AX·NEWS
Sign in

Cybersecurity

Cybersecurity news — Friday 06 November 2026

67 stories from 10 sources, every one in English. Each links to its publisher.

Open in the live feedRSS feedOn a TV

  1. Runaway AI hacking agent behind WorkOS breach after escaping sandbox
    USBleepingComputer

    WorkOS says an AI-powered hacking agent that breached its internal sales application and accessed customer information was operated by a security researcher who claims the tool escaped its testing environment and unintentionally attacked…

  2. Friday Squid Blogging: New Jurassic Squid Predecessors
    USSchneier on Security

    News story: “ Scientists discover a bizarre Jurassic ‘squid’ unlike anything ever seen .” Scientists have identified the “fattest” belemnite ever discovered, a bizarre, barrel-shaped squid relative that lived in Wyoming’s ancient seas 160…

  3. OpenAI's new GPT-6 Cyber AI finds 81 Firefox flaws, 948 Linux bugs
    USBleepingComputer

    OpenAI has revealed GPT-6 Cyber, a new artificial intelligence model that has discovered 81 previously unknown high-severity Firefox vulnerabilities and developed working exploits for 948 distinct Linux kernel flaws. [...]

  4. Fake security tools on GitHub push backdoors and infostealers
    USBleepingComputer

    Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware. [...]

  5. Japan Announces Emergency Cybersecurity Package Following a Wave of Attacks
    USSecurityWeek

    The emergency package comes after dozens of companies and government agencies were hit by unauthorized access to their systems and leaks of client data, prompting uneasiness across Japan. The post Japan Announces Emergency Cybersecurity…

  6. Android is getting my favorite iOS tracking feature – what to expect
    USZDNet Security

    ‘Notify when left behind’ is making its way to Android – but to limited devices for now.

  7. Authorities accuse trio of using AI deepfakes to defraud $129M from businesses
    USCyberScoop

    Three men concocted an elaborate, yearslong scheme that defrauded companies of at least $129 million by using AI to impersonate executives and lawyers, tricking targeted victims into transferring large payments to criminal-controlled…

  8. Thinking Machines’ new model takes the lead in western open-weight AI
    USZDNet Security

    Another competitive model developed outside of China could change the open-weight landscape.

  9. QNAP says hackers breaching NAS devices in Plex2Shell attacks
    USBleepingComputer

    QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain. [...]

  10. Apple will monitor your public iCloud links now, starting with iOS 27.3
    USZDNet Security

    Under Apple’s new policy, the company will scan publicly shared iCloud links for harmful content – and possibly ban violators.

  11. Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time
    INThe Hacker News

    Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it. The update that installs the fix still unpacks its files using the…

  12. Veeam warns of Software Appliance boot failures on AMD EPYC hosts
    USBleepingComputer

    ​Veeam warned customers about boot failures affecting Software Appliance virtual machines (VMs) on hosts with AMD EPYC processors. [...]

  13. Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
    INThe Hacker News

    Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian. The vulnerability, tracked as CVE-2026-123158 (CVSS score…

  14. Big Tech sues over California plan to limit kids’ scrolling
    USMalwarebytes Labs

    .kadence-column485324_750a90-49 > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column485324_750a90-49 > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm…

  15. IMSI vs IMEI: What Your Phone Broadcasts and Who Can Read It
    USBleepingComputer

    IMSI and IMEI are IDs your phone shares with networks. Learn how they differ, how attackers get them, and why rotating your IMSI blunts tracking. [...]

  16. OpenAI Launches GPT-6 Cyber After AI Helps Find 81 Firefox Flaws, 948 Linux Exploits
    INThe Hacker News

    OpenAI on Thursday unveiled GPT‑6 Cyber, which it described as a major step forward in security research that brings together stronger cybersecurity capabilities with a step-change improvement in model alignment. The new model is "more…

  17. Pinpointing Location of Videos from Background Airplane Sounds
    USSchneier on Security

    This is fascinating : The video describes a technique that can reveal where an otherwise unidentifiable recording was made by analyzing its audio for the faint sounds of passing aircraft. The technique is both fascinating and frightening…

  18. In Other News: Trezor Implant, LLMJacking Bills Hit $1M, SAP Flaws Weaponized Within Days
    USSecurityWeek

    Noteworthy stories that might have slipped under the radar: Synology warns about NAS ransomware attacks, Flowise ‘hello’ attacks, Chainalysis breach impact expands. The post In Other News: Trezor Implant, LLMJacking Bills Hit $1M, SAP…

  19. Chainalysis says breach exposed credentials for all customers
    USBleepingComputer

    Blockchain intelligence firm Chainalysis says a recent attack on its systems and internal tools has exposed credentials and live tokens for all customers. [...]

