Attackers could exploit the flaws for remote code execution, credential theft, and administrator account creation.
The post N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days appeared first on SecurityWeek.
https://www.securityweek.com/n-able-takes-n-central-offline-as-researcher-drops-over-30-zero-days/
Claude Code is leaking sensitive information on public GitHub instances thanks to a partial oversight in the way its settings files are handled. That’s the finding of AI security researchers at Apiiro, who discovered thousands of secrets, including database passwords, API tokens, and root logins, amid Claude Code settings files embedded in GitHub repositories.
The leak stems from the way Claude Code handles user approval for automated shell commands. When a user chooses the “Yes, and don’t ask again” option to approve running a command, that choice gets stored as part of a rule in the local “.claude/settings.local.json” file on the user’s computer. That rule is sometimes coded as a pattern, but the command itself is often written to that settings file as is, including any sensitive information that may be embedded within it.
This isn’t really a significant security issue if the settings file stays on the user’s local machine (assuming that machine doesn’t become compromised itself, of course). And Anthropic notes in its Claude Code documentation that this particular settings file gets added to the developer’s global .gitignore list, which usually prevents it from being shared publicly.
But that .gitignore setting isn’t reflected at the repo level, meaning the sensitive file can be uploaded accidentally if a repo is cloned to another machine or a folder becomes a repo later, for instance. In many cases, Claude Code itself will commit changes to the settings file without the user’s input, Apiiro writes.
Apiiro’s researchers found over 100,000 cases where Claude Code’s local settings file had been uploaded to a public GitHub repository. Of these, only about 1,100 from 63 different organizations contained secrets such as public API tokens, database passwords, or private keys. Even after these files are discovered and removed from a repository, the secrets can persist in forks of the original project if a GitHub user isn’t careful.
https://arstechnica.com/ai/2026/11/claude-code-settings-files-expose-thousands-of-secrets-on-github/
Online fashion retailer Revolve has informed the Indiana Attorney General’s Office that 1,515,073 individuals were impacted by the data breach it disclosed in October.
The company revealed the incident on October 29 in a filing with the US Securities and Exchange Commission (SEC). It started sending notification letters to impacted customers around the same time.
Revolve had not publicly shared a total. Its notices to regulators in Iowa, Massachusetts, South Carolina, Texas, and Vermont covered roughly 197,000 people combined.
The retailer says an unauthorized party broke into some of its systems, including its e-commerce platform, on September 11. Per the Indiana Attorney General’s records, Revolve became aware of the intrusion on September 29.
According to the company, the intruder may have relied on “automated means” to collect customers’ names and contact information, including mailing addresses, along with their card numbers and expiration dates.
The exposure is limited to shoppers who chose to store a payment method in their online accounts.
Revolve reported the attack to federal law enforcement and enlisted external cybersecurity experts to help with its response.
The company has yet to explain how the hackers got into its systems. So far, the attack has not been publicly claimed by any hacker group.
Related: Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers
Related: Amplifon Americas Data Breach Impacts 1.3 Million
Related: Over 3 Million People Hit by Frontline Education Data Breach
https://www.securityweek.com/revolve-puts-data-breach-victim-count-at-1-5-million/
Threat actors are exploiting Plex2Shell to hack into Plex Media Server applications on QNAP NAS devices, Taiwanese storage and networking solutions provider QNAP warns.
Plex2Shell is a chain of four vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656) in Plex Media Server that was patched this summer.
Widespread exploitation of the four-flaw chain started in mid-October, after technical details and proof-of-concept (PoC) code were published.
Successful exploitation of Plex2Shell does not require valid credentials and could allow attackers to execute arbitrary code on exposed servers, with the privileges of the Plex service.
Plex Media Server is available as a third-party application to QNAP NAS users, through the official App Center.
“QNAP has received reports from some users that Plex Media Server on their NAS appears to have been compromised through these vulnerabilities,” the Taiwanese firm warned on Friday.
“The QNAP Technical Support team is assisting affected users and has confirmed that no data loss has occurred. The QNAP Product Security Incident Response Team (QNAP PSIRT) has confirmed that the vulnerabilities exist only in Plex Media Server; QTS, QuTS hero, and other QNAP operating systems are not themselves affected,” it added.
QNAP NAS users are advised to update to Plex Media Server version 1.43.3 or later as soon as possible.
Devices accessible from the internet should be considered potentially compromised and Plex should be reinstalled, QNAP says, adding that the passwords for both Plex and the NAS should be immediately rotated.
“If you do not need remote access to Plex, disable Plex Remote Access and do not forward port 32400. If you do need remote access, use a VPN instead. Also make sure QTS or QuTS hero and all installed apps are up to date,” QNAP says.
The company has published a step-by-step remediation guide to help users identify and respond to potential compromises.
Related: Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH
Related: Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical
Related: Critical Node-RED Flaw Exploited in Attacks
Related: Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
https://www.securityweek.com/plex2shell-exploited-against-qnap-nas-users/
Its multi-agent AI platform generates the telemetry an attack would produce to fix gaps in enterprise defenses.
