Hackers Rig Websites to Raid Unpatched Phones
Hackers are turning legitimate websites into digital bear traps to swipe cookies, passwords, and other data from unpatched iPhones and Android devices. Sekoia links the campaign to Russia’s APT29 with moderate-to-high confidence. By hijacking Ukrainian analytics service Plerdy’s tracking script, the spies extended the trap to thousands of legitimate sites; simply visiting a compromised page could trigger a silent attack.
Update iOS or Android, and Chrome on Android. Every exploited flaw already had a fix, and CISA recently ordered federal agencies to patch one of the iOS bugs. A fully patched device swats this specific threat away entirely. If you think your phone got caught in the dragnet, use a safe, secondary device to kill active sessions and change your passwords.
Apparently, “Remind me later” is part of the spies’ business model.
mSecure Users Face a Password Reset Marathon
Password manager mSecure is urgently asking you to spend your weekend resetting all your credentials after detecting suspicious activity. While official details are scarce, a customer-posted support reply reveals an attacker swiped an encrypted database of current and former mSecure Cloud sync users. Naturally, developer mSeven claims there is zero proof the confidential contents were actually exposed.
Changing your master password is just the warm-up act. You’ll need to manually replace your individual logins through each service’s official app or website, starting with high-stakes targets like email, banking, and enterprise accounts. Then comes the real fun: re-enrolling two-factor authentication secrets and swapping out stored passkeys (just make sure you have an alternative sign-in method ready so you don’t lock yourself out).
Congratulations, your password manager just delegated its one job back to you.
Harvard Data Breach Hits 851,000 Email Addresses
Nearly a year after Harvard’s 2025 breach, Have I Been Pwned identified approximately 851,000 exposed email addresses.
The records included donor histories and personal details that attackers could exploit for impersonation and targeted phishing.
I think this breach raises an important question about how organizations verify someone’s identity. When attackers have access to donation histories and family details, traditional verification questions become less reliable.
Restrict bulk donor data exports and independently verify sensitive account or payment changes.
Google Patches 216 Android Vulnerabilities, Including RCE
Google’s November 2026 Android security update fixes 216 vulnerabilities, including a RCE flaw requiring no user interaction.
Other fixes address privilege escalation, information disclosure, and a denial-of-service flaw that could disrupt emergency calls.
Different manufacturer and carrier update schedules can make it difficult for security teams to maintain consistent protection across company-issued mobile devices.
Use MDM tools to monitor patch compliance, enforce security updates, and restrict corporate access until vulnerable devices are patched.
CISA Flags Actively Exploited WordPress RCE Flaw
CISA added WordPress Core vulnerability CVE-2026-119977 to its Known Exploited Vulnerabilities catalog following reports of active exploitation.
The flaw allows unauthenticated RCE during certain Core upgrades, exposing websites to potential compromise while administrators install security updates.
Security teams should require evidence of both successful remediation and a compromise assessment before considering the issue resolved.
Apply the patch, review upgrade logs for suspicious activity, and check for unauthorized files or administrator accounts.
Hacker’s AI Army Targets Emergency Services in Taiwan
A threat actor used AI agents to target organizations in 11 countries, compromising systems and exposing sensitive data in Taiwan.
This incident demonstrated how AI enables individual attackers to operate at scale.
What concerns me most is that these attacks relied on well-known weaknesses, including exposed APIs and SQL injection.
Eliminate default credentials, secure public-facing APIs, and monitor for automated scanning and exploitation attempts.
Nearly 1,000 Zyxel Switches Hacked Despite Patch
A zero-day flaw in some Zyxel GS1900 switch models allows unauthenticated local attackers to execute system commands despite June’s security patch.
Researchers linked the exploit to attacks compromising 996 switches across 48 countries, potentially exposing configurations and credentials.
I’m concerned that a compromised switch could give attackers a foothold inside the network while remaining outside routine endpoint monitoring.
Install Zyxel’s model-specific Patch 3 firmware, restrict switch management access, and monitor for unauthorized configuration changes.
Can You Keep Up With Vulnerabilities?
AI-powered tools are accelerating vulnerability discovery and increasing the number of security flaws organizations must assess and remediate.
How to reduce your vulnerability exposure:
- Use vulnerability management solutions to discover assets, scan for vulnerabilities, and identify security gaps.
- Establish a vulnerability management policy to prioritize exploited flaws, set remediation deadlines, and accelerate patching.
- Validate fixes and monitor emerging threats by rescanning systems and investigating signs of exploitation.
Track remediation backlogs, enforce escalation deadlines for critical vulnerabilities, and measure how quickly fixes are verified and deployed to production.