The latest security reporting, combined across sources and tagged, newest first.
Why now: this site build contains 11,185 stories. It includes 2,900 vulnerability news stories. The newest available reporting appears below.
Reporting is aggregated from multiple sources. Anything Cybersecurity Tracker computes or infers is labelled as its own judgment, never as a claim made by a source.
Stories are combined, de-duplicated, and tagged by category, vendor, and threat actor. Filter by your job role, follow the vendors you run, get the email digest, or subscribe by Really Simple Syndication (RSS). No account required.
CVE records with CISA KEV additions, newly reported exploitation in the last 7 days, or news coverage in the last 48 hours
CVE-2026-124194Microsoft OfficepinnedCVSS 6.5Added to CISA KEV on 2026-11-10 · Exploitation newly reported on 2026-11-10 · 2 news mentions in 48 hours
CVE-2026-19868SonicWall SonicOS SSLVPNpinnedCVSS 7.5Added to CISA KEV on 2026-11-06 · Exploitation newly reported on 2026-11-06
CVE-2026-109619PHP Group PHPpinnedCVSS 9.24 news mentions in 48 hours
CVE-2026-109618PHP Group PHPpinnedCVSS 9.24 news mentions in 48 hours
CVE-2026-111497Google BrotlipinnedCVSS 9.24 news mentions in 48 hours
CVE-2026-102895GPUStack GPUStackpinnedCVSS 9.8Added to CISA KEV on 2026-11-09 · 1 news mention in 48 hours
CVE-2026-125350Google ChromiumpinnedCVSS 8.8Added to CISA KEV on 2026-11-10 · 1 news mention in 48 hours
CVE-2026-20320Cisco BroadWorkspinnedCVSS 7.5Added to CISA KEV on 2026-11-10
Records from your pinned vendors are marked and listed first when they are trending.
How pins work
Pins are the vendors you added to My Stack on the home page. Your pin list is saved only in this browser. Shared view and feed requests include the selected vendor names in their URLs. Pins never change what the tracker collects or scores.
Anthropic's CEO stated that artificial intelligence (AI) agents will play a larger role in cybersecurity, with the potential to patch vulnerabilities within a year. He characterized patching as a bigger enterprise challenge than vulnerability discovery itself, speaking alongside JPMorgan Chase's CEO at a recent event.
Why it matters: Enterprise security teams should monitor AI agent capabilities in vulnerability management, as autonomous patching systems could reshape how organizations respond to flaws.
The Federal Aviation Administration (FAA) grounded all flights across the United States due to communication issues affecting multiple Air Route Traffic Control Centers that manage national airspace. The ground stop followed what the agency characterized as extraordinary circumstances related to the disruption of these critical communication systems.
Why it matters: Airlines, airports, and travelers face immediate operational disruption; security and infrastructure practitioners should monitor for the underlying cause, which could indicate system failure, cybersecurity incident, or other critical infrastructure vulnerability.
The Federal Aviation Administration (FAA) issued a ground stop citing extraordinary circumstances, though federal officials have not disclosed the cause of the communications disruption or confirmed whether a cyberattack investigation is underway.
Why it matters: Aviation operators and cybersecurity teams need clarity on whether this disruption stems from a cyberattack, as the lack of transparency affects incident response decisions and sector-wide risk assessment.
The FBI issued an alert about Artex, an open source hacking tool that automates attack chaining at rapid speed. The tool can accelerate intrusions from initial targeting to privileged access in under three hours, compressing what typically requires days into a fraction of that time.
Why it matters: Organizations globally face faster compromise timelines; security teams must accelerate detection and response capabilities to match the speed that Artex enables for attackers.
Tracker inference
Vulnerabilities and PatchesResearchCVE-2026-124726
CVE-2026-124726 is a relative path traversal vulnerability in Apache APISIX versions 3.19.0 before 3.20.0 that allows callers to invoke undeclared endpoints through the Model Context Protocol endpoint using the HTTP method and credentials of a declared route. The issue carries a CVSS 4.0 score of 6.9 (medium severity).
Why it matters: Teams running Apache APISIX 3.19.0 should patch to 3.20.0 or later to prevent attackers from bypassing OpenAPI access controls and reaching unintended application programming interface (API) paths with elevated credentials.
