Skip to main content
IMMUNITYSEC

Cybersecurity News & Intelligence

News on actively exploited vulnerabilities, hacking and extortion campaigns, AI security incidents, and patching priorities, written for a general tech audience.

Updated

Browse by Category

4 categories

AI Security News & Analysis

3 articles

News and analysis of security incidents involving large language models, AI agents, and AI infrastructure. Covers prompt injection, reward hacking, agent sandbox escapes, supply chain attacks through AI coding agents, and the mitigations that contain them.

Defensive Engineering News & Analysis

3 articles

News on how organizations respond to actively exploited vulnerabilities: patch deadlines set through the CISA Known Exploited Vulnerabilities catalog and federal directives, checks for compromise after an attack, and the guidance vendors and agencies publish.

Threat Intelligence News & Analysis

8 articles

News on active threat actors and campaigns, including state-sponsored operations, data theft and extortion, and law enforcement takedowns. Articles cover who was targeted, what the attackers took, how companies and agencies responded, and the advice that followed.

Vulnerability News & CVE Analysis

4 articles

News on serious security flaws in widely used software and services. Articles explain in plain terms what each flaw allows, which products and versions are affected, whether attackers are exploiting it in the wild, and which updates and vendor guidance fix it.

Latest Articles

18 total
Threat Intelligence News & Analysis
2026-11-04•4 min read

Sekoia says Russia's APT29 hijacked websites and a Ukrainian analytics service to target unpatched phones

French security company Sekoia said on November 4, 2026, that APT29, a hacking group widely attributed to Russia's foreign intelligence service, ran a campaign that tried to break into unpatched iPhones and Android phones whose owners visited compromised or fake websites. For one week from August 27, the attackers also tampered with a tracking script from Plerdy, a Ukrainian analytics service loaded by thousands of websites. Every flaw the attackers used had already been fixed, and Sekoia said fully updated devices are safe.

Vulnerability News & CVE Analysis
2026-11-04•3 min read

CISA says attackers are exploiting WordPress flaw that lets them run code during updates

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) said on November 3, 2026, that attackers are exploiting CVE-2026-119977, a flaw in WordPress core that could let someone without an account run code on a web server while WordPress installs a full update. WordPress fixed the flaw in version 7.1.4 on October 28, 2026, and CISA gave U.S. federal civilian agencies until November 6 to apply the fix.

Threat Intelligence News & Analysis
2026-11-03•6 min read

Attackers heat up fridges and freezers at more than 100 stores across Europe, spoiling food

Attackers remotely changed the settings on refrigeration controls at more than 100 supermarkets and food shops in Belgium, Sweden, Ireland, Luxembourg, the Netherlands, Estonia, and other European countries overnight into Monday, November 2, 2026, warming fridges and freezers and forcing some stores to throw away food. The attacks followed a similar wave that hit hundreds of French supermarkets three weeks earlier. No one has claimed responsibility, and Belgium's federal prosecutor has opened a criminal investigation.

Threat Intelligence News & Analysis
2026-11-03•4 min read

Zelensky says Ukraine hacked Russia's emergency alert app after fake nuclear warnings hit Ukrainians

Hackers hijacked Ukraine's Air Alert app late on November 1, 2026, and sent false warnings of a nuclear threat, radiation, chemical attacks, and street fighting to users across the country. Hours later, attackers sent fake alerts about launched nuclear warheads through the mobile app of Russia's Emergency Situations Ministry, which said the message reached 33 of Russia's 89 regions. Ukrainian President Volodymyr Zelensky told PBS News on November 2 that Ukraine hacked the Russian app in response to the attack on its own system.

Threat Intelligence News & Analysis
2026-11-02•5 min read

Google takes down XCPE botnet of 1.3 million Android TV boxes and bans maker Videostrong

Google said on November 2, 2026, that it and industry partners had dismantled the XCPE botnet, which enrolled more than 1.3 million set-top boxes, in late October. Google assesses with high confidence that Shenzhen device maker Videostrong Technology Co. built the backdoor into its own firmware and sold access to criminals, and it has banned the company from making certified Android devices. The backdoor remains on the boxes, and owners cannot remove it themselves.

AI Security News & Analysis
2026-11-01•4 min read

Cursor says tampered Claude Code extension in its marketplace tried to backdoor up to 5,000 users

Cursor said on October 29, 2026, that tampered versions 2.1.312 and 2.1.313 of Anthropic's Claude Code extension were available in its extension marketplace for about 11 hours that day. The tampered versions tried to install a backdoor, a hidden way for an attacker to log in to a computer. Cursor said at most 5,000 users were affected, and how the attacker published the versions remains unclear.