November 13, 2026

What happened

IBM’s Digital Sovereignty Index reports that 94% of surveyed enterprises experienced at least one digital sovereignty challenge during the past three years. [1]

Among affected enterprises, 91% had to demonstrate retained control during their most challenging event. [2]

Among affected enterprises, 81% had to provide formal evidence of control to regulators, auditors, customers, or internal stakeholders. [2]

The report defines digital sovereignty as an organization’s ability to retain control and provide credible evidence of that control across critical AI-related areas; the supplied text truncates the remainder of the definition. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   94% of surveyed enterprises experienced at least one digital sovereignty challenge in the past three years, according to IBM’s Digital Sovereignty Index.

2. [2]

   Of those affected, 91% were required to demonstrate that they retained control during their most challenging event, and 81% had to provide formal evidence to regulators, auditors, customers or internal stakeholders.

3. [3]

   The report defines digital sovereignty as an organization’s ability to retain control and provide credible evidence of that control across critical AI, … More → The post Digital sovereignty leaves enterprises chasing their own audit trails appeared first on Help Net Security .

Read the original article →

What happened

A fixed-release MCP server on an administrator’s workstation ran with 15 different dependency sets over five weeks without configuration changes. [1]

James Lagermann, Corelight’s Director of Technical Alliances, found the dependency drift in the company’s lab. [2]

Why it matters

Twenty-three of the server’s 69 packages changed versions, including cryptography, a JSON Web Token library and the MCP software development kit. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   An MCP server configured to run one fixed release on an administrator’s workstation ran with 15 different sets of dependencies over five weeks, with its configuration untouched.

2. [2]

   James Lagermann, Director of Technical Alliances at Corelight, found the drift in his company’s lab.

3. [3]

   Twenty-three of the server’s 69 packages changed versions, including the cryptography library, the JSON Web Token library and the MCP software development kit itself.

Read the original article →

What happened

N-able said it was taking additional precautions after public disclosure of flaws tracked as 4EverAble2Shell and Agent2Shell. [1]

N-able said it was restricting certain N-central features and integrations. [2]

Known limitations

N-able said the restrictions may affect some functionality while remediation was being completed; the supplied statement is truncated before its conclusion. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   N-able on Thursday said it's taking additional precautions in the wake of public disclosure of a new set of flaws tracked as 4EverAble2Shell and Agent2Shell.

2. [2]

   "We are restricting certain N-central features and integrations," the company said in a Thursday update.

3. [3]

   "These measures may affect some functionality, but we believe taking additional precautions while remediation is completed is the

Read the original article →

What happened

Material Security reported tracking suspected North Korean fake IT workers through monitored hiring pipelines and counting 27 personas that reached onboarding over one year. [1]

The personas were fabricated job seekers with résumés and faces who applied for remote engineering roles. [2]

Why it matters

At one company, a persona that reached onboarding was associated with about 277,000 files containing Social Security numbers being shared company-wide or by public link. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Material Security followed suspected North Korean fake IT workers through the hiring pipelines of organizations it monitors and counted 27 personas that reached onboarding over one year.

2. [2]

   The personas are fabricated job seekers, complete with résumés and faces, applying for remote engineering roles.

3. [3]

   At one company where a persona got that far in the past month, about 277,000 files containing Social Security numbers were shared company-wide or by public link.

Read the original article →

What happened

Attackers used a fake Microsoft Teams meeting scheduler to persuade an employee at a construction company to approve a device-code sign-in. [1]

The attackers obtained a valid session token before Huntress’s security operations center identified the incident. [2]

The victim entered the code and completed MFA. [5]

Why it matters

Device-code phishing abuses a legitimate Microsoft sign-in flow: the attacker initiates sign-in, receives a short code, and persuades the victim to enter it on Microsoft’s genuine device-login page. [3] [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Attackers used a fake Microsoft Teams meeting scheduler to trick an employee at a construction company into approving a device code sign-in.

2. [2]

   They got a valid session token before Huntress’s security operations center identified the incident.

3. [3]

   Device code phishing abuses a real Microsoft sign-in flow.