Tracker inference
Vulnerabilities and PatchesResearchCVE-2026-124723
CVE-2026-124723 is a medium severity authorization flaw in Apache APISIX versions 3.18.0 through 3.19.0 that allows clients without a certificate to access upstream resources protected by mutual TLS (mTLS) when specific configuration options are enabled. The vulnerability stems from an interpretation conflict in URI handling that bypasses certificate validation requirements.
Why it matters: Organizations running APISIX with mTLS protection and the vulnerable configuration flags enabled should verify their versions and apply patches immediately, as unauthenticated clients can circumvent certificate-based access controls.
Researchers disclosed 14 serious vulnerabilities in Dixell and Copeland refrigeration supervision systems, with severity scores up to 9.8 and at least two under active exploitation. The flaws grant administrative access and stem from critical control bypasses, such as executing login input as shell commands before password validation. Patches are now available, though legacy versions remain exposed, and honeypot testing demonstrates rapid attacker interest in internet-connected industrial controllers.
Why it matters: Organizations operating refrigeration systems and other internet-connected industrial controllers must patch immediately and implement network segmentation, as attackers are actively probing for and exploiting these devices to disrupt cold chain operations and food safety.
Tracker inference
Vulnerabilities and PatchesResearchCVE-2026-124719
CVE-2026-124719 is an authentication bypass vulnerability in Apache APISIX 3.19.0 before 3.20.0 that allows a caller to spoof another identity when a Route's configured headers and OpenAPI document declare the same header. An attacker with valid credentials can then act as another identity against the upstream application programming interface (API).
Why it matters: Teams running affected APISIX versions should patch to 3.20.0 or later to prevent authenticated users from impersonating other identities and accessing upstream APIs with elevated privileges.
Tracker inference
Vulnerabilities and PatchesResearchCVE-2026-124716
Apache APISIX versions 1.4.0 through 3.19.0 contain an authorization bypass in the authz-keycloak plugin that allows an authenticated user with any one of a route's required permissions or scopes to access the protected upstream service without satisfying all required permissions, including HTTP methods the authorization server denied.
Why it matters: Organizations running affected versions of Apache APISIX with Keycloak authorization are exposed to privilege escalation: authenticated users can bypass partial authorization checks to reach resources they should not access.
Tracker inference
Vulnerabilities and PatchesResearchTracker priority: TrackCVE-2026-124680
CVE-2026-124680 is a route-level authentication bypass vulnerability in Apache APISIX versions 0.9 through 3.19.0 caused by path normalization differences between the routing layer and upstream forwarding. An unauthenticated client can access upstream paths protected by authentication plugins when an unprotected route exists on the same upstream and the upstream does not collapse paths.
Why it matters: Organizations running affected Apache APISIX versions should assess whether their deployments have multiple routes to the same upstream, as unauthenticated attackers could bypass route-level auth protections to reach sensitive backend services.
Tracker inference
Vulnerabilities and PatchesResearchTracker priority: TrackCVE-2026-124679
CVE-2026-124679 is an authentication bypass vulnerability in Apache APISIX versions 3.18.0 through 3.19.0 that affects routes using jwe-decrypt with strict mode disabled and a forward_header different from the token header. An unauthenticated client can supply a spoofed identity header that the upstream service treats as gateway-decrypted plaintext, bypassing authentication controls.
Why it matters: Organizations running APISIX 3.18.0 to 3.19.0 with jwe-decrypt and forward-auth configured in this manner face immediate identity spoofing risk; patch to a fixed version or adjust strict mode settings.
Tracker inference
Vulnerabilities and PatchesResearchCVE-2026-124666
CVE-2026-124666 affects Apache APISIX versions 3.8.0 through 3.19.0, allowing authentication bypass when multi-auth falls back from wolf-rbac to another authenticator. Client-supplied Wolf identity headers persist in requests and can be exploited by downstream services that trust them without re-validation.
Why it matters: Organizations running affected APISIX versions with multi-auth configurations must patch immediately, as authenticated users can spoof Wolf identity headers to escalate privileges or access unauthorized resources in downstream services.
