Binance has warned iPhone users about worse_query, an iOS flaw that could let malicious apps read files belonging to other apps. In its November 10 warning, the exchange named iOS 26.7.1, 27.0.1, and 27.2 as affected, saying seed phrases, private keys, and login details could be exposed.

The company said this is an operating system issue, not a flaw unique to Binance. The warning concerns the boundary that normally keeps each app’s private files separate. If an attacker crosses that boundary, sensitive data stored by wallets and other apps could become accessible.

iOS crypto wallet vulnerability

Researcher forcequitOS published worse_query as a developer proof of concept. Its documentation describes a sandbox escape for iOS 26.0 through 26.7.2 and iOS 27.2. A sandbox is the restricted space that limits what an app can access, including files held by other apps.

The project lists access to application data folders, shared App Group folders, and some system locations. It requires an App Group container, a shared storage area linked to an app. The researcher calls it a proof of concept that “isn’t useful by itself,” rather than a complete theft tool.

Cybersecurity News previously covered iOS sandbox escape fixes that addressed similar failures in app isolation. However, those earlier patches do not establish that worse_query is fixed.

For this flaw, the key concern is whether another app’s readable files contain secrets that should remain protected.

The worse_query research repository documents file access, not confirmed cryptocurrency theft. SlowMist security chief 23pds separately warned that untrusted IPA packages could use this access to expose wallet recovery phrases, keystores, or browser cache data stored without encryption. The flaw does not automatically drain wallets.

That distinction matters. Access to a wallet’s files does not necessarily reveal usable private keys. Risk depends on what the wallet saves and how it protects those records.

Related SparkKitty malware coverage shows another exposure route, where attackers searched phone images for recovery phrases rather than breaking app isolation.

Binance recommends deleting apps from untrusted sources, including sideloaded or manually signed IPA files, and updating iOS and installed apps. Anyone who suspects a breach should move funds to a new wallet created on a clean device and reset active login sessions.

Apple’s security release page lists iOS 27.2.1 and iOS 26.7.3 updates released November 9. However, that listing alone does not confirm a worse_query fix. Users should install official updates without treating an update as proof that previously exposed wallet secrets are safe.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Binance Warns iPhone Users of Major iOS Flaw That May Expose Crypto Wallet, Private Keys appeared first on Cyber Security News.

SAP’s November 2026 Security Patch Day brings fixes for critical vulnerabilities across SAP NetWeaver, Web Dispatcher, Gateway, and other business applications.

Released on November 10, the update includes 35 new security notes, four GitHub security advisories, and three updates to earlier notes.

Four vulnerabilities carry the maximum CVSS score of 10.0, making them the leading priorities for security teams. The release addresses memory corruption, missing authentication, broken access control, and code injection flaws.

SAP urges customers to review its security support portal and apply relevant corrections promptly. Administrators should check individual notes for affected components, patch requirements, and deployment instructions.

Among the most serious issues is CVE-2026-76964, a memory corruption vulnerability in SAP NetWeaver AS ABAP’s Internet Communication Manager.

According to the published CVE record, the software does not properly validate certain network input. An attacker without credentials could send crafted traffic, trigger memory corruption, and potentially execute arbitrary code, fully compromising the affected system.

SAP Security Patch Day

SAP Security Note 3778530 addresses this vulnerability. Affected releases include KRNL64UC 7.53 and KERNEL versions 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, and 9.20. Its CVSS vector indicates network access, low attack complexity, and no privilege or user interaction requirement.

Another maximum-severity flaw, CVE-2026-89126, affects SAP Web Dispatcher and is covered by Note 3778556. The memory corruption issue spans several kernel, Web Dispatcher, HDB, and runtime components. CVE-2026-89103 addresses broken access control in SAP Gateway and is covered by Note 3798345.

The fourth 10.0-rated issue, CVE-2026-120017, involves missing authentication in the SAML2 Service Provider within SAP NetWeaver AS ABAP and ABAP Platform.

Note 3849308 covers affected SAP_BASIS releases from selected older versions through 922. All four listed vectors indicate that exploitation requires neither credentials nor user interaction.

Three further critical notes carry scores of 9.9. These cover CVE-2026-109803 in NetWeaver Knowledge Management XML Forms, CVE-2026-76965 in the ABAP Application Server, and CVE-2026-109795 in S4CRM. Their listed vectors require low-level privileges, distinguishing them from the four unauthenticated maximum-severity issues.

SAP also patched cross-site request forgery in Web Dispatcher and Internet Communication Manager, rated 9.6, and an XML external entity vulnerability in BusinessObjects Web Intelligence, rated 9.1.