4. [4]

   The attacker starts a sign-in, gets a short code back, and persuades the victim to type it into Microsoft’s genuine device login page.

5. [5]

   The victim enters the code, completes MFA … More → The post How attackers turned a Teams meeting booking into a device code phishing trap appeared first on Help Net Security .

Read the original article →

What happened

North Korean state hackers reportedly stole more than $400 million in cryptocurrency over 18 months by luring targets into fake Zoom and Teams calls using webcam footage of earlier victims. [1]

The FBI calls the scheme “FaceStealer.” [2]

Why it matters

The FBI seized more than 900 recordings and warned crypto and web3 workers and open-source maintainers about the scheme on November 12. [3]

Known limitations

The supplied evidence does not describe the infection mechanism, post-compromise access, or recommended defensive actions. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   North Korean state hackers have stolen more than $400 million in cryptocurrency over the past 18 months by pulling targets into fake Zoom and Teams calls filled with webcam footage of earlier victims.

2. [2]

   The FBI calls the scheme FaceStealer.

3. [3]

   It has seized more than 900 of those recordings, and on November 12 it warned crypto and web3 workers and open-source maintainers about the scheme.

4. [4]

   Source: FBI Every successful call infects the target and records them, … More → The post Stolen webcam clips of 900+ victims feed North Korea’s $400 million fake Zoom scheme appeared first on Help Net Security .

Read the original article →

What happened

C++26’s Draft International Standard failed its ISO ballot after a dispute over the Contracts feature, which was the major sticking point for opposing voters. [1] [2] [3] [4]

Contracts add preconditions, postconditions, and assertions that can catch programming errors that might otherwise cause undefined behavior. [5] [6]

Why it matters

The ballot received 13 votes in favor, 9 against, and 12 abstentions; the negative-vote share exceeded ISO’s requirement of no more than 25 percent. [2] [3]

Critics led by Bjarne Stroustrup characterized the current Contracts proposal as hastily implemented, insufficiently tested, complex, and potentially better implemented as a library. [7] [8] [9] [10]

The failed late-stage ballot puts C++26’s expected release this year at risk and could result in the informal name C++27 if release slips to next year. [11] [12] [13]

Known limitations

The evidence does not establish which option WG21 will choose or whether C++26 will ship this year. [11] [14] [15] [16] [17]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The next version of the C++ programming language may be delayed at the last minute due to a dispute over a security-enhancing Contracts feature.

2. [2]

   In October, the Draft International Standard (DIS) of C++26 failed its ISO ballot — the next-to-last stage in the International Organization for Standardization’s approval process during which a standard's technical details are formally ratified by a set of national standards bodies.

3. [3]

   The ballot saw 13 votes cast in favor, 9 against, and 12 abstentions, failing to meet the ISO requirement of having no more than 25 percent negative votes.

4. [4]

   Contracts was the major sticking point for those voting nay.

5. [5]

   Contracts dispute Contracts allow developers to add preconditions and postconditions to code, as well as assertions that check whether specified conditions hold.

6. [6]

   Such checks can help catch programming errors that might otherwise lead to undefined behavior.

7. [7]

   One group backs the C++ creator Bjarne Stroustrup, who is against the technology in its present form in grounds it was hastily implemented.

8. [8]

   But Stroustrup roasted the revised proposal (P2900) that made it into C++26.

9. [9]

   “The P2900 contracts and extensions aim to change the nature of C++ and are an existential threat to C++, adding complexity and bloat,” Stroustrup and his colleagues wrote in a paper last August.

10. [10]

    They noted that the implementation is messy, outdated, not sufficiently tested, and could be more effectively implemented as a library.

11. [11]

    With the ballot failing at this late point of the standardization process – a rarity in C++ history – the language risks missing its expected shipping date of this year.

12. [12]

    That outcome may force everyone to refer to the new version as “C++27” rather than C++26.

13. [13]

    (That’s only the informal name; the official name of this eighth version of the language, should it be released next year, would be “ISO/IEC 14882:2027.”) ISO C++ working group WG21 is meeting next week in Búzios, Brazil, for the confronto final.

