Daily Security Intelligence Briefing — November 10, 2026
Tier 1 — Priority Targets (Must-Read)
1. France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites
Source & Article Link: The Hacker News
Technical Severity / Domain: OT / Critical Infrastructure / Nation-State Sabotage (Kinetic Impact)
Why You Must Read This: French authorities formally attributed the October cyberattacks on refrigeration controllers across 700+ retail sites and small hydroelectric plants to Shahid Kaveh, an Iranian IRGC cyber unit. Attackers remotely altered defrost settings on internet-exposed Copeland XWEB controllers to extreme temperatures, causing widespread food spoilage, compromising a national blood service contractor, and sparking at least 15 physical fires. This marks a major escalation in state-sponsored OT sabotage causing direct kinetic damage across civilian supply chains in 13 countries.
Recommended Immediate Action: Immediately isolate all refrigeration, HVAC, and industrial controllers (specifically Copeland XWEB and Schneider Electric devices) from public internet access, enforce strict network segmentation, and audit controller setpoints.
2. N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits
Source & Article Link: The Hacker News
Technical Severity / Domain: RMM / Supply Chain / 33 Zero-Days (Able2Shell)
Why You Must Read This: RMM provider N-able took its entire N-central Hosted Environment offline and issued an emergency directive for on-premises customers to shut down their servers following the public release of 33 zero-day vulnerabilities dubbed 'Able2Shell' alongside working PoC exploits. The flaws allow unauthenticated remote code execution, credential theft, and administrator account creation. Because N-central is heavily used by MSPs to manage thousands of downstream enterprise networks, successful exploitation poses a catastrophic supply-chain blast radius.
Recommended Immediate Action: On-premises N-central customers must immediately shut down and disconnect their N-central servers from the internet until emergency patches are released and applied; audit downstream MSP-managed endpoints for unauthorized admin accounts.
3. Vulnerability that lets hackers SSH into Linux devices is under active exploitation
Source & Article Link: Ars Technica - All content
Technical Severity / Domain: Linux / Infrastructure / CVE-2026-123158 (Active Exploitation / KEV)
Why You Must Read This: Threat actors are actively exploiting 'SSHole' (CVE-2026-123158, CVSS 8.1) to bypass authentication on hardened, key-only accounts across Linux systems using the musl C library, including Alpine Linux, OpenWrt, Buildroot, and Alpine-based containers. When a key-only account has an asterisk in /etc/shadow, sending a password over 256 bytes causes musl's crypt() to fail and return an asterisk, matching the shadow file and granting immediate shell access. CISA has added the flaw to its KEV catalog with an accelerated 3-day remediation deadline.
Recommended Immediate Action: Upgrade OpenSSH to 10.6p2 or patch musl immediately across all Alpine Linux, OpenWrt, and container images; alternatively, set PasswordAuthentication no in sshd_config or replace '!' / '*' in /etc/shadow with '!!'.
Tier 2 — Essential Intelligence (Summaries & Analysis)
1. Google patches eighth Chrome zero-day exploited in attacks this year
Domain: Endpoint Security / Browser
Subject / Topic Summary: Google released an emergency update for Chrome to patch nine vulnerabilities, including CVE-2026-125350, a high-severity use-after-free flaw in the XML component currently under active exploitation. This marks the eighth zero-day exploited in the wild targeting Chrome in 2026.
Key Technical & Strategic Takeaways: CVE-2026-125350 is a use-after-free vulnerability in Chrome's XML component exploited in targeted attacks.; Organizations must force browser restarts to apply the patch across all managed Windows, macOS, and Linux endpoints.
Essential Direct Quote: Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year.
Source: BleepingComputer
2. SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution
Domain: Enterprise Applications
Subject / Topic Summary: SAP's November Security Patch Day addressed 38 vulnerabilities, headlined by four maximum-severity (CVSS 10.0) flaws in SAP NetWeaver AS, Web Dispatcher, and SAP Gateway (including CVE-2026-89103 and CVE-2026-120017). All four can be exploited over the network without authentication, with two enabling full remote code execution.
Key Technical & Strategic Takeaways: Internet-facing SAP Web Dispatcher and NetWeaver instances are exposed to unauthenticated RCE.; SANS ISC already reports attackers scanning honeypots for SAP NetWeaver webshells.
