Archive
An OpenSSH password authentication bypass lets attackers into Alpine Linux servers running sshd without PAM through accounts with no password set. Fixed packages shipped on 5 November; no CVE has been assigned.
Zyxel GS1900 switches patched in June are still open to unauthenticated command execution. The new flaw, CVE-2026-107441, is fixed in 2.90 Patch 3 firmware.
Prince Holding Group's Singapore director Karen Chen Xiuling was arrested at Changi Airport and faces two charges, as police put assets seized or frozen in the case above S$700 million.
Android CVE-2026-58868 is a critical remote code execution flaw in the Framework that needs no user interaction. Phones need security patch level 2026-11-01 or later.
GTA VI scam sites are selling fake leaked copies, $199 keys and Android APKs, and some downloads carry trojans and infostealers, ahead of the game's 19 November console launch.
Thai police have broken up a ring that supplied company bank accounts to call-centre scam gangs, with warrants for 56 people and losses of more than 250 million baht across at least 130 cases.
PhilJobNet, the Office of the Vice President and the Philippine Air Force are among the agencies hackers claim to have breached on 5 November. None has been confirmed; the OVP disputes its case.
CERT-In warns Indian banks, NBFCs, fintechs and crypto exchanges that the Crafty Falcon campaign is using AI attack tools and their own payment APIs to move money out.
Cyberattack on French blood banks: settings on cold rooms holding plasma at three EFS sites were pushed to very high temperatures. No products were lost, the blood service says.
Ransomware attack on Burnaby School District, B.C.: the Qilin group claims to have published stolen files, and the district says some of its data may be included.
Signs your phone is hacked: a draining battery and unknown apps point to spyware, but the operator-side tapping alleged in the Prabowo case leaves no trace on the handset.
A flaw in APT, the package manager behind Debian and Ubuntu, lets an attacker on the network path replace a verified package and run code as root. Debian has fixed it; Ubuntu hasn't yet.
