❌

Normal view

Received — 2 November 2026 ⏭ Security

Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers

✇The Hacker News
By: Swati Khandelwal
2 November 2026 at 11:50
Two critical flaws in Langflow could let a remote attacker with no account bypass authentication or run arbitrary code, IBM said last week. Langflow is an open-source tool for building AI agents and workflows, and its vulnerability reports go to IBM. Every release from 1.0.0 through 1.12.8 has the flaws, and the only fix is version 1.13.0. Neither flaw is in CISA's Known

Is Your SOC Ready for AI Agents? A Maturity Check Before You Deploy

✇The Hacker News
By: Unknown
2 November 2026 at 11:30
Forty percent of security teams now use AI every day, and another 56% are testing it. Only 4% have no plans to adopt it, according to Prophet Security's State of AI in Security Operations 2026 survey of more than 250 CISOs, SOC leaders and practitioners. For the teams still testing, the next decision is whether their own SOC is ready. AI SOC readiness has two parts: whether a SOC has the

Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data

✇The Hacker News
By: Swati Khandelwal
2 November 2026 at 11:08
Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged accounts, including one for a domain controller. Microsoft said in a report that it investigated two such intrusions, one of which resulted in company

Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts

✇The Hacker News
By: Ravie Lakshmanan
2 November 2026 at 10:50
Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211, where "CL" refers to cluster and "UNK" stands for unknown

New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value

✇The Hacker News
By: Ravie Lakshmanan
2 November 2026 at 05:51
Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value. Like other typical stealer families, VOLTA is equipped to harvest passwords and cookies from Chromium-based web browsers; data from Outlook profiles and Slack workspaces;

/r/netsec's Q4 2026 Information Security Hiring Thread

✇/r/netsec - Information Security News & Discussion
By: /u/netsec_burn
1 November 2026 at 17:19

Overview

If you have open positions at your company for information security professionals and would like to hire from the /r/netsec user base, please leave a comment detailing any open job listings at your company.

We would also like to encourage you to post internship positions as well. Many of our readers are currently in school or are just finishing their education.

Please reserve top level comments for those posting open positions.

Rules & Guidelines

Include the company name in the post. If you want to be topsykret, go recruit elsewhere. Include the geographic location of the position along with the availability of relocation assistance or remote work.

  • If you are a third party recruiter, you must disclose this in your posting.
  • Please be thorough and upfront with the position details.
  • Use of non-hr'd (realistic) requirements is encouraged.
  • While it's fine to link to the position on your companies website, provide the important details in the comment.
  • Mention if applicants should apply officially through HR, or directly through you.
  • Please clearly list citizenship, visa, and security clearance requirements.

You can see an example of acceptable posts by perusing past hiring threads.

Feedback

Feedback and suggestions are welcome, but please don't hijack this thread (use moderator mail instead.)

submitted by /u/netsec_burn
[link] [comments]

r/netsec monthly discussion & tool thread

✇/r/netsec - Information Security News & Discussion
By: /u/albinowax
1 November 2026 at 14:29

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

submitted by /u/albinowax
[link] [comments]

CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key

✇The Hacker News
By: Swati Khandelwal
1 November 2026 at 08:51
A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To do it, the attacker had to reach their HTTPS API over the network and have the trusted client's public certificate. Once in, the attacker would act as that client, with access to the cluster and its virtual machines. If the impersonated account is

Weekly Update 528: Reading AI-generated Code & the Economics of Solar

✇Troy Hunt
By: Troy Hunt
1 November 2026 at 07:35
Weekly Update 528: Reading AI-generated Code & the Economics of Solar

By pure timing coincidence, the Proton CEO's AI @ Proton, Engineering Manifesto made headlines around the same time as this week's video. The guy's management style and choice of language have really rubbed a lot of people up the wrong way, and deservedly so, IMHO. However... this section of his screed really resonated with me:

Your job has fundamentally changed. It is no longer to write code, and LLMs are not here to help you write better code faster. Your job is to help the LLM write better code faster.

Dev jobs as we know them are gone. Dead. And if you disagree, you're in for a shock in the very near future. But at the same time:

I don't remember the last time tech has been this exciting. It's white hot right now. Anyone who loves technology and computers is probably having a great time right now.

— Jack Rhysider 🏴‍☠️ (@JackRhysider) October 30, 2026

Yes! This! Not handwriting code "old school" isn't something to lament; rather, our unprecedented ability to innovate, create and build things that are meaningful to us is something to be enormously excited about. Anyway, on that topic:

Weekly Update 528: Reading AI-generated Code & the Economics of Solar
Weekly Update 528: Reading AI-generated Code & the Economics of Solar
Weekly Update 528: Reading AI-generated Code & the Economics of Solar
Weekly Update 528: Reading AI-generated Code & the Economics of Solar

Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script

✇The Hacker News
By: Swati Khandelwal
1 November 2026 at 07:25
Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company. Polymarket says it is refunding about $2.7 million to 726 affected wallets. Blockchain records show crypto worth about $2.64 million reached

FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist

✇The Hacker News
By: Ravie Lakshmanan
1 November 2026 at 07:03
The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets from Binance to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899. The FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI),

NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection

✇The Hacker News
By: Ravie Lakshmanan
1 November 2026 at 07:02
Cybersecurity researchers have disclosed details of what has been described as a "highly sophisticated infection chain" targeting government organizations in Asia. The activity, detailed by Kaspersky this week, targeted a custom Windows 10 build used exclusively by government entities in Asia and involves the deployment of a previously undocumented .NET assembly-loading framework codenamed

Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data

✇The Hacker News
By: Ravie Lakshmanan
31 October 2026 at 12:01
American blockchain analysis firm Chainalysis said it was the target of a cybersecurity incident in which an external actor accessed non-sensitive customer data. However, the company noted that the breach did not result in unauthorized access to its investigation content, authentication credentials, or session tokens. "This month, Chainalysis detected an external actor using offensive agentic

Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims

✇WIRED
By: Lily Hay Newman · Matt Burgess
31 October 2026 at 12:00
Named Volta-Autodoxer, the recently uncovered malware uses AI tools to collect troves of data about victims, from login credentials and credit card numbers to Discord sessions and UberEats receipts.

Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

✇The Hacker News
By: Ravie Lakshmanan
31 October 2026 at 08:27
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. The vulnerabilities are listed below - CVE-2026-111357 (CVSS score: 8.8) - A missing authentication for a critical function vulnerability that could allow a

❌