The post Brava Security Emerges From Stealth With $15 Million in Funding appeared first on SecurityWeek.
https://www.securityweek.com/brava-security-emerges-from-stealth-with-15-million-in-funding/
An Estonian newspaper recently revealed that a British soldier disobeyed a direct order to remove the SIM card from his cellphone before being deployed to a part of Estonia, approximately 90 miles west of the Russian border.
As a result of his refusal to engage in this element of operational security (opsec), the soldier, Daniel Barton-Kennedy, had his phone hacked, and nude photos of himself were stolen and used as blackmail against him.
Eventually, Barton-Kennedy was court-martialed for disobeying a lawful command, pled guilty, was reduced in rank, and ordered to serve 10 months in detention.
https://arstechnica.com/security/2026/11/british-soldier-ignored-order-to-pull-his-sim-card-then-got-blackmailed/
SonicWall has patched a SonicOS vulnerability that can be used to bypass SAML authentication, warning customers that it may have been exploited in attacks.
Tracked as CVE-2026-19868, the flaw affects the SSL VPN component of SonicOS, the operating system that runs on SonicWall firewalls. It’s one of seven vulnerabilities described in an advisory published on November 6.
“An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA),” reads SonicWall’s description of CVE-2026-19868.
According to the vendor, an SSL VPN is exposed only if SAML-based login is enabled. CVE-2026-19868 has a CVSS score of 7.1, which puts it in the high-severity range. The flaw was reported by Ryan Harris of The Electronic Office.
SonicWall said its product security team “has investigated a report indicating potential exploitation of this vulnerability.”
CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalog on the same day. Under Binding Operational Directive 26-04, federal agencies must address it by November 20.
Neither the vendor nor CISA has shared any details about the suspected attacks. It’s also unclear whether the flaw was exploited as a zero-day, before a patch became available.
Impacted devices include Gen7 TZ, NSa, NSsp and NSv firewalls with SonicOS 7.3.3-7015 or older. Gen8 TZ, NSa and NSv firewalls with SonicOS 8.2.2-8015 or older are also affected.
SonicOS versions 7.3.4-7013 and 8.2.3-8015 resolve the issue, and there are no workarounds. “Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks,” SonicWall said.
SonicWall’s advisory doesn’t mark any of the other six flaws as exploited. Two of them, each with a CVSS score of 8.8, affect the SonicOS management interface. One is a permissive cross-domain policy issue and the other is a session validation bug.
Under certain circumstances, a remote attacker could abuse either one without logging in to take unauthorized actions.
Three of the remaining flaws are pre-authentication buffer overflows in the SSL VPN service and the TACACS+ authentication client. Attackers could use them to launch DoS attacks at the application level.
The last one is a weak password hashing issue in virtual appliances. An attacker who already has high-privileged local access could exploit it to obtain a platform credential, which gives access to some of the platform’s settings.
Threat actors often exploit SonicWall product vulnerabilities. CISA’s KEV catalog currently includes 20 security holes, but the agency has yet to add CVE-2026-102255, which hackers started targeting last month, just days after its disclosure.
Related: Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws
Related: SonicWall Warns of Two SMA1000 Zero-Days Exploited in Attacks
Related: SonicWall and Splunk Patch Critical Vulnerabilities
https://www.securityweek.com/sonicwall-patches-exploited-sonicos-bug-that-weakens-vpn-logins/
Blockchain analysis firm Chainalysis said that hackers have obtained sensitive personal information—including names, usernames, password hashes, and live tokens—for all of its users following a breach of its network security.
The accomplishment could be a major coup for the attackers. Both Chainalysis and public sources have revealed a long list of high-profile customers, including government agencies such as the FBI, US Immigration and Customs Enforcement agency, and the US Air Force, as well as private companies such as Microsoft, Coinbase, and Barclays. It’s unclear if the data theft exposed customers to additional threats.
Last Friday, Chainalysis said it had been the target of a cybersecurity incident in October that was similar to the hacks of other platforms during the same month. The external actor used AI agent-assisted offensive techniques to gain unauthorized access to Chainalysis systems and internal tools. An email the company sent to affected customers said some “non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on our platform were accessed.” It’s not clear why the company considered such information “non-sensitive.”
https://arstechnica.com/security/2026/11/chainalysis-says-hackers-stole-credentials-and-tokens-for-all-of-its-customers/
The emergency package comes after dozens of companies and government agencies were hit by unauthorized access to their systems and leaks of client data, prompting uneasiness across Japan.
The post Japan Announces Emergency Cybersecurity Package Following a Wave of Attacks appeared first on SecurityWeek.
https://www.securityweek.com/japan-announces-emergency-cybersecurity-package-following-a-wave-of-attacks/
A camera on a tower doesn’t physically stop a thief; it changes what they think will happen next.
https://www.securitymagazine.com/blogs/14-security-blog/post/102650-cameras-only-deter-people-who-believe-theyre-being-watched