equifax revealed on Tuesday that the recent data breach affects roughly 100,000 Canadian consumers, but the company’s systems in Canada were not compromised.

Event image poster

The leading global conference series for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Learn More

Application Security

Application Security

Sysdig’s platform uses runtime visibility to track AI agent actions and block risky behavior before it reaches production systems.

Cloud Security

Cloud Security

Created by Zerto and Kashya veterans, the startup has launched a platform designed to recover whole cloud applications. 

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.