Attacker abuses Microsoft Entra ID to target downstream MSP clients
Researchers are investigating the abuse campaign of a lone hacker who has been using stolen application secrets for Microsoft Entra ID to sign into Microsoft 365 and Azure environments at various managed service providers, according to a recent report by Todyl. The hacker targeted 45 app registrations at about 18 organizations and successfully authenticated at least 33 of them. READ MORE...
DigiCert data breach exposes customer information, identity documents
DigiCert warns it suffered a data breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to customer information and identity documents. The certificate authority says the breach affected a small portion of its archived customer data, including names, business email addresses, phone numbers, and business addresses. For some people, the exposed records also contained personal identification documents. READ MORE...
DreamHost confirms data breach exposed FTP logins and webmail sessions
DreamHost is warning of a data breach after attackers gained access to its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords. This follows the American web hosting provider and domain registrar's announcement that it suffered a cybersecurity incident requiring users to reset their email and FTP/SFTP passwords. In a data breach notification, DreamHost now says the breach extended from August 2026 to October 23, 2026, the day it was discovered. READ MORE...
Norway's aid agency pwned and all users' data is stolen
Norway's national aid agency, Norad, has confirmed that cyber criminals broke into its systems, stealing information about each and every registered user of its grant portal. Norad, which coordinates Norway's assistance for foreign development, said that 20,614 registered individuals had their names and email addresses swiped, and information from at least three organizations' applications was "misdirected." READ MORE...
Bank Phishing Sites Show Fake 'Suspended' Pages to Evade Takedowns
A threat actor has been relying on fake 'suspended account' notices to hide phishing content from users revisiting its look-alike bank websites, cybersecurity firm Kela reports. The campaign, active since May, has been relying on more than 300 fake domains, including 248 impersonating 189 US financial institutions. The first were registered in late 2025, but most of them appeared between July and September 2026. READ MORE...
New York's Queens Public Library battles ransomware crims: Wi-Fi, checkouts, and website go dark
New York City's Queens Public Library (QPL) is battling a ransomware attack, it confirmed on Wednesday evening via social media and to patrons directly. The disruption has downed QPL's website, on-site computers, check-out and return machines, its public Wi-Fi, mobile app, and its digital media services. Renewals are also unavailable, although library users are not charged fines for returning materials late. READ MORE...
Scammers capitalize on GTA 6 hype to push malware and crypto cons
Scammers are offering supposed leaked builds, early copies and phone versions of Grand Theft Auto VI (GTA 6) weeks before the game's November 19 launch, Netcraft warned in a new blog post. The company looked at GTA VI-themed domains that appeared between July 1 and October 27, 2026. Most of the lures fell into four groups, with sites borrowing the name of popular GTA VI leaker CyberLeek, promising early access, advertising mobile versions that don't exist, or giving the game away for free. READ MORE...
mSecure tells users to change passwords but won't say why
Password manager mSecure has warned current and former customers to protect the confidential information stored in its app after detecting "suspicious activity." But its advice about what users should do comes without an explanation of what happened or whose information might be at risk. The warning leaves users to decide whether to replace credentials-and whether it's safe to store replacements in mSecure. READ MORE...
Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day
A recently patched vulnerability in Zyxel GS1900 series switches was exploited in the wild as a zero-day to hack almost 1,000 devices, cybersecurity firm Binarly reports. The flaw is tracked as CVE-2026-107441 (CVSS score of 8.8) and is described as an out-of-bounds write issue in the CGI program of the Zyxel GS1900 series switch firmware. According to Zyxel, an unauthenticated attacker could exploit the security defect via crafted HTTP requests to achieve OS command execution. READ MORE...
Hackers exploited iOS and Android flaws to infect phones
Hackers possibly linked to the Kremlin exploited previously patched iOS and Android flaws in an attempt to hack visitors of multiple websites, including one celebrating the 250th anniversary of American independence, researchers said Wednesday. The attackers, which the researchers assessed with "moderate to high confidence" were part of Russia's Foreign Intelligence Service, targeted other sites, many with links to that country's ongoing war against Ukraine. READ MORE...
Critical Rails Bug Threatens to Derail Vulnerable Servers
A critical vulnerability in Rails could send impacted Web servers off the tracks. Rails, or Ruby on Rails, is a Web application framework built on Ruby. The framework's Active Storage component handles file uploads and can use the ImageMagick image processing suite to analyze uploaded images. And unfortunately, a flaw enables attackers to write arbitrary files to a Web server via ImageMagick. READ MORE...
- ...in 1605, Guy Fawkes is arrested in the act of placing explosives underneath the British Parliament, as part of the "Gunpowder Plot."
- ...in 1911, Roy Rogers is born in Cincinnati. The location of his home later became home plate at Riverfront Stadium.
- ...in 1940, Franklin Delano Roosevelt is elected to an unprecedented fourth term as President of the United States.
- ...in 1968, Richard Nixon is elected as 37th President of the United States.
