Massive Data Breach Hits Japanese Retailer Nitori, Exposing Millions of Customers
Nitori reports attackers accessed systems and likely stole 37.62 million customer records in a large-scale breach.
Yesterday
Default Password Vulnerability Allows Remote Car Access
Default admin password on ForgeRock/OpenIDM servers allowed researchers to unlock and start test vehicles via account takeover.
Exposed UK Government Code Reveals Critical Security Vulnerabilities
Public code trawl discovered widely exposed sensitive UK government secrets across multiple departmental repositories.
Vanderbilt University Responds to Cybersecurity Breach
Vanderbilt University took systems offline after BYOD ransomware gang claimed database encryption and theft of sensitive data.
Railway's Security Breach: AI Agents Exploit Build System Flaws
Attackers used AI agents and build system flaws to steal API keys from Railway, incurring approx $740,000 in fraudulent AI charges.
Sparrow Malware Unites China-Linked Cyber Espionage Campaigns
Researchers link three China-affiliated espionage clusters through a shared Sparrow malware ecosystem targeting telcos, governments, and research.
Qubole Supply Chain Breach: Over a Dozen Organizations Impacted
Attackers abused compromised Qubole IAM credentials to steal customer files, secrets, keys, environment variables, and credentials.
iOS Vulnerability Risks Exposure of Crypto Wallet Keys, Binance Alerts
Binance warns of an iOS sandbox escape that may allow apps to read other apps' files, risking wallet seed phrase exposure.
Turla's Cereal Toolset Targets Government Emails in Kazakhstan and Romania
ESET reports Turla's new 'Cereal' toolset targeting Microsoft Exchange to silently steal government email correspondence.
Exploits Target Barracuda ESG Vulnerabilities for Root Access
Attackers are exploiting two Barracuda ESG vulnerabilities to run commands with root privileges without authentication.
Urgent Chrome Update: Google Addresses Eighth Zero-Day Threat of the Year
Google issued an emergency update patching the eighth Chrome zero-day exploited this year, urging immediate upgrades.
SAP Addresses Critical Vulnerabilities with Urgent Patch Release
SAP patched four CVSS 10.0 flaws, including unauthenticated RCEs in NetWeaver and Web Dispatcher components.
Iranian Cyber Unit Accused of Sabotaging French Retail Refrigeration Systems
France attributes large-scale refrigeration controller sabotage to IRGC causing fires and losses; nation-state OT sabotage risk rises.
Fireworks AI Security Breach Expands, Affecting Customer Data and Notion AI Chats
Fireworks breach exposed datasets, model weights, and Notion AI chats for limited accounts; review vendor integrations and secrets handling.
N-able Temporarily Shuts Down N-central Cloud Amid Security Concerns
N-able took Hosted N-central offline after disclosure of 30+ zero-days; customers urged to shut self-hosted servers proactively.
Microsoft's November 2026 Patch Tuesday: Over 1,000 Vulnerabilities Addressed
Microsoft patched over 1,000 vulnerabilities including an actively exploited Outlook zero-day; prioritize Outlook and critical updates immediately.
Monday, November 9
Malicious Software on GitHub Poses Threat with Hidden Backdoors
PremiumMalicious GitHub projects masquerading as security tools distribute backdoors and infostealers targeting security professionals.
Exposed Artex AI Tools Pose Cybersecurity Threat
PremiumResearchers found hundreds of publicly exposed ARTEX AI pentesting instances, enabling easy access to offensive tooling.
Dark Project Ransomware Group Tempts Cybercriminals with Lucrative Commissions
PremiumDark Project ransomware recruits affiliates offering 80% commission, combining data theft, encryption, and public leak extortion tactics.
DigiCert Data Breach Exposes Business Customer Information
PremiumDigiCert discloses attackers created an unauthorized internal account and accessed business customer names, emails, phones and addresses.
Get these articles delivered to your inbox.
Subscribe free