Cybersecurity

The UK and France have issued voluntary, non-binding Pall Mall Process guidelines for the commercial cyber intrusion industry, endorsed by 14 countries.

Dreeze exits stealth with a $33m seed led by Norwest and Bessemer, and says its Application Revival platform is generally available on AWS.

AllUnited says an attacker used a club-website form flaw on 9 November to copy member data, including IBANs, from every club on its platform.

Apple’s iOS 27.2.1 update, released 9 November, fixes Bluetooth pairing and iMessage group-chat flaws. Apple has not said any were exploited.

CISA added a Cisco BroadWorks XXE flaw, CVE-2026-20320, to KEV. Cisco’s August advisory still says it is not aware of malicious use.

Microsoft lists an Outlook spoofing flaw as exploited. CISA added CVE-2026-124194 to KEV, with a 24 November deadline for federal agencies.

LNbits 1.7.0 is an urgent security update. Versions before it put funds at risk of theft. Upgrade before running; a patch alone is not recovery.

Vates says a critical Xen Orchestra authentication bypass is being actively exploited and can lead to admin access and XCP-ng root takeover.

Vanta has signed a definitive agreement to acquire Pillar Security. The planned AI Governance product is due in January 2027; no price was disclosed.

NEAR AI says an SGLang flaw let an attacker into one inference server, exposing about 100 users' details. NEAR Protocol was not affected. No CVE is named.