https://vulnpocalypse.dev/feeds/Windows, macOS, browsers, Android, iOS and remote-access clients: exploited flaws and updates.enThu, 12 Nov 2026 16:59:02 +0000https://vulnpocalypse.dev/advisories/the420in-reports-microsoft-confirms-windows-11-november-2026-update-errors/https://vulnpocalypse.dev/advisories/the420in-reports-microsoft-confirms-windows-11-november-2026-update-errors/Thu, 12 Nov 2026 12:00:00 +0000The420.in reports Microsoft says some Windows 11 PCs fail to install KB5132061; an automatic fix is due within 48 hours, so wait for it.ecosystemendpointenterprisehttps://vulnpocalypse.dev/advisories/security-affairs-reports-europe-spyware-victims-face-little-accountability/https://vulnpocalypse.dev/advisories/security-affairs-reports-europe-spyware-victims-face-little-accountability/Thu, 12 Nov 2026 12:00:00 +0000Security Affairs reports on an IrpiMedia investigation saying European spyware victims get few answers; no CVE or patch is named.ecosystemendpointhttps://vulnpocalypse.dev/advisories/hudson-rock-reports-school-bomb-threat-sender-accounts-in-infostealer-data/https://vulnpocalypse.dev/advisories/hudson-rock-reports-school-bomb-threat-sender-accounts-in-infostealer-data/Thu, 12 Nov 2026 12:00:00 +0000Hudson Rock reports two university accounts tied to school bomb threats appear in old infostealer data; check and reset exposed credentials.breachendpointenterprisehttps://vulnpocalypse.dev/advisories/hkcert-reports-multiple-google-chrome-vulnerabilities-fixed-in-1570810378/https://vulnpocalypse.dev/advisories/hkcert-reports-multiple-google-chrome-vulnerabilities-fixed-in-1570810378/Thu, 12 Nov 2026 12:00:00 +0000HKCERT reports multiple Google Chrome vulnerabilities rated medium risk; update to 157.0.8103.78 or later on Linux, Mac and Windows.exploitedendpointhttps://vulnpocalypse.dev/advisories/darktrace-says-stolen-claude-api-keys-can-steer-claude-code-as-implant/https://vulnpocalypse.dev/advisories/darktrace-says-stolen-claude-api-keys-can-steer-claude-code-as-implant/Thu, 12 Nov 2026 12:00:00 +0000Help Net Security reports Darktrace showed stolen Claude API keys can steer Claude Code in a lab test; scope and rotate keys.ai-toolsai-toolsendpointhttps://vulnpocalypse.dev/advisories/castlerat-stealc-gootloader-bleepingcomputer-reports-europol-takedown/https://vulnpocalypse.dev/advisories/castlerat-stealc-gootloader-bleepingcomputer-reports-europol-takedown/Thu, 12 Nov 2026 12:00:00 +0000BleepingComputer reports Europol seized servers tied to CastleRAT, StealC and Gootloader; check if your credentials were exposed.breachendpointwebhttps://vulnpocalypse.dev/advisories/akamai-reports-strikestub-a-clickfix-powershell-malware-and-rat/https://vulnpocalypse.dev/advisories/akamai-reports-strikestub-a-clickfix-powershell-malware-and-rat/Thu, 12 Nov 2026 12:00:00 +0000Akamai reports on StrikeStub, a ClickFix PowerShell malware and modular RAT; only the headline was reviewed, so read Akamai's full post.exploitedendpointhttps://vulnpocalypse.dev/advisories/intelbras-ip-cameras-kaspersky-reports-dos-flaw-in-firmware-update-endpoint/https://vulnpocalypse.dev/advisories/intelbras-ip-cameras-kaspersky-reports-dos-flaw-in-firmware-update-endpoint/Thu, 12 Nov 2026 12:00:00 +0000Kaspersky reports an unauthenticated DoS flaw in Intelbras IP camera firmware, update affected cameras to firmware R.260804 