Afternoon Review in IT Security — November 12, 2026

Today's threat landscape reflects escalating risks across container infrastructure, software supply chains, and browser environments. Critical vulnerabilities in widely deployed platforms continue to drive urgent patching requirements while active exploitation campaigns demonstrate the speed at which attackers capitalize on security gaps.

Critical Red Hat Quay Vulnerability Allows Unauthenticated Attackers to Hijack Container Registries

A critical vulnerability in Red Hat Quay has emerged that permits unauthenticated attackers to take control of container registry token signing. Tracked as CVE-2026-123710, the flaw carries a CVSS score of 9.8 and was published by Red Hat on November 11, 2026. Any attacker with network access to a registry's key server can exploit this vulnerability to hijack the signing infrastructure, posing severe risks to container supply chain integrity. Source: Cyber Security News

Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign

A large-scale credential theft operation designated as the wfx-loot campaign has compromised thousands of GitHub accounts to distribute a CI secret stealer across the platform. The malicious payload was executed in over 1,800 GitHub repositories, with the campaign targeting approximately 60,000 repositories in total. This supply chain attack demonstrates the effectiveness of account hijacking as a vector for deploying credential harvesting tools at scale. Source: SecurityWeek

CISA Warns of Google Chromium 0-Day Vulnerability Actively Exploited in Attacks

The Cybersecurity and Infrastructure Security Agency has added CVE-2026-125350, a zero-day vulnerability in Google Chromium, to its Known Exploited Vulnerabilities catalog following confirmation of active exploitation. The flaw resides in the browser's XML component and allows remote code execution through specially crafted webpages. Users of Chrome, Edge, and Opera are advised to verify their browser versions immediately, as the vulnerability is already being weaponized in the wild. Source: Cyber Security News

PHP2Shell and Node2Shell: Critical Runtime Vulnerabilities Demand Immediate Patching

Two critical runtime vulnerabilities affecting PHP and Node.js have been identified and added to the CISA Known Exploited Vulnerabilities list. PHP2Shell encompasses CVE-2026-109618 and CVE-2026-109619, with fixes available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Node2Shell is tracked as CVE-2026-111497 and has been patched in Node.js versions 22.23.4, 24.22.1, and 26.12.1. These flaws are particularly dangerous because they affect the runtime itself rather than application code, meaning every deployed application inherits the vulnerability until patching occurs. Source: Qualys Blog

Organizations face mounting pressure to address multiple critical vulnerabilities spanning container infrastructure, development platforms, browsers, and runtime environments. The combination of active exploitation, zero-day status, and supply chain implications underscores the need for coordinated patching strategies and continuous vulnerability monitoring across all technology stacks.