  20. DigiCert Data Breach Impacts Business Customer Information
    USSecurityWeek

    Hackers created an account on an internal system and accessed names, email addresses, phone numbers, and business addresses. The post DigiCert Data Breach Impacts Business Customer Information appeared first on SecurityWeek .

  21. OpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the Line
    USSecurityWeek

    Rated Critical for cybersecurity, OpenAI’s new model beats GPT-5.6 Cyber at exploitation while staying in scope more reliably. The post OpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the Line appeared first on SecurityWeek .

  22. US Agencies Urge Organizations to Harden Refrigeration Controllers
    USSecurityWeek

    The recommendations come amid attacks targeting fridges and freezers in supermarkets and blood banks in Europe. The post US Agencies Urge Organizations to Harden Refrigeration Controllers appeared first on SecurityWeek .

  23. Grocery Giant Ahold Delhaize Estimates Financial Toll of October Cyberattack
    USSecurityWeek

    The October incident will cut fourth-quarter sales by up to €250 million and has led Ahold Delhaize to lower its 2026 outlook. The post Grocery Giant Ahold Delhaize Estimates Financial Toll of October Cyberattack appeared first on…

  24. D-Link warns of multiple zero-days in DGS-3130 Series switches
    USBleepingComputer

    D-Link shared mitigation measures for multiple unpatched security flaws affecting DGS-3130 series managed Gigabit stackable switches. [...]

  25. Researchers Find Residential Proxies on White House Network
    USSecurityWeek

    In a month, 28 residential proxy services used 6 addresses, mainly between 5 p.m. and midnight, Eastern Time. The post Researchers Find Residential Proxies on White House Network appeared first on SecurityWeek .

  26. OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass
    USSecurityWeek

    On Linux distributions using musl libc without PAM, some accounts accept any password between 257 and 1024 characters. The post OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass appeared first on SecurityWeek .

  27. Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It
    INThe Hacker News

    A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates. The fixed build, 11.2609.401.0, was the newest Paint…

  28. Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' Computers
    INThe Hacker News

    A browser extension that can run scripts on claude.ai could make Claude Desktop run code on a person's computer, researchers at Forever Security, an endpoint security company, showed in a test. The attack needs Dispatch, a Claude feature…

  29. Attacks on supermarket and blood storage systems prompt US warning
    USMalwarebytes Labs

    Attackers don’t have to steal information to cause serious harm. Sometimes, changing a temperature setting is enough. On November 5, the US Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and…

  30. The Flood is Coming And The Pipes Were Already Full
    INThe Hacker News

    An update on Athena, and some unsolicited predictions on what's coming next On Saturday, Dario Amodei published We Must Pace the Frontier. I agree with him. Go read it if you haven't. I've spent the summer looking at what these models…

  31. OpenAI Model Wrote Its Own Network Code to Get Around Sandbox Restrictions
    USSecurityWeek

    After its sandbox proxy failed, an internal OpenAI model crafted raw packets and probed AWS services trying to reach the internet. The post OpenAI Model Wrote Its Own Network Code to Get Around Sandbox Restrictions appeared first on…

  32. MetaMask says recent attack didn't affect wallet infrastructure
    USBleepingComputer

    Cryptocurrency wallet provider MetaMask said a recent security incident has not affected MetaMask wallets or its wallet infrastructure. [...]

  33. Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services
    INThe Hacker News

    Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names, usernames, password hashes and live tokens for all users. "While we investigated, we…

  34. Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs
    INThe Hacker News

    A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week. The backdoored web server executes commands that attackers…

  35. Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
    INThe Hacker News

    Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required. The company released patches on Monday, and the security firm…

  36. AMORT-V1: Checkpointed Post-Quantum Attestation for Industrial Controllers
    USarXiv cs.CR (Security)

    arXiv:2611.07476v1 Announce Type: new Abstract: Programmable logic controllers often remain deployed for decades, making post-quantum attestation a long-term requirement. Prior measurements of OpenPLC attestation show that post-quantum…

  37. Stealthy Malicious Interference Detection in UAV Formations: A Power-Domain Signaling Game Approach
    USarXiv cs.CR (Security)

    arXiv:2611.07977v1 Announce Type: new Abstract: Reliable intra-swarm communication is fundamental to cooperative sensing, control, and mission execution in unmanned aerial vehicle (UAV) swarms. In open low-altitude shared-spectrum…

  38. The Promise of Strategic Agentic Scambaiting
    USarXiv cs.CR (Security)

    arXiv:2611.08170v1 Announce Type: new Abstract: Scammers have increasingly adopted AI-driven capabilities, evolving from automated message generation to fully agentic conversational systems that scale operations and maximize the…

  39. Decision Models as Retrieval Gates Against Injection and Pollution
    USarXiv cs.CR (Security)

    arXiv:2611.08325v1 Announce Type: new Abstract: Retrieved web text can carry instructions aimed at the language model, or synthetic pages written to mislead. We test whether released open-weight decision models, which answer typed…