Developers should also review the GitHub advisories. These include improper JWT signature verification in SAP Cloud SDK for Python versions below 0.63.1, path traversal in its Agent Memory module, and a cross-tenant sandbox takeover issue in SAP/astonish.

The release follows October’s SAP security updates, which also addressed critical code injection and access control weaknesses. Earlier September SAP patches covered additional NetWeaver and cloud risks, reinforcing the need to track successive monthly fixes rather than treat each release separately.

Security teams should match installed component versions against the November notes, prioritize reachable systems affected by critical flaws, and test patches before deploying to production.

The supplied bulletin does not report active exploitation. Severity scores describe technical risk, not evidence that attackers have already compromised vulnerable installations.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post SAP Security Patch Day – Critical SAP NetWeaver, Dispatcher and Gateway Vulnerabilities Patched appeared first on Cyber Security News.

France has blamed Iran’s Islamic Revolutionary Guard Corps for a cyberattack that disrupted refrigeration at around 700 supermarket sites.

During the night of October 11–12, 2026, attackers changed cooling controls remotely, causing major food losses and around 20 fires, according to the Paris prosecutor’s office.

Foreign Minister Jean-Noël Barrot confirmed the attribution on November 9, calling it an attack of “unprecedented scale and unprecedented aggression.”

He said France had summoned Iran’s ambassador and would seek European sanctions against those responsible. The affected retailers included Système U, Intermarché, and E.Leclerc.

Hackers Hijacked Refrigeration Systems

Investigators said the attackers reached refrigeration control systems through web interfaces, targeting equipment from Danfoss, followed by Dixell and Copeland.

Once inside, they started abnormal defrost cycles with no time limit. They also disabled sensor safety alerts that should have warned staff when temperatures exceeded set limits.

Defrosting normally removes ice so cooling equipment can work properly. Keeping that function running helps units maintain safe temperatures.

Earlier Cybersecurity News coverage of the supermarket fridge attacks described how remote changes left retailers checking stock and removing chilled and frozen food that could no longer be sold safely.

The attack therefore combined two harmful actions: changing the physical cooling process and removing warnings about the resulting temperature rise.

That distinction matters because the damage was not limited to stolen information or unavailable software. The compromised controls directly affected food storage and created safety risks inside stores.

According to Franceinfo’s report on the investigation, the judicial inquiry targets the leader of Shahid Kaveh, his two deputies, and others yet to be identified. Prosecutors described Shahid Kaveh as an offensive cyber unit linked to the IRGC’s electronic and cyber center.

France’s Anti-Cybercrime Office and domestic intelligence agency, DGSI, investigated the incident. Prosecutors cited an attack pattern associated with the unit, the use of Farsi, and IP addresses linked to devices in Iran.

The inquiry covers organized computer attacks and dangerous damage, aggravated by allegedly serving a foreign power.

The exact entry method remains publicly unconfirmed. Franceinfo’s technical reporting noted a previously disclosed authentication weakness in Danfoss AK-SM 800A systems, but said it had not established its use in this attack.

Separately, Cybersecurity News documented thousands of exposed Danfoss hosts, but that count does not prove each system was compromised.

Operators should remove control interfaces from public internet access, install supported updates, replace default passwords, and restrict remote maintenance through protected connections.

Recovery also requires checking controller settings, defrost schedules, accounts, and alerts. Restoring connectivity without reviewing those settings could leave harmful changes in place.

French officials have also cautioned against linking every refrigeration incident to this group. ANSSI chief Vincent Strubel said similar attacks affecting French blood service sites had not been attributed to the same attacker.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post France Says Iranian Hackers Hijacked Refrigeration Systems at 700 Supermarkets via Remote Defrost Controls appeared first on Cyber Security News.

Anthropic has launched Claude Mythos 5.2, its latest AI model for cybersecurity engineering, reporting a 76.3% score on CyScenarioBench.

Released on November 9 alongside Claude Fable 5.2, the model is designed to help security teams find, reproduce, and fix software vulnerabilities. Access remains controlled because those same skills could also help attackers.

The result improves on Mythos 5.1’s 61.7%, a gain of 14.6 percentage points. However, Anthropic notes that each laboratory’s CyScenarioBench scores use different tasks.

That limits direct comparisons with competing models, making the improvement over Anthropic’s earlier release more useful than a simple vendor-by-vendor ranking.

Mythos 5.2 also scored 89.6% on Anthropic’s internal CVE Rediscovery evaluation, compared with 78.3% for Mythos 5.1 and 81.3% for Opus 5.5 without safeguards.

The October 2026 test covered 1,829 published vulnerabilities, giving models project code from before each security fix and asking them to independently locate the underlying flaw.

