Tuesday, November 10, 2026

Top story

Critical Terminal2Shell flaw is reported as a design flaw in terminal emulators on major operating systems that can spawn a shell on launch. The report says attackers get command execution with the logged-in user's privileges, no patches exist, and exploitation is in the wild. Defenders are advised not to open terminals and to set SHELL=/bin/false.

Exploitation & threats

• Google says exploited Chrome XML use-after-free CVE-2026-125350 is fixed in Stable 157.0.8103.50/.51, with details withheld pending updates.
• Researchers say attackers are exploiting OpenSSH on musl without PAM (CVE-2026-123158); Alpine is the most exposed.
• Plex2Shell is used against exposed Plex Media Server systems to run code and install miners; 1.43.3.10861 fixes it.
• France blamed the IRGC for October refrigerator attacks on 700 sites that raised temperatures, spoiled stock and started fires.
• CISA added four KEV entries covering GPUStack, FreeSWITCH, OpenSSH and IBM Aspera Faspex after evidence of exploitation.
• GhostAction injects workflows that steal cloud and AI keys from tens of thousands of GitHub repositories.

Patch priorities

• SonicWall SSL-VPN CVE-2026-19868: upgrade Gen7 and Gen8 to SonicOS 7.3.4-7013 or v8.2.3-8015.
• Veeam appliances CVE-2026-98432: install kernel 5.14.0-570.60.1+27.2.el9_6_ciq with Veeam Updater and restart.
• CVE-2026-116779, FreeSWITCH: upgrade to 1.11.3 to close arbitrary command execution.
• CVE-2026-102895, GPUStack: upgrade to 2.2.0; no workaround is listed.
• CVE-2026-123218, IBM Aspera Faspex 5.0.0–5.0.19: see vendor advisory for the admin bypass.
• React Server Components: see vendor advisory for packages 19.0.0–19.3.0 and verify resolved versions in lockfiles.

Breaches & incidents

• Iris Ohyama confirmed a cloud breach affecting about 7.7 million customers, including passwords for some.
• The Justice Department says three men used deepfake CEOs and lawyers to obtain more than $129 million in wires.
• Leak sites claimed Landmark Group, Vertex Pharmaceuticals, El Camino Health, SimonMed, Scripps and Solenis; the gangs claim those posts.
• Acronis says a Taiwan attacker using AI agents took Taipei 119 dispatch records and hit about 10 organizations.

AI

• Anthropic released Fable 5.2 and Mythos 5.2, cutting Fable input to $8 per million tokens, with faster replies and zero-data retention.
• Fable 5.2 is available to all users with cyber and biology safeguards; Mythos 5.2 stays limited to vetted programs.
• According to The Wall Street Journal, Anthropic is proceeding with an IPO as some investors seek a valuation under $1.5 trillion.
• New Apache-2.0 weights include Ripple-65B-Preview, Arete-27B and Qwen3.8-27B-DSpine-b16.
• Malbear says a jailbroken DeepSeek agent spent more than two weeks in a European telecom and claimed patient and billing data.

Watchlist

• N-able took hosted N-central offline after more than 30 Able2Shell proof-of-concept exploits; it reports no active exploitation.
• Federal agencies must remediate the SonicWall SAML bypass by November 20, 2026.
• CVE-2026-124600, GV-Face: no fix is stated; stop using it where traffic can be intercepted.
• Microsoft says actors using ARTEX moved from public GitHub secrets to Azure Key Vault access in minutes.