Cybersecurity

Microsoft's Patch Tuesday can't break stuff if it won't install

KB5132061 throws 0x800F0993 and 0x800F0989 errors, and Redmond is saying nothing

Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits

Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026.

Asus, Zoom Release Security Patches

Attackers could exploit them for command execution, memory overwrites, and privilege escalation.

Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities

Attackers could exploit the bugs to tamper with certificate entries, achieve remote code execution, and compromise hosts.

2013 breach at Russian cybercrime forum resurfaces with millions of victims' credentials

YouHack thought protecting members' passwords with mostly unsalted MD5 hashes would do

Fortinet Patches Nearly 100 Vulnerabilities

The massive drop comes after the company integrated frontier AI models into its product security testing.

eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise

The in-house Python script behind eMudhra's October key compromise has now cost the company 8 more of its intermediate certificate authorities (CAs), even though it did not weaken their keys.

Also: BleepingComputer

Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing…

November Patch Tuesday boasts over 1,000 bugs but only one zero-day so far

Microsoft admins wail and gnash their teeth

Railway breach leads to $740,000 in fraudulent AI charges

Cloud hosting provider Railway says hackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and generate approximately $740,000 in fraudulent AI usage, potentially exposing credentials for up to…

Japanese furniture giant Nitori says hackers stole 37.6M customer records

Nitori, a major Japanese furniture and home accessories retailer, discovered that an attacker accessed a system on its network and may have stolen 37.62 million customer records.

Microsoft releases Windows 10 KB5131096 extended security update

Microsoft released the Windows 10 KB5131096 extended security update, which includes this month's November 2026 Patch Tuesday fixes and a few bug fixes and changes.

Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones

A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules.

SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users

An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday.

Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day

Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability.

Also: SecurityWeek

Windows 11 KB5132061 & KB5131087 cumulative updates released

Microsoft has released the Patch Tuesday Windows 11 and cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs, and add new features.

Adobe Patches 110 Vulnerabilities Across 9 Products

Adobe has fixed vulnerabilities in AEM, Premiere, Photoshop, After Effects, Connect, Audition, Dimension, Content Credentials SDK, and Media Encoder.

Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem

Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical…

Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers

A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts.

Also: The Hacker News

Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed

An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today.

Also: BleepingComputer

SAP patches ICM2SHELL and PROXYGATE maximum severity flaws

SAP patched 35 vulnerabilities in its November 2026 security updates, including four maximum-severity issues affecting its NetWeaver, Web Dispatcher, and Gateway software.

Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities

An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it.

Also: SecurityWeek

Turla hackers use new Cereal malware to spy on govt Exchange servers

The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations.

Also: The Hacker News

Chrome Update Patches Exploited XML Zero-Day, Eighth This Year

The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks.