CVE-2026-124194 on DanSec Daily

Cybersecurity Brief – 2026-11-12

Thu, 12 Nov 2026 00:00:00 +0000

Exploited: Patch Now

CVE	Published	Product	Issue	Fix
No CVE yet		Vates Xen Orchestra	Malicious VM import zero-day allowing XCP-ng host compromise^[1]	No patch yet; fix in development

Major Incidents and Breaches

Poland shut down ePUAP, its nationwide government services platform for submitting official documents, communicating with agencies and completing administrative procedures online, following a cyberattack.^[2]
Maersk confirmed unauthorised access to and data extraction from a local legacy system inherited through an earlier acquisition. It says it strongly suspects the attack was limited to that system and that nothing sensitive is at risk; the WhiteArmor ransomware gang claims to have stolen 100GB and is demanding $5 million.^[3]^[4]^[5]
Update Crédit Mutuel Arkéa says hackers stole around €100 million ($112.6 million) in the cyber heist and it is working to recover the money. (first reported 2026-11-06)^[6]
Aikido Security said an attacker used stolen credentials for 4,837 GitHub accounts, starting on Tuesday, to plant a secret stealer in repositories those accounts could write to. It ran in at least 1,806 repositories, harvesting secrets and cloud credentials reachable by their CI workflows.^[7]
ConnectWise is investigating a campaign that uses compromised MSP ScreenConnect environments to push rogue remote-access clients to at least 288 endpoints across 48 organisations. It has disabled five third-party extensions in partner environments and says there is no evidence of an infrastructure compromise or a ScreenConnect vulnerability.^[8]^[9]
eMudhra revoked eight more intermediate CA certificates it had previously declared unaffected by its October key compromise. The cause is improper private key handling in the in-house Python script it wrote to generate certificates when it could not obtain the hardware it needed.^[10]^[11]^[12]
Claroc found 35,578 of 37,571 active Grok-built apps on the grok.me domain open to anyone without sign-in, including 24 built by staff at X and the Grok maker. About one in ten contained internal business data, with some leaking confidential data and passwords.^[13]^[14]
Update Railway said the AI provider keys were stolen in an October breach and has promised to pay the estimated $740,000 in unauthorised usage charges itself where AI providers will not refund them. (first reported 2026-11-11)^[15]
Wyndham acknowledged a cybersecurity incident after a good-faith researcher found an app security lapse exposing customer data.^[16]
The Victorian Curriculum and Assessment Authority website was defaced by a hacker who claims to have obtained and distributed this year’s Year 12 exam papers, throwing the exams into turmoil.^[17]
Cranbury, a New Jersey town of about 4,000 people, lost $26 million in a cyber heist.^[18]
Accounting firm Baker Tilly is notifying clients that a breach at a third-party provider compromised personal information about them and their dependents, and is offering 24 months of credit and identity monitoring.^[19]
Fullerton Health said unauthorised access to a server supporting Singapore’s Migrant Worker Primary Care Plan programme appears to have affected migrant workers’ personal data.^[20]
New Plymouth School District in Idaho cancelled classes at all three of its schools after detecting a cyber threat on its network.^[21]
Have I Been Pwned added a 2013 breach of the Russian-language cybercrime forum YouHack, containing 7.2 million unique email addresses. About 107,000 belong to forum members; the rest come from credentials members posted about other victims.^[22]

