Wednesday, November 11, 2026

Google confirmed in-the-wild exploitation of Chrome CVE-2026-125350, a high-severity XML use-after-free that can corrupt memory and run code. Emergency Stable updates reach 157.0.8103.50 and .51 on Windows and macOS, and 157.0.8103.50 on Linux. Attack details stay restricted, so prompt updating is the practical defense.

Exploitation & threats

• France blamed an IRGC-linked unit for sabotage at about 700 retail sites, where October 11 defrost changes caused food losses and fires.
• Barracuda said attackers chained two Email Security Gateway flaws for root in a small number of customer compromises, and listed patches should be applied.
• Vates said a Xen Orchestra authentication bypass is being exploited and is fixed in 6.9.1 and 6.10.0.
• N-able took hosted N-central offline worldwide and released an emergency 2026.4 HF2 fix after 33 exploits were published.
• ESET attributes the Cereal toolset on government Exchange servers to Turla, with victims in Kazakhstan and Romania.
• iVerify says leaked DarkSword and Coruna kits are infecting employee iPhones through ads and lookalike finance sites.

Patch priorities

• Install November updates immediately for exploited Outlook CVE-2026-124194, which can leak an NTLMv2 hash, per this Patch Tuesday brief.
• CISA’s KEV update calls for GPUStack 2.2.0, FreeSWITCH 1.11.3, OpenSSH 10.6p2, and Faspex 5.0.19 PL1, covering CVE-2026-102895, CVE-2026-116779, CVE-2026-123158, and CVE-2026-123218.
• Apply Ahsay’s mid-October patches for CVE-2026-105133 and CVE-2026-105134 after Huntress reported zero-day use to plant shells and miners.
• Apply the four November SAP notes for unauthenticated CVSS 10.0 flaws, including CVE-2026-76964 and CVE-2026-120017, detailed in SAP’s patch day.
• Upgrade affected FortiManager branches to 8.0.1, 7.6.8, 7.4.6, or 7.2.9, as Fortinet’s advisory covers critical pre-login code execution.

Breaches & incidents

• Japanese retailer Nitori said an attacker may have taken 37.62 million customer records, while passwords and card data were not exposed.
• Leak sites carried about 30 group claims in a day, including Bear Valley Community Hospital, SberSpasibo, and Roane Transportation Services.

AI

• Google made Gemini 4 Carbon available on November 10 at $2 per million input tokens and $10 per million output tokens.
• Anthropic released Claude Fable 5.2 and Mythos 5.2, and Artificial Analysis ranks Fable first at 65, ahead of Carbon at 60.
• Anthropic’s updated IPO filing offers 825 million shares at $70 to $78, implying up to $1.404 trillion fully diluted.

Watchlist

• Apply SonicWall’s update for KEV-listed CVE-2026-19868, a SonicOS SSLVPN authentication bypass, because no workaround is stated.
• See the vendor advisory for CVE-2026-121356, an unauthenticated Adobe Connect SSRF rated CVSS 10, with no named workaround.
• CISA told federal agencies to patch exploited Outlook CVE-2026-124194 by month’s end, according to a separate Patch Tuesday report.