as soon as possible.exploitednetwork-edgeendpointhttps://vulnpocalypse.dev/advisories/cursor-2026-cves/https://vulnpocalypse.dev/advisories/cursor-2026-cves/Thu, 12 Nov 2026 12:00:00 +0000Seven 2026 Cursor CVEs let prompt injection or a cloned repo run code outside the sandbox. Update to 3.1.2 or later; the Windows git.exe bug has no stated fix.ai-toolsai-toolsendpointhttps://vulnpocalypse.dev/advisories/signdrop-windows-clfs-exploit-researcher-claims-system-access-no-patch/https://vulnpocalypse.dev/advisories/signdrop-windows-clfs-exploit-researcher-claims-system-access-no-patch/Wed, 11 Nov 2026 12:00:00 +0000Cyber Security News reports a researcher claims SignDrop gives Windows SYSTEM via CLFS; no CVE or patch, so limit local code execution.exploitedendpointenterprisehttps://vulnpocalypse.dev/advisories/securityweek-reports-zoom-workplace-and-asus-router-patches/https://vulnpocalypse.dev/advisories/securityweek-reports-zoom-workplace-and-asus-router-patches/Wed, 11 Nov 2026 12:00:00 +0000SecurityWeek reports Zoom patched two Workplace for Windows flaws in 7.1.8 and later, and Asus issued a router advisory; update both.exploitedendpointnetwork-edgehttps://vulnpocalypse.dev/advisories/securityweek-reports-intel-and-amd-addressed-over-200-flaws/https://vulnpocalypse.dev/advisories/securityweek-reports-intel-and-amd-addressed-over-200-flaws/Wed, 11 Nov 2026 12:00:00 +0000SecurityWeek reports Intel and AMD published over 50 advisories covering over 200 flaws; check vendor advisories and apply available updates.exploitedendpointenterprisehttps://vulnpocalypse.dev/advisories/palo-alto-says-prisma-browser-needs-chromium-fixes-pan-sa-2026-0014/https://vulnpocalypse.dev/advisories/palo-alto-says-prisma-browser-needs-chromium-fixes-pan-sa-2026-0014/Wed, 11 Nov 2026 12:00:00 +0000Palo Alto Networks says Prisma Browser builds below 157.19.4.39 lack Chromium fixes; it reports no exploitation. Update Prisma Browser.exploitedenterpriseendpointhttps://vulnpocalypse.dev/advisories/microsoft-reports-threat-actors-using-gsocket-for-persistent-linux-c2/https://vulnpocalypse.dev/advisories/microsoft-reports-threat-actors-using-gsocket-for-persistent-linux-c2/Wed, 11 Nov 2026 12:00:00 +0000Microsoft reports threat actors deploy GSocket on compromised Linux servers for persistent access; remove the client, not just patch the app.ecosystemwebendpointopen-sourcehttps://vulnpocalypse.dev/advisories/kaspersky-reports-citrus-ransomware-using-vless-tunnels-and-sn00py/https://vulnpocalypse.dev/advisories/kaspersky-reports-citrus-ransomware-using-vless-tunnels-and-sn00py/Wed, 11 Nov 2026 12:00:00 +0000Kaspersky reports Citrus ransomware group uses VLESS tunnels and Sn00py; review contractor VPN and RDP access and GHOST machine accounts.breachenterpriseendpointhttps://vulnpocalypse.dev/advisories/iverify-reports-leaked-darksword-and-coruna-kits-hit-employee-iphones/https://vulnpocalypse.dev/advisories/iverify-reports-leaked-darksword-and-coruna-kits-hit-employee-iphones/Wed, 11 Nov 2026 12:00:00 +0000Help Net Security reports iVerify says leaked DarkSword and Coruna kits infect employee iPhones; check iOS versions and work access.exploitedendpointenterprisehttps://vulnpocalypse.dev/advisories/hkcert-reports-adobe-november-2026-security-update-for-nine-products/https://vulnpocalypse.dev/advisories/hkcert-reports-adobe-november-2026-security-update-for-nine-products/Wed, 