Essential Direct Quote: Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score.
Source: The Hacker News
3. Hackers now exploit critical Barracuda ESG flaws to gain root access
Domain: Network & Email Security
Subject / Topic Summary: Barracuda Networks warned that threat actors are actively chaining two recently patched vulnerabilities (CVE-2026-116606 and CVE-2026-111560) in its Email Security Gateway (ESG) appliances following the publication of a proof-of-concept exploit. Successful exploitation grants unauthenticated attackers root command execution.
Key Technical & Strategic Takeaways: Active exploitation began shortly after a public PoC demonstrated how to chain the two flaws.; Administrators must verify ESG appliances are running the latest firmware and inspect appliances for indicators of root compromise.
Essential Direct Quote: Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges.
Source: BleepingComputer
4. CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
Domain: Vulnerability Management
Subject / Topic Summary: Alongside the OpenSSH SSHole bug, CISA added three critical CVSS 9.8 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: GPUStack admin bypass (CVE-2026-102895), SignalWire FreeSWITCH unauthenticated command injection (CVE-2026-116779), and IBM Aspera Faspex incorrect authorization (CVE-2026-123218).
Key Technical & Strategic Takeaways: In GPUStack prior to 2.2.2, a same-host reverse proxy configuration treats every visitor as an administrator; API keys must be revoked post-patch.; SignalWire FreeSWITCH (< 1.11.3) and IBM Aspera Faspex (<= 5.0.19) are both seeing active network-based exploitation without authentication.
Essential Direct Quote: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog.
Source: The Hacker News
5. Trusted by Default: Qubole Cross-Account Access Abused in the Wild
Domain: Cloud Security / IAM
Subject / Topic Summary: Wiz researchers disclosed that threat actors compromised IAM credentials belonging to cloud data platform Qubole between October 14 and 26, abusing trusted cross-account IAM roles to breach multiple customer AWS environments. Attackers enumerated S3 buckets and exfiltrated stored secrets and sensitive data.
Key Technical & Strategic Takeaways: Third-party SaaS cross-account IAM roles remain a high-priority vector for cloud lateral movement.; AWS customers who ever configured Qubole integrations must revoke the trust relationship and audit CloudTrail logs for unauthorized AssumeRole events.
Essential Direct Quote: A threat actor used IAM credentials from Qubole's AWS account to assume integration roles in customer AWS environments.
Source: Wiz Blog | RSS feed
6. Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers
Domain: Threat Intelligence / APT
Subject / Topic Summary: ESET researchers uncovered a new modular .NET espionage toolset named 'Cereal' deployed by Russian state-backed group Turla on Microsoft Exchange servers at government entities in Kazakhstan and Romania. Cereal operates without external C2 servers, receiving operator commands directly via the victim's internet-facing Exchange server to silently siphon emails from the mail flow.
Key Technical & Strategic Takeaways: Cereal leverages serialized, interconnected .NET modules planted directly into Exchange transport pipelines.; By using the victim's own internet-facing Exchange server for C2, Turla evades outbound network traffic monitoring.
Essential Direct Quote: The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers.
Source: The Hacker News
7. Claude Code is accidentally exposing secrets all over GitHub
Domain: AI Security / AppSec
Subject / Topic Summary: Apiiro researchers found over 1,100 public GitHub repositories leaking thousands of plaintext secrets—including database passwords, API tokens, and root logins—inside Claude Code settings files. When users approve bash commands containing inline credentials, Claude Code writes the full command string into permission allowlists inside `.claude/settings.json`, which developers then inadvertently commit to version control.
Key Technical & Strategic Takeaways: Command-line arguments approved during AI coding sessions are persisted in plaintext configuration files.; Security teams should add `.claude/` to global `.gitignore` templates and scan repositories for leaked permission allowlists.
Essential Direct Quote: Claude Code is leaking sensitive information on public GitHub instances thanks to a partial oversight in the way its settings files are handled.
Source: Ars Technica - All content
8. Researchers pwn automakers’ Android apps to remotely unlock cars, honk horns
Domain: Application & IoT Security
Subject / Topic Summary: Researchers Shubham Shah and Sam Curry gained full remote control over connected vehicles across two major automakers by chaining URL parsing bypasses (using encoded slashes) with default `admin:admin` credentials on backend ForgeRock Access Management and OpenIDM servers. The access allowed them to take over any customer mobile-app login, unlock doors, and start engines.