These results need an important distinction. Rediscovering known vulnerabilities is not the same as finding new zero-day flaws unknown to software developers.

The benchmark measures performance against documented issues, rather than proving a specific success rate for unknown bugs. Anthropic says Mythos 5.2 improves vulnerability discovery, reproduction, and repair, but the launch does not establish a 76.3% zero-day detection rate.

The release follows earlier work with Mythos models on vulnerability research and code scanning. Cybersecurity News previously covered Mythos 5’s integration into Claude Security, which gave enterprise customers access to model-powered findings and suggested fixes without unrestricted access to the model itself. That separation remains central to Anthropic’s rollout.

Anthropic reports in its launch announcement that one security company found other tested frontier models missed one in six confirmed bugs identified by Mythos 5.2. Another tester reported fewer exaggerated severity ratings. These are individual testing results, not proof that the model will avoid false alarms across every codebase.

Fable 5.2 and Mythos 5.2 share the same underlying model, but their safeguards differ. Fable includes stronger restrictions for cybersecurity and biology work, while Mythos supports approved research through verification programs.

Both generate output up to 30% faster than their predecessors, with standard pricing of $8 per million input tokens and $40 per million output tokens.

The Cyber Verification Program offers Defense, Red Team, and Specialized Access tiers. Individuals can apply for Defense Access, while higher tiers require organizational approval.

Authorized penetration testing and exploit development fall under Red Team Access. Work for customers requires separate approval, and Anthropic’s usage restrictions continue to apply at every tier.

Enterprise customers can also use Mythos 5.2 through Claude Security without joining the verification program. As covered in Claude Security’s continuous scanning update, the service checks repository changes, tracks fixes, and reopens findings when flaws return.

API and MCP connections help teams move findings into existing development and security workflows. Anthropic’s Claude Security documentation keeps human review central. Teams must review and approve proposed patches, especially for critical systems.

Faster discovery can shorten investigations, but finding a flaw is only the beginning. Security teams still need to validate its impact and test the fix.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Anthropic Launches Claude Mythos 5.2, Scoring 76.3% on Cybersecurity Benchmark to Identify 0-Day Flaws appeared first on Cyber Security News.

A poisoned version of the popular Nx Console extension for Visual Studio Code stayed on the official VS Code Marketplace for only about 18 minutes.

That was long enough for some developers to install it and hand over their secrets. The theft led to one of the most serious developer-tool breaches of 2026.

The extension has more than 2.2 million installs across versions, so even a short window put many machines at risk. The group behind the campaign, TeamPCP, says it took around 3,800 internal repositories from a single GitHub employee’s device.

GitHub called that figure “directionally consistent” with its own investigation. GitHub also said it found no evidence that customer-owned repositories were affected.

Analysts at BlackFog noted the activity in a new report on how TeamPCP turned developer tools into a route for data theft.

The researchers explain that the Nx Console incident was not a one-off. It was the latest step in a campaign that began months earlier with build systems and security tools.

Hackers Steal GitHub Tokens

TeamPCP first appeared at the end of 2025 and is driven by money. Its Telegram channel launched in November 2025 and had close to 700 members by February 2026.

In March 2026, the group got into Aqua Security’s build systems and hid credential-stealing code inside the Trivy vulnerability scanner.

It then used the stolen credentials to hit other tools, including Checkmarx KICS and LiteLLM. Readers can see how this played out when the LiteLLM package was compromised with a backdoor in two versions.

Two months later, on May 18, 2026, the group moved from build pipelines to individual developers. The poisoned Nx Console version reached the marketplace, and it runs directly on a developer’s own computer.

Anything the developer can reach, the malicious code can reach too. That includes source code, cloud keys, and GitHub tokens.

According to BlackFog, the group follows the same pattern each time. It gets into software that already runs, collects every secret within reach, sends the data out, and then uses it.

In the Trivy case, the stealer searched process memory on GitHub-hosted runners for values marked as secrets. On self-hosted runners, it checked more than 50 paths for SSH keys, cloud credentials, and Kubernetes files.

The legitimate scan could keep running, so victims saw nothing odd. Stolen data was locked with AES-256-CBC and an RSA-4096 public key, packed as tpcp.tar.gz, and sent over HTTPS to a lookalike of Aqua’s real domain.

If that upload failed and a strong enough personal access token was available, the payload could create a repository named tpcp-docs in the victim’s own GitHub account and attach the archive to a release.

That fallback is clever because the traffic then appears to come from the victim’s account. Cyber Security News has already covered how the compromised Nx Console extension was pushed using stolen publishing credentials. The Nx team had its own credentials taken during an earlier incident, which made the poisoned release possible.