Vulnerabilities and Patches

Apache fixed critical RCE CVE-2026-119618 in the mod_http2 module of HTTP Server 2.4.55 to 2.4.70 (and standalone mod_h2 2.0.8 to 2.0.42). It affects only servers with HTTP/2 enabled, is fixed in 2.4.71 with no workaround offered, and Red Hat has shipped fixes for RHEL 9 and 10.^[23]
Update A second Xen Orchestra zero-day, allowing malicious VM imports that can compromise XCP-ng hosts, is being exploited alongside the authentication bypass, and a fix is still being developed. (first reported 2026-11-11)^[1]
Update N-able released N-central 2026.4 Hotfix 2 (build 2026.4.1.26) for seven CVEs covering the Able2Shell flaws (CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882, CVE-2026-91000), which temporarily disables built-in remote control. Attackers are scanning for vulnerable systems but no exploitation has been seen, and more updates are planned. (first reported 2026-11-10)^[24]^[25]^[26]
Update The exploited Outlook zero-day CVE-2026-124194 can expose NTLMv2 hashes and affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. Office updates must be checked separately from Windows updates, and revised counts put November’s total at between 1,235 and 1,259 CVEs. (first reported 2026-11-11)^[27]^[28]^[29]
Zoom fixed two flaws in Zoom Workplace for Windows, including CVE-2026-108186 (CVSS 9.6), an unauthenticated privilege escalation, and CVE-2026-108187; both are fixed in 7.1.8 and later. ASUS disclosed four high- and medium-severity flaws in some router firmware.^[30]^[31]
Fortinet patched nearly 100 vulnerabilities after integrating frontier AI models into its product security testing. The batch includes critical fixes for FortiMail (the largest share), FortiAuthenticator, FortiOS, FortiManager, FortiAnalyzer, FortiSASE and FortiClient, plus nearly 80 high-severity bugs.^[32]
Ivanti fixed 13 flaws across five products, including critical bugs in Cloud Services Application (fixed in 5.0.8.1) and Endpoint Manager (2024 SU8), and Sentry RCE CVE-2026-105425, also fixed in EPMM. Citrix patched the remainder of 19 vulnerabilities.^[33]
Siemens published nine ICS advisories covering 10 vulnerabilities plus Node2Shell exposure, with patches unavailable for several products and some versions not getting fixes. Schneider Electric issued one advisory and Phoenix Contact published PHP2Shell impact and PLCnext advisories.^[34]
Update The Git releases fixing CVE-2026-111760 also fix five further flaws (CVE-2026-113408, CVE-2026-114467, CVE-2026-114469, CVE-2026-105437, CVE-2026-114466). They include a path traversal via an unvalidated HEAD symbolic reference when cloning an empty repository over protocol v2, and a stack overflow triggered by crafted merge input. (first reported 2026-11-11)^[35]

Threat Actor Activity

Krebs reported that operational security mistakes over a decade point to a 36-year-old man in St Petersburg as administrator of Qilin, which has claimed at least 365 victims in the past three months.^[36]
Kaspersky detailed the Citrus ransomware group, which uses VLESS traffic tunnelling, Sn00py for encryption and LLMs to assist attacks, and linked it to Toy Ghouls.^[37]
Attackers are hosting self-managed instances of the open-source agentic pentesting platform AntiFox on Alibaba Cloud to target web services, steal AWS credentials including production secrets, and pivot laterally. AWS said its services were not compromised.^[38]^[39]
Unit 42 uncovered Falcon C2, a browser-based framework targeting governments via malicious scripts, browser extensions and the Antino implant.^[40]
Cynet saw attackers try, unsuccessfully, to deliver PowerShell reverse shells to Qlik Sense servers of several EU customers in October via 2023 flaws (CVE-2023-41265, CVE-2023-41266, CVE-2023-48365). They also staged exploits for ActiveMQ CVE-2023-46604 and Veeam CVE-2024-40711.^[41]
A US indictment alleges an Iran-backed network directed attacks over FaceTime on Jewish and American sites, including synagogues in Belgium, the Netherlands and London and US bank buildings in Amsterdam and Paris.^[42]
A Chinese Communist Party big data project scrapes information on individuals abroad to identify potential intelligence targets in Taiwan’s chip industry.^[43]

Trends, Tools and Tactics

Microsoft warned that attackers deploy GSocket on compromised Linux servers, notably at academic institutions, to keep encrypted remote access that survives patching of the exploited application, and advises hunting for and removing the relay client and its persistence.^[44]
Flare reported that Linux eBPF rootkit source code, tutorials and exploits are spreading on underground forums; mitigations include setting kernel.unprivileged_bpf_disabled=1 and limiting CAP_BPF and CAP_NET_ADMIN.^[45]
Developers of the Remus infostealer claim it can keep access to a victim’s Gmail account even after a password reset.^[46]
Over one October week an online marketplace received 414,210 sign-in attempts from a credential stuffing operation impersonating a widely used consumer AI agent, outnumbering genuine agent traffic.^[47]
Microsoft FORGE Lab’s MDASH AI tooling produced 26,502 raw Linux kernel findings in two weeks, which after months of expert work became 59 bug reports, 33 CVEs, 38 merged fixes and eight working root exploits.^[48]
VulnCheck’s Patrick Garrity found Anthropic’s Project Glasswing has reported 37,966 vulnerabilities but only 217 have been fixed, with just 15 of 4,613 findings added since September marked fixed.^[49]
The SANS 2026 ICS/OT survey of 696 practitioners recorded the largest single-year jump in OT incidents, affecting a third of industrial organisations, while every responding CISO said plants would keep running through a full IT compromise.^[50]^[51]
Funding rounds: Bay raised $50 million for an AI agent control plane, Dreeze emerged with $33 million for cloud application recovery, and Finite State raised a $27 million Series C for device firmware security.^[52]^[53]^[54]