Tracker inference
Vulnerabilities and PatchesResearchCVE-2026-128239
CVE-2026-128239 affects GPAC's MP4Box component through version 26.07.0, allowing a NULL pointer dereference in MPEG-4 form handlers when processing specially crafted XMT input files. The vulnerability carries a CVSS 3.1 score of 5.5 (medium) with local attack vector and high availability impact. A fix has been applied in commit bc416b997622e43de65afab3bae9b7d05d72f2b0.
Why it matters: Users and systems processing untrusted MPEG-4 or XMT media files with MP4Box face potential denial of service; developers should update GPAC to patched versions or restrict file input from untrusted sources.
The United States and other nations finalized voluntary industry guidelines for commercial cyber intrusion capabilities, such as spyware, through the Pall Mall Process led by the U.K. and France. The guidelines establish four pillars: regulatory compliance, due diligence, risk management, and compliance monitoring, with recommendations for export controls, risk assessments, technical access controls, and continuous oversight. Advocates and civil society groups said the standards are a step forward but fall short of binding requirements, mandatory kill switches, and stronger accountability measures needed to limit spyware misuse.
Why it matters: Organizations developing, selling, or procuring offensive cyber tools must understand these voluntary standards; security professionals and compliance teams should track national implementation to assess whether guidelines translate into enforceable controls that affect vendor selection and supply chain risk.
The total number of CVEs disclosed in 2026 surpassed 100,000 by November 13, more than double 2025's annual count, driven primarily by artificial intelligence (AI) powered vulnerability discovery and reporting. The median time from CVE publication to active exploitation has compressed from 120 days in 2025 to 80 days in the first half of 2026, with some vulnerabilities exploited within hours, as AI accelerates both vulnerability hunting and exploit development. The industry faces growing strain on open source maintainers and package registries from AI-generated reports, prompting some projects to adopt tiered service models or restrict vulnerability disclosure policies.
Why it matters: Security teams must shift from CVSS-based patching to risk-based prioritization using CISA's binding operational directive, focusing on internet-exposed and actively exploited vulnerabilities, because the volume of CVEs now exceeds human triage capacity and exploitation windows continue to shrink with AI assistance.
A White House task force concluded that regulatory cyber defense standards are outdated for the artificial intelligence (AI) era and recommended liability relief for companies experiencing AI-fueled cyberattacks. The group met for the second time to evaluate whether existing frameworks adequately address modern threat landscapes.
Why it matters: Security leaders and compliance teams need to track this position, as liability changes could reshape incident response obligations and insurance requirements for organizations targeted by AI-enabled attacks.
ArcticRAT, an Android malware operated by a cybercrime gang, has evolved from targeting cryptocurrency theft to enabling full device control. The operators now employ artificial intelligence (AI) to analyze stolen victim financial data at scale.
Why it matters: Mobile users and organizations with Android deployments face increased risk from this malware's expanded capabilities; security teams should review endpoint detection capabilities for suspicious device control and credential access.
N-able disclosed 33 zero-day vulnerabilities in its software, affecting managed service providers (MSPs) and their customers. OpenAI introduced a kill switch mechanism for autonomous agents. ISMG editors discussed the security implications and how organizations measure cyber risk reduction.
Why it matters: MSPs and their downstream clients face immediate exploitation risk from 33 unpatched zero-days in N-able software; practitioners should assess exposure and contact N-able for mitigation guidance or patches.
A threat actor or group named Curious Worm has emerged recently, with activity observed in October and November. The group operates a dark web leak site and has claimed more than half of 12 incidents targeting the healthcare sector.
Why it matters: Healthcare organizations need to monitor Curious Worm as a newly active threat to their sector; practitioners should track this group's tactics and targets to assess organizational risk.
The City of Osaka disclosed a data breach affecting approximately 1 million individuals and advised residents to remain vigilant against fraudulent emails impersonating the municipal government. The incident occurred as Japan faced multiple concurrent cyber attacks on government and critical infrastructure.
Why it matters: Residents of Osaka and victims across Japan face elevated risk of targeted phishing, fraud, and identity theft following exposure of their personal data; municipalities and critical infrastructure operators should review incident response protocols and communication controls.
Tracker inference
No stories match your current filters. Reset search and filters to show all stories.
Stories come from the published source set, are combined when reports cover the same event, and are ordered newest first. Trending uses the last 7 Coordinated Universal Time (UTC) calendar days, while the details feed states each story's published or first-seen date.