Why a Short Window Still Causes Long-Term Damage

The 18-minute figure can sound small, but removing a bad package does not remove the access it already gave away. BlackFog says some stolen tokens were used weeks after the first theft.

Credentials taken in March were seen exploring other victim environments later. Stolen GitHub repositories were also listed for sale at a price of at least $50,000.

The group makes money in several ways. It has posted leaked material through ShellForce, offered credentials and source code for sale, and teamed up with ransomware operators such as Vect.

Hijacked servers were also used for cryptomining and proxies. The wider fallout shows up in the Mini Shai-Hulud npm campaign, which pushed npm to reset publishing tokens that bypass two-factor authentication.

Law enforcement has started to respond. In August 2026, Australian authorities charged two alleged principal members, aged 21 and 23.

The US Department of Justice separately announced an indictment against one of them. These allegations remain unproven. Even so, a recent FBI warning about TeamPCP shows how seriously officials take the threat to developer tools.

For defenders, BlackFog offers practical steps. Review third-party actions before using them and pin the full commit SHA in workflows. Give each CI/CD job only the secrets it needs, and use short-lived credentials through OIDC federation where possible.

Consider delaying extension and package updates on developer machines, and commit lock files. Teams can still apply security fixes quickly, but should know the Nx Console case shows how little time a bad update needs.

Teams should also limit public access to Docker APIs, Kubernetes control planes, Ray dashboards, and Redis servers. They should patch apps that use React Server Components against React2Shell (CVE-2025-55182).

If any indicator below turns up, rotate exposed credentials and check logs for signs that they were used. BlackFog also points to outbound traffic as a place to catch trouble.

Data exfiltration appeared in 96% of the attacks in its first-quarter 2026 ransomware analysis, though that figure covers BlackFog’s dataset and not TeamPCP alone.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Steal GitHub Tokens Through Malicious VS Code Extension That Remained Available for 18 Minutes appeared first on Cyber Security News.

A threat actor has built an automated system that registers fake accounts on the FOFA search engine, scans the internet for leaked AI keys, and tests them for free use.

The operation relies on 1,438 fake FOFA accounts to find exposed OpenAI and DeepSeek API keys on misconfigured servers. The stolen keys power the attacker’s own AI tools and scripts.

The tool works like a self-running agent. It creates accounts, searches for weak servers, pulls out keys, and checks how much credit each key still has.

Nobody has to operate it by hand. Exposed secrets are already a common problem, and the 28,000 exposed Git repositories found earlier this year included 123 OpenAI keys.

Analysts at VECERT noted the malicious toolset after recovering files from the attacker’s server. They tracked the case as VECERT-TI-2026-1107-B and linked it to a larger campaign they call Operation Ghost-Campus.

In their report on Medium, they say the actor may be based in China. The same server held scripts that target a Shanghai college, which VECERT covered in earlier findings.

Hackers Use 1,438 Fake FOFA Accounts

FOFA is a search engine that lists internet-facing devices and services. Free users get only a small number of searches, so the attacker needed a way around that limit.

VECERT found that the actor runs a private “catch-all” email system on the domain melocc.cc. Its subdomains, including mail, api, pop, imap and smtp, all point to the same server.

This setup lets a script sign up for FOFA, receive the confirmation email, click the activation link, and finish in seconds. Researchers recovered a file named fofa_accounts.csv and control panel screenshots.

These confirm at least 1,438 unique accounts, along with passwords and login tokens ready for API use. Each account is a basic “Registered User” with zero F-points and only 300 web queries. By rotating through all 1,438 tokens, the attacker spreads the searches across accounts.

That allows tens of thousands of free queries a day. The searches look for exposed .env files, Docker settings and poorly secured Git repositories, which often hold secrets.

Scanners that hunt for these files are not new, and the same tactic appeared in the recent fake AI crawler scans that GreyNoise tracked.

When a scan finds a weak server, the agent uses regular expressions to pull out API keys. For OpenAI, it tests keys that start with “sk-proj-” against api.openai.com. It sorts them into working keys, keys with no balance left (a 429 error), and revoked keys (a 401 error).

For DeepSeek, it matches keys with the pattern sk-[a-f0-9]{32} and also checks the money left in the account. One dashboard showed 8 valuable assets, 16 verified credentials and 3 usable DeepSeek keys, with balances of 50.68, 8.52 and 0.80. Those keys came from servers tied to labibiyat.com and nyisu.com.

What the Attacker Does With the Stolen AI Access

The stolen keys supply free computing power. According to VECERT, they run an interactive web terminal called “Pi — AI Coding Assistant,” built on GoTTY. The same AI access supports other scripts on the attacker’s server.