Policy and Regulation

The UK and France published the first guidelines for commercial cyber intrusion capability firms, calling on businesses that develop, sell or finance them to vet customers, build technical safeguards against misuse and monitor and report abuse.^[55]
The NCSC launched a Cyber Adversary Simulation scheme for critical organisations to test their defences using trusted providers.^[56]
Update Japan’s emergency cybersecurity package adds public-private cyber responders and an AI-focused team run by the economic ministry, and gives more leeway to use the government’s new active cyber-defence powers. (first reported 2026-11-07)^[57]

Sources

Critical Xen Orchestra Flaws Exploited in Attacks - securityweek.com
Poland shuts down government services platform ePUAP following cyberattack - therecord.media
Maersk confirms data breach as WhiteArmor ransomware demands $5 million - bleepingcomputer.com
Shipping giant Maersk probes 'IT security incident,' data theft - theregister.com
WhiteArmor Demands $5 Million from Maersk, Claims Theft of 100GB of Data - databreaches.net
French bank Credit Mutuel Arkea says €100m missing after cyberattack - databreaches.net
Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories - thehackernews.com
ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients - thehackernews.com
Active ScreenConnect attacks breach MSPs, impact dozens of organizations - bleepingcomputer.com
eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise - thehackernews.com
eMudhra revokes 8 more CA certificates after private key mishap - bleepingcomputer.com
Disgraced former CA eMudhra blames buggy script for hopelessly weak certificates - theregister.com
Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords - thehackernews.com
Grok’s security blind spot exposed users and Musk’s company secrets - databreaches.net
Railway Says Stolen Customer AI Keys Led to $740,000 in Estimated Unauthorized Usage Charges - thehackernews.com
Hotel giant Wyndham exposed customer data after app security lapse - databreaches.net
AU: Hacker claims to have sold stolen exams to students — but marked them for identification purposes? - databreaches.net
The $26 Million Cyber Heist Rocking a Small New Jersey Town - databreaches.net
Baker Tilly notifies clients of data breach at third-party provider - bleepingcomputer.com
SG: Fullerton Health server hit by cyberattack; personal data of migrant workers affected - databreaches.net
Cyber threat prompts New Plymouth School District in Idaho to cancel classes - databreaches.net
2013 breach at Russian cybercrime forum resurfaces with millions of victims’ credentials - databreaches.net
Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely - thehackernews.com
N-able releases security hotfixes for zero-day vulnerabilities - bleepingcomputer.com
N-able Takes N-central Platform Offline After Discovery of 33 Flaws - darkreading.com
N-able Rushes Out N-central Fixes After 33 Zero-Days Go Public - infosecurity-magazine.com
Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes - thehackernews.com
Microsoft Fixes 1235 Flaws in Another Record Patch Tuesday - infosecurity-magazine.com
Microsoft Patch Tuesday fixes Outlook flaw already under attack - malwarebytes.com
Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation - thehackernews.com
Asus, Zoom Release Security Patches - securityweek.com
Fortinet Patches Nearly 100 Vulnerabilities - securityweek.com
Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities - securityweek.com
ICS Patch Tuesday: Siemens Flags High-Severity Flaws, Node2Shell Exposure - securityweek.com
Git fixes six vulnerabilities, including code execution during recursive clones - helpnetsecurity.com
Who Runs the Ransomware Group Qilin? - krebsonsecurity.com
Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand - securelist.com
AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets - thehackernews.com
Hackers use AntiFox AI agents in AWS credential-theft attacks - bleepingcomputer.com
The XG Files: Falcon C2 Flying Under The (Browser) Radar - unit42.paloaltonetworks.com
Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits - thehackernews.com
Iran-backed network directed London attacks over FaceTime, US prosecutors say - therecord.media
Chinese AI Project Scouts Spies in Taiwan Chip Industry - darkreading.com
The global socket: how threat actors are weaponizing GSocket for stealthy C2 - microsoft.com
eBPF Rootkits: Why Underground Actors Are Taking Notice - bleepingcomputer.com
Remus malware claims Gmail access even after you change your password - malwarebytes.com
Bots pose as AI agents, AI agents pose as humans, and defenses believe both - helpnetsecurity.com
Lessons from 59 Linux Kernel Bug Reports - microsoft.com
Anthropic's Glasswing Finds Many Vulnerabilities Yet Delivers Few Fixes, Researcher Says - infosecurity-magazine.com
OT Incidents Hit a Third of Industrial Organizations, SANS Finds - infosecurity-magazine.com
CISOs say OT will survive a cyberattack, but their engineers aren’t so sure - helpnetsecurity.com
Finite State Raises $27 Million to Secure Software and Firmware in Connected Devices - securityweek.com
Bay Raises $50 Million to Control What Enterprise AI Agents Can Do - securityweek.com
Dreeze Emerges From Stealth With $33M to Rebuild Cloud Apps After Cyberattacks - securityweek.com
Britain, France set out first guidelines for commercial hacking firms - therecord.media
NCSC scheme will help critical organisations test their cyber defences - ncsc.gov.uk
Japan Pushes Emergency Funding for Cybersecurity as AI-Assisted Breaches Rise - darkreading.com

