Know the moment the organizations you depend on are breached

CISA flags WordPress RCE flaw as actively exploited in attacks

The US Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress vulnerability in the wild. [...]

Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads

A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick. The Rails project disclosed the flaw in an advisory and fixed it in versions 8.1.4.1 and 8.0.5.2. The flaw is in Active Storage, the part of Rails that handles file uploads. Some apps store

CrowdStrike launches AI kill switch to shut down rogue agents

With a notable rise in autonomous AI agents veering off-script inside corporate networks, CrowdStrike has launched an enterprise AI Kill Switch, giving security teams control to cut off and disable models when they go rogue. Integrated into its Falcon Guardian platform, this AI Kill Switch will provide security teams with the human control to terminate the agent at its root, where it runs, block it from launching again, and even cut off its enterprise network access. The launch comes as…

3AM Ransomware Used Human-AI Hybrid Tactics in UK School Estate Compro

Hackers Exploit Zyxel GS1900 Zero-Day in the Wild to Hijack Network Switches

A flaw in Zyxel GS1900 switches was already being used by hackers, and the patch meant to fix it did not work. Researchers at Binarly found that a public exploit hit a different bug than the one Zyxel had patched. Zyxel has now confirmed it as a new flaw, tracked as CVE-2026-107441. Zyxel published its […] The post Hackers Exploit Zyxel GS1900 Zero-Day in the Wild to Hijack Network Switches appeared first on Cyber Security News.

Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory

Two flaws in the Xen hypervisor allow a malicious guest virtual machine (VM) to read and write the memory of other VMs on the same host, including dom0. Dom0 is the VM that, by default, has full permissions and manages the others. Patches are out, and there is no known mitigation, the Xen Project said in an advisory on November 3. All Xen versions from 4.6 onward are vulnerable,

Microsoft Edge Now Automatically Blocks Malicious Websites Sending Fake Virus Alert Notifications

Microsoft Edge now automatically disables notifications from websites that send users to detected scam pages, cutting off a route used to deliver fake virus warnings. The protection connects Microsoft Defender SmartScreen and Scareware blocker detections with notification permissions, helping prevent malicious sites from repeatedly drawing people back into the same scam. The change arrived with […] The post Microsoft Edge Now Automatically Blocks Malicious Websites Sending Fake Virus Alert…