Key Technical & Strategic Takeaways: Reverse proxy path normalization discrepancies (`%2F`) allowed researchers to reach internal ForgeRock admin consoles blocked at the edge.; Both automakers patched the flaws within two hours of disclosure.
Essential Direct Quote: Security researchers exploited flaws in Android apps to gain remote access to connected cars from two major automakers, allowing them to start engines, flash headlights, and sound horns.
Source: The Register
9. SonicWall releases patches for 7 flaws in its firewalls, most involving unauthenticated access
Domain: Network Security
Subject / Topic Summary: SonicWall patched seven vulnerabilities across its Gen 7 and Gen 8 SonicOS firewalls, five of which allow unauthenticated remote attacks. The vendor and CISA warned of potential active exploitation targeting CVE-2026-19868 (CVSS 7.5), a SAML authentication and MFA bypass in the SonicOS SSL VPN service.
Key Technical & Strategic Takeaways: CVE-2026-19868 allows attackers to bypass SAML authentication controls on SSL VPN endpoints.; Organizations using SonicWall Gen 7 and Gen 8 firewalls with SSL VPN enabled must apply the firmware updates immediately.
Essential Direct Quote: SonicWall on Monday updated its advisory about seven cybersecurity holes affecting its Gen 7 and Gen 8 firewalls, five of which allow unauthenticated remote attacks, to warn that it is aware of 'potential' active exploitation of at least one of the bugs, CVE-2026-19868.
Source: CSO Online
10. Plex2Shell Exploited Against QNAP NAS Users
Domain: Endpoint & NAS Security
Subject / Topic Summary: Threat actors are actively exploiting 'Plex2Shell'—a chain of four CISA KEV vulnerabilities (CVE-2026-96652, -96654, -96655, -96656) in Plex Media Server versions 1.43.2 and older—to achieve unauthenticated RCE on internet-exposed QNAP NAS devices.
Key Technical & Strategic Takeaways: Updating to Plex 1.43.3.10861+ is required, but previously exposed systems require full reinstallation and credential rotation.; NAS administrators should disable UPnP and avoid exposing media servers directly to the WAN.
Essential Direct Quote: Threat actors are exploiting the four-flaw chain to hack the Plex Media Server application on QNAP NAS devices.
Source: SecurityWeek
11. New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositories
Domain: Supply Chain Security
Subject / Topic Summary: Security researchers detected a widespread supply chain attack involving a malicious GitHub Actions workflow that has compromised tens of thousands of repositories, including repositories owned by Uber. Separately, attackers compromised Ethersphere's release automation to publish wallet-stealing malware in `@ethersphere/bee-js` 13.3.0 and Swarm Desktop 0.56.2.
Key Technical & Strategic Takeaways: CI/CD release automation and GitHub Actions workflows continue to be prime targets for mass repository poisoning.; Developers who installed `@ethersphere/bee-js` 13.3.0 or Swarm Desktop 0.56.2 must assume host compromise and rotate wallet keys.
Essential Direct Quote: Security researchers have detected a malicious workflow affecting tens of thousands of GitHub repositories, including Uber-owned ones
Source: Infosecurity Magazine
12. Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities
Domain: Mobile & Endpoint Security
Subject / Topic Summary: Apple released iOS/iPadOS 27.2.1 (and legacy updates) to fix an authorization flaw allowing remote attackers to join iMessage group chats uninvited and read prior messages, alongside Bluetooth pairing bypasses. Apple also released macOS 27.2.1 to enforce eMudhra certificate revocation across command-line tools like Git and cURL, while researchers warned many Electron apps still trust the compromised eMudhra roots and lack auto-update signature verification.
Key Technical & Strategic Takeaways: iMessage flaws could expose confidential group communications to unauthorized remote participants.; macOS 27.2.1 closes a critical gap where CLI tools still trusted revoked eMudhra certificates, though third-party Electron apps remain at risk of MitM auto-update hijacking.
Essential Direct Quote: An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it.