11 Nov 2026 12:00:00 +0000HKCERT reports Adobe released its November 2026 monthly update covering nine products rated Medium; apply the vendor fixes.exploitedendpointenterprisehttps://vulnpocalypse.dev/advisories/gbhackers-reports-fake-cloudflare-captcha-lures-hide-malware-in-png-images/https://vulnpocalypse.dev/advisories/gbhackers-reports-fake-cloudflare-captcha-lures-hide-malware-in-png-images/Wed, 11 Nov 2026 12:00:00 +0000GBHackers reports Huntress research on fake Cloudflare CAPTCHA ClickFix lures that run PowerShell; never paste commands from a web page.ecosystemendpointwebhttps://vulnpocalypse.dev/advisories/fortiguard-labs-reports-tinstaporn-android-casino-app-malware/https://vulnpocalypse.dev/advisories/fortiguard-labs-reports-tinstaporn-android-casino-app-malware/Wed, 11 Nov 2026 12:00:00 +0000Hackread reports FortiGuard Labs found TinstaPorn, a fake Macau casino Android app that collects phone and location data; avoid sideloading it.ecosystemendpointhttps://vulnpocalypse.dev/advisories/bitlocker-bypass-flaws-cyber-security-news-reports-microsoft-disclosure/https://vulnpocalypse.dev/advisories/bitlocker-bypass-flaws-cyber-security-news-reports-microsoft-disclosure/Wed, 11 Nov 2026 12:00:00 +0000Cyber Security News reports Microsoft disclosed two BitLocker bypass flaws needing physical access; check the KB updates for your Windows build.exploitedendpointenterprisehttps://vulnpocalypse.dev/advisories/asec-reports-snakekeylogger-phishing-disguised-as-quote-requests/https://vulnpocalypse.dev/advisories/asec-reports-snakekeylogger-phishing-disguised-as-quote-requests/Wed, 11 Nov 2026 12:00:00 +0000ASEC reports phishing emails posing as quote requests deliver SnakeKeylogger through a JavaScript attachment; do not open such attachments.ecosystemendpointhttps://vulnpocalypse.dev/advisories/microsoft-november-2026-patch-tuesday-exploited-outlook-zero-day/https://vulnpocalypse.dev/advisories/microsoft-november-2026-patch-tuesday-exploited-outlook-zero-day/Wed, 11 Nov 2026 12:00:00 +0000Microsoft's November 2026 Patch Tuesday fixes an exploited Outlook NTLM hash flaw, CVE-2026-124194; install the November updates.exploitedenterpriseendpointhttps://vulnpocalypse.dev/advisories/chrome-cve-2026-125350-zero-day-update-to-1570810350/https://vulnpocalypse.dev/advisories/chrome-cve-2026-125350-zero-day-update-to-1570810350/Wed, 11 Nov 2026 12:00:00 +0000Google patched an actively exploited Chrome XML use-after-free, CVE-2026-125350; update Chrome to 157.0.8103.50 or later and relaunch.exploitedwebendpointhttps://vulnpocalypse.dev/advisories/check-point-reports-three-china-nexus-campaigns-linked-via-sparrow-malware/https://vulnpocalypse.dev/advisories/check-point-reports-three-china-nexus-campaigns-linked-via-sparrow-malware/Wed, 11 Nov 2026 12:00:00 +0000The Hacker News reports Check Point links three China-nexus espionage clusters via Sparrow malware; review indicators and sideloading alerts.breachendpointnetwork-edgewebhttps://vulnpocalypse.dev/advisories/apple-ios-2721-and-macos-patches-fix-imessage-and-bluetooth-flaws/https://vulnpocalypse.dev/advisories/apple-ios-2721-and-macos-patches-fix-imessage-and-bluetooth-flaws/Wed, 11 Nov 2026 12:00:00 +0000Apple fixed iMessage group chat, Bluetooth and AirPlay pairing flaws in 27.2.1 and sibling releases; update