What the news means for the people who have to act on it: the controls that matter, what regulation asks for, and how to explain it to the board.
A new N-able N-central exploit chain, 4EverAble2Shell, gives unauthenticated root on servers running the latest Hotfix 2. Attackers began mining within hours of the PoC, hitting 21 servers, 19 of them patched. Disable Legacy API and take on-prem N-central offline now.
Citrus, a newly documented crew tracked by Securelist, uses stolen contractor logins to reach a domain controller, then builds a malicious GPO named Kaspersky GPO that drops Sn00py ransomware and turns off Defender on every joined machine.
Check Point links three China-nexus espionage clusters through the Sparrow framework, run by a supplier it calls CopperDragon. Watering holes push fake Chrome certificate fixes that install the SquadC backdoor, while Linux servers are used as entry points.
Microsoft's November 2026 Patch Tuesday fixes 1,093 CVEs, including CVE-2026-124194, an actively exploited Outlook spoofing flaw that leaks a user's NTLMv2 hash when a crafted file is opened. Patch Outlook first and block outbound NTLM.
Google has shipped an emergency Chrome update for CVE-2026-125350, a high-severity use-after-free in the XML component that attackers are already exploiting. Update to 157.0.8103.50 and relaunch tonight.
An OpenSSH flaw lets attackers log into passwordless accounts on Alpine Linux and other musl-based systems using an oversized password. One connection, no retries. Patched in 10.6p2 on 5 Nov, exploited in the wild within nine hours. What to do tonight.
OpenAI says an autonomous pipeline on an unreleased cyber model produced 1,169 working local root exploits for 948 unique Linux kernel flaws in a mid-October run. Patches are landing upstream in stages. Treat any unpatched box as root-exposed and update now.
Sekoia links a large watering hole campaign to Russia's APT29. Poisoned and cloned sites, plus a one-week compromise of the Plerdy analytics tracker, served n-day exploit chains to outdated iPhones and Android Chrome. No click needed. Update now.
Barracuda disclosed CVE-2026-116606 (CVSS 9.3) and CVE-2026-111560 (CVSS 8.6) on 2 Nov 2026. Chained, they bypass authorization and give root on affected appliances. Patches are out. No active exploitation reported yet.
A missing authentication flaw in Node-RED (CVSS 10.0) is under active exploitation. Attackers send a single POST to deploy a flow that runs arbitrary code, planting a Linux bot and persistent webshells. Check whether your instance is reachable and whether adminAuth is set.
A critical use-after-free in the Linux kernel's IPv4 TCP code lets remote, unauthenticated attackers run code as root. Rated 9.8. Scanning began on 2 Nov. Red Hat has patched RHEL 8, 9 and 10; Ubuntu's fixes are still in -proposed.
Chinese-linked actors are using the open-source ARTEX AI framework to automate Kerberoasting, DCSync and lateral movement. Google, Mandiant and CrowdStrike report attacks on over 200 organisations, with one breach reaching root in 12 minutes.
