Trezor Confirms Hidden Implants in CryptoBilis-Sold Wallets That Can Steal Recovery Phrases
https://thehackernews.com/2026/11/trezor-confirms-hidden-hardware.html?m=1

wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories
https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories

Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html