Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access

The Hacker News - Nov 10, 2026

French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild. The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062. "REST cookie parsing turns authenticationToken=j:%7B%7D into {}," Vates VMS said in an alert. "REST authentication passes that object to the

Read full article

MORE NEWS

Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones

Nov 10, 2026

Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones

A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1. The flaw, tracked as CVE-2026-111760, is an integer truncation in how Git handles its index. An

SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users

Nov 10, 2026

SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users

An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday. The attacker could also have seen requests being processed on that server that day, including requests sent in confidential mode, the company said earlier this week. That mode processes requests inside a trusted execution environment (TEE

Urgent warning to Gmail users about new hacking threat exposing private messages: Act now

Nov 10, 2026

Urgent warning to Gmail users about new hacking threat exposing private messages: Act now

Gmail users are being warned about a disturbing new hacking threat that could allow cybercriminals to secretly access their private messages and banking details.

Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access

Nov 10, 2026

Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access

French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild. The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062. "REST cookie parsing turns authenticationToken=j:%7B%7D into {}," Vates VMS said in an alert. "REST authentication passes that object to the

America’s Measles Problem Has Reached Endemic Level

Nov 10, 2026

America’s Measles Problem Has Reached Endemic Level

A panel of scientific experts will convene on Tuesday to evaluate the United States’ measles elimination status. But genetic data already shows the virus is once again endemic.

Claude chatbot maker set for $1.3tn stock market debut despite 'catastrophic' AI warning

Nov 10, 2026

Claude chatbot maker set for $1.3tn stock market debut despite 'catastrophic' AI warning

The AI company behind the Claude chatbot will offer its shares at between $70 and $78, which is lower than what was expected.

Noah's Ark discovery revealed as first photos show wood buried 30 feet underground

Nov 10, 2026

Noah's Ark discovery revealed as first photos show wood buried 30 feet underground

The hunt for Noah's Ark has taken a dramatic turn as the first photographs emerge of wood unearthed deep beneath a mountainside in Turkey.

Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem

Nov 10, 2026

Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem

Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year. Check Point Research is tracking the clusters under the names SilentDelivery,

Anthropic Targets Valuation of Up to $1.4 Trillion for Blockbuster I.P.O.

Nov 10, 2026

Anthropic Targets Valuation of Up to $1.4 Trillion for Blockbuster I.P.O.

The A.I. company’s pricing would make it one of the biggest ever public listings. It comes at a volatile moment in markets, with investors questioning the sustainability of the A.I. boom.

America's food supply under threat as FBI warns of new cyberattacks that could hit grocery stores nationwide

Nov 10, 2026

America's food supply under threat as FBI warns of new cyberattacks that could hit grocery stores nationwide

The FBI and other US agencies are warning that America may soon see attacks on its food supply, sending prices skyrocketing before the holidays.

Amazon unveils Ring drone that patrols rooms, hunts down intruders and records suspicious activity day or night

Nov 10, 2026

Amazon unveils Ring drone that patrols rooms, hunts down intruders and records suspicious activity day or night

More than a decade after transforming doorbells into security cameras, Amazon has unveiled a flying robot that can patrol your home on command.

Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor

Nov 10, 2026

Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor

Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant. The activity, observed by Huntress in early October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two

RECOMMENDED

Science Thread

Science Thread delivers quality and fascinating science and technology content that matters on a daily basis and makes it go viral.

ABOUT US
Sign Up

Copyright © 2015 - 2026 Science Thread. All Rights Reserved.