your Apple devices.exploitedendpointhttps://vulnpocalypse.dev/advisories/n-able-n-central-offline-33-alleged-zero-days-able2shell/https://vulnpocalypse.dev/advisories/n-able-n-central-offline-33-alleged-zero-days-able2shell/Wed, 11 Nov 2026 12:00:00 +0000A researcher published exploit code for 33 unpatched N-central flaws; N-able took hosted N-central offline and told on-prem users to shut down pending a fixexploitedenterpriseendpointhttps://vulnpocalypse.dev/advisories/fake-github-security-tool-repos-spread-asyncrat-doctor-web-reports/https://vulnpocalypse.dev/advisories/fake-github-security-tool-repos-spread-asyncrat-doctor-web-reports/Wed, 11 Nov 2026 12:00:00 +0000Doctor Web reports fake GitHub security tool repos infected over 2,000 PCs; inspect build steps before running any cloned project.supply-chainopen-sourceendpointcryptohttps://vulnpocalypse.dev/advisories/armorsteal-python-malware-kit-steals-data-and-mines-crypto-seqrite-reports/https://vulnpocalypse.dev/advisories/armorsteal-python-malware-kit-steals-data-and-mines-crypto-seqrite-reports/Wed, 11 Nov 2026 12:00:00 +0000Seqrite reports Armorsteal, a Python kit that steals data and mines crypto on Windows; check for its scheduled tasks and Defender exclusions.ecosystemendpointcryptohttps://vulnpocalypse.dev/advisories/claude-dispatch-unpatched-rce/https://vulnpocalypse.dev/advisories/claude-dispatch-unpatched-rce/Wed, 11 Nov 2026 12:00:00 +0000A browser extension on claude.ai can drive Claude Dispatch to run commands on connected desktops. Anthropic closed it as a duplicate and won't fix it.ai-toolsai-toolsendpointhttps://vulnpocalypse.dev/advisories/tata-motors-connected-car-app-flaws/https://vulnpocalypse.dev/advisories/tata-motors-connected-car-app-flaws/Wed, 11 Nov 2026 12:00:00 +0000CERT-In CIVN-2026-0537 details four high-severity flaws in Tata Motors iRA apps that let attackers impersonate car owners. Patched in iRA 2.0 26.8.2 / iRA.ev.exploitedendpointwebhttps://vulnpocalypse.dev/advisories/openai-gpt6-cyber-948-linux-flaws/https://vulnpocalypse.dev/advisories/openai-gpt6-cyber-948-linux-flaws/Wed, 11 Nov 2026 12:00:00 +0000OpenAI's GPT-6 Cyber built 948 working Linux kernel root exploits and reported 81 high-severity Firefox flaws, all disclosed for patching.ai-toolsai-toolsopen-sourceendpointhttps://vulnpocalypse.dev/advisories/fake-gta-vi-download-sites-push-malware-and-crypto-scams-ahead-of-the-november-1/https://vulnpocalypse.dev/advisories/fake-gta-vi-download-sites-push-malware-and-crypto-scams-ahead-of-the-november-1/Wed, 11 Nov 2026 12:00:00 +0000Netcraft found fake GTA VI leaked builds, early access and mobile downloads that deliver flagged malware or demand crypto before the November 19 launch.ecosystemendpointcryptowebhttps://vulnpocalypse.dev/advisories/apt29-watering-hole-campaign-serves-n-day-ios-and-android-exploits-via-hacked-si/https://vulnpocalypse.dev/advisories/apt29-watering-hole-campaign-serves-n-day-ios-and-android-exploits-via-hacked-si/Wed, 11 Nov 2026 12:00:00 +0000Russia-linked APT29 used hacked sites, cloned domains and the Plerdy tracker to serve patched-flaw exploits to out-of-date iPhones and Android phones.supply-chainendpointwebhttps://vulnpocalypse.dev/advisories/chrome-157-fixes-213-security-bugs-7-rated-critical-in-desktop-and-android-build/https://vulnpocalypse.dev/advisories/chrome-157-fixes-213-security-bugs-7-rated-critical-in-desktop-and-android-build/Wed, 