Skip to main content
IMMUNITYSEC

Cybersecurity News & Intelligence

News on actively exploited vulnerabilities, hacking and extortion campaigns, AI security incidents, and patching priorities, written for a general tech audience.

Updated

Browse by Category

4 categories

AI Security News & Analysis

3 articles

News and analysis of security incidents involving large language models, AI agents, and AI infrastructure. Covers prompt injection, reward hacking, agent sandbox escapes, supply chain attacks through AI coding agents, and the mitigations that contain them.

Defensive Engineering News & Analysis

3 articles

News on how organizations respond to actively exploited vulnerabilities: patch deadlines set through the CISA Known Exploited Vulnerabilities catalog and federal directives, checks for compromise after an attack, and the guidance vendors and agencies publish.

Threat Intelligence News & Analysis

19 articles

News on active threat actors and campaigns, including state-sponsored operations, data theft and extortion, fraud, and law enforcement takedowns and charges. Articles cover who was targeted, what the attackers took, how companies and agencies responded, and the advice that followed.

Vulnerability News & CVE Analysis

9 articles

News on serious security flaws in widely used software and services. Articles explain in plain terms what each flaw allows, which products and versions are affected, whether attackers are exploiting it in the wild, and which updates and vendor guidance fix it.

Latest Articles

34 total
Threat Intelligence News & Analysis
2026-11-12•4 min read

US moves to seize $1.2 billion stolen from Binance and disrupts North Korea's FaceStealer video call scheme

The US Justice Department said on November 12, 2026, that it had obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance in the October 29 theft it attributes to North Korea. The department also seized cloud infrastructure used in FaceStealer, a North Korean scheme of fake video calls that the FBI says has stolen more than $400 million in 18 months.

Threat Intelligence News & Analysis
2026-11-12•4 min read

Huntress says attackers used a ScreenConnect extension to plant rogue remote access on 288 computers

Attackers used cloud-hosted ConnectWise ScreenConnect remote access panels on November 11, 2026, to install rogue ScreenConnect clients and a malicious toolkit called SCKit on at least 288 computers at 48 organizations, security firm Huntress reported. Huntress linked the activity to RMM+, a third-party ScreenConnect extension whose versions 1.0.31 and 1.0.32 accepted a blank access key. ConnectWise disabled RMM+ and four related extensions in about 400 partner environments and said it had found no vulnerability in ScreenConnect itself.

Vulnerability News & CVE Analysis
2026-11-11•4 min read

Microsoft fixes exploited Outlook flaw CVE-2026-124194 as November Patch Tuesday tops 1,000 bugs

Microsoft released its November 2026 security updates on November 10, 2026, fixing CVE-2026-124194, a Microsoft Outlook flaw that attackers exploited before a fix existed. The flaw can leak a user's Windows login data to an attacker when the user opens a specially crafted message file. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) gave federal agencies until November 24 to patch it, in a release that fixed more than 1,000 flaws for the second month in a row.

Threat Intelligence News & Analysis
2026-11-11•3 min read

Japanese furniture retailer Nitori says breach may have exposed up to 37.62 million customer records

Nitori Holdings, the Japanese furniture and home goods retailer, said on November 9, 2026, that up to 37.62 million personal information records may have leaked after a third party gained unauthorized access to a system it manages. The records include names, addresses, phone numbers, email addresses, and dates of birth, but not login passwords or credit card information. Nitori confirmed the access on November 6 and said a third party may have accessed the system as early as mid to late October.

Threat Intelligence News & Analysis
2026-11-10•4 min read

Vanderbilt University tells campus to shut down devices as BYOD ransomware group claims data theft

Vanderbilt University in Nashville, Tennessee, told students, faculty, and staff on November 9, 2026, to shut down university devices and disconnect from campus Wi-Fi while it responded to an active cybersecurity incident. The BYOD ransomware group claimed responsibility and says it holds more than 1 million Social Security numbers along with student and employee records. Vanderbilt has not confirmed the group's involvement or whether any data was stolen, and most university systems were still restricted on November 10.

Vulnerability News & CVE Analysis
2026-11-10•4 min read

N-able takes N-central offline after researcher publishes 33 unpatched flaws online

N-able took its hosted N-central remote management service offline on November 9, 2026, after an independent researcher published details and proof-of-concept code for 33 unpatched vulnerabilities in the platform, which the researcher called Able2Shell. N-able told customers who run N-central on their own servers to take them offline as well until it releases a fix, which it expected around midday Eastern time on November 10. The company said it had not seen the flaws exploited.