Breaking cybersecurity alerts on active attacks, data breaches and actively exploited flaws, with what to do right now.
The FBI issued a flash alert about Artex, an open-source pentesting platform that plugs any LLM into AI agents that run attack stages automatically. Some intrusions reached privileged access in under three hours.
French vendor Vates warned that a critical flaw in Xen Orchestra, the management tool for XCP-ng virtualization, is under active exploitation. A crafted cookie bypasses authentication, granting admin rights and root control of hosts.
On Tuesday, November 10, CISA listed two flaws, one in Cisco BroadWorks and one in Openwave Messaging Webtop Media Transcoder, in its Known Exploited Vulnerabilities (KEV) catalog, even though fixes have been out for months.
On November 9, CISA added four actively exploited flaws to its KEV catalog. The standout is an OpenSSH bug on Linux systems using musl libc without PAM, such as Alpine Linux, where some setups accept any long password.
Attackers broke into cloud-hosted ConnectWise ScreenConnect environments and installed rogue remote-access clients on at least 288 endpoints across 48 organizations. Researchers then found SCKit, a toolkit built to spread from customer devices to MSP technicians.
Attackers began exploiting a new N-able N-central zero-day, 4EverAble2Shell, hours after a public exploit appeared, compromising at least 21 servers, 19 of them on the latest security update.
An attacker used 4,837 stolen GitHub accounts to plant code that steals CI secrets and cloud credentials; it ran in at least 1,806 repositories.
Attackers breached unpatched Check Point gateways via PHP2Shell, escalated privileges in Gaia OS (CVE-2026-123039) and planted the TSGA backdoor.
Cursor says an attacker used a leaked vendor access key to push two malicious Claude Code extension builds to its marketplace for about 11 hours on October 29.
CISA flags two exploited Barracuda flaws: an ESG auth bypass (CVE-2026-116606) and a root command injection (CVE-2026-111560) that attackers can chain.