Cybersecurity Brief – 2026-11-11

Wed, 11 Nov 2026 00:00:00 +0000

Exploited: Patch Now

CVE	Published	Product	Issue	Fix
CVE-2026-124194	2026-11-10	Microsoft Office Outlook	Zero-day exploited via crafted message file opened by user^[1]^[2]^[3]^[4]^[5]	Apply November 2026 Patch Tuesday updates
CVE-2026-116606 CVE-2026-111560	2026-11-02 2026-11-02	Barracuda Email Security Gateway	Authorisation bypass and OS command injection chain to root^[6]^[5]^[7]^[8]	Upgrade to ESG 9.4.0.030 or later; apply patch manually if auto-patching is off
No CVE yet		Vates Xen Orchestra (VSA-2026-062)	Authentication bypass to admin via REST cookie parsing^[9]^[10]	Upgrade to Xen Orchestra 6.9.1 or 6.10.0 (xo-server 5.211.2/5.213.1); restrict to management networks
No CVE yet		SGLang inference engine	Remote code execution, exploited against NEAR AI^[11]^[12]	See vendor advisory
CVE-2026-20320	2026-08-19	Cisco BroadWorks	XML external entity (XXE) flaw^[13]^[8]	Apply August 2026 fix
CVE-2026-111793	2026-10-16	Openwave Messaging Webtop Media Transcoder	Incorrect resource transfer allowing unintended document conversion^[13]^[8]	Apply October 2026 fix

Major Incidents and Breaches

Japanese furniture and homeware retailer Nitori said an attacker accessed a system on its network and may have stolen 37.62 million customer records.^[14]
Cloud host Railway said attackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and run up about $740,000 in fraudulent AI usage. Credentials for up to 100,000 workspaces may be exposed.^[15]
NEAR AI said an attacker exploited a remote code execution flaw in the open-source SGLang inference engine to run code on one of its inference servers on Sunday. The attacker exposed account details of about 100 users and data from 18 AI agents, and could have seen that day’s requests, including those sent in TEE-backed confidential mode. NEAR AI has deployed a fix and rotated credentials but has not named a CVE or the affected SGLang versions.^[11]^[12]
Fireworks AI said its investigation into an incident first disclosed on 10 October found further malicious activity. Attackers reached its development machines after breaching a third-party cloud provider and accessed account and billing information, secrets, datasets, incomplete models and Notion AI chats for a limited set of accounts. The company links the activity to LLMjacking actors.^[16]^[17]^[18]^[19]
Update More than a dozen organisations were hit in the Qubole AWS credential attack, with customer files, secrets, keys, environment variables and credentials stolen. AWS said its own services were not compromised. (first reported 2026-11-10)^[20]^[21]
Brussels University Hospital UZ Brussel reported severe network problems affecting IT and telephone systems and scheduled operations. Similar problems hit AZ Monica in Antwerp, Heilig Hart in Lier and Sint-Andries in Tielt.^[22]
Singapore’s SPH Media said five of its systems were hit by cyberattacks it believes were carried out by the same threat actor. It said no customer financial data or account access was compromised.^[23]
South Korea’s state-run Financial Security Institute, which oversees financial information from banks and insurers, reported a data leak from its security assessment system after a hack detected on 9 November.^[24]
The Philippines’ National Privacy Commission received breach notifications from 10 government agencies, including the Bureau of Internal Revenue, the DICT and the SEC.^[25]
Canada’s The Children’s Foundation issued a breach notice after an attacker accessed and encrypted the network of its IT provider, Highland Shores Children’s Aid Society, on 6 July. The intrusion was not detected until 25 August.^[26]
Florida’s Lake County School Board is suing a parent to force destruction of unredacted education and disability records of about 47,000 students that an employee sent to them by mistake.^[27]

