Tata Motors apps exposed four flaws that could let attackers impersonate owners
Tata Motors’ iRA 2.0 and iRA.ev mobile apps…
Updated 3 minutes ago
Tech news, decoded.
AI, security, automation, cloud and self-hosting — explained without the noise.
Trending now
Latest articles
Fresh from the blog: news, security alerts and hands-on how-tos. Keep scrolling for more.
DreamHost says File Manager breach exposed customer login details
DreamHost confirmed that attackers used its web-based File Manager to reach customer login details, and in a small number of cases they may also have viewed private mailbox contents. The hosting provider said the exposed data included FTP/SFTP usernames and passwords, plus some webmail credentials. It discovered the unauthorized access on October 23, 2026, and its investigation placed the possible exposure window back to approximately August. What DreamHost found DreamHost…
Apple flaw added to CISA’s exploited list after active abuse
The U.S. Cybersecurity and Infrastructure Security Agency, or CISA, added a medium-severity Apple security flaw to its Known Exploited Vulnerabilities catalog on Wednesday after reports of active exploitation. The issue, CVE-2024-27834, affects multiple Apple operating systems and was already fixed by Apple in May 2024. Pointer authentication bypass in Apple software CVE-2024-27834 carries a CVSS score of 5.5 and is an improper authentication flaw. It could let an attacker with…
Apple expands public iCloud link checks for harmful content
Apple will begin checking photos and files shared through public iCloud links for harmful content in version 27.3 or later of iOS, iPadOS, macOS, and visionOS. The policy applies to content shared with “Anyone with the Link,” including items in iCloud Photos and iCloud Drive, and Apple set out the change in a support document published November 3, 2026. Public iCloud Link Scanning Apple’s notice applies to link-based sharing rather…
OpenAI pipeline produced 948 Linux root exploits in a 30-hour run
OpenAI detailed a prototype pipeline that used an upcoming cyber-focused artificial intelligence model to validate and patch 948 local privilege escalation vulnerabilities in Linux. The company said the run cost $1.2 million in API costs and that the work produced working exploits that could let a low-privileged local user reach root access. The pipeline and its five stages OpenAI described the process as an agentic pipeline with five stages. It…
Citrix XenServer vulnerability needs management network access
Citrix has disclosed a critical XenServer vulnerability that could let an unauthenticated attacker compromise virtualization hosts and supporting appliances. Tracked as CVE-2026-98432, the flaw requires access to the management network, which limits which systems are exposed. XenServer releases and affected appliances The November 3 security bulletin covers XenServer 8.4 and XenServer 9, along with affected Workload Balancing and Conversion Manager appliances. Citrix researchers said the issue could compromise the host,…
Snapchat+ subscriptions top 30 million as Snap expands paid tiers
Snap has passed 30 million paid Snapchat+ subscribers, according to its third-quarter 2026 earnings release on Wednesday. The total is up by 5 million since February, when the company said it had crossed 25 million. Snap said paid subscribers span Snapchat+, Memories Storage, and Lens+. Snapchat+ launched in 2022 and gives subscribers exclusive and pre-release features for $3.99 per month. Snap later added more paid tiers beyond the core subscription…
AI PACs lost key 2026 races despite spending millions
Political groups on both sides of the AI debate spent millions of dollars trying to influence Tuesday’s midterm elections and shape future AI regulation. The spending produced mixed results, and some of the most heavily backed candidates lost their races. AI-focused political action committees, or PACs, poured money into candidates, while groups backing stronger AI safeguards also spent heavily. The contests also exposed a larger argument over whether Congress should…
Debian and Ubuntu APT flaw enables root code execution in package retries
A flaw in APT affects Debian and Ubuntu package downloads when an attacker can alter traffic between the package manager and the package server. The issue lets a checked package be replaced during a retry, and the attacker’s code can run as root. Advisories from Debian, Ubuntu, and APT’s developers were published on November 4. APT retries failed downloads by default from Debian 12 and Ubuntu 22.04 onward, which creates…
Rails Active Storage flaw can expose server secrets through crafted uploads
A critical flaw in Ruby on Rails Active Storage can let an unauthenticated user upload a crafted image and make the server write files. If uploads use the Disk service, the same upload can also make the server read files. The Rails team rated the bug Critical, gave it a CVSS score of 9.8, and published the advisory on November 4, 2026. ImageMagick behavior behind the flaw The issue starts…
APT29 campaign uses n-day flaws to target iOS and Android devices
A watering hole campaign tied with moderate-to-high confidence to APT29 has been hitting iOS and Android users who visit compromised websites or fake portals that imitate legitimate ones. Researchers at cybersecurity company Sekoia traced the activity to pages and domains that profiled visitors, selected exploit chains by browser version, and delivered payloads without user interaction. Apple and Google have already patched the flaws used in the campaign. The report says…
Cloudflare’s Zero Wire tracks critical CVEs and security fixes
Cloudflare has launched Zero Wire, a public vulnerability intelligence feed designed to help security teams track critical CVEs, understand exploitation activity, and find security fixes. Announced on November 3, 2026, it sits within Cloudflare Radar’s security section and brings technical evidence, vendor guidance, and recommended actions into readable briefings. The service is built around a familiar problem. When a serious vulnerability appears, defenders have to assemble scattered advisories while checking…
Chrome 157 closes 213 security holes across Windows, macOS, and Linux
Google has released Chrome 157 for Windows, macOS, and Linux, and the update fixes 213 security bugs, including seven that are rated critical. The stable release will reach users over the coming days and weeks, and the patched versions are 157.0.8103.38 for Linux and 157.0.8103.38/.39 for Windows and macOS. Seven critical flaws in browser graphics code Two of the critical vulnerabilities are buffer overflows in Dawn, Chrome’s implementation of the…