News
Straight from the wire: security alerts, releases and supply-chain stories — newest first.
SAP Patch Day: Four Critical CVSS 10.0 Pre-Auth Flaws Fixed in NetWeaver Components
SAP fixed four unauthenticated CVSS 10.0 flaws on November Patch Day — ICM, Web Dispatcher, SAP Gateway and SAML2 service provider, including two pre-auth RCE paths Onapsis researchers call ICM2SHELL and PROXYGATE.
N-able Pulls N-central Cloud Offline After 33 Zero-Days (Able2Shell) Dropped with PoC Exploits
Researcher Sean Bales published Able2Shell — 30+ unpatched N-central vulnerabilities with PoC scripts reaching root — and N-able took its hosted N-central offline and told on-prem customers to shut servers down.
Google Patches Actively Exploited Chrome XML Use-After-Free (CVE-2026-125350)
Chrome 157.0.8103.50/.51 fixes CVE-2026-125350, a high-severity use-after-free in the XML component that Google says is already exploited in the wild; reported anonymously on November 6.
Firefox 161 Enters Public Beta Testing Ahead of a November 24 Release
Firefox 161 beta is out with a customizable shortcut for copying the current tab's URL, better WebRTC call quality, Chrome history import keeping visit frequency, and CSS random() support — final release due November 24.
Linux TCP Flaw CVE-2026-98432: Red Hat Has Shipped Fixes, Ubuntu's Remain in -proposed
A 9.8/10 use-after-free in the kernel's IPv4 TCP handling lets unauthenticated remote attackers reach code execution; RHEL errata are out, and Ubuntu's fixes sit in -proposed for 22.04-26.04.
Web3Auth Flaw Exposes Keplr Social-Login Wallets; $6M Rescue Sweep and a Missing Attacker
Users of Keplr wallets created with Google or Apple sign-in had money stolen through a Web3Auth flaw both companies confirmed; Web3Auth swept at-risk wallets into recovery wallets and its login service is still degraded.
Debian Ships Symfony Security Update Fixing Sixteen CVEs
Debian issued DSA-6617-1 for the symfony PHP framework on November 9, 2026, lifting the package in trixie from 6.4.41+dfsg-0+deb13u1 to 6.4.50+dfsg-0+deb13u1 to address sixteen tracked vulnerabilities.
Mesa 26.3 Ships Vulkan 1.3 via PanVK and Widens Arm Mali Coverage
Mesa 26.3 lands Vulkan 1.3 on PanVK for Arm Mali v6/v7 chips, brings new Mali and PowerVR coverage, and a wide list of game-specific improvements. The project still calls it a development release; 26.3.1 follows.
Firefox 160 Final Builds Published Ahead of Official Unveiling
Final Firefox 160 builds are on Mozilla's download server ahead of the November 10 unveiling, introducing Mini Window, Picture-in-Picture speed control, MKV playback, and on-by-default Local Network Access restrictions on Android.
Claude Code's Saved Approvals Leak Passwords and API Keys into Public GitHub Repos
A scan of public GitHub found 1,122 copies of Claude Code's saved-approval file holding real secrets — database passwords, SSH logins, CI tokens; rotate every credential before cleaning history.
Attacker Used Qubole's AWS Credentials to Assume Customer Integration Roles and Steal Data
Wiz says a threat actor spent two October weeks assuming customers' Qubole-integration IAM roles from Qubole's own AWS account, harvesting secrets and draining S3; runners should check CloudTrail back to October 1.
Zyxel GS1900 Patched Switches Stay Exposed: New Patch 3 Firmware Fixes It as CVE-2026-107441
Binarly found the June patch for an exploited Zyxel GS1900 switch flaw leaves the same pre-auth root RCE open; firmware 2.90 Patch 3, fixing it as CVE-2026-107441, is out for ten models after roughly 996 switches were looted.
Xen XSA-523: Grant Copy Flaws Let One VM Read and Write Any Other VM’s Memory
XSA-523: two grant-copy flaws (CVE-2026-102703/102704) let a malicious VM read and write other VMs’ memory including dom0 across Xen 4.6+; no mitigation, fixed upstream for 4.18–4.19 and via XCP-ng/Qubes builds.