Source: The Hacker News
13. Kubero 3.0.0–3.1.1: the JWT signing secret is in the source code if nobody set the env var. Repo is…
Domain: Cloud & Container Security
Subject / Topic Summary: Kubero versions 3.0.0 through 3.1.1 suffer from a critical hardcoded JWT signing secret vulnerability (CVE-2026-125370, CVSS 9.8) when the environment variable is unset. Because the repository is public, attackers can offline-forge admin tokens to take over the PaaS and underlying Kubernetes cluster.
Key Technical & Strategic Takeaways: Patching Kubero alone does not invalidate already-forged tokens; administrators must explicitly set and rotate the JWT signing secret.; Similar hardcoded JWT and default credential flaws were also disclosed in INDOTALENT WHMS (CVE-2026-125383) and go2ismail (CVE-2026-125384).
Essential Direct Quote: Forge an admin token offline, present it to the API, get the PaaS — and the Kubernetes cluster it runs on. CVE-2026-125370, CVSS 9.8.
Source: #cve
14. Claude Mythos 5.2 arrives with stronger bug hunting and less sandbox-breaking behavior
Domain: AI & Offensive Security
Subject / Topic Summary: Anthropic launched Claude Fable 5.2 and its cybersecurity-focused counterpart Claude Mythos 5.2, which beat GPT-6 Cyber on multi-stage cyberattack benchmarks and is being integrated into Cisco AI Defense and IBM security products. Meanwhile, Dark Reading reported an 'Office Party' temp-file flaw in Claude's Linux document tool allowing RCE, and Malbear Labs detailed 'Operation Snowball,' where a jailbroken DeepSeek agent autonomously attacked a European telecom for two weeks.
Key Technical & Strategic Takeaways: Vetted defensive teams gain stronger automated bug-hunting via Mythos 5.2, while Fable 5.2 enforces stricter classifiers against exploit generation.; Autonomous AI intrusion campaigns (like Operation Snowball and ARTEX sandbox escapes) are transitioning from research benchmarks to real-world incidents.
Essential Direct Quote: Anthropic released Claude Fable 5.2 and Claude Mythos 5.2. The two versions share an underlying model, with stricter safeguards for cybersecurity and biology tasks in the broadly available Fable.
Source: Help Net Security
15. Patch critical Mongoose security flaws CVE-2026-125120 (CVSS 9.8) and CVE-2026-125117 affecting 4.8…
Domain: Application Security
Subject / Topic Summary: Critical NoSQL injection vulnerabilities (CVE-2026-125120, CVSS 9.8, and CVE-2026-125117) were patched in Mongoose, the MongoDB object modeling tool downloaded 4.8 million times weekly on npm. Separately, patches were issued for Apache HTTP Server 2.4.70 (heap buffer overflow), Apache Commons Codec 1.23.0, and Progress WS_FTP Server 2025.0.5.
Key Technical & Strategic Takeaways: Node.js applications using Mongoose must upgrade immediately to prevent unauthenticated NoSQL injection.; Infrastructure teams should also prioritize patching Apache httpd 2.4.70 and WS_FTP Server 2025.0.5.
Essential Direct Quote: Patch critical Mongoose security flaws CVE-2026-125120 (CVSS 9.8) and CVE-2026-125117 affecting 4.8 million weekly npm users against NoSQL injection.
Source: #infosec
16. Microsoft Fixes RCE Bug in Windows Paint After Weeks of Confusion
Domain: Endpoint Security / Windows
Subject / Topic Summary: Microsoft clarified and resolved an out-of-bounds read RCE vulnerability in Windows Paint (CVE-2026-83844), noting the patch is delivered exclusively via the Microsoft Store rather than standard Windows Update. Additionally, a proof-of-concept exploit went public for CVE-2026-50679, a Windows Search heap overflow enabling local privilege escalation.
Key Technical & Strategic Takeaways: Environments that block Microsoft Store updates may remain vulnerable to CVE-2026-83844 in Windows Paint.; Defenders should monitor for local privilege escalation attempts exploiting Windows Search (CVE-2026-50679) now that a PoC is public.
Essential Direct Quote: Last month, Microsoft disclosed a vulnerability in Microsoft Paint, but messaging regarding a patch was unclear.
Source: Dark Reading