Victims whose keys are taken may see unexpected bills or drained credits, and logs will show their own key in use, not the attacker’s. A recent jailbroken DeepSeek AI agent case shows how much damage cheap, unlimited model access can enable.

The same server also held tools aimed at the Shanghai Publishing and Printing College. VECERT says the data of 5,132 students at the Fengxian campus was collected, including names, phone numbers, national ID numbers, home addresses and campus card balances.

The scraper reportedly refreshes this data every 48 hours. Bots also fake reading activity every 30 seconds to earn school points, adding 10 points for roughly every 11 minutes.

The campaign shows how AI helps attackers scale up simple tricks. Free accounts, public search engines and basic pattern matching were enough to gather keys from servers around the world.

Other credential theft campaigns follow a similar pattern, such as the GhostAction GitHub account compromise that went after OpenAI and cloud keys. Keep API keys out of .env files, public repositories and web-accessible folders.

Revoke and rotate any key that may have been exposed, then check usage logs for odd spikes or unknown locations. Set spending limits on AI accounts, and watch for traffic to the infrastructure listed below.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Use 1,438 Fake FOFA Accounts to Steal OpenAI and DeepSeek API Keys Across the Internet appeared first on Cyber Security News.

A fake Ruby package called strutil-core looked like a harmless text helper. In fact, it ran a credential-stealing worm the moment a developer installed it.

The worm also wrote backdoors into the settings of AI coding tools. It could even delete a victim’s home folder if they tried to cancel a stolen GitHub token.

The gem was live on RubyGems for only about five hours. Even so, it shows how quickly attackers are moving toward developer laptops, build servers and the AI assistants that now sit on them.

Version 1.0.0 went up on November 1, 2026 from an account named jamnajiea, and it was clean. Less than two hours later the same account pushed version 1.0.1, which carried a 5.48 MB payload.

A sandbox run recorded reads from 51 credential stores, including AWS, npm, PyPI, Docker, Kubernetes, Claude and Codex files. This detail gave the story its headline number.

Researchers at Socket.dev noted that their AI scanner flagged the file 70 seconds after it was published. They found no public projects that depended on the gem.

They also have not confirmed any victims, and they stress that download counters do not show how many people were infected. RubyGems removed both versions within hours.

Malicious Ruby Gem

The gem described itself as “lightweight string manipulation helpers.” In reality, its Ruby code did only one small job. The danger sat in a native extension script named extconf.rb.

RubyGems runs this file during installation, so nobody has to load the gem in an app for the attack to start. On Linux and macOS, the script downloads the Bun JavaScript runtime and quietly runs the bundled payload.

The theft goes well beyond a few password files. The worm looks for cloud keys, package registry tokens, SSH keys, Kubernetes and Vault secrets, password manager data and crypto wallets.

With AWS keys, it reads Secrets Manager and SSM values across 17 regions. The stolen data is encrypted and sent to paleasbest[.]top. If that fails, the worm creates a public GitHub repository, described as “project-utils,” or falls back to GitLab.

On GitHub Actions runners, the payload also reads secrets straight from process memory, using the same trick seen in the 2025 tj-actions compromise.

It even tries to tamper with the StepSecurity Harden-Runner security agent, though StepSecurity says those attempts fail.

Developers who followed an earlier malicious RubyGems campaign targeting developers will see the same goal here: grab keys from the machines that build and ship software.

The code is also built to spread. It contains routines to republish infected packages to RubyGems, npm and PyPI, and to move through SSH. Socket confirmed these routines exist but saw no successful spread from this gem.

The malware skips systems with Russian, Ukrainian, Belarusian and several other regional language settings. It also leaves a trail of odd file names, such as a systemd service called pkg-runtime.

Backdoors Planted in AI Coding Tools

The second half of the story is the AI angle. The worm searches the home folder for settings files used by AI coding tools, such as settings.json, mcp.json and .aider.conf.yml.

It adds a fake MCP server named workspace-tools that runs the malware with Node. It also adds SessionStart hooks, which run code whenever a coding session opens.

If the worm finds working Git credentials, it pushes the same trick into repositories. It writes files such as .claude/settings.json, .cursor/mcp.json, CLAUDE.md, AGENTS.md and a VS Code task that runs when a folder opens.

The generated AGENTS.md even tells coding agents to run a setup script before their first command. So a developer who simply opens an infected repo in an AI tool may start the worm again, depending on that tool’s trust settings.

This fits a wider pattern. Attackers have already used a fake Gemini npm package to reach folders used by Cursor, Claude and other AI tools.

More recently, a malicious Claude Code extension in the Cursor marketplace planted an SSH key on developer machines.cybersecuritynews+1

For persistence, the worm installs a Python backdoor, sync.py. Every hour it checks public GitHub commits for a secret marker, msync-3f7a.