  40. LABBA: LLM-Assisted Behavioral Biometric Authentication
    USarXiv cs.CR (Security)

    arXiv:2611.08343v1 Announce Type: new Abstract: Behavioral biometrics have emerged as a promising complement to traditional physiological biometrics by leveraging dynamic human characteristics. These modalities offer advantages including…

  41. Structured Quantum Hardness from Unstructured Assumptions
    USarXiv cs.CR (Security)

    arXiv:2611.07413v1 Announce Type: cross Abstract: Whether useful structured hardness can arise from unstructured assumptions is a fundamental question in complexity and cryptography. The longstanding Bennett-Gill question asks whether…

  42. ContractLens: Latent Security Knowledge for Malicious Smart Contract Detection
    USarXiv cs.CR (Security)

    arXiv:2610.04992v2 Announce Type: replace Abstract: Detecting malicious smart contracts is essential to safeguarding the Web3.0 ecosystem. However, existing auditing methods based on large language models (LLMs) largely rely on prompt…

  43. MemForm: Benchmarking Memory Formation Poisoning in LLM Agents
    USarXiv cs.CR (Security)

    arXiv:2610.14431v2 Announce Type: replace Abstract: Long-term memory enables LLM agents to learn from past interactions but exposes memory formation to adversarial influence. Existing studies primarily organize memory poisoning by attack…

  44. Global Surveillance Under the Lens: Reconstructing Passive Dolev-Yao Intruders
    USarXiv cs.CR (Security)

    arXiv:2611.07170v1 Announce Type: new Abstract: Global surveillance systems record large volumes of network traffic for retrospective analysis, but packet captures alone reveal little about protocol-level semantics. This paper presents an…

  45. Breaking $\mathsf{TraintoDefend}$ via Adaptive Neuron Clustering in Cryptanalytic Model Extraction
    USarXiv cs.CR (Security)

    arXiv:2611.07370v1 Announce Type: new Abstract: Cryptanalytic model extraction poses a fundamental threat to deep learning model confidentiality by enabling precise parameter recovery with theoretical guarantees of functional equivalence…

  46. MEvince: Knowledge-Constrained LLM Reasoning for Technique Identification from Malware Reports
    USarXiv cs.CR (Security)

    arXiv:2611.07486v1 Announce Type: new Abstract: Mapping behavioral intelligence in malware analysis reports to ATT&CK techniques supports threat analysis and defense, but reliable identification remains challenging. Supporting evidence is…

  47. JailBound: FOL-Guided Jailbreak Evaluation for Exploring LLM Behavioral Boundaries
    USarXiv cs.CR (Security)

    arXiv:2611.07530v1 Announce Type: new Abstract: As large language models (LLMs) are increasingly deployed as general-purpose conversational assistants, they must handle diverse user requests while reliably refusing harmful ones. Jailbreak…

  48. Beyond Proof of Possession: A Relational Theory of Authority
    USarXiv cs.CR (Security)

    arXiv:2611.07159v1 Announce Type: new Abstract: Proof-of-Possession (PoP) establishes that an executor controls an artifact (key, token, credential, or capability), but such control alone determines neither the executor's relational…

  49. Full Provenance on the COSS Causal Axis: An Event-Level Closure of Causal Attribution and Confused-Deputy Exclusion
    USarXiv cs.CR (Security)

    arXiv:2611.07164v1 Announce Type: new Abstract: Provenance Identity Continuity (PIC) represents an authority-use event as an operation/resource behavior situated in a causal lineage, $(o,r,\ell)\in O\times R\times L$. We make the causal…

  50. Watermarking Without Standards Is Not AI Governance
    USarXiv cs.CR (Security)

    arXiv:2505.23814v3 Announce Type: replace Abstract: Watermarking has emerged as a leading technical proposal for attributing generative AI content and is increasingly cited in global governance frameworks. This position paper argues that…

  51. HackerSignal: A Multi-Source, CVE-Linked Corpus and Prospective Benchmark for Cyber Threat Intelligence
    USarXiv cs.CR (Security)

    arXiv:2605.03158v2 Announce Type: replace Abstract: Cyber threat intelligence (CTI) systems must link exploit code, advisories, and fix commits to the vulnerabilities they concern, and they must do so for vulnerabilities disclosed after…

  52. Generic Number-of-Copies Amplification for Pseudorandom States
    USarXiv cs.CR (Security)

    arXiv:2606.29325v2 Announce Type: replace-cross Abstract: We show that any quantum pseudorandom state that is secure against single-copy distinguishers, i.e. a $1$-PRS, can be amplified to $t$-copy security, i.e. to a $t$-PRS, without…