CISA, FBI, HHS, USDA and DOT Warn of Attacks on Industrial Refrigeration and Cold Chain Controllers
A joint US government fact sheet says threat actors are exploiting unpatched or internet-exposed refrigeration and cold chain controllers to alter temperatures and spoil inventory — with concrete hardening steps.
APT Flaw (CVE-2026-109518) Lets On-Path Attacker Run Code as Root During Package Installs
A high-severity APT flaw (CVE-2026-109518, CVSS 7.7) lets an on-path attacker swap verified packages and run code as root on Debian 12+ and Ubuntu 22.04+ defaults. Fixed builds are out for all supported Ubuntu releases.
Rails Active Storage 9.8: Crafted ImageMagick Uploads Let Attackers Write Server Files
A 9.8 flaw in Rails Active Storage lets unauthenticated uploads drive ImageMagick to write — and read — files outside the image; fixed in 8.1.4.1 and 8.0.5.2 alongside an 8.8 sibling; default Debian/Ubuntu policies do not stop it.
LNbits Tells Every Operator to Stop Their Servers Immediately Amid Waves of Exploits
Citing a wave of attacks and unreleased security patches, the LNbits project told all operators to shut down their open-source Bitcoin Lightning wallet servers now; one operator reported funds drained hours before the warning.
SSHole: OpenSSH Password Bypass Flaw Exploited Within Hours of Disclosure
OpenSSH flaw CVE-2026-123158 ("SSHole") lets an oversized password log into passwordless accounts on musl-based systems like Alpine. Exploitation began within hours of disclosure; update to 10.6p2 and restart sshd.
WordPress CVE-2026-119977: Patching an Exploited Updater Race Condition Can Briefly Reopen It
CVE-2026-119977 — a WordPress updater race now on CISA KEV — is fixed in 7.1.4 and branch backports to 4.7.39; the fixing update itself unpacks with old code, so block wp-content/upgrade access before patching.
CISA Adds SonicWall SonicOS SSL-VPN MFA Bypass (CVE-2026-19868) to KEV Catalog
SonicWall patched CVE-2026-19868 — an SSL-VPN flaw where an alternate authentication method slips past SAML and MFA; CISA added it to KEV on evidence of active exploitation.
Ethersphere Supply Chain Compromise: Malicious bee-js 13.3.0 and Swarm Desktop 0.56.2
A supply-chain attack hit Ethersphere’s own release pipeline: malicious bee-js 13.3.0 on npm and Swarm Desktop 0.56.2 carry a loader that steals Swarm node wallet keys and installs persistence on Linux, macOS and Windows.
Binance Breach: $6.3 Billion — the Largest Crypto Theft on Record
Attackers made off with roughly $6.3 billion in a breach Binance says started with fake job interviews and call-related malware aimed at the exchange's own engineers — the largest crypto theft to date.
PHP2Shell: Critical RCE Vulnerabilities in PHP Core
The PHP Group patched two critical core flaws (CVE-2026-109618, CVE-2026-109619, rated 9.2) that allow unauthenticated remote code execution; exploitation in the wild is confirmed and CISA urges immediate patching.
Canonical Releases Ubuntu 24.04 Noble Numbat
Canonical has announced the release of Ubuntu 24.04 LTS, codenamed Noble Numbat, available to download and install from ubuntu.com.
Critical Crypto Bug Fixed in PuTTY
Many versions of the PuTTY client have a subtle vulnerability that can allow an attacker to compromise some private keys and then forge signatures to log into remote servers.
New Technique to Trick Developers Detected in an Open Source Supply Chain Attack
Cybercriminals were discovered cleverly manipulating GitHub's search functionality and using meticulously crafted repositories to distribute malware.
Ubuntu 24.10 and Debian 13 Trixie to Feature New CLI
The APT 3.0 package manager is getting a completely revamped UI with columnar display, support for colors, and much more.
CVE-2024-3094: Critical RCE Vulnerability in XZ Utils
A critical supply chain compromise has been detected in XZ Utils versions 5.6.0 and 5.6.1, which may lead to remote code execution (RCE) via SSH authentication on affected distributions.
Vulnerability Management: Beyond Patching
An article explores the evolving landscape of vulnerability management, delving deeper than mere patching — from NIST framework core functions to PCI DSS and ISO 27001/27002 compliance changes and the role of Zero Trust.