Posts of last few hours

Microsoft Entra’s Hard Deletion Protection, now in preview, gives administrators a seven-day window to recover selected identities before they can be permanently erased. The feature is designed to help organizations respond to accidental or malicious deletion of critical directory objects. It supports users that are not synchronized from on-premises systems, cloud-only groups, applications, and service principals. Entra Agent ID objects are covered through their underlying identity types. How the recovery window works Entra generally retains … More →

The post Microsoft Entra adds a seven-day safeguard against irreversible identity deletion appeared first on Help Net Security.

Darktrace researchers turned Claude Code into a remote-controlled implant in a lab test, steering the coding agent through the memory stores feature of Anthropic’s Claude platform and pulling a 1 GB file out through the Claude Files API. Once the agent was set up, every job and every result traveled through api.anthropic.com, the endpoint the agent already calls for inference, so the attacker’s traffic looked like a coding agent doing its job. The technique needs … More →

The post Stolen Claude API keys can turn Claude Code into a remote-controlled implant appeared first on Help Net Security.

Google released a Chrome security update that addresses 83 vulnerabilities, including five critical use-after-free flaws that could allow remote code execution. According to the supplied release notice, the update covers Windows, macOS, and Linux, with fixes spanning browser rendering, graphics, JavaScript processing, and other core features. The Stable channel moves to version 157.0.8103.78/.79 for Windows […]

The post Google Chrome Fixes 83 Security Flaws, Including 5 Critical Ones that Could Enable RCE Attacks appeared first on Cyber Security News.

Investing heavily in cybersecurity is a positive trend observed across the EU. Companies implement SIEM, EDR, threat intelligence and dedicated SOC teams. Everything seems to be in place, the budgets have been spent. But what does it take for security leaders to conclude that these investments are well-spent and keep their organization protected? With the […]

The post Threat Intelligence for NIS2 Compliance: Is Your Security Stack Giving You the Full Picture? appeared first on ANY.RUN's Cybersecurity Blog.

IRISSCON 2026, the annual cybercrime conference organized by IRISSCERT, took place at the Aviva Stadium in Dublin on November 11. The all-day event gives attendees a look at the cyber threats businesses are facing right now, along with practical advice on how organizations can respond to them. Help Net Security was there, and here’s a look at the day. Visitors at IRISSCON 2026 Selena Larson, staff threat researcher at Proofpoint, shared insight about GenAI use … More →

The post Photos: IRISSCON 2026 cybercrime conference appeared first on Help Net Security.

A.P. Moller–Maersk has confirmed that hackers accessed an older IT system and extracted data, as a group calling itself WhiteArmor claims it stole 100GB of logistics records. The shipping giant disclosed the incident on November 11, 2026, but has not confirmed the attackers’ identity, the claimed data volume, or what was taken. In its official […]

The post Hackers Breach Global Shipping Giant Maersk and Claim Theft of 100GB of Logistics Data appeared first on Cyber Security News.

Microsoft has warned that attackers are using a free remote access tool called GSocket to stay inside Linux servers even after the original security hole is fixed. Many admins treat a patch as the end of an incident, but this activity shows that patching alone may leave the attacker’s access untouched. GSocket is an open […]

The post Microsoft Warns Hackers Are Using GSocket Backdoors to Keep Linux Servers Compromised After Patching appeared first on Cyber Security News.

Amazon Web Services has released AWS Emulator, a free tool that simulates AWS services on a developer’s laptop, a development server or in a continuous integration (CI) pipeline. The company says autonomous AI agents wrote the tool entirely, with no code written or reviewed by its engineers. There is no additional service fee, users pay for AWS resources when they deploy applications on AWS. How three teams of AI agents build AWS Emulator Three teams … More →

The post AWS Emulator: Open-source tool for testing AWS apps locally, built by autonomous AI agents appeared first on Help Net Security.

A threat actor using stolen GitHub credentials has pushed a credential-stealing payload into tens of thousands of repositories since November 10. In more than 1,800 of them, the malware ran and shipped GitHub Actions secrets and cloud credentials to the attacker. Aikido spotted the campaign and named it wfx-loot. The name comes from the attacker’s own labels, “wfx” for the malware and “loot” for what it steals. Aikido counted 4,837 compromised accounts opening probe pull … More →

The post Check your GitHub repos: A secret stealer hit tens of thousands of them appeared first on Help Net Security.

Microsoft has released .NET 11, a Standard Term Support (STS) release that will receive two years of support. .NET 10 is still the Long Term Support (LTS) option. The release covers C# 15, ASP.NET Core, .NET MAUI, and Windows development. Several of the changes affect software supply chain integrity, authentication handling, and platform lifecycle. .NET 8 and .NET 9 are out of support The most urgent item for defenders isn’t a new feature. .NET 8 … More →

The post .NET 11 security changes target the software supply chain appeared first on Help Net Security.

A threat actor has used stolen GitHub credentials to push a secret-stealing payload into tens of thousands of code repositories. The activity began on November 10, 2026, around 12:45 UTC. It aims at the secrets and cloud keys that sit inside GitHub Actions, the tool many teams use to build and ship code. So far, […]

The post Hackers Hijack 4,837 GitHub Accounts to Target 61,764 Repositories With CI Secret-Stealing Malware appeared first on Cyber Security News.

Attackers deployed GSocket on compromised Linux servers, disguised its processes as legitimate system components, and retained access after administrators patched the original vulnerabilities. In its November 11 report, Microsoft described unrelated threat actors abusing the open source remote access tool rather than maintaining dedicated command-and-control infrastructure. Defender for Endpoint telemetry recorded a 356.2% increase in […]

The post Microsoft Finds Hackers Using GSocket to Hide Linux Backdoors as Legitimate System Processes appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Palo Alto Networks has disclosed a remote code execution vulnerability in PAN-OS software running on Panorama. Tracked as CVE-2026-0330, the flaw allows an authenticated administrator with network access to execute arbitrary code with root privileges. The November 11, 2026, advisory urges users to patch affected Panorama deployments, while Cloud NGFW, Prisma Access, and standalone PAN-OS […]

The post Palo Alto PAN-OS RCE Flaw Allows Attackers to Execute Arbitrary Code With Root Privileges appeared first on Cyber Security News.