Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Latest Cybersecurity News

Attackers could exploit them for command execution, memory overwrites, and privilege escalation.

Attackers could exploit the bugs to tamper with certificate entries, achieve remote code execution, and compromise hosts.

The Series C round will fund international expansion and more autonomous features for the firm’s device security platform. 

The massive drop comes after the company integrated frontier AI models into its product security testing.

Founded by three ex-IDF Unit 8200 intelligence officers, Bay is launched to provide a control plane for AI agents.

Created by Zerto and Kashya veterans, the startup has launched a platform designed to recover whole cloud applications. 

Pre-Patch Tuesday advisories were published by VDE CERT, Phoenix Contact, Johnson Controls, and Hitachi Energy. 

The flaws, CVE-2026-111793 and CVE-2026-20320, let attackers leak sensitive information, including configuration data.

Intel and AMD disclose more than 200 vulnerabilities, including critical flaws in Intel TDX software and numerous AMD graphics bugs.

The security defects could allow attackers to bypass authorization and gain root access to devices.

Apple has patched Bluetooth and AirPlay pairing flaws, iMessage vulnerabilities, and an exploited Brotli bug across its platforms.

CVE-2026-124194 is the Outlook zero-day for which Microsoft says it’s aware of active exploitation. 

Adobe has fixed vulnerabilities in AEM, Premiere, Photoshop, After Effects, Connect, Audition, Dimension, Content Credentials SDK, and Media Encoder.

Chipmaker Patch Tuesday Chipmaker Patch Tuesday

Intel and AMD disclose more than 200 vulnerabilities, including critical flaws in Intel TDX software and numerous AMD graphics bugs.

Barracuda vulnerability Barracuda vulnerability

The security defects could allow attackers to bypass authorization and gain root access to devices.

Microsoft Outlook exploit Microsoft Outlook exploit

CVE-2026-124194 is the Outlook zero-day for which Microsoft says it’s aware of active exploitation. 

Top Cybersecurity Headlines

CISA has added CVE-2026-123218 and CVE-2026-116779 to KEV, urging federal agencies to patch them within three days.

The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks.

The initial exploitation attempts are attributed to botnets and crypto miners, but other threat actors are expected to follow suit.

SecurityWeek Industry Experts

More Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

NOW LIVE: CISO Forum 2026 Summit

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

Join to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers’ agents write to running a coordinated system of security agents you’ve built yourself.

Register

Upcoming Cybersecurity Events

CISO Forum Virtual Summit

The 2026 Virtual CISO Forum brings together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
[November 10 & 11, 2026 | Virtual]

Read More
CISO Forum 2026 Year-End Review Virtual Roundtable

SecurityWeek’s CISO Forum 2026 Year-End Virtual Roundtable will reflect on a landmark year in security and discuss how to fortify your enterprise strategy for 2027.
[December 2, 2026 | Virtual]

Read More
Cyber AI and Automation Summit 2026

SecurityWeek’s Cyber AI & Automation Summit pushes the boundaries of security discussions by exploring the implications and applications of predictive AI, machine learning, and automation in modern cybersecurity programs.
[December 8 & 9, 2026 | Virtual]

Read More
Zero Trust Summit Now On-Demand

SecurityWeek’s 2026 Zero Trust Summit will deep-dive into the world of digital identity management and the role of zero-trust principles and associated technologies
[Originally October 14, 2026]

Read More

Vulnerabilities

Cybercrime

During 2016, the US government made 49,868 requests to Facebook for user data; 27,850 requests to Google; and 9,076 requests to Apple. Governments will not stop making these requests, since the internet has become a major avenue for mass surveillance. The real issue is to what extent internet companies will seek to protect their users' data from unwarranted government intrusions.

A purveyor of static code analysis wished to pitch his product to Samsung. What better way, he thought, than to run his product against the Samsung Tizen operating system, and demonstrate the results. The demonstration fell through, and the purveyor decided instead to publish his findings.

Two security researchers recently discovered an issue with improperly configured Oracle Access Manager (OAM) 10g that can be exploited by remote attackers to hijack sessions from unsuspecting users.

Last month at the Gartner Security and Risk Management conference, I had the opportunity to speak with many CISOs, analysts and other security professionals. One of the common threads through many of these conversations was how to use threat intelligence more effectively to understand and act upon the highest priority threats facing their organizations. They have acquired multiple data feeds from multiple sources, but without the ability to sift through the data it has just become noise.

The personal details of millions of Verizon customers were exposed online due to a misconfigured Amazon Web Services (AWS) S3 bucket operated by a third-party vendor, but the telecoms giant has downplayed the incident.

Event image poster

The leading global conference series for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Learn More

Application Security

Application Security

Sysdig’s platform uses runtime visibility to track AI agent actions and block risky behavior before it reaches production systems.

Cloud Security

Cloud Security

Created by Zerto and Kashya veterans, the startup has launched a platform designed to recover whole cloud applications. 

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.