11 Nov 2026 12:00:00 +0000Google released Chrome 157 with 213 security fixes, seven rated critical, and has not said any of them are exploited in the wild.exploitedwebendpointhttps://vulnpocalypse.dev/advisories/3am-ransomware-encrypts-37-machines-in-uk-school-estate-in-suspected-ai-assisted/https://vulnpocalypse.dev/advisories/3am-ransomware-encrypts-37-machines-in-uk-school-estate-in-suspected-ai-assisted/Wed, 11 Nov 2026 12:00:00 +0000A 3AM ransomware affiliate encrypted 37 machines in a UK school estate in September 2026, with Bitdefender suspecting AI-assisted command retries.ai-toolsenterpriseendpointai-toolshttps://vulnpocalypse.dev/advisories/paprat-bitter-espionage-south-asia/https://vulnpocalypse.dev/advisories/paprat-bitter-espionage-south-asia/Wed, 11 Nov 2026 12:00:00 +0000Fortinet says the Bitter espionage group is spreading a new backdoor, PapRAT, in South Asia using malicious VHDX disk images, shortcut files and MSI installers.breachendpointenterprisehttps://vulnpocalypse.dev/advisories/google-xcpe-android-botnet/https://vulnpocalypse.dev/advisories/google-xcpe-android-botnet/Wed, 11 Nov 2026 12:00:00 +0000Google and partners took down XCPE, a firmware backdoor that turned over 1.3 million Android set-top boxes into a botnet, and banned maker Videostrong.breachendpointhttps://vulnpocalypse.dev/advisories/android-november-2026-update-fixes-critical-zero-click-rce-cve-2026-58868-in-fra/https://vulnpocalypse.dev/advisories/android-november-2026-update-fixes-critical-zero-click-rce-cve-2026-58868-in-fra/Wed, 11 Nov 2026 12:00:00 +0000Google's November 2026 Android bulletin fixes 216 flaws, including critical zero-click RCE CVE-2026-58868 on Android 14 through 17.exploitedendpointenterprisehttps://vulnpocalypse.dev/advisories/volta-ai-infostealer/https://vulnpocalypse.dev/advisories/volta-ai-infostealer/Wed, 11 Nov 2026 12:00:00 +0000Cisco Talos found VOLTA, a Windows infostealer that grabs credentials, crypto wallets and Gmail data, then asks Claude, Kimi or Gemini to rank the victim.ai-toolsendpointai-toolshttps://vulnpocalypse.dev/advisories/solanacry-fake-solana-github-repo-lures-ai-coding-agents-hackread-reports/https://vulnpocalypse.dev/advisories/solanacry-fake-solana-github-repo-lures-ai-coding-agents-hackread-reports/Wed, 11 Nov 2026 12:00:00 +0000Hackread reports a fake GitHub Solana starter kit tells AI agents to install NetSupport RAT; review commands before agents run them.supply-chainai-toolsopen-sourcecryptoendpointhttps://vulnpocalypse.dev/advisories/apple-warns-iphone-users-in-99-countries-of-mercenary-spyware-targeting-includin/https://vulnpocalypse.dev/advisories/apple-warns-iphone-users-in-99-countries-of-mercenary-spyware-targeting-includin/Wed, 11 Nov 2026 12:00:00 +0000Apple began sending new mercenary spyware threat notifications in 99 countries, including to German lawmakers; vendor and exploit are not confirmed.ecosystemendpointhttps://vulnpocalypse.dev/advisories/trojanized-claude-code-extension-21312-21313-on-cursor-marketplace-installs-pers/https://vulnpocalypse.dev/advisories/trojanized-claude-code-extension-21312-21313-on-cursor-marketplace-installs-pers/Wed, 11 Nov 2026 12:00:00 +0000A tampered anthropic.claude-code build on the Cursor marketplace planted an SSH key, a