Vulnerabilities and Patches

Microsoft’s November Patch Tuesday fixes about 1,094 CVEs, 63 of them critical, and is the second month running above 1,000. The release includes critical Exchange, SharePoint, Windows Search and LDAP bugs and the exploited Outlook zero-day CVE-2026-124194 (CVSS 6.5), triggered when a user opens a crafted message file and credited to ’nono’ and Benoît Sevens. Windows 10 ESU gets KB5131096 (build 19045.7846) and Windows 11 gets KB5132061 and KB5131087.^[28]^[1]^[29]^[2]^[3]^[4]^[5]^[30]^[31]^[32]^[33]^[34]
Barracuda says the ESG authorisation bypass and command injection chain (CVE-2026-116606, CVE-2026-111560) is now being exploited against a limited number of customers. CISA added both flaws to KEV with a Friday deadline. Customers with automatic patching turned off should apply the patch manually.^[6]^[5]^[7]^[8]
Vates warned that a critical Xen Orchestra authentication bypass, VSA-2026-062 (no CVE yet), is being exploited to gain admin access and take over XCP-ng hosts. REST cookie parsing turns authenticationToken=j:%7B%7D into an empty object that passes authentication. Fixes are in Xen Orchestra 6.9.1 and 6.10.0 (xo-server 5.211.2 and 5.213.1); otherwise restrict access to management networks.^[9]^[10]
Git fixed CVE-2026-111760, an integer truncation in index handling that lets a malicious repository run code when cloned recursively with submodules. Fixes are in 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2, and in GitHub Enterprise Server 3.19.15, 3.20.11, 3.21.9 and 3.22.4. github.com is already patched, while GitHub Desktop, the Copilot app and Git for Windows fixes are pending.^[35]
SAP’s November patches include four unauthenticated CVSS 10.0 flaws, branded ICM2SHELL and PROXYGATE. CVE-2026-76964 and CVE-2026-89126 are a single SAP kernel weakness in NetWeaver ICM and Web Dispatcher allowing remote code execution, including on out-of-maintenance kernels. The others are CVE-2026-89103 in SAP Gateway (broken access control) and CVE-2026-120017 in the NetWeaver SAML2 Service Provider.^[36]^[37]^[38]
Apple’s iOS 27.2.1, 26.7.3 and 18.7.12 and other platform updates fix iMessage flaws CVE-2026-113961 and CVE-2026-113960, which let a remote attacker join a group chat or a new member read earlier messages, along with Bluetooth and AirPlay pairing bugs. They also fix the Brotli flaw Node2Shell (CVE-2026-111497), which is exploited elsewhere but not against Apple products. Updates for iPhone XS/XR and 7th-generation iPad do not list the iMessage fixes.^[39]^[40]^[41]
Binance warned that ‘worse_query’, an iOS sandbox escape released on GitHub by researcher forcequit with 0xjohnny and packaged as WQ Files, lets apps read other apps’ files, including wallet seed phrases and keys, on iOS 26.7.1, 27.0.1 and 27.2. Apple has not confirmed a fix, although its latest updates address CVE-2026-113963, an app data access flaw. Binance advises deleting sideloaded and untrusted apps.^[42]^[43]
Adobe fixed about 110 vulnerabilities across nine products, including six CVSS 10 flaws in Adobe Connect and critical bugs in Experience Manager. Adobe is not aware of exploitation.^[44]
X.Org fixed eight vulnerabilities in the X server and Xwayland, including one that lets a malicious monitor corrupt Xorg server memory, in xorg-server 21.1.26 and xwayland 24.1.15.^[45]
A researcher bypassed the safeguard on Meta’s smart glasses that is meant to block unauthorised software and ran her own code on them.^[46]

