the xtralinux.org desk
The open web. On watch.
Brief, source-linked news about security, linux and open source — tracked and explained as it breaks, by the XtraLinux desk.
Latest entriesApache HTTP Server 2.4.71 Fixes Critical mod_http2 RCE CVE-2026-119618
CVE-2026-119618: a race condition in mod_http2 assign_headers() corrupts the heap and gives unauthenticated RCE on Apache 2.4.55-2.4.70 servers with HTTP/2; fixed in 2.4.71, HTTP/2 off is the mitigation.
wfx: 4,837 Hijacked GitHub Accounts Seed CI Secret Stealer Across Thousands of Repos
Stolen GitHub tokens have pushed a CI secret stealer (wfx) into thousands of repositories since November 10, via workflow injections and npm postinstall hooks that exfiltrate secrets and cloud credentials and survive rotation.
Node.js November 2026 Security Release Fixes 16 Flaws, Seven Rated High
Node.js 22.23.5, 24.22.3 and 26.13.1 close 16 vulnerabilities, seven high: HTTP/2 bugs that crash servers or leak other connections memory, an HTTPS flaw exposing TLS private keys, and TLS 1.2 mTLS bypasses. Updating is the only fix.
eMudhra Revokes Eight More Intermediate CAs After Script Exposed Their Private Keys
eMudhra revoked six TLS and two code-signing intermediate CAs late last week after an April 2025 script pulled their RSA keys from the HSM during a key transfer; it had told Mozilla the RSA issuers were unaffected.
X.Org Server 21.1.26 and Xwayland 24.1.15 Patch Eight Flaws: Out-of-Bounds Writes, Integer Overflows and Length Bypasses
X.Org Server 21.1.26 and Xwayland 24.1.15 (November 10) fix eight X server issues — crafted-EDID memory overruns plus bypassable size checks in Xv, XRes, XTest and glamor (CVE-2026-109091 to -109096, -109903, -109904).
Microsoft Patch Tuesday: 1,259 Flaws, Exploited Outlook Bug CVE-2026-124194 Lands on CISA KEV
Microsoft's November Patch Tuesday fixes 1,259 vulnerabilities, including an exploited Outlook flaw (CVE-2026-124194) that can leak NTLMv2 hashes via a crafted message file; CISA added it to KEV with a November 24 deadline.
CISA Adds Exploited Cisco BroadWorks and Openwave Webtop Flaws to KEV Catalog
CISA put CVE-2026-20320 (Cisco BroadWorks XXE) and CVE-2026-111793 (Openwave Webtop Media Transcoder) in the Known Exploited Vulnerabilities catalog on November 10, 2026, with federal patch deadlines of November 24.
Xen Orchestra Auth Bypass VSA-2026-062 Actively Exploited Toward XCP-ng Root Takeover
Vates rates VSA-2026-062 — an empty-object login-token auth bypass in Xen Orchestra with no CVE id yet — critical and actively exploited; fixes in XO 6.9.2/6.10.1 and xo-server 5.211.2/5.213.1.
Git 2.56.1 Fixes Code Execution via Malicious Repository Recursive Clones
Git shipped fixes for six vulnerabilities on November 10, 2026 — led by CVE-2026-111760, an integer truncation that lets a malicious repo execute code during a recursive clone; 2.56.1 plus backports to 2.50.2–2.55.1.
SAP Patch Day: Four Critical CVSS 10.0 Pre-Auth Flaws Fixed in NetWeaver Components
SAP fixed four unauthenticated CVSS 10.0 flaws on November Patch Day — ICM, Web Dispatcher, SAP Gateway and SAML2 service provider, including two pre-auth RCE paths Onapsis researchers call ICM2SHELL and PROXYGATE.
N-able Pulls N-central Cloud Offline After 33 Zero-Days (Able2Shell) Dropped with PoC Exploits
Researcher Sean Bales published Able2Shell — 30+ unpatched N-central vulnerabilities with PoC scripts reaching root — and N-able took its hosted N-central offline and told on-prem customers to shut servers down.
Google Patches Actively Exploited Chrome XML Use-After-Free (CVE-2026-125350)
Chrome 157.0.8103.50/.51 fixes CVE-2026-125350, a high-severity use-after-free in the XML component that Google says is already exploited in the wild; reported anonymously on November 6.