reverse tunnel and persistence on up to 5,000 developer machines.supply-chainai-toolsendpointhttps://vulnpocalypse.dev/advisories/sophos-reports-gold-ogre-used-ai-agents-in-aur0ra-ransomware-intrusions/https://vulnpocalypse.dev/advisories/sophos-reports-gold-ogre-used-ai-agents-in-aur0ra-ransomware-intrusions/Wed, 11 Nov 2026 12:00:00 +0000Sophos reports the GOLD OGRE group used Cursor and AI models to run Aur0ra ransomware intrusions, so check for its indicators and tighten AD defenses.ai-toolsai-toolsenterpriseendpointhttps://vulnpocalypse.dev/advisories/cursor-claude-code-extension-backdoor/https://vulnpocalypse.dev/advisories/cursor-claude-code-extension-backdoor/Wed, 11 Nov 2026 12:00:00 +0000Fake Claude Code 2.1.312 and 2.1.313 on Cursor's marketplace added an attacker SSH key and reverse tunnel. Check authorized_keys for svc-telemetry.supply-chainai-toolsendpointopen-sourcehttps://vulnpocalypse.dev/advisories/claude-code-extension-cursor-trojanized/https://vulnpocalypse.dev/advisories/claude-code-extension-cursor-trojanized/Wed, 11 Nov 2026 12:00:00 +0000A tampered Anthropic.claude-code extension (2.1.312/2.1.313) was live on Cursor's marketplace ~11 hours, planting an SSH backdoor. Rotate keys, remove it.supply-chainai-toolsendpointhttps://vulnpocalypse.dev/advisories/android-sms-of-death-wap-push/https://vulnpocalypse.dev/advisories/android-sms-of-death-wap-push/Wed, 11 Nov 2026 12:00:00 +0000One crafted WAP push SMS crashes com.android.phone on Android 12 to 16, dropping calls. Install the October 2026 patch; Android 12 and 13 get no fix.exploitedendpointopen-sourcehttps://vulnpocalypse.dev/advisories/anthropic-ai-model-chained-flaws-into-chrome-safari-android-windows-and-linux-ex/https://vulnpocalypse.dev/advisories/anthropic-ai-model-chained-flaws-into-chrome-safari-android-windows-and-linux-ex/Wed, 11 Nov 2026 12:00:00 +0000Anthropic says an unreleased model chained flaws into five working exploits for Chrome, Safari, Android, Windows and Linux, all reported and patched.ai-toolsai-toolswebendpointopen-sourcehttps://vulnpocalypse.dev/advisories/apple-backports-fix-for-exploited-coregraphics-zero-day-cve-2026-86950-to-older/https://vulnpocalypse.dev/advisories/apple-backports-fix-for-exploited-coregraphics-zero-day-cve-2026-86950-to-older/Wed, 11 Nov 2026 12:00:00 +0000Apple backported the fix for exploited CoreGraphics flaw CVE-2026-86950 to iOS 18.7.11 and iPadOS 18.7.11 for older iPhones and iPads.exploitedendpointhttps://vulnpocalypse.dev/advisories/popcorn-time-fork-updater-left-devices-open-to-hijacking-malwarebytes-reports/https://vulnpocalypse.dev/advisories/popcorn-time-fork-updater-left-devices-open-to-hijacking-malwarebytes-reports/Wed, 11 Nov 2026 12:00:00 +0000Malwarebytes reports an abandoned Popcorn Time fork updater could run attacker code, so remove Popcorn Time or Time4Popcorn from old devices.exploitedendpointopen-sourcehttps://vulnpocalypse.dev/advisories/attackers-abuse-microsoft-teams-external-chat-for-it-support-impersonation-and-m/https://vulnpocalypse.dev/advisories/attackers-abuse-microsoft-teams-external-chat-for-it-support-impersonation-and-m/Wed, 11 Nov 2026 12:00:00 +0000Arctic Wolf saw over 400 incidents where attackers used external Teams chats and email bombing to get remote access and run payloads within 15 minutes.ecosystementerpriseendpointcloud