Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Latest Cybersecurity News

A critical authentication bypass allows attackers to execute arbitrary code as admin and take over XCP-ng nodes.

Attackers could exploit them for command execution, memory overwrites, and privilege escalation.

Attackers could exploit the bugs to tamper with certificate entries, achieve remote code execution, and compromise hosts.

The Series C round will fund international expansion and more autonomous features for the firm’s device security platform. 

The massive drop comes after the company integrated frontier AI models into its product security testing.

Founded by three ex-IDF Unit 8200 intelligence officers, Bay is launched to provide a control plane for AI agents.

Created by Zerto and Kashya veterans, the startup has launched a platform designed to recover whole cloud applications. 

Pre-Patch Tuesday advisories were published by VDE CERT, Phoenix Contact, Johnson Controls, and Hitachi Energy. 

The flaws, CVE-2026-111793 and CVE-2026-20320, let attackers leak sensitive information, including configuration data.

Intel and AMD disclose more than 200 vulnerabilities, including critical flaws in Intel TDX software and numerous AMD graphics bugs.

The security defects could allow attackers to bypass authorization and gain root access to devices.

Apple has patched Bluetooth and AirPlay pairing flaws, iMessage vulnerabilities, and an exploited Brotli bug across its platforms.

CVE-2026-124194 is the Outlook zero-day for which Microsoft says it’s aware of active exploitation. 

Chipmaker Patch Tuesday Chipmaker Patch Tuesday

Intel and AMD disclose more than 200 vulnerabilities, including critical flaws in Intel TDX software and numerous AMD graphics bugs.

Barracuda vulnerability Barracuda vulnerability

The security defects could allow attackers to bypass authorization and gain root access to devices.

Microsoft Outlook exploit Microsoft Outlook exploit

CVE-2026-124194 is the Outlook zero-day for which Microsoft says it’s aware of active exploitation. 

Top Cybersecurity Headlines

CISA has added CVE-2026-123218 and CVE-2026-116779 to KEV, urging federal agencies to patch them within three days.

The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks.

The initial exploitation attempts are attributed to botnets and crypto miners, but other threat actors are expected to follow suit.

SecurityWeek Industry Experts

More Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

NOW LIVE: CISO Forum 2026 Summit

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

Join to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers’ agents write to running a coordinated system of security agents you’ve built yourself.

Register

Upcoming Cybersecurity Events

CISO Forum Virtual Summit

The 2026 Virtual CISO Forum brings together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
[November 10 & 11, 2026 | Virtual]

Read More
CISO Forum 2026 Year-End Review Virtual Roundtable

SecurityWeek’s CISO Forum 2026 Year-End Virtual Roundtable will reflect on a landmark year in security and discuss how to fortify your enterprise strategy for 2027.
[December 2, 2026 | Virtual]

Read More
Cyber AI and Automation Summit 2026

SecurityWeek’s Cyber AI & Automation Summit pushes the boundaries of security discussions by exploring the implications and applications of predictive AI, machine learning, and automation in modern cybersecurity programs.
[December 8 & 9, 2026 | Virtual]

Read More
Zero Trust Summit Now On-Demand

SecurityWeek’s 2026 Zero Trust Summit will deep-dive into the world of digital identity management and the role of zero-trust principles and associated technologies
[Originally October 14, 2026]

Read More

Vulnerabilities

Cybercrime

A total of 81 security vulnerabilities have been addressed in this month’s set of security patches for the Android platform. 13 of the flaws were rated Critical severity.The security bulletin has two security patch levels, each focused on addressing vulnerabilities in specific components. 

Threat actors are leveraging malicious PowerPoint files and a recently patched Microsoft Office vulnerability to target UN agencies, foreign ministries, international organizations, and entities interacting with international governments, Fortinet warns.

A group of cyberspies believed to be operating out of Russia has been observed targeting energy facilities in the United States and other countries, and the attackers appear to be increasingly interested in gaining access to the control systems housed by these organizations.

Lenovo has reached a settlement with the U.S. Federal Trade Commission (FTC) and Attorneys General in 32 states regarding the company’s decision to preinstall man-in-the-middle (MitM) software on its laptops.

A team of security researchers from the University of California, Santa Barbara has discovered a series of code execution and denial of service vulnerabilities in the bootloaders of popular mobile platforms.

Event image poster

The leading global conference series for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Learn More

Application Security

Application Security

Sysdig’s platform uses runtime visibility to track AI agent actions and block risky behavior before it reaches production systems.

Cloud Security

Cloud Security

Created by Zerto and Kashya veterans, the startup has launched a platform designed to recover whole cloud applications. 

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.