@hacker_meme

🚨 35,578 Grok-built apps were accessible online without signing in. Some exposed confidential X documents, employee passwords, and patient data. Even hard-to-guess app URLs could be found through searchable DNS records. Full findings…

Ship fast. Fix what's exploitable. The Secure Software Delivery Toolkit starts with a simple idea: developers keep their pace when security points them to the few risks that are exploitable. Noisy scanner output makes those risks hard to spot. Inside are 4 practical resources created by Wiz's…

‼️ Microsoft confirms active exploitation of an Outlook flaw. The bug could expose NTLMv2 authentication hashes when users open a crafted message file. It's one of 1,259 vulnerabilities patched this month. CISA has added it to its exploited flaws list. Details ↓…

🚨 Railway says stolen customer AI keys led to an estimated $740,000 in unauthorized charges. Attackers exploited a build isolation flaw, moved through internal cloud systems, and decrypted customer secrets. Railway will cover charges AI providers won't refund. Full details ↓…

‼️ Microsoft researchers showed that changing just 7 neurons out of 12,000+ in an AI model can plant a hidden backdoor. A hidden trigger made the model generate attacker-chosen commands that an AI agent could execute with its own permissions. Details ↓…

🚨 Hackers are exploiting flaws in Cisco BroadWorks and Openwave Messaging, CISA confirms. Both vulnerabilities are already patched, but how attackers are exploiting them remains unknown. Federal agencies have until November 24 to apply fixes. Details…

🚨 UPDATE: N-able releases N-central 2026.4 HF2 to address 7 CVEs following the Able2Shell disclosure. All hosted N-central servers worldwide have been upgraded. On-premises customers are urged to keep servers offline until updates are applied. Another hotfix is planned. Details ↓…

‼️ A new Git flaw lets malicious repositories execute code on your machine during recursive clones. Tracked as CVE-2026-111760, the flaw abuses submodule hooks to run attacker-controlled code. Git has released fixes for this and five other vulnerabilities. Details…

🚨 An attacker exploited an SGLang RCE flaw to breach NEAR AI. Data stolen from 18 AI agents and about 100 user accounts. Confidential AI requests processed on one server may also have been visible to the attacker. What NEAR AI confirmed about the breach ↓…

‼️ ALERT - Hackers are actively exploiting a critical authentication bypass in Xen Orchestra. A crafted cookie can grant Admin access and enable root-level takeover of XCP-ng hosts. Patches are available. Here's what admins need to know…