the xtralinux.org desk
The open web. On watch.
Brief, source-linked news about security, linux and open source — tracked and explained as it breaks, by the XtraLinux desk.
Latest entriesSAP Patch Day: Four Critical CVSS 10.0 Pre-Auth Flaws Fixed in NetWeaver Components
SAP fixed four unauthenticated CVSS 10.0 flaws on November Patch Day — ICM, Web Dispatcher, SAP Gateway and SAML2 service provider, including two pre-auth RCE paths Onapsis researchers call ICM2SHELL and PROXYGATE.
N-able Pulls N-central Cloud Offline After 33 Zero-Days (Able2Shell) Dropped with PoC Exploits
Researcher Sean Bales published Able2Shell — 30+ unpatched N-central vulnerabilities with PoC scripts reaching root — and N-able took its hosted N-central offline and told on-prem customers to shut servers down.
Google Patches Actively Exploited Chrome XML Use-After-Free (CVE-2026-125350)
Chrome 157.0.8103.50/.51 fixes CVE-2026-125350, a high-severity use-after-free in the XML component that Google says is already exploited in the wild; reported anonymously on November 6.
Linux TCP Flaw CVE-2026-98432: Red Hat Has Shipped Fixes, Ubuntu's Remain in -proposed
A 9.8/10 use-after-free in the kernel's IPv4 TCP handling lets unauthenticated remote attackers reach code execution; RHEL errata are out, and Ubuntu's fixes sit in -proposed for 22.04-26.04.
Firefox 161 Enters Public Beta Testing Ahead of a November 24 Release
Firefox 161 beta is out with a customizable shortcut for copying the current tab's URL, better WebRTC call quality, Chrome history import keeping visit frequency, and CSS random() support — final release due November 24.
Web3Auth Flaw Exposes Keplr Social-Login Wallets; $6M Rescue Sweep and a Missing Attacker
Users of Keplr wallets created with Google or Apple sign-in had money stolen through a Web3Auth flaw both companies confirmed; Web3Auth swept at-risk wallets into recovery wallets and its login service is still degraded.
Debian Ships Symfony Security Update Fixing Sixteen CVEs
Debian issued DSA-6617-1 for the symfony PHP framework on November 9, 2026, lifting the package in trixie from 6.4.41+dfsg-0+deb13u1 to 6.4.50+dfsg-0+deb13u1 to address sixteen tracked vulnerabilities.
Firefox 160 Final Builds Published Ahead of Official Unveiling
Final Firefox 160 builds are on Mozilla's download server ahead of the November 10 unveiling, introducing Mini Window, Picture-in-Picture speed control, MKV playback, and on-by-default Local Network Access restrictions on Android.
Mesa 26.3 Ships Vulkan 1.3 via PanVK and Widens Arm Mali Coverage
Mesa 26.3 lands Vulkan 1.3 on PanVK for Arm Mali v6/v7 chips, brings new Mali and PowerVR coverage, and a wide list of game-specific improvements. The project still calls it a development release; 26.3.1 follows.
Claude Code's Saved Approvals Leak Passwords and API Keys into Public GitHub Repos
A scan of public GitHub found 1,122 copies of Claude Code's saved-approval file holding real secrets — database passwords, SSH logins, CI tokens; rotate every credential before cleaning history.
Attacker Used Qubole's AWS Credentials to Assume Customer Integration Roles and Steal Data
Wiz says a threat actor spent two October weeks assuming customers' Qubole-integration IAM roles from Qubole's own AWS account, harvesting secrets and draining S3; runners should check CloudTrail back to October 1.
Zyxel GS1900 Patched Switches Stay Exposed: New Patch 3 Firmware Fixes It as CVE-2026-107441
Binarly found the June patch for an exploited Zyxel GS1900 switch flaw leaves the same pre-auth root RCE open; firmware 2.90 Patch 3, fixing it as CVE-2026-107441, is out for ten models after roughly 996 switches were looted.