14. [14]

    According to a blog post from Thibault Ricord-Marchal, a software engineering consultant at the Paris-based Margo consultancy, the group faces a number of choices.

15. [15]

    They can carve Contracts out of the spec so the rest of C++26 can ship.

16. [16]

    Another option is moving Contracts into a separate technical specification, where work can continue to refine the technology.

17. [17]

    Or they could do a minor revision, vote again and hope the balmy Brazilian weather chills everyone out.®

Read the original article →

What happened

An unknown threat actor targeted unpatched Check Point Security Gateways through PHP2Shell vulnerabilities, then used a previously unreported local privilege-escalation flaw in Gaia OS to deploy the TSGA backdoor. [1]

Check Point detailed activity that began on October 30, 2026, and targeted Israeli organizations; the supplied text truncates the description of the broader follow-up. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   An unknown threat actor has been observed targeting unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously unreported local privilege escalation flaw in Gaia OS to deploy a backdoor called TSGA.

2. [2]

   The activity, detailed by Check Point, began on October 30, 2026, and targeted Israeli organizations, with a broader follow-up

Read the original article →

What happened

OpenAI’s Daybreak combines web application penetration testing with tools intended to investigate vulnerabilities and develop fixes. [1]

Daybreak includes Red Team and Defense Factory, connecting security-weakness discovery with patching and retesting. [2]

Daybreak Red Team is offered through an early-access program and uses coordinated agents to examine application source code and context, investigate potential attacks, and verify fixes. [3]

Known limitations

The supplied evidence does not specify Daybreak’s test coverage, deployment requirements, performance, or broader availability. [1] [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   OpenAI is bringing AI agents into more of the software security process with Daybreak, pairing web application penetration testing with tools that investigate vulnerabilities and develop fixes.

2. [2]

   The two offerings, Red Team and Defense Factory, connect the work of finding security weaknesses with patching and retesting them.

3. [3]

   Red Team tests applications and verifies fixes Daybreak Red Team, offered through an early-access program, uses coordinated agents to examine application source code and context, investigate potential attack … More → The post OpenAI’s Daybreak brings AI agents to security testing and vulnerability fixes appeared first on Help Net Security .

Read the original article →

What happened

HMICFRS found a large gap in police and National Crime Agency understanding of responsible retrospective facial recognition (RFR) use, attributing it to fragmented, underdeveloped governance and legislation. [1] [2]

Investigators often treated RFR results as evidence rather than intelligence and were unaware that potential matches required further enquiries before enforcement action. [3] [4]

HMICFRS reported insufficient corroborative enquiries in some cases and said a small number of officers relied too heavily on RFR results, leading to inappropriate investigative action; practice remained inconsistent after some forces strengthened processes. [5] [6] [7]

The inspectorate found that forces too often retained custody images on the Police National Database despite guidance requiring deletion in some circumstances. [10] [11] [12]

Why it matters

HMICFRS said police forces must show that safeguards are in place, bias and data-retention risks are managed, and decisions remain subject to human judgment; it called clearer statutory frameworks, national standards, and stronger oversight essential to public confidence. [8] [9]

HMICFRS found that centralized facial-recognition teams generally provided better governance and more consistent processes. [13]

Known limitations

The inspectorate clarified that an arrest after an RFR match is not necessarily wrongful because investigators may need to rule subjects out of their inquiries. [14]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   According to a report from His Majesty's Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS), there is a large gap in understanding among police forces and the National Crime Agency about how RFR should be used in responsible policing.

2. [2]

   The inspectorate blamed "fragmented and underdeveloped" frameworks for governance and legislation.

3. [3]

   Illustrating the breadth of misunderstanding across forces, the report noted that despite the message being routinely communicated by National Police Chiefs' Council (NPCC) reps, individual investigators "often" thought RFR results constituted evidence rather than intelligence.

4. [4]

   In many cases, they are unaware that RFR results require further enquiries before enforcement action can be taken.

