Attackers exploit UnrealIRCd flaw enabling server-level command injection
CVE-2026-114713 in UnrealIRCd 6.0.0 before 6.2.7.1 lets linked-network users inject server commands; US agencies must patch by November 16.
1
Saturday, November 14, 2026
Security & AI, live
Updated 12:53 UTC · 13m agoNext check 13:13 UTC4 new in the last hour
Top right now
24hTop stories
Stories
Unpatched Check Point gateways wiped after PHP2Shell exploitation
Two late-October waves used three CVEs for root, webshells and, in Israel, a Linux wiper.
Microsoft 365 outage disrupts Outlook, Teams and government email
Microsoft reported early stabilization Friday but said capacity was still below baseline and it saw no sign of a cyberattack.
1
Research claims banned Nvidia chips trained China’s leading open models
A former OpenAI researcher says Kimi K3 and DeepSeek V4 weights show Blackwell fingerprints; Jensen Huang left Nvidia this week.
1
Cursor traces October breach to Fireworks AI key and backdoored extensions
A read-only vendor key exposed agent traces and credentials; malicious Claude Code builds sat in Cursor’s cache for about 11 hours.
1
Vani AIChat, create and build with frontier AI.Claude, GPT, Gemini and Grok in one workspace: research with sources, images and video, docs and slides, projects with memory.
GLM 5.3 Derisked for security research
An AI model for exploit, malware and vulnerability work, in chat or over the API.
Try it freeOsaka says third-party email breach exposed over 1 million addresses
Arara says a November 2 attack exposed 77 million addresses from nearly 400 customers, including Sega and TKC.
Falcon C2 used to hijack browsers at government agencies
Unit 42 says the Node.js framework, also tracked as XG, hit agencies in five countries from March to May 2026.
BlackNevas wiped an ESXi estate via VMware management tools
Over 10 days the attacker hit four ESXi hosts, every guest, both vCenters and connected backups, with no hypervisor exploit.
Stolen LLM API keys used to fund ARTEX credential-theft agents
Amazon’s MadPot honeypots captured ARTEX agent memory from October 3 to November 5; a separate deepfake KYC effort failed.
1
Apache Shiro before 3.0.1 accepts any password with auth caching (CVE-2026-129349)
After one successful login, DefaultLdapRealm skips the LDAP bind and accepts any later password when caching is on.
Stanford open-sources Memorilla, a latent memory module for frozen LLMs
A 194M-parameter module gives a frozen Qwen3-8B 16 tokens and beat full context on FactKG with 108x fewer document tokens.
1
FAA finds no hacking signs in nationwide ground stop
The November 13 stop lasted over four hours, disrupted thousands of flights, and investigators are examining a software update.
Apple describes Secure Exclaves that isolate camera and microphone data
On HomeView, only a person identifier, position and confidence reach the main OS, not audio or video.
1
Runway releases open-weight Praxis-1 robot control model
Weights and code are Apache 2.0; Runway reports 46.2% on RoboLab-120, but those scores are not independently verified.
OpenAI reassigns robotics researchers to other teams
Staff move under Mark Chen and Greg Brockman after GPT-6 Astra beat specialized models on simulated robot tasks.
Hijacked GitHub accounts plant secret-stealing malware in thousands of repos
The script also rewrites AWS role trust and injects Azure federated credentials so access can survive rotation.