It reads a hidden link from the commit message and runs the script found there, but only if the link carries the attacker’s digital signature.

The nastiest piece is a wiper. When the worm steals a GitHub token, it installs a monitor called net-health-checker. Every 45 seconds, the monitor tests the token.

If GitHub answers with a 401 or 403 error, it runs a command that deletes the user’s home folder. In other words, revoking the token, the usual first response step, triggers the damage.

Socket links this build to the testmetest worm, part of the Miasma family that grew out of the public Shai-Hulud toolkit. The sync.py file is identical to the testmetest version.

the Shai-Hulud source has been public since May 2026, shared code does not prove one operator is behind every copy. This fits the pattern in recent supply chain attacks on developers.socket

Anyone who installed strutil-core 1.0.1 should treat the machine and every reachable credential as compromised. Isolate the host first. Then stop and remove net-health-checker and pkg-runtime before revoking the GitHub token.

Rotate all keys from a clean device and rebuild the host. Developers should also check Gemfile.lock files, CI caches and container images, and remove unknown workspace-tools entries from their AI tool settings.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Malicious Ruby Gem Steals 51 Types of Credentials and Plants Backdoors in AI Coding Tools appeared first on Cyber Security News.

Progress Software has released its November 2026 WS_FTP Server Service Pack to address security weaknesses that could expose credentials, allow access to restricted files, and let remote attackers disrupt file transfers.

The company recommends upgrading Windows installations to WS_FTP Server 2025.0.5, also identified as version 10.0.5. The November 9 advisory supplied for this report describes five high-severity CVEs. Although the requested headline refers to seven vulnerabilities and path traversal, the supplied details do not establish either claim.

Administrators should use the individual CVE descriptions to understand the risks rather than assume every issue allows the same attack.

CVE-2026-115338, rated 8.1, affects the XFT service when connections use unencrypted HTTP. A network attacker could intercept sensitive information or change requests sent to the service.

Until patching is complete, Progress recommends disabling HTTP, requiring HTTPS, invalidating active sessions, and rotating credentials known to have crossed unencrypted connections.

Another flaw, CVE-2026-115340, carries a 7.1 score and concerns temporary files created during file transfers. These files may contain user credentials and session data. Anyone with access could obtain sensitive information. Progress credits researcher Momen Elmady, known as 0xmatrix, with discovering the issue.

Progress WS_FTP Server Fixes Vulnerabilities

Temporary measures include shortening XFT session timeouts where practical and limiting the Ad Hoc Transfer endpoint to trusted networks when public access is unnecessary. These controls reduce exposure but do not replace the update.

CVE-2026-115341, rated 7.7, affects Thin Client Web Transfer. Weak access restrictions could allow an authenticated FTP user to read files outside their intended scope.

Researcher Mateusz Mieczkowski, known as rexnets, received discovery credit. The advisory describes file disclosure, without explaining a confirmed path traversal mechanism.

CVE-2026-115339 has a 7.5 score and allows an unauthenticated remote attacker to exhaust XFT memory because resource limits are insufficient. Administrators can temporarily lower message-size and array-size limits to the minimum needed for normal transfers, with configuration guidance from Progress support.

The fifth issue, CVE-2026-35189, affects OpenSSL certificate processing and also scores 7.5. A certificate containing many relative certificate revocation list distribution points can trigger excessive memory use and denial of service.

Within WS_FTP Server, this risk applies to affected packages containing OpenSSL 3.5.8 when client-certificate requests are enabled. That setting is turned off by default. Progress says releases 2024.0.8 and 2025.0.5 update OpenSSL to 3.5.9. Customers should not replace the bundled library independently.

The broader file-transfer threat remains relevant. Cybersecurity News previously covered active exploitation of Wing FTP Server, a separate product, and millions of internet-facing FTP servers. Neither report establishes exploitation of these WS_FTP flaws.

Progress recommends version 2025.0.5 to resolve all vulnerabilities listed in the supplied notice. The company says workarounds only reduce exposure and that remediation requires the full installer. Organizations should schedule downtime because the upgrade causes a service outage.

Customers should obtain installers through the Progress Community portal and review the vendor’s upgrade guidance. The public release-notes page retrieved for this report still lists 2025.0.4 as its newest entry, so it does not independently confirm the November fixes.

The supplied notice does not report active exploitation. Its documented risks still make patch planning important, especially where web transfer endpoints are reachable from untrusted networks or credentials may have previously traveled over HTTP.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Progress WS_FTP Server Fixes 7 Security Flaws Allowing Credential Theft, Path Traversal, and Remote Attacks appeared first on Cyber Security News.

