Photo: Jelson25, Public domain, via Wikimedia Commons
Security in brief
Microsoft released November 2026 security updates addressing 1,235 flaws, including an actively exploited Outlook zero-day. The Patch Tuesday releases included an extended security update for Windows 10 and cumulative updates for versions 26H2, 25H2, 24H2 and 23H2 of its successor.
Google released emergency security updates for Chrome to fix nine vulnerabilities, including an actively exploited use-after-free flaw. Tracked as CVE-2026-125350 and described as affecting XML, the high-severity bug was the browser’s eighth zero-day exploited in attacks since the start of 2026.
Barracuda Networks warned that hackers had begun exploiting two recently patched vulnerabilities in its Email Security Gateway software. The flaws allow attackers to run commands with root privileges; CISA added one, CVE-2026-116606, to its Known Exploited Vulnerabilities catalog on November 10.
Vates VMS warned of an actively exploited authentication bypass in Xen Orchestra that could grant attackers administrator privileges. Tracked as VSA-2026-062, the critical flaw did not yet have a CVE identifier; exploitation could allow hackers to take over XCP-ng virtualization hosts.
Hackers used compromised credentials for a Qubole big data platform account to access and steal data from multiple customers’ AWS environments. The breach involved identity and access management credentials, with the attackers exploiting trusted access to reach the affected cloud environments. (BleepingComputer)
Fireworks AI disclosed further malicious activity affecting a limited set of accounts, including account and billing information, secrets, datasets and incomplete models. Hackers accessed its development machines after breaching a third-party cloud provider, and the company said all affected customers had been notified.
Turla used a previously undocumented espionage toolset called Cereal to intercept emails on government Microsoft Exchange servers. The Russia-aligned, state-sponsored group deployed the tools to break into victims’ systems and collect correspondence surreptitiously, according to an ESET report describing the activity.
SAP patched 35 vulnerabilities in its November 2026 security updates, including four rated at the maximum severity score of 10.0. All four could be exploited without logging in; three affected the NetWeaver application server and one affected Web Dispatcher, with two enabling remote code execution.
France attributed an October cyberattack on refrigeration controllers at about 700 French retail sites to a cyber unit of Iran’s Islamic Revolutionary Guard Corps. The government said the attackers broke into the controllers on the night of October 11 and changed their defrost settings.
Hackers exploited two now-patched vulnerabilities in AhsayCBS to deploy a Python-based backdoor capable of evading sandboxes. Huntress observed the activity in early October 2026; the attack chained CVE-2026-105133 and CVE-2026-105134 to deliver the implant, according to researchers who disclosed details of the intrusion.
Figure of the day: 18. An attacker stole data from 18 agents and about 100 users after exploiting an SGLang remote code execution flaw on a NEAR AI inference server. (The Hacker News)
The detail
3 vulnerabilities newly known-exploited as of 2026-11-10.
Exploited now
CVE-2026-124194: Microsoft 365 Apps for Enterprise: 6.5 medium · added to KEV 2026-11-10. Prioritize remediation based on the KEV listing, not just the medium severity rating.
CVE-2026-125350: Google Chrome: 8.8 high · added to KEV 2026-11-10. Prioritize patching: the flaw is in KEV, not just sitting on a severity chart.
CVE-2026-116606: Barracuda Email Security Gateway (ESG): 9.3 critical · EPSS 1.6% · added to KEV 2026-11-10. Prioritize remediation: the flaw is critical and has been added to KEV.
Breaches
Harvard: Harvard (harvard.edu), 851K accounts: Charitable donations, Citizenship statuses, Dates of birth, Education levels, Email addresses. Treat unexpected donation requests with caution; exposed email addresses and charitable donation records could make targeted phishing more convincing.
AfD: AfD (afd.de), 345K accounts: Email addresses, Email messages. Watch for targeted phishing that uses exposed email messages to make the bait convincing.
Industry and research
Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor: The Hacker News. Check for the sandbox-evading Python backdoor, not just the exploited flaws.
CISA Adds Four Known Exploited Vulnerabilities to Catalog: CISA Cybersecurity Advisories. Prioritize remediation of the four known exploited vulnerabilities.
CISA Adds Six Known Exploited Vulnerabilities to Catalog: CISA Cybersecurity Advisories. Prioritize the six catalog additions for remediation.
Query any of this yourself with Spydr: curl -L "spydr.io/threats?kev=1&since=1d"
This product uses data from the NVD API but is not endorsed or certified by the NVD. Known exploited vulnerabilities from the CISA KEV catalog. Exploit prediction scores from FIRST EPSS. Breach data from Have I Been Pwned (haveibeenpwned.com), licensed under CC BY 4.0.