AX·NEWS
Sign in

Cybersecurity

Cybersecurity news — Wednesday 04 November 2026

48 stories from 8 sources, every one in English. Each links to its publisher.

Open in the live feedRSS feedOn a TV

  1. What Democratic control of Congress means for cybersecurity
    USCyberScoop

    Democrats’ big win on Election Day, which saw them take control of both the House and Senate, has ramifications for the Cybersecurity and Infrastructure Security Agency, artificial intelligence, surveillance policy and much more. Here’s…

  2. Vercel rolls out new protection against stolen session cookie attacks
    USBleepingComputer

    Vercel is gradually rolling out Device Bound Session Credentials (DBSC) on its platform as a key defense against information stealer malware. [...]

  3. Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
    USBleepingComputer

    Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. [...]

  4. Officials extradite Canadian man to US for alleged cryptomining spree
    USCyberScoop

    Two Canadian men broke into the networks of multiple U.S. universities, stole credentials and implanted malware on compromised computers to commandeer processing power for a cryptocurrency mining operation , the Justice Department said…

  5. Is Chrome’s settings menu getting a search bar? What we know
    USZDNet Security

    Chrome might receive a much-needed addition.

  6. DreamHost confirms data breach exposed FTP logins and webmail sessions
    USBleepingComputer

    DreamHost is warning of a data breach after attackers gained access to its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords. [...]

  7. The fake $750 Apple Cash reward that pays out nothing
    USMalwarebytes Labs

    .kadence-column484244_4b5e59-45 > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column484244_4b5e59-45 > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm…

  8. Researchers asked people to use AI chatbots for election info – results were mixed
    USZDNet Security

    Chatbots can skew election-related information and act as an intervening layer in a voter’s search.

  9. Cyberattack disrupts blood storage refrigeration systems in France
    USBleepingComputer

    France's national blood service has confirmed that a cyberattack targeting a refrigeration equipment provider raised temperature and defrost settings at three of its facilities, threatening stored blood products. [...]

  10. Want an AI job? Deployment engineers are earning executive-level pay – up to $1.45M a year
    USZDNet Security

    AI has ushered in new jobs, and some of them are paying handsomely, according to a new study.

  11. Safari finally gets 3 popular browser features – and I can’t wait to try them
    USZDNet Security

    New developer beta release notes point to deeper Siri AI integration and more Safari customization.

  12. Can Netflix’s new AI tool stop your TV-streaming doomscrolling? How to try it
    USZDNet Security

    Netflix is adding a new Discover feature, which recommends tailored streaming selections. Here’s how it works.

  13. mSecure tells users to change passwords but won’t say why
    USMalwarebytes Labs

    Password manager mSecure has warned current and former customers to protect the confidential information stored in its app after detecting “suspicious activity.” But its advice about what users should do comes without an explanation of…

  14. Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root
    INThe Hacker News

    A flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own. The attacker's code then runs as root, according to advisories that Debian, Ubuntu, and…

  15. SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records
    INThe Hacker News

    SonicWall has warned of two vulnerabilities impacting end-of-life Global Management System (GMS) systems that it said will not be patched. Details of the security flaws, which affect SonicWall GMS 9.5.2 and earlier versions, are below …

  16. NIKKE PC game launcher hacked to spread remote access, data-stealing malware
    USBleepingComputer

    The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game's PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data. [...]

  17. Researchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak Toolkit
    INThe Hacker News

    Cybersecurity researchers have disclosed details of an OpenAI Codex jailbreak bundle that's designed to modify an artificial intelligence (AI) agent's trusted instructions to insert advertisements for a third-party AI gateway. The…

  18. mSecure password manager hack prompts password reset warnings
    USBleepingComputer

    mSeven Software is warning current and former mSecure password manager customers to change passwords, reset two-factor authentication, and remove passkeys following a cyberattack that reportedly exposed an encrypted customer database. [...]

  19. Google Calendar phishing campaign hijacks sessions, bypasses MFA
    USBleepingComputer

    A phishing campaign used Google Calendar invites, trusted redirects, and fake login pages to hijack corporate Google sessions and bypass MFA protections. Material Security examines how Operation CloudFire tracked the attacks, blocked…

  20. SonicWall warns of unpatched flaws in end-of-life GMS software
    USBleepingComputer

    SonicWall warned customers of two security flaws affecting end-of-life Global Management System (GMS) systems that will not be patched. [...]

  21. Sysdig Adds Runtime Security and Governance for AI Agents
    USSecurityWeek

    Sysdig’s platform uses runtime visibility to track AI agent actions and block risky behavior before it reaches production systems. The post Sysdig Adds Runtime Security and Governance for AI Agents appeared first on SecurityWeek .

  22. APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
    INThe Hacker News

    The Russia-linked threat actor known as APT29 is presumed to be behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack involving a Ukrainian web…

  23. Barracuda ESG Authentication Bypass Flaw Opens Path to Root
    USSecurityWeek

    An authentication bypass and a command injection flaw can be chained for root access on Barracuda’s Email Security Gateway appliances. The post Barracuda ESG Authentication Bypass Flaw Opens Path to Root appeared first on SecurityWeek .

  24. Agentic Data Security Firm Sentra Raises $150 Million
    USSecurityWeek

    The company will invest in agentic data security capabilities and expand its go-to-market organization. The post Agentic Data Security Firm Sentra Raises $150 Million appeared first on SecurityWeek .