Vanderbilt University told students, faculty, and staff to shut down university devices and disconnect from campus Wi-Fi on November 9, 2026, while its IT team investigated an active cybersecurity incident.

The warning came as the BYOD ransomware group claimed it had locked university databases and stolen sensitive student, employee, and research data. Vanderbilt has not confirmed the group’s involvement or its data theft claims.

The Nashville university said the incident could affect devices, internal systems, and cloud services. In its official incident update, Vanderbilt urged users to watch for unexpected pop-ups, missing files, unfamiliar applications, and unusual requests for passwords or login approvals. Its IT team began investigating and working to contain the incident.

BYOD posted a message on its data leak site claiming possession of more than one million Social Security numbers, along with names, email addresses, phone numbers, and student and employee records.

The attackers also claimed access to university research data and control of its domain controller. These claims remain unverified, and Vanderbilt has not announced a confirmed number of affected people.

The note linked to BYOD’s leak site and provided contact details through the Session messaging platform. It claimed that backups were compromised and threatened to release data and cause further disruption unless the university negotiated.

Vanderbilt University Shuts Down Devices After Breach Claim

Local reporting also described files changing to the “.byod” extension and university research becoming inaccessible. Those accounts suggest file encryption, but they do not establish how widely systems were affected.

Vanderbilt has not publicly identified the attackers’ entry point, confirmed which systems were encrypted, or explained whether stolen accounts or a software flaw enabled access.

By 7:15 p.m. on November 9, Vanderbilt said campus Wi-Fi was available again. However, access to most university systems and applications remained restricted.

Its IT team was working with government agencies and other partners. The university planned to operate normally on November 10, with classes, student services, and staff attendance continuing as scheduled.

Faculty facing grant deadlines were directed to seek support from the university’s research office. Students were told to contact instructors about additional guidance and flexibility on coursework deadlines. The update showed that network access had partly returned, while important university applications remained unavailable.

BYOD previously appeared in reporting about an alleged Trump Mobile data breach. Separately, the Stanford University ransomware breach shows how campus incidents can expose sensitive records. Neither report establishes how Vanderbilt was breached.

Vanderbilt instructed anyone seeing suspicious activity not to click links, open attachments, or attempt repairs. Users should shut down the affected device and contact the IT service desk from another device or by phone.

The university’s public notice leaves key questions unanswered, including the full scope of any encryption, whether personal records were stolen, and when restricted systems will return to service.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Vanderbilt University Shuts Down Campus Devices After BYOD Ransomware Group Claims Network Breach appeared first on Cyber Security News.

Apple released iOS 27.2.1 and iPadOS 27.2.1 on November 9, 2026. The update fixes nine security flaws in Bluetooth, AirPlay, Messages, and other parts of the system.

It runs on iPhone 11 and later, and on several recent iPad models, including iPad Pro, iPad Air, iPad 9th generation, and iPad mini 6th generation. Apple’s security release page lists the update. Apple does not say any of these flaws were used in real attacks.

Most fixes address how devices pair with each other. Two bugs let someone get around the limit on pairing code guesses. Normally, a device blocks a person who keeps guessing wrong codes. If that limit fails, someone nearby could keep trying until a guess works.

The first, CVE-2026-113964, sits in CoreUtils. Apple says someone in Bluetooth range could skip the limit and pair with a device without the owner doing anything.

An anonymous researcher reported it. A second CoreUtils bug, CVE-2026-113965, could let a malicious Bluetooth device pair on its own, with no user action. Apple found that one itself.

Two more bugs affect AirPlay pairing codes. CVE-2026-113968 lets someone within Bluetooth range bypass the AirPlay limit. CVE-2026-113969 sits in rapportd and lets a person on the same network do the same. Both were fixed by improving how the system tracks its state.

Apple Fixes 9 Security Vulnerabilities

Bluetooth also had a memory bug. CVE-2026-113970 is a use-after-free flaw, which means the system keeps using memory after it has been released. Someone within Bluetooth range could use it to corrupt process memory. Apple fixed it with better memory handling.

The Messages app got two fixes, both reported by anonymous researchers. CVE-2026-113961 could let a remote person join an iMessage group chat and read its messages.

Apple fixed it by adding stronger checks on who can join. CVE-2026-113960 let a person added to a group read messages sent before they joined. Apple removed the code behind that flaw.

iMessage group chats can expose private conversations when access controls fail, although earlier flaws were more severe, including the NICKNAME zero-click exploit used against high-profile targets and fixed in iOS 18.3.

CVE-2026-113963 in App Intents could let an app access sensitive user data. László Várady reported it, and Apple fixed it by adding stronger authorization checks.

