the xtralinux.org desk
The open web. On watch.
Brief, source-linked news about security, linux and open source — tracked and explained as it breaks, by the XtraLinux desk.
Latest entrieseMudhra Revokes Eight More Intermediate CAs After Script Exposed Their Private Keys
eMudhra revoked six TLS and two code-signing intermediate CAs late last week after an April 2025 script pulled their RSA keys from the HSM during a key transfer; it had told Mozilla the RSA issuers were unaffected.
X.Org Server 21.1.26 and Xwayland 24.1.15 Patch Eight Flaws: Out-of-Bounds Writes, Integer Overflows and Length Bypasses
X.Org Server 21.1.26 and Xwayland 24.1.15 (November 10) fix eight X server issues — crafted-EDID memory overruns plus bypassable size checks in Xv, XRes, XTest and glamor (CVE-2026-109091 to -109096, -109903, -109904).
Microsoft Patch Tuesday: 1,259 Flaws, Exploited Outlook Bug CVE-2026-124194 Lands on CISA KEV
Microsoft's November Patch Tuesday fixes 1,259 vulnerabilities, including an exploited Outlook flaw (CVE-2026-124194) that can leak NTLMv2 hashes via a crafted message file; CISA added it to KEV with a November 24 deadline.
CISA Adds Exploited Cisco BroadWorks and Openwave Webtop Flaws to KEV Catalog
CISA put CVE-2026-20320 (Cisco BroadWorks XXE) and CVE-2026-111793 (Openwave Webtop Media Transcoder) in the Known Exploited Vulnerabilities catalog on November 10, 2026, with federal patch deadlines of November 24.
Xen Orchestra Auth Bypass VSA-2026-062 Actively Exploited Toward XCP-ng Root Takeover
Vates rates VSA-2026-062 — an empty-object login-token auth bypass in Xen Orchestra with no CVE id yet — critical and actively exploited; fixes in XO 6.9.2/6.10.1 and xo-server 5.211.2/5.213.1.
Git 2.56.1 Fixes Code Execution via Malicious Repository Recursive Clones
Git shipped fixes for six vulnerabilities on November 10, 2026 — led by CVE-2026-111760, an integer truncation that lets a malicious repo execute code during a recursive clone; 2.56.1 plus backports to 2.50.2–2.55.1.
SAP Patch Day: Four Critical CVSS 10.0 Pre-Auth Flaws Fixed in NetWeaver Components
SAP fixed four unauthenticated CVSS 10.0 flaws on November Patch Day — ICM, Web Dispatcher, SAP Gateway and SAML2 service provider, including two pre-auth RCE paths Onapsis researchers call ICM2SHELL and PROXYGATE.
N-able Pulls N-central Cloud Offline After 33 Zero-Days (Able2Shell) Dropped with PoC Exploits
Researcher Sean Bales published Able2Shell — 30+ unpatched N-central vulnerabilities with PoC scripts reaching root — and N-able took its hosted N-central offline and told on-prem customers to shut servers down.
Google Patches Actively Exploited Chrome XML Use-After-Free (CVE-2026-125350)
Chrome 157.0.8103.50/.51 fixes CVE-2026-125350, a high-severity use-after-free in the XML component that Google says is already exploited in the wild; reported anonymously on November 6.
Linux TCP Flaw CVE-2026-98432: Red Hat Has Shipped Fixes, Ubuntu's Remain in -proposed
A 9.8/10 use-after-free in the kernel's IPv4 TCP handling lets unauthenticated remote attackers reach code execution; RHEL errata are out, and Ubuntu's fixes sit in -proposed for 22.04-26.04.
Firefox 161 Enters Public Beta Testing Ahead of a November 24 Release
Firefox 161 beta is out with a customizable shortcut for copying the current tab's URL, better WebRTC call quality, Chrome history import keeping visit frequency, and CSS random() support — final release due November 24.
Web3Auth Flaw Exposes Keplr Social-Login Wallets; $6M Rescue Sweep and a Missing Attacker
Users of Keplr wallets created with Google or Apple sign-in had money stolen through a Web3Auth flaw both companies confirmed; Web3Auth swept at-risk wallets into recovery wallets and its login service is still degraded.