Friday, November 13, 2026

Top story

November Patch Tuesday fixes 1,095 flaws includes exploited Outlook spoofing CVE-2026-124194 and Chrome CVE-2026-125350. Cisco Talos says 64 flaws are critical and 48 could allow remote code execution, including in Exchange and Active Directory. Patch those exploited and critical bugs first.

Exploitation & threats

• Attackers mined 21 N-central servers: Huntback says 19 already ran Hotfix 2, and chaining CVE-2026-90436 can yield root when Legacy API is enabled.
• Check Point gateways hit with a wiper: Check Point Research says attackers used PHP2Shell, then CVE-2026-123039, and wiped some Israeli ESXi hosts.
• SCKit pivots through ScreenConnect: Blackpoint says a patched client blocked the CVE-2026-84869 payload, but stolen operator sessions can still spread commands.
• wfx-loot stole GitHub Actions secrets: Aikido says 4,837 accounts probed 61,764 repositories and the payload ran in more than 1,800.
• Operation Endgame seizes crime-kit servers: Authorities seized 235 servers and 257 domains and identified credentials for 6.4 million victims.
• Cairn AI used against 19 organizations: Unit 42 says access succeeded at 10 targets, and one business lost more than one million records.

Patch priorities

• CVE-2026-124194, Outlook: install LTSC 2021 build 16.0.14334.21048 or LTSC 2024 build 16.0.17932.21140.
• CVE-2026-125350, Chrome: update to 157.0.8103.50 or later and restart; CISA set a November 24 deadline for the Outlook flaw.
• CVE-2026-84869, ScreenConnect: update clients to 26.6.5 or newer and stop using RMM+ 1.0.31 and 1.0.32.
• CVE-2026-119618, Apache HTTP Server: upgrade the latest release or disable HTTP/2; Wiz knows of no exploits.
• NetScaler ADC and Gateway: update to 14.1-73.57 or later, or 13.1-64.39 or later of 13.1; Citrix knows of no exploits.
• CVE-2026-19868, SonicOS SSLVPN: apply SonicWall’s update; no workaround is provided.

Breaches & incidents

• Muji operator warns of a customer leak: Ryohin Keikaku says more than 27 million emails and nearly 1.1 million card numbers may have leaked.
• US moves to seize Binance theft proceeds: the Justice Department cited court authorization for more than $1.2 billion; Binance and the FBI attribute a $6.3 billion theft to TraderTraitor.
• The same action disrupted North Korean FaceStealer infrastructure, according to the Justice Department.

AI

• Jensen Huang resigns as Nvidia CEO: the board named CFO Colette Kress interim CEO; the New York Times reported affairs and a suspected Chinese spy.
• Democrats open an Nvidia China inquiry: lawmakers asked Commerce to preserve records on H200 export licenses after Huang’s resignation.
• Google releases Gemini 4 Hydrogen: the fast model costs $1.50 per million input tokens and is live in the Gemini app and API.
• Newly listed models include NousResearch Arete-27B, Zyphra ZONOS3-Mini, and Tencent Qwen3.8-27B-DSpine-b16.

Watchlist

• Unauthenticated Quay key-replacement flaw: CVE-2026-123710 has no named fix; restrict /keys while anonymous access remains enabled.
• CVE-2026-121352 in Adobe Connect and CVE-2026-76964 in SAP NetWeaver are scored CVSS 10, with no known exploits or named fixed versions.
• CVE-2026-123218, IBM Aspera Faspex, is in KEV, but IBM has not listed a fixed version.
• N-able says hosted N-central showed scanning but no compromise; on-premises servers with public Legacy API remain exposed to new proof-of-concept code.