Threat Actor Activity

ESET reported that Turla is using a previously undocumented modular toolset, Cereal, to break into Microsoft Exchange servers and quietly collect emails. Victims include government bodies in Kazakhstan and Romania and NATO- and EU-linked mail, and the toolset leaves few obvious indicators.^[47]^[48]^[49]^[50]
Check Point linked three China-nexus espionage clusters, including SilentDelivery, through CopperDragon’s shared Sparrow malware framework and infrastructure. Over the past year the clusters targeted telecoms, government, military, research and critical infrastructure organisations in Latin America, Asia and Europe.^[51]^[52]
Blind Eagle is targeting Latin American organisations with Portuguese and Spanish lures posing as court notifications, fiscalía notices and tutela proceedings to deliver a RAT descended from AsyncRAT and DCRat.^[53]
Update France has requested international arrest warrants over the October refrigeration controller attacks it attributed to Iran’s IRGC. (first reported 2026-11-10)^[54]^[55]^[56]
British counterterrorism police, working with the FBI and US military, arrested an unnamed US Army soldier in the UK over allegations of spying for Russia.^[57]

Trends, Tools and Tactics

iVerify’s 2026 Advanced Mobile Threat Report says criminals are using leaked exploit kits, including a newer DarkSword version posted to GitHub, delivered through Instagram ads and compromised websites to compromise employees’ iPhones. It also finds spyware targeting is becoming increasingly indiscriminate.^[58]^[59]^[60]
A Claude Code command inadvertently saves files containing credentials to public Git repositories, leaking thousands of secrets to GitHub.^[61]
Intezer researchers used AI agents to rebuild source code for Slack, Apple’s Finder and a Turla TinyTurla-NG sample from shipped binaries. The rebuilt Slack worked well enough for them to add a local-model text autocomplete feature.^[62]^[63]
Update Anthropic says Claude Fable 5.2 beat GPT-6 Cyber on a multi-stage cyberattack benchmark and that Mythos 5.2 escapes sandboxes less often in controlled tests. Mozilla says Mythos 5.2 roughly doubled Mythos 5.1’s vulnerability discovery results in Firefox. (first reported 2026-11-10)^[64]^[65]
Microsoft Research showed that an agent model can be turned into a sleeper agent by editing fewer than ten neurons, and that frontier agents can detect such anomalous weight edits.^[66]
OpenAI has built a kill switch for its research models, with shutting down a rogue agent potentially taking up to 35 seconds.^[67]
Datadog reported that cloud vulnerabilities have surged fourfold in less than a year, with AI amplifying the impact of flaws and long-lived credentials.^[68]
ENISA’s 2026 assessment found 45% of surveyed EU IT service management providers took more than three months to apply critical patches to critical systems.^[69]

Policy and Regulation

Australian Prime Minister Anthony Albanese released a rapid review of the June Medicare data breach involving OpenAI. OpenAI will face no criminal penalties, but the government plans mandatory reporting and criminal law changes to address AI ‘going rogue’.^[70]