5. [5]

   "We found that some investigators didn't always carry out enough corroborative enquiries before acting on potential matches," the report stated.

6. [6]

   "In a small number of cases, officers relied too heavily on RFR results, which led to inappropriate investigative action.

7. [7]

   "Although some forces had strengthened their processes after such incidents, practice remained inconsistent." Later in the report, the inspectorate described the findings as "deeply concerning." Some of the excuses police staff offered included acute demands on response teams leading to reduced opportunities to carry out further enquiries before acting on RFR matches.

8. [8]

   "Police forces must be able to show that appropriate safeguards are in place, risks relating to bias and data retention are effectively managed, and decisions are still subject to human judgment," she said.

9. [9]

   "A clearer statutory framework, stronger national standards and improved governance and oversight arrangements are essential to maintaining public confidence." As well as legislative and governance-related concerns, HMICFRS also noted in its report that officers' training around the use of RFR remains inconsistent, and if improvements were made, this would lead to more effective and lawful use of RFR across the UK.

10. [10]

    Another major issue was police forces' failure to meet their image retention obligations.

11. [11]

    Forces were found too often to retain custody images taken of suspects on the Police National Database, against which many RFR queries are made.

12. [12]

    Police guidance sets out the scenarios in which custody images can and cannot be retained, and the inspectorate found that forces have failed to delete images that should have been wiped.

13. [13]

    The best forces had centralized facial recognition teams, which generally provided better governance and consistent processes.

14. [14]

    However, the inspectorate clarified that just because an arrest is made, it does not necessarily mean it is wrongful, as investigators may need to rule out subjects from their inquiries.

Read the original article →

What happened

An international police operation took down servers behind Gootloader, CastleRAT, and StealC. [1]

The three malware tools were used to gain access to computers, steal passwords, and launch ransomware attacks. [2]

Why it matters

Police seized about 6.4 million stolen logins belonging to more than 40,000 victims, according to Germany’s Federal Criminal Police Office. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   An international police operation took down servers behind Gootloader, CastleRAT and StealC this week.

2. [2]

   Criminals used the three malware tools to gain access to computers, steal passwords, and launch ransomware attacks.

3. [3]

   Police also seized about 6.4 million stolen logins belonging to more than 40,000 victims, according to Germany's Federal Criminal Police Office (BKA).

Read the original article →

What happened

The UK Information Commissioner’s Office (ICO) received and assessed more than 300 reports of medical-record snooping by healthcare staff between January and mid-October 2026. [1] [2]

The reports included staff accessing records of people they knew, browsing out of curiosity, and sharing private information with unauthorized people; the figure covers organizational reports, not confirmed breaches, and excludes cases awaiting assessment. [3] [4]

Why it matters

The reported activity involved workers misusing legitimate job-related access to view records of people they were not treating, such as neighbors or former partners, rather than necessarily hacking into systems. [5] [6]

The ICO said unauthorized health-record access can harm patients’ privacy and public trust, and reported that it has prosecuted 16 healthcare workers for snooping over the past decade. [7] [8] [9]

Known limitations

The ICO warned that it could take enforcement action against healthcare organizations whose protections are inadequate, but the source does not state that such action has been taken in connection with the 2026 reports. [10] [11] [12]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The Information Commissioner's Office (ICO) said on Thursday that it had written to more than 200 senior health leaders across the UK, warning that employees accessing records without good reason put patient privacy and public trust at risk.

2. [2]

   The ICO received and assessed more than 300 reports of medical record snooping between January and mid-October 2026.

3. [3]

   Staff were caught looking up people they knew, poking around patient files out of sheer curiosity, and sharing private information with people who had no business seeing it.

4. [4]

   The figure covers reports submitted by healthcare organizations rather than confirmed breaches, and excludes cases still awaiting assessment.

5. [5]

   The problem isn't necessarily that healthcare workers are hacking into systems, as many already have legitimate access to patient records as part of their jobs.

6. [6]

   The trouble starts when they use that access to look up someone they're not treating, whether it's a neighbor, an ex-partner, or somebody whose name has appeared in the news.