  25. The Classics Return: Vulnerable E-Mail Scripts, (Wed, Nov 4th)
    USSANS ISC

    One of the early web application vulnerabilities I remember was CVE-2000-0411 [CVE]. This was a simple vulnerability in a CGI-bin script used to send e-mail. The vulnerability was pretty straightforward: Adding additional parameters to the…

  26. US charges two Canadians accused of hacking US universities
    USBleepingComputer

    A federal grand jury indicted two Canadians suspected of hacking multiple US universities and using the compromised systems to mine for cryptocurrency. [...]

  27. AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks
    USSecurityWeek

    Hackers have been harvesting AI access tokens and have been using AI-assisted offensive tools to automate attacks. The post AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks appeared first on SecurityWeek .

  28. Canadian Extradited to US Over Cryptomining Hacks on University Supercomputers
    USSecurityWeek

    A federal grand jury indicted two Canadian men for hijacking university supercomputers to secretly mine Electroneum cryptocurrency. The post Canadian Extradited to US Over Cryptomining Hacks on University Supercomputers appeared first on…

  29. Chrome 157 fixes 213 security issues, including 7 critical flaws
    USMalwarebytes Labs

    On November 3, Google issued Chrome 157 to the stable channel for Windows, Mac and Linux. The update is rolling out over the coming days and weeks. Most users are on Chrome’s Stable channel. The desktop update brings Chrome to versions…

  30. CISA flags WordPress RCE flaw as actively exploited in attacks
    USBleepingComputer

    The US Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress vulnerability in the wild. [...]

  31. Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads
    INThe Hacker News

    A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick. The Rails project disclosed the flaw in an…

  32. Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory
    INThe Hacker News

    Two flaws in the Xen hypervisor allow a malicious guest virtual machine (VM) to read and write the memory of other VMs on the same host, including dom0. Dom0 is the VM that, by default, has full permissions and manages the others. Patches…

  33. Radio With No Radar: Why Agent Runtime Security Fails Without the Layers Beneath It
    INThe Hacker News

    Nearly every agent security pitch now ends on the same promise: the product stops the bad action in real time. The promise holds for one kind of agent, the kind whose traffic passes through a gateway the enterprise owns. Most agents never…

  34. China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor
    INThe Hacker News

    A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a surveillance campaign…

  35. Malicious cPGuard Updates Served in OpsShield Supply Chain Attack
    USSecurityWeek

    Using compromised credentials, the attackers accessed OpsShield’s update servers and poisoned multiple cPGuard versions. The post Malicious cPGuard Updates Served in OpsShield Supply Chain Attack appeared first on SecurityWeek .

  36. Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical
    USSecurityWeek

    The browser update resolves dozens of memory safety bugs and incorrect/missing authorization issues. The post Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical appeared first on SecurityWeek .

  37. Rigged Coding Assignment, Abused AI Tool Opened Path to $6 Billion Binance Heist
    USSecurityWeek

    Binance’s first incident report traces the record theft to a months-long campaign that compromised three engineers’ computers. The post Rigged Coding Assignment, Abused AI Tool Opened Path to $6 Billion Binance Heist appeared first on…

  38. Hackers use n-day exploits in zero-click attacks on iOS, Android devices
    USBleepingComputer

    A large-scale watering hole attack associated with Russian hackers has been targeting iOS and Android users visiting compromised sites or fake ones impersonating legitimate portals. [...]

  39. North Korea Launches Missiles Toward the Sea as Pyongyang Protests Against US Claims on Binance Hack
    USSecurityWeek

    In recent months, North Korea has accelerated its weapons tests in a likely bid to increase its leverage in potential diplomacy with the US. The post North Korea Launches Missiles Toward the Sea as Pyongyang Protests Against US Claims on…

  40. Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million
    USSecurityWeek

    A $300,000 award went to a pre-launch flaw that exposed conversations and tokens on internal Muse test VMs used by Meta staff. The post Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million appeared first on SecurityWeek .

  41. Russian Police Arrest 3 Suspected VasyGrek Hackers, Dismantle Criminal Infrastructure
    INThe Hacker News

    Russian authorities have arrested three suspected members of a threat group known as VasyGrek and dismantled its criminal infrastructure. Also known as Fluffy Wolf, the threat actor has a history of targeting Russian and international…

  42. Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction
    INThe Hacker News

    A critical Android flaw could allow an attacker to run code on a phone without any user action remotely, Google said in its November security bulletin. The flaw, CVE-2026-58868, affects Android 14 through 17. Phones get the fix with…

  43. New Falcon Cloud Security Innovations Secure the Cloud AI Runs On
    USCrowdstrike Blog
  44. CrowdStrike Brings Enterprise Browser Security to the Falcon Platform
    USCrowdstrike Blog
  45. CrowdStrike Introduces Agentic Adversary Emulation to Counter AI-Enabled Adversaries
    USCrowdstrike Blog
  46. CrowdStrike Extends the Agentic SOC to Detect and Stop Agent Insider Threats
    USCrowdstrike Blog
  47. CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades
    INThe Hacker News

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The high-severity vulnerability…

  48. ISC Stormcast For Wednesday, November 4th, 2026 https://isc.sans.edu/podcastdetail/10164, (Wed, Nov 4th)
    USSANS ISC