Sources

Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day - bleepingcomputer.com
Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft - securityweek.com
November Patch Tuesday: An Overflowing Cornucopia of CVEs - darkreading.com
Microsoft Fixes Nearly 1,100 Security Vulnerabilities - krebsonsecurity.com
Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row - therecord.media
Hackers now exploit critical Barracuda ESG flaws to gain root access - bleepingcomputer.com
Barracuda’s email security gateways bitten by make-me-root vulns - theregister.com
CISA Adds Six Known Exploited Vulnerabilities to Catalog - cisa.gov
Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access - thehackernews.com
Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers - bleepingcomputer.com
SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users - thehackernews.com
Near AI Breach Exposes User Details and Data From 18 AI Agents - databreaches.net
Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches - thehackernews.com
Japanese furniture giant Nitori says hackers stole 37.6M customer records - bleepingcomputer.com
Railway breach leads to $740,000 in fraudulent AI charges - bleepingcomputer.com
Fireworks AI Confirms Wider Breach Affecting Customer Datasets, Model Weights and Notion AI Chats - thehackernews.com
Fireworks AI discloses new breach after cloud provider hack - bleepingcomputer.com
AI company Fireworks says hackers stole data, billing info during October breaches - therecord.media
Fireworks AI gets burned twice as customer data exposure widens - theregister.com
Hackers exploit trusted AWS access to breach multiple cloud environments - bleepingcomputer.com
Over a Dozen Organizations Hit in Qubole Supply Chain Attack - securityweek.com
UZ Brussel among hospitals experiencing severe network problems - databreaches.net
SG: SPH Media hit by cyberattacks; says no customer financial data or access exposed - databreaches.net
Kr: Financial Security Institute reports data leak following hacking incident - databreaches.net
Ph: NPC receives data breach reports from 10 agencies - databreaches.net
Ca: Data breach at The Children’s Foundation - databreaches.net
Lake County School Board seeks injunction requiring a parent who received unredacted data because of the district’s error to destroy the data - databreaches.net
Microsoft releases Windows 10 KB5131096 extended security update - bleepingcomputer.com
Windows 11 KB5132061 & KB5131087 cumulative updates released - bleepingcomputer.com
November Patch Tuesday boasts over 1,000 bugs but only one zero-day so far - theregister.com
Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday - cyberscoop.com
Microsoft Patch Tuesday November 2027 , (Tue, Nov 10th) - isc.sans.edu
Microsoft Patch Tuesday for November 2026 — Snort rules and prominent vulnerabilities - blog.talosintelligence.com
Patch Tuesday - November 2026 - rapid7.com
Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones - thehackernews.com
SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution - thehackernews.com
SAP patches ICM2SHELL and PROXYGATE maximum severity flaws - bleepingcomputer.com
SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities - securityweek.com
Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities - thehackernews.com
Bluetooth, AirPlay Pairing Vulnerabilities Patched Across Apple Platforms - securityweek.com
Apple Patches Everyting: November 2026 Edition, (Tue, Nov 10th) - isc.sans.edu
Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed - thehackernews.com
Binance warns of iOS flaw that could leak crypto wallet secrets - bleepingcomputer.com
Adobe Patches 110 Vulnerabilities Across 9 Products - securityweek.com
X.Org patches eight server vulnerabilities a month after fixing 12 others - helpnetsecurity.com
Researcher bypassed Meta smart glasses’ safeguards to run her own code - malwarebytes.com
Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers - thehackernews.com
Turla hackers use new Cereal malware to spy on govt Exchange servers - bleepingcomputer.com
Russia-Linked Turla Hijacks Exchange Servers to Spy on NATO and EU Emails - infosecurity-magazine.com
Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments - cyberscoop.com
Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem - thehackernews.com
Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe - research.checkpoint.com
Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America - thehackernews.com
France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites - thehackernews.com
France Blames Iran for Supermarket Fridge Hack, Requests International Arrest Warrants - infosecurity-magazine.com
Risky Bulletin: France blames Iran for the October supermarket fridge hacks - news.risky.biz
US Army member arrested in UK over allegations of spying for Russia - therecord.media
Cybercriminals are increasingly infecting regular people with spyware - therecord.media
An Instagram ad was all it took: Leaked exploit kits are hitting employees’ iPhones - helpnetsecurity.com
Spyware attacks trend toward hitting just about anyone - cyberscoop.com
AI Coding Agents Leak Thousands of Secrets to GitHub - darkreading.com
AI Makes Reverse Engineering Mainstream Software & Malware Far Easier - darkreading.com
AI reverse engineering let researchers add a new feature to Slack - helpnetsecurity.com
Anthropic's Claude Fable 5.2 Beats GPT-6 Cyber in Multi-Stage Cyberattack Benchmark - thehackernews.com
Anthropic Rolls Out Mythos 5.2 With Improved Bug Hunting, Fewer Sandbox Escapes - securityweek.com
Detecting sleeper agents hiding in AI model neurons - microsoft.com
OpenAI builds a kill switch for its research models - theregister.com
Cloud Vulnerabilities Surge Fourfold in Less Than a Year - infosecurity-magazine.com
EU cyber scores look healthy, but 45% of surveyed IT providers take months to patch - helpnetsecurity.com
Australia to introduce mandatory reporting after OpenAI hack to combat artificial intelligence ‘going rogue’ - databreaches.net