[{"title": "ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories", "link": "https://thehackernews.com/2026/11/threatsday-apache-ofbiz-rce-dreamhost.html", "summary": "How much damage can someone do without breaking much? Quite a lot, it seems. A stolen login can open doors across several systems. A trusted setting can be used to lock people out. Even a simple file copy can reach places it shouldn't. And while new tools are helping find security holes faster, some important systems are still taking months, sometimes over a year, to get patched. Not exactly a", "source": "hackernews", "published_date": "2026-11-05T20:11:10"}, {"title": "Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out", "link": "https://thehackernews.com/2026/11/is-your-exposure-management-platform.html", "summary": "A critical finding can move through several security tools and still leave the organization exposed.\u00a0\n\nThe vulnerability has a severity score, and a ticket has reached the queue. Progress then depends on information the finding may lack: who owns the system, whether attackers can reach it, what protection exists, and how a change could affect the business.\u00a0\n\nEach missing detail creates", "source": "hackernews", "published_date": "2026-11-05T17:55:00"}, {"title": "5 Active Cyber Threats That Put US Enterprises at Risk in October 2026", "link": "https://thehackernews.com/2026/11/5-active-cyber-threats-that-put-us.html", "summary": "October 2026 brought another wave of cyber threats targeting US businesses, with attackers exploiting trusted platforms, legitimate authentication processes, and everyday business workflows. For enterprises, these campaigns raise the stakes beyond individual security incidents, increasing the risk of financial losses, data breaches, and costly operational disruption.\n\nBelow, we examine five", "source": "hackernews", "published_date": "2026-11-05T15:36:19"}, {"title": "Vulnerability Scans for Older Cisco IOS Vulnerability / Opt-Out Headers, (Thu, Nov 5th)", "link": "https://isc.sans.edu/diary/rss/33492", "summary": "This morning, I was browsing our honeypot data for any new and existing PHP exploit attempts. Instead, I first ran into some GeoServer exploits, but found them to be too boring to write up. This Cisco IOS exploit attempt was a bit more interesting. Still nothing new. I suspect this is for CVE-2023-20198.", "source": "sans_isc", "published_date": "2026-11-05T15:29:08"}, {"title": "Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content", "link": "https://thehackernews.com/2026/11/apple-to-start-scanning-publicly-shared.html", "summary": "Apple has revealed that it plans to start checking public iCloud links for harmful content starting with iOS 27.3, iPadOS 27.3, macOS 27.3, and visionOS 27.3.\n\nThe change specifically applies to scenarios where users share iCloud content, such as photos in iCloud Photos or files in iCloud Drive, by sharing a link and making it accessible to \"Anyone with the link.\"\n\nWhen users choose this option,", "source": "hackernews", "published_date": "2026-11-05T14:43:28"}, {"title": "CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access", "link": "https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html", "summary": "The Indian Computer Emergency Response Team (CERT-In) has disclosed that an artificial intelligence (AI)-assisted threat actor it tracks as Crafty Falcon is targeting organizations in the Banking, Financial Services, and Insurance (BFSI) sectors in the country.\n\nDescribing the threat as active and ongoing, the activity involves the use of publicly-available AI-driven offensive security tools", "source": "hackernews", "published_date": "2026-11-05T14:12:03"}, {"title": "Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution", "link": "https://thehackernews.com/2026/11/zyxel-gs1900-patch-fails-to-block-zero.html", "summary": "Zyxel GS1900 network switches that received the vendor's earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found.\n\nThe exploit lets anyone who can reach a switch's web management interface run commands on it without logging in. Zyxel has released new firmware for 10 GS1900 models that closes the hole.\n\nThe earlier fix is the 2.90", "source": "hackernews", "published_date": "2026-11-05T12:36:33"}, {"title": "Post-Quantum Questions to Ask Your Vendors", "link": "https://www.cisa.gov/resources-tools/resources/post-quantum-questions-ask-your-vendors", "summary": "CISA, the Australian Signals Directorate\u2019s Australian Cyber Security Centre (ASD\u2019s ACSC) and the National Security Agency (NSA) released joint guidance and an accompanying quick-reference list to help organizations assess vendor readiness for transitioning to post-quantum cryptography (PQC). As quantum computing advances, widely used public-key cryptography will become vulnerable to compromise fro", "source": "cisa_advisories", "published_date": "2026-11-05T12:00:00"}, {"title": "ISC Stormcast For Thursday, November 5th, 2026 https://isc.sans.edu/podcastdetail/10166, (Thu, Nov 5th)", "link": "https://isc.sans.edu/diary/rss/33490", "summary": "", "source": "sans_isc", "published_date": "2026-11-05T11:25:11"}, {"title": "Hackers backdoor Linux servers using trojanized CWP web server", "link": "https://www.bleepingcomputer.com/news/security/hackers-backdoor-linux-servers-using-trojanized-cwp-web-server/", "summary": "A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. [...]", "source": "bleepingcomputer", "published_date": "2026-11-05T11:24:26"}]