SECNEWS.co.uk https://validator.w3.org/feed/docs/rss2.html 2026 CVE count passes 100,000: what it means for UK disclosure Cohere buys London AI code-review start-up cubic Italy fines Meta €805m over Facebook’s Android gallery access Mior and Skyfall attacks let rogue cloud hosts break AMD SEV-SNP VMs Follow-up: Fireworks key let attackers breach Cursor, plant extension Citrix patches 28 NetScaler flaws, one hitting every default install Trezor confirms cellular implants in reseller-sold Safe 5 wallets Google Project Zero to disclose bugs after 30 days, fixed or not Drone maker Quantum Systems hit by poisoned QBase software update Microsoft probes SignDrop zero-day dropped amid bounty feud Microsoft 365 outage: early estimate puts cyber losses at $300m-$500m FaceStealer: North Korea replays stolen webcam clips in fake calls ICO logs record 1,371 cyber breach reports in a single quarter Darktrace: stolen Claude keys can turn Claude Code into an implant Apify breach exposes customer 2FA recovery codes and GitHub tokens Check Point gateway zero-day chained with PHP2Shell to wipe ESXi hosts Attackers turn GSocket relay into hard-to-block C2 on Linux servers OpenAI pays initial $1,000 for Codex flaw that risked npm backdoor SilentAir: state hackers hijack telcos to snoop on calls and 2FA texts UK and France set first rules for spyware firms, 14 states sign up Silent Lynx ran Hermes AI agent to loot Tajik government files ICO tells 200+ health chiefs to vouch for record snooping controls EU security vendors’ EMEA sales up 35% as sovereignty drives buying Chromium tracker slip let researcher fake a $1.33m Chrome bounty Lego pulls BrickLink marketplace offline over ‘unusual activity’ China-linked operator used Cairn AI agents to breach 10 organisations Qlik Sense servers hit again as attackers stage Veeam, ActiveMQ kits wfx-loot: 4,837 hijacked GitHub accounts plant CI secret stealer VulnCheck: Anthropic’s Glasswing logs 38,000 findings, only 217 fixed Unverified: n0n leaks data it claims came from Expedia SAP fixes four CVSS 10 flaws, including ICM2SHELL and ProxyGate Hijacked MSP ScreenConnect panels push rogue clients to 288 PCs ZDI drops 47 Meta AI library zero-days after 230 days unfixed Maersk confirms data theft from legacy system it inherited 35,000 Grok-built apps left open to anyone, some leaking staff data NCSC launches CyAS scheme to assure red teams for CNI and government Microsoft admits spam rule change blocked legit mail to Outlook.com Chubb: UK mid-market ranks cyber top risk, few tailor their cover Xen Orchestra flaw exploited to grab hypervisor admin rights Mittwald MCP server breach went unseen for eight days: IR lessons Microsoft to switch on Claude in UK Copilot by default on 9 December Saepio buys fintech security consultancy Remitech in second deal Binance disputes ShinyHunters claim of 335m stolen user records Editing under 10 neurons can backdoor AI agents, Microsoft warns Peers table 24-hour customer alerts and AI incident reporting November Patch Tuesday: exploited Outlook zero-day leaks NTLM hashes Leaked iPhone exploit kits now hit rank-and-file staff, says iVerify ENISA’s NIS2 report: what EU cyber gaps mean for UK firms Vanta to buy AI agent security firm Pillar in reported $150m deal Researcher drops iOS sandbox escape, forgoing bounty over Apple delay