CVE-2026-111497 sits in brotli, a data compression tool. A specially crafted file could trigger an out-of-bounds write, meaning data lands outside its intended memory space. That can lead to memory corruption. Apple fixed it with better input checks and did not name a reporter.

Open Settings, tap General, then Software Update, and install iOS 27.2.1 or iPadOS 27.2.1. Apple notes that you can’t roll back an update once it is installed. Turning off Bluetooth and AirPlay when you do not need them also reduces your exposure.

Pairing flaws remind us that attackers don’t always need malware to get in. Sometimes they only need enough guesses. The AirPlay fixes also follow a rough year for the protocol.

Cyber Security News reported on the AirBorne AirPlay flaws, which put billions of devices at risk. Apple tracks each issue by its CVE ID, a shared number system explained on the CVE Program site. Anyone who finds an Apple bug can report it through Apple Product Security.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Apple Fixes 9 Security Vulnerabilities in iOS 27.2.1, Including Bluetooth Pairing and iMessage Flaws appeared first on Cyber Security News.

Hackers abused AWS credentials associated with Qubole to breach multiple customer cloud environments, harvest secrets, and steal sensitive S3 data between October 14 and October 26, 2026. Sentra reported that more than a dozen organizations were hacked, describing the broader impact as involving dozens of Qubole customers. Some compromised integration roles had remained dormant for […]

The post Hackers Abuse Qubole’s Trusted AWS Access to Breach Multiple Cloud Accounts and Steal Sensitive Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

SAP released 35 new security notes and four GitHub security advisories on November 10, 2026, alongside three updates to earlier notes. Four vulnerabilities carry the maximum CVSS score of 10.0 and affect NetWeaver Internet Communication Manager, Web Dispatcher, SAP Gateway, and the SAML2 Service Provider. The release covers memory corruption, missing authentication, access control failures, […]

The post SAP November 2026 Patch Day Fixes Four Maximum-Severity Security Vulnerabilities appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A critical missing-authentication flaw in Apache Airflow lets attackers run code on Celery workers without any Airflow credentials. Tracked as CVE-2026-68982, the bug is classified as CWE-306 and affects Airflow versions before 3.4.0 that use CeleryExecutor. Anyone who can write to the Celery broker can make a worker run any Python function it can import, […]

The post Critical Apache Airflow Flaw CVE-2026-68982 Enables Unauthenticated Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Russian-linked espionage group Turla has deployed a previously undocumented .NET malware toolkit that turns compromised Microsoft Exchange servers into surveillance platforms and command infrastructure. Named Cereal, the modular toolset intercepts selected emails while allowing legitimate messages to continue through the transport pipeline, concealing intelligence collection inside routine government communications. ESET disclosed the findings on November […]

The post Russian-Linked Turla Hackers Abuse Microsoft Exchange Infrastructure to Target Sensitive Communications appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

SEGA confirmed on November 9, 2026, that attackers stole 2,196,044 customer email addresses after breaching Arara, its newsletter provider. Of these, 92,273 included information linked to newsletter delivery. The incident affected messages promoting SEGA and SEGA Fave products, highlighting the risks of third-party breaches. The intrusion involved Arara Message, an outsourced email distribution platform. SEGA […]

The post SEGA Confirms Data Breach Exposing 2.19 Million Customer Email Addresses Following Third-Party Cyberattack appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

North Korea-aligned hackers have renewed attacks on drone technology companies while expanding operations against software supply chains. Together, these campaigns expose industrial knowledge and software distribution channels to compromise. ESET’s APT Activity Report, published October 28, covers operations observed between April and September 2026. Researchers identified renewed Lazarus targeting of the drone sector and a […]

The post North Korean Hackers Target Drone Technology and Software Supply Chains in New Cyberespionage Campaigns appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Fireworks AI has disclosed a wider security breach involving customer account information, billing records, secrets, datasets, and incomplete model weights. Its November 9 update links the activity to financially motivated criminals pursuing LLM-jacking, which involves stealing access to large language models and reselling their capacity through illegal routing gateways. The investigation remains ongoing. The company […]

The post Fireworks AI Hit by LLMJacking Cyberattack Exposing Customer Data and AI Model Weights appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Dark Storm Team uses Telegram as both a hacktivist broadcasting network and a cybercrime storefront, advertising distributed denial-of-service attacks, database dumps, compromised accounts, and surveillance access. A StealthMole investigation described in the supplied material traces an operation combining politically framed disruption claims with commercial services, cryptocurrency payments, and repeated channel migrations. First observed in late […]

The post Dark Storm Team Offers DDoS Attacks, Database Dumps, and Stolen Access Through Telegram Channels appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.