OpenAI’s AI pipeline reproduced 1,724 Linux vulnerabilities and generated 948 working local privilege escalation exploits for $1.2 million.
Get the latest international news and world events from around the world.
Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root
APT flaw CVE-2026–109518 lets attackers with HTTP traffic control replace verified packages and execute code as root when downloads retry.
SonicWall Won’t Patch EoL GMS Flaws That Could Expose Files, Alter Database Records
SonicWall warns two flaws in end-of-life GMS 9.5.2 and earlier will remain unpatched, allowing file reads or SQL injection under specific conditions.
APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
APT29-linked attackers use compromised sites and Plerdy analytics to deliver iOS and Android exploits that steal browser and device data.
Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads
Rails fixes a critical Active Storage flaw that enables arbitrary file writes through ImageMagick uploads and file reads in Disk service apps.
MSecure password manager hack prompts password reset warnings
MSeven Software is warning current and former mSecure password manager customers to change passwords, reset two-factor authentication, and remove passkeys following a cyberattack that reportedly exposed an encrypted customer database.
NIKKE PC game launcher hacked to spread remote access, data-stealing malware
The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game’s PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data.
According to a notice published on X, a client update was issued on November 4 at 02:30 (UTC +9) to address the issue.
“We have identified an issue indicating that the PC Launcher’s script files may have been tampered with by a third party,” reads the statement on X.
Google Calendar phishing campaign hijacks sessions, bypasses MFA
Material Security’s Threat Research team identified the campaign and has taken down hundreds of domains used by attackers in what they have dubbed Operation CloudFire. Here’s what they learned along the way.
The lure: Google Calendar invites
The messages arrive as Google Calendar invites, sometimes delivered by BCC and often sent from an organization the recipient has already corresponded with. The pretexts are mundane: voicemail notifications, RFP and RFI requests, court summonses, and missed payment notices.
Uber Battles Driver Shortage as Gross Bookings Jump 20%
Uber’s most recent quarter showed the ride-hailing/delivery giant enjoying strong consumer engagement, while facing an operational bottleneck. The company
Northwestern astrophysicists develop method for detecting distant planets in space telescope images
A team of astrophysicists from Northwestern University has developed a new method to cut through the bright glare of starlight that blocks some distant planets from the view of NASA’s James Webb Space Telescope.
The method combines physics-based modeling and techniques used in machine learning. It corrects for minuscule imperfections in the telescope that make it difficult to find faint objects in space, Northwestern said.
The team of Northwestern researchers applied their method to existing images from the James Webb Space Telescope and improved its sensitivity by as much as 15 times, Northwestern said. The result was the sight of a giant exoplanet that could not be seen without the method being used.