7. [7]

   "Accessing someone's health records without a legitimate reason isn't harmless curiosity.

8. [8]

   It can cause enormous distress to patients and jeopardize the vital trust people place in our health service," Arnold said.

9. [9]

   The ICO has prosecuted 16 healthcare workers for snooping through patient records over the past decade, with unauthorized access to personal information potentially amounting to a criminal offense under the Data Protection Act 2018.

10. [10]

    Arnold warned that the regulator could also take enforcement action against healthcare organizations whose protections aren't up to scratch.

11. [11]

    "I've written to chief executives across the UK asking them to personally assure me that their safeguards work in practice.

12. [12]

    Where they don't, we expect organizations to put that right," he said.

Read the original article →

What happened

Europol and police in 14 countries arrested 354 dark-web vendors and buyers in Operation TorNado, which ran from May 2025 to October 2026. [1]

Investigators targeted people who had traded on five marketplaces that were already offline: Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door. [2]

Police also targeted vendors and buyers using forums, single-vendor shops and encrypted services, although the supplied text is truncated after this point. [4]

Why it matters

The source states that users of the identified markets remained exposed after those sites went dark. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Europol and police in 14 countries arrested 354 dark web vendors and buyers in Operation TorNado, which ran from May 2025 to October 2026.

2. [2]

   Investigators went after people who had traded on five marketplaces that were already offline: Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door.

3. [3]

   Seized money (Source: Europol) The people who used those markets were still exposed after the sites went dark.

4. [4]

   Police also went after vendors and buyers on forums, single-vendor shops and encrypted … More → The post 354 dark web vendors and buyers arrested in Operation TorNado appeared first on Help Net Security .

Read the original article →

What happened

Enea identified a newly identified spying group, named SilentAir, that used hacked equipment inside Asian mobile operators to intercept calls and texts of selected people, mostly in Taiwan. [1] [2]

Enea found the group’s attack sources in at least six Asian countries and assessed with high confidence that SilentAir is a state-level actor. [2] [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A newly identified spying group used hacked equipment inside Asian mobile operators to intercept the calls and texts of selected people, mostly in Taiwan.

2. [2]

   Enea, a telecom and cybersecurity software company based in Stockholm, found the group's attack sources in at least six Asian countries and named it SilentAir this week.

3. [3]

   It assessed with high confidence that SilentAir is a state-level actor,

Read the original article →

What happened

Apple published details of Secure Exclaves, a security architecture intended to protect camera and microphone data during background processing. [1]

Apple says data processed and analyzed within Secure Exclaves cannot be accessed by the main operating system, apps, or Apple itself. [2]

Apple uses Secure Exclaves for person recognition on HomeView, Siri Recap, and Live Rewind. [3]

The architecture also protects on-screen camera and microphone indicators on iPhone 18 Pro; the supplied text is truncated after this reference. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Apple published details of Secure Exclaves, a security architecture designed to protect camera and microphone data during background processing.

2. [2]

   Apple says data processed and analyzed within Secure Exclaves cannot be accessed by the main operating system, apps, or the company itself.

3. [3]

   The company uses Secure Exclaves for person recognition on HomeView, as well as for Siri Recap and Live Rewind.

4. [4]

   The architecture also protects the on-screen camera and microphone indicators on iPhone 18 Pro, iPhone … More → The post Apple details Secure Exclaves, isolated runtimes for camera and microphone data appeared first on Help Net Security .

Read the original article →

What happened

Quantum Systems said its drones resumed operations with Germany’s military after a cyberattack led to a precautionary grounding. [1]

The company said it detected the attack in late October and reported it to relevant authorities, but disclosed few details about the intrusion. [2]

Der Spiegel reportedly said malware was detected in an update to QBase, Quantum Systems’ ground-control software; QBase supports mission planning, flight monitoring and data processing. [3] [4]

Quantum Systems said its fleet was operating normally worldwide, including in Germany and with the Bundeswehr; it said the Bundeswehr was the only customer to ground its systems as a precaution. [7] [8]

Why it matters

The malicious update reportedly reached German military and other customer servers but did not directly infect the drones. [5]

Quantum Systems said the threat was contained through its IT and security teams’ response with authorities, and said the incident’s characteristics meant end users and operators faced no risk from operating its unmanned systems. [3] [6]

Known limitations

The company disclosed few intrusion details, while Germany’s defense ministry declined to comment on the attack or its reported details. [2] [8]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Quantum Systems says its drones are flying again with Germany's military after a cyberattack prompted a precautionary grounding.

