Security news roundup: 4 Nov 2026

The stories security teams are following today. Each link goes to the original report.

Headlines

• CISA flags WordPress RCE flaw as actively exploited in attacks (BleepingComputer)
• Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory (The Hacker News)
• Hackers use n-day exploits in zero-click attacks on iOS, Android devices (BleepingComputer)
• Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction (The Hacker News)
• CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades (The Hacker News)
• AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks (SecurityWeek)
• Barracuda ESG Authentication Bypass Flaw Opens Path to Root (SecurityWeek)
• Agentic Data Security Firm Sentra Raises $150 Million (SecurityWeek)
• Cyberattack wipes cloud data at major Russian hosting provider Beget (The Record)
• French blood service hit by Europe-wide cyberattacks on refrigeration (The Record)