Topic
Security
34 stories about Security that passed the news check, newest first.
Security · High impact ·
AI platform leaks cost $1,700: Why hard $0 caps matter
On October 31, 2026, security firm Wiz disclosed that nine AI developer platforms leaked environment variables.
DEV Community: ai
Security · High impact ·
DigiCert Data Breach Impacts Business Customer Information
DigiCert says an unauthorized user accessed customer data through an internal system.
SecurityWeek · 3 sources
Security ·
A Fake Claude Code Extension Tried to Open a Backdoor to Your PC
A fake Claude Code extension attempted to open a backdoor on users' PCs.
Real Python
Security · High impact ·
D-Link warns of multiple zero-days in DGS-3130 Series switches
D-Link warned of multiple zero-day vulnerabilities in its DGS-3130 Series managed Gigabit stackable switches.
BleepingComputer
Security · High impact ·
Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It
Microsoft disclosed CVE-2026-83844, a remote code execution flaw in Windows Paint.
The Hacker News · 2 sources
Security ·
Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' Computers
Researchers at Forever Security showed in a test that a malicious browser extension could make Claude Desktop run code on a user's computer.
The Hacker News
Security · High impact ·
A Backdoor Sat in the Firmware Partition of 1.3 Million Set-Top Boxes
On 2 November 2026, Google Threat Intelligence Group disclosed that Google and its partners dismantled XCPE, a backdoor.
DEV Community: ai
Security · High impact ·
Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services
Chainalysis said some information belonging to all its users was exposed in a cyberattack.
The Hacker News · 3 sources
Business ·
Palo Alto Networks in talks to buy AI agent security startup Clutch for $500M
Palo Alto Networks is reportedly in talks to acquire AI agent security startup Clutch for $500M.
AI News & Artificial Intelligence | TechCrunch
Security ·
Threat actors use agentic AI tooling to find and abuse exposed secrets
Microsoft Threat Intelligence reports threat actors using agentic AI tooling to find and abuse exposed secrets.
Microsoft Security Blog
Security ·
Fwd: Go 1.27.4 and Go 1.26.11 pre-announcement
The Go team plans to issue Go 1.27.4 and Go 1.26.11, as announced in a security pre-announcement dated 2026-11-05.
Open Source Security
Security · High impact ·
Even gem list can run someone else's code
Ruby gems can run code during installation and on every gem command, including gem list.
Aikido Security's Blog
Launch ·
Nearly 1.5 million exposed secrets targeted in new revocation program
Truffle Security has launched the Secrets Revocation Program, a free initiative.
BleepingComputer
Security ·
CPython sandbox escape
Runsybil reported a sandbox escape vulnerability in CPython, according to an oss-security post by Alan Coopersmith dated 2026-11-05.
Open Source Security · 2 sources
Security · High impact ·
Harden cooling systems now, feds warn critical infrastructure operators amid attacks
US government agencies, including CISA and the FBI, issued a joint advisory warning that attackers are targeting refrigeration and cooling controllers.
The Record from Recorded Future News · 6 sources
Security ·
SourceHut disabled registration bypass | CVE-2026-121728
A registration bypass affecting SourceHut was disclosed and assigned CVE-2026-121728.
Lobsters
Security · High impact ·
AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research
OpenAI built an autonomous pipeline that found, validated, and generated patches for 948 local privilege-escalation vulnerabilities in the Linux kernel.
SecurityWeek · 3 sources
Security ·
Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction
Researchers disclosed a vulnerability in OpenAI's ChatGPT that could bypass Lockdown Mode protections.
The Hacker News
Security · High impact ·
Langflow's Critical Flaws Show Why Agent Tool Calls Need a Scrub Layer, Not Just a Patch
IBM disclosed critical vulnerabilities in Langflow, an open-source AI agent and workflow builder.
DEV Community: ai
Tutorial ·
Your .env Is Not a Secrets Manager, and Your AI Tools Can Read It Too
The post argues that .env files are not a secrets manager and recommends a setup small teams can maintain.
DEV Community: python
Policy ·
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub will begin blocking GitHub Actions workflows triggered by pull_request_target in public repositories on December 2, 2026.
Socket
Security · High impact ·
ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories
DreamHost warned of a data breach after attackers accessed its File Manager platform for two months.
The Hacker News · 2 sources
Security · High impact ·
Zlib 1.4 Released With More Than One Dozen Security Fixes
zlib 1.4 was released on 2026-11-05 with security fixes.
Phoronix · 2 sources
Security · High impact ·
How the Python ecosystem responded to the eMudhra intermediate compromise
The eMudhra intermediate Certificate Authority compromise was reported on October 20, 2026.
Python Software Foundation News · 2 sources
Launch ·
AWS Frontier Agents Earn Autonomy by Keeping an Approval Gate
AWS Security Agent and AWS DevOps Agent reached general availability on March 31, 2026.
DEV Community: ai
Security · High impact ·
CVE-2026-109518: apt Flaw Lets Attackers Swap Packages After Verification and Run Code as Root
CVE-2026-109518 is a flaw in apt that lets attackers swap packages after they have been verified.
Step Security Blog
Security · High impact ·
CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access
CERT-In says the AI-assisted threat actor Crafty Falcon is targeting banking, financial services and insurance organizations in India.
The Hacker News · 3 sources
Security ·
Want to Rent an Internet Address at the White House?
Layer3 Intel found 28 residential proxy services using 6 IP addresses on the White House network over one month.
Krebs on Security · 4 sources
Security · High impact ·
More Asian airlines announce data breaches after attack on Spanish IT provider Amadeus
Six Asian airlines, including Japan Airlines, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines and Malaysia Airlines, have reported data breaches in the past week.
The Record from Recorded Future News · 2 sources
Security · High impact ·
Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root
A flaw in APT, the package manager for Debian and Ubuntu, lets an attacker who can modify package downloads swap a verified package for their own.
The Hacker News · 2 sources
Security · High impact ·
SonicWall warns of unpatched flaws in end-of-life GMS software
SonicWall warned customers of two security flaws affecting end-of-life Global Management System (GMS) systems.
BleepingComputer
Security · High impact ·
CISA flags WordPress RCE flaw as actively exploited in attacks
CISA warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress remote code execution flaw in the wild.
BleepingComputer
Security · High impact ·
Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads
A critical flaw in Ruby on Rails lets an unauthenticated attacker write arbitrary files on an app's server by uploading a crafted file.
The Hacker News · 2 sources
Security ·
Wednesday, November 11, 2026 Security Releases
The Node.js project published a blog post titled "Wednesday, November 11, 2026 Security Releases" on 2026-11-04.
Node.js Blog