Thursday, November 12, 2026

Top story

Chrome patches exploited XML zero-day. Google fixed CVE-2026-125350, Chrome’s eighth zero-day this year, in stable builds 57.0.8103.50/.51 on Windows and Mac and 157.0.8103.50 on Linux. CISA added it to KEV and wants users patched before November 24, because exploitation may corrupt data or run code.

Exploitation & threats

• Barracuda flaws chained for root: Attackers are chaining CVE-2026-116606 and CVE-2026-111560 for an authorization bypass and root, and Barracuda said a small number of organizations were hit.
• SCKit infects ScreenConnect endpoints: Huntress says a worm-like toolkit compromised at least 288 managed endpoints across 48 organizations through abused ScreenConnect panels starting November 11.
• Xen Orchestra authentication bypass exploited: Vates says attackers are obtaining an administrator token on releases before 6.9.2 and 6.10.1, and it has not assigned a CVE.
• AhsayCBS flaws used to plant backdoors: Huntress says attackers exploited CVE-2026-105133 and CVE-2026-105134 on three servers from October 8–11; hotfixes are 10.3.4.45 and 9.15.2.70.
• Openwave and BroadWorks flaws added to KEV: Attackers are exploiting CVE-2026-111793, fixed in 1.1.22.0, and CVE-2026-20320, fixed in RI.2026.07, with a November 24 federal deadline.

Patch priorities

• Outlook flaw leaks NTLMv2 hashes: Install fixes for exploited CVE-2026-124194, including Office LTSC 2021 16.0.14334.21048 and LTSC 2024 16.0.17932.21140.
• N-able ships N-central hotfix: Upgrade to N-central 2026.4.1.26 and keep unpatched servers offline after public Able2Shell proof-of-concept code.
• SAP patches PROXYGATE and ICM2SHELL: Apply Notes 3798345, 3778530 and 3778556 for CVE-2026-76964 and CVE-2026-89126; Onapsis reported no exploitation.
• Node.js patches 16 flaws: Upgrade to v22.23.5, v24.22.3 or v26.13.1, prioritizing public HTTP/2 and HTTPS servers that can leak TLS keys or crash.
• Upgrade OpenSSH to 10.6p2 for KEV password-bypass CVE-2026-123158 on musl without PAM.

Breaches & incidents

• Credit Mutuel Arkea says hackers stole about €100 million: The bank said hackers stole around €100 million through fraudulent transactions on one account, and the funds were not cryptocurrency.
• Railway attackers stole AI credentials: Railway confirmed a 26-hour October 20 intrusion exposed variables in at most 1.85% of workspaces, and AI keys later drew $740,000 in charges.
• Grok app builder left apps open: Claroc found 35,578 of 37,571 online grok.me apps readable without sign-in, including ICU records, staff rosters and plain-text passwords.
• Akira, Deadlock, The Gentlemen and Curious Worm claimed new leak-site victims, including Leware Construction and Quality Air, and those posts are unverified.

AI

• Attackers use AntiFox AI agents: Arctic Wolf says Alibaba-hosted AntiFox agents planted an IIS webshell and obtained some production AWS secrets.
• Claude Code permission file leaks secrets: GitGuardian counted 31,088 distinct secrets across 23,276 repositories, including 5,343 still valid when found.
• Board reportedly prepares to oust Huang: The Wall Street Journal reports Nvidia’s board could meet Wednesday to remove Jensen Huang, after shares fell about 8% after hours.
• Times reports second Huang allegation: The New York Times reports an alleged affair with Nvidia vice president Kimberly Powell, which five employees described to the paper.

Watchlist

• IBM has not listed a fixed version for KEV Aspera Faspex bypass CVE-2026-123218.
• SonicWall lists no workaround for KEV SSLVPN bypass CVE-2026-19868; apply its update.
• Apache has not stated a fixed version for mod_http2 race CVE-2026-119618.