2. [2]

   The company says it spotted the attack at the end of October and reported it to the relevant authorities, but disclosed few details about the intrusion.

3. [3]

   "Through the quick measures taken and the characteristics of the incident, there is no risk in operating Quantum Systems' unmanned systems for the end users and the operators." It added that other players in the European defense industry, and those who support Ukraine's military efforts, have faced "persistent cyberattacks for years." The Bundeswehr grounded its Quantum Systems drones after malware was detected in an update to QBase, the company's QBase ground-control software, Der Spiegel reported, citing unnamed sources.

4. [4]

   QBase lets operators plan missions, monitor flights, and process data from the ground.

5. [5]

   The malicious update reportedly reached servers belonging to the German military and other customers, but did not directly infect the drones.

6. [6]

   "The threat was contained thanks to the swift response of our IT and security teams in close and transparent collaboration with the authorities," it said on Thursday.

7. [7]

   "The fleet is operating normally around the globe – including Germany and the Bundeswehr," Quantum Systems told Reuters.

8. [8]

   "The Bundeswehr was the only customer to ground their systems as a precaution." A spokesperson for Germany's defense ministry declined to comment on the attack or the reported details.

Read the original article →

What happened

Trezor said three Safe 5 wallets bought from reseller CryptoBilis contained an extra circuit-board implant capable of copying recovery phrases. [1]

The implant reads the recovery phrase from the wallet screen and sends it over a mobile network to an attacker-controlled server. [2]

Known limitations

Trezor examined one wallet in its lab and identified the other [source text is truncated]. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Three Trezor Safe 5 wallets bought from the reseller CryptoBilis contain an implant, an extra circuit board that can copy their recovery phrases, hardware wallet maker Trezor said yesterday.

2. [2]

   The implant reads the phrase from the wallet's screen and sends it over the mobile network to a server controlled by the attackers.

3. [3]

   The company examined one of the wallets in its lab, identified the other

Read the original article →

What happened

Two publicly disclosed attacks, Mior and Skyfall, allow a malicious host to read data inside AMD SEV-SNP-protected virtual machines, which are intended to keep the server operator out. [1]

Mior can additionally modify a virtual machine’s memory and forge the signed report that confirms which software it runs. [2]

Both attacks require control of the server’s hypervisor; Mior additionally requires control of the server’s BIOS. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Two attacks made public this week allow a malicious host to read data inside AMD SEV-SNP-protected virtual machines (VMs), which are built to keep the server's operator out.

2. [2]

   One of them, Mior, can also modify a VM's memory and fake the signed report confirming which software it runs.

3. [3]

   Both need control of the server's hypervisor, and Mior also needs control of the server's BIOS.

Read the original article →

What happened

PostgreSQL has a type-confusion flaw, CVE-2026-6460, that allows a database user able to create objects to run code on the server; the flaw is rated CVSS 8.8. [1] [2]

Updates released yesterday fix this flaw and 51 other security flaws. [3]

Full protection also requires rebuilding any C-language extensions installed on the server. [4]

Known limitations

The supplied evidence truncates the statement about the rights granted to code executed through the flaw. [5]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A type confusion flaw in PostgreSQL lets a database user who can create objects run code on the server.

2. [2]

   The flaw, tracked as CVE-2026-6460, has a CVSS score of 8.8.

3. [3]

   Updates released yesterday fix it, along with 51 other security flaws.

4. [4]

   Full protection from this flaw also requires rebuilding any C-language extensions installed on the server.

5. [5]

   Any code run this way has the rights of the operating

Read the original article →