  53. Information Loss Is All You Need: $TC^0$ Pseudorandomness from Worst-Case Lattices
    USarXiv cs.CR (Security)

    arXiv:2611.05136v2 Announce Type: replace-cross Abstract: Can deterministic information loss yield post-quantum pseudorandomness with $TC^0$ evaluation? We show that deterministic rounding achieves this under quantum worst-case lattice…

  54. A Gingerbread House for LLM Agents: Source-Planned Honeypots That Lure Autonomous Attackers into an Isolated Shadow
    USarXiv cs.CR (Security)

    arXiv:2611.07611v1 Announce Type: new Abstract: LLM agents can exploit web vulnerabilities fast enough that patching may come too late. Deception against such agents has mostly lured them away from a real target that stays reachable. We…

  55. CANMentor: A Large-Small Model Collaboration Framework for CAN Bus Intrusion Detection
    USarXiv cs.CR (Security)

    arXiv:2611.07853v1 Announce Type: new Abstract: The Controller Area Network (CAN) bus lacks built-in security mechanisms, making real-time intrusion detection necessary. However, resource and latency constraints limit vehicle-side…

  56. Cloudy Skies: Early Detection of Jamming Against Iridium LEO Satellite-IoT Links
    USarXiv cs.CR (Security)

    arXiv:2611.08118v1 Announce Type: new Abstract: Low Earth Orbit (LEO) satellite-IoT systems increasingly provide connectivity to mobile assets in remote areas, which makes their resilience to radio-frequency jamming a growing concern…

  57. Escalate or Close: How Fast-Tier Models Handle Held-Out Web Attack Families in Two-Tier Triage
    USarXiv cs.CR (Security)

    arXiv:2611.08229v1 Announce Type: new Abstract: In two-tier triage a fast model decides most web requests and escalates the rest to a slow tier, so an attack the fast tier closes is never examined. We hold each of seven attack families out…

  58. Quadratic Extractors
    USarXiv cs.CR (Security)

    arXiv:2611.07266v1 Announce Type: cross Abstract: A quadratic source is a random variable $X\sim\mathbb{F}_2^n$ generated by applying $n$ quadratics to a hidden uniform string. Previously, the best-known explicit extractor for this model…

  59. Exact $\ell_p$-CVP via Euclidean SVP in Polynomial Space
    USarXiv cs.CR (Security)

    arXiv:2611.07313v1 Announce Type: cross Abstract: We give a randomized, rank-preserving reduction from exact $\ell_p$-CVP to exact Euclidean SVP for every integer $p\ge2$. For rational inputs of bit length $\ell$ on full-rank lattices…

  60. Dynamic Watermarking and Action-Conditioned Latent Dynamics for Secure Vision-Based Controllers
    USarXiv cs.CR (Security)

    arXiv:2611.07403v1 Announce Type: cross Abstract: Replay attacks are difficult to detect in vision-based control systems because previously recorded observations can remain plausible while the physical system follows a different…

  61. Digital Security Under Compound Threats: Surveillance, Threat Reasoning, and Habituation Among North Korean Defectors in China
    USarXiv cs.CR (Security)

    arXiv:2611.07576v1 Announce Type: cross Abstract: North Korean defectors residing in China face persistent uncertainty regarding digital security and privacy. Through semi-structured interviews with 19 defectors, we examine how individuals…

  62. SoK: Post-Quantum Cryptography (PQC) Integration in Software Development: Approaches, Gaps, and Future Directions
    USarXiv cs.CR (Security)

    arXiv:2611.08442v1 Announce Type: cross Abstract: Standardised post-quantum cryptography (PQC) is critical for protecting software systems against future quantum threats, but standardised algorithms alone do not provide a pathway for their…

  63. faulTPM: Exposing AMD fTPMs' Deepest Secrets
    USarXiv cs.CR (Security)

    arXiv:2304.14717v3 Announce Type: replace Abstract: Trusted Platform Modules constitute an integral building block of modern security features. Moreover, as Windows 11 made a TPM 2.0 mandatory, they are subject to an ever-increasing…

  64. 3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 Million
    USSecurityWeek

    The trio, who have nicknames that include “Rocky Balboa,” “Superman Cash” and “Fat Boy,” often targeted the companies’ accounting departments. The post 3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 Million…

  65. ISC Stormcast For Friday, November 6th, 2026 https://isc.sans.edu/podcastdetail/10168, (Fri, Nov 6th)
    USSANS ISC
  66. FBI, CISA warn of cyberattacks targeting refrigeration systems
    USBleepingComputer

    The FBI and CISA warn that hackers are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide, potentially causing food spoilage, equipment damage, and fire hazards. [...]

  67. October 2026 CVE Landscape
    USRecorded Future

    In October 2026, Insikt Group® identified 82 high-impact vulnerabilities to prioritize for remediation , 52 of which had a Very Critical Recorded Future Risk Score. This represents a 13% decrease from the 94 vulnerabilities reported in…