Mohit Kumar

🚨 WordPress Core flaw under active exploitation. CISA confirms attacks targeting CVE-2026-119977, a high-severity race condition that can allow unauthenticated code execution during core upgrades. Over 12,600 exploit attempts blocked in 24 hours. Details: thehackernews.com/2026/11/ci…

‼️ Google issues patches for a critical Android flaw that could allow remote code execution without any user interaction. 🠖 Affects Android 14–17 🠖 216 flaws fixed, 23 rated Critical Check your phone's security patch level. Read: thehackernews.com/2026/11/go…

‼️ mSecure is urging customers to consider changing passwords, resetting 2FA, and removing passkeys after reporting suspicious activity. But were password vaults accessed? The company hasn't disclosed that. Here's what we know so far: thehackernews.com/2026/11/ms…

‼️ Breaking - Hackers hijacked cPGuard's security update channel to push a backdoor onto Linux servers and collect password hashes, database secrets, and SSH files. The attacker retrieved files tied to 32 customer servers. Affected versions: 5.88.12–5.88.19. What admins need to know ↓ thehackernews.com/2026/11/cp…

🚨 LLMjacking attacks are driving cloud charges as high as $1 MILLION at some enterprises. Google says attackers are hijacking LLM access using stolen cloud credentials, then abusing AI resources and reselling access through underground marketplaces. Read → thehackernews.com/2026/11/go…

‼️ Binance reveals how hackers pulled off a $6.43 BILLION crypto theft. Fake job interviews, a trojanized Homebrew installer, and abuse of an internal AI tool were part of the attack that compromised engineers and reached Binance's wallet signing service. Full details ↓ thehackernews.com/2026/11/bi…

🛑 Barracuda discloses two security flaws that could be chained to gain ROOT access to affected devices. The authorization bypass and command injection flaws require access to the admin interface. One affects six Barracuda products. Details and fixes: thehackernews.com/2026/11/ba…

⚠️ Permanent admin rights give attackers privileges they can abuse long after they're needed. Syteca's PEDM replaces standing access with just-in-time elevation, automated approvals, and activity logs on Windows endpoints. How it works without overwhelming IT helpdesks → thehackernews.com/expert-ins…

🚨 Russia-aligned Gorbag hackers exploited a patched WinRAR flaw to deploy GIFTEDCROOK malware. The group targets Ukrainian government and defense organizations, using info-stealers to harvest browser data, credentials, VPN configs, and sensitive documents. Read how the attacks work ↓ thehackernews.com/2026/11/ru…

‼️ ALERT - Ubuntu releases "test patches" for a critical Linux TCP RCE (CVSS 9.8) vulnerability. Want the fix now? You'll have to enable Ubuntu's opt-in testing channel. No date for regular updates. Red Hat? Already patched RHEL 8, 9 and 10. And disabling MPTCP? Not enough. The bug is in IPv4 TCP. Details ↓ thehackernews.com/2026/11/re…

⚠️ Synology NAS devices are under ransomware attack. Attackers are exploiting a flaw patched in December 2024 to target devices running outdated DSM versions. Synology urges users to update immediately. Details → thehackernews.com/2026/11/sy…

🚨 Second wave of cyberattacks hits supermarket fridges across Europe. Hackers remotely changed cooling settings, in some cases setting freezers to 50°C. Stores have been forced to discard food and pull products from shelves. Here's what we know ↓ thehackernews.com/2026/11/se…

‼️ BREAKING - Google disrupts a 1.3 million-device Android botnet and bans TV box maker Videostrong. Google says the company deliberately built a backdoor into its devices and sold access to criminals. The control servers are down. The backdoor is still there. Full story: thehackernews.com/2026/11/go…

🚨 Government Linux servers targeted in an espionage campaign using SysGoRAT and suspected AI-generated scripts. Tracked as CL-UNK-1211, attackers planted web shells, harvested credentials, and attempted to steal government emails while covering their tracks. Inside the campaign ↓ thehackernews.com/2026/11/go…

‼️ A critical flaw in Canonical's LXD and MicroCloud (CVE-2026-112816, CVSS 10.0) lets attackers impersonate trusted clients without their private keys. Requires HTTPS API access and a trusted client's public certificate. → Cluster and VM access → Host root access if the impersonated client is privileged Details ↓ thehackernews.com/2026/11/cr…

‼️ FBI confirms North Korea's TraderTraitor hackers were behind the record $6.43 billion Binance crypto heist. $2.85 billion in stolen assets has been frozen as investigators track the laundering of funds through Ethereum. Full story: thehackernews.com/2026/11/fb…

🚨 New NetamLoader malware targets a government-only Windows 10 build in Asia. The attack abuses legitimate Patch My PC components, hijacks .NET execution, bypasses AMSI, and loads encrypted payloads. Kaspersky identified one victim. The attackers remain unknown. How the attack works - thehackernews.com/2026/11/ne…

🚨 $2.7 MILLION stolen from Polymarket traders in under an hour. The attackers didn't need to steal private keys. They hijacked a third-party DebugBear script and abused signed-in sessions to drain funds and trading positions. 726 wallets affected. $3.9M in refunds. Here's how it happened: thehackernews.com/2026/11/ha…

🚨 UPDATE: Cursor confirms two versions of Anthropic's Claude Code extension were affected by the SSH backdoor attack: v2.1.312 and v2.1.313 for Windows and macOS. thehackernews.com/2026/10/of…

🚨 Blockchain analysis firm Chainalysis confirms a data breach involving offensive agentic techniques. An attacker gained access to internal systems and tools, exposing customer names, email addresses, user IDs, and organization roles. Full story: thehackernews.com/2026/10/ch…