Cloud hosting provider Railway says hackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and generate approximately $740,000 in fraudulent AI usage, potentially exposing credentials for up to 100,000 workspaces.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: CVE-2026-102895 GPUStack Improper Authentication Vulnerability CVE-2026-116779 SignalWire FreeSwitch Code Injection Vulnerability CVE-2026-123158 OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability CVE-2026-123218 IBM Aspera Faspex Incorrect Authorization Vulnerability The first issue added to the catalog, CVE-2026-102895 (CVSS score of 9.8), is an improper authentication vulnerability affecting GPUStack, an open-source platform used to manage GPU clusters and AI model deployments. The flaw allows remote, unauthenticated attackers to bypass authentication and obtain administrator privileges by making requests appear to originate from the local system. Successful exploitation can expose sensitive information, create persistent administrator API keys, modify configurations and potentially execute arbitrary code. Exploitation has been observed in the wild against a GPUStack 2.1.1 deployment. Security researcher Javier Sixto reported the in-the-wild exploitation, but no specific threat group has been identified. The issue affects versions before 2.2.0. The second issue, CVE-2026-116779 (CVSS score of 9.8), is a code injection vulnerability in SignalWire FreeSWITCH, an open-source communications platform. The flaw allows attackers to send specially crafted SIP MESSAGE requests and abuse the API chat protocol to execute FreeSWITCH API commands. Depending on the configuration, this can expose credentials and configuration data, manipulate telephone calls and execute operating system commands with the privileges of the FreeSWITCH process. SignalWire confirmed that exploitation has been observed in the wild. The vulnerability was added to CISA’s KEV catalog on November 9, 2026, but no information identifying the attackers or a specific campaign has been disclosed. FreeSWITCH versions before 1.11.3 are affected. The third issue, CVE-2026-123158 (CVSS score of 8.1), is an authentication bypass vulnerability affecting OpenSSH. Under specific conditions, when OpenSSH runs on Linux systems using the musl C library without Pluggable Authentication Modules (PAM), the SSH server may incorrectly interpret password input as a password hash. A remote, unauthenticated attacker can exploit the flaw by submitting a specially crafted password to bypass authentication and access affected accounts. CISA added the vulnerability to its KEV catalog on November 6, 2026, indicating that exploitation has been observed. However, no specific threat actor or attack campaign has been publicly identified. OpenSSH versions before 10.6p2 are affected. The fourth issue, CVE-2026-123218 (CVSS score of 9.8), is an incorrect authorization vulnerability affecting IBM Aspera Faspex 5. It allows an authenticated user to craft a specific message that bypasses authorization checks and potentially gain full administrative privileges. Successful exploitation could give attackers access to sensitive information and allow them to modify or disrupt the affected system. IBM disclosed the vulnerability on November 7, 2026, and released a fix in Aspera Faspex 5.0.19 PL1. I found no public confirmation of exploitation in the wild or information identifying attackers at the time of writing. Versions 5.0.0 through 5.0.19 are affected. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the two vulnerabilities by November 12, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA) Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
ESET found Russia-Linked APT group Turla using a new toolset, dubbed Cereal, on government Exchange servers in Kazakhstan and Romania. ESET Research detailed a previously undocumented toolset it calls Cereal, built to run on Microsoft Exchange servers. The researchers found it on 28 November 2025 at a government body in Kazakhstan, and later at a government body in Romania, which was compromised on 23 December. The researchers discovered that in Romania, it was set up to spot emails to or from NATO and the European Union. ESET attributes it with high confidence to the Turla APT group (aka Secret Blizzard, Snake, Uroburos, Waterbug, Venomous Bear and KRYPTON) that has been active since at least 2004, targeting diplomatic and government organizations and private businesses in the Middle East, Asia, Europe, North and South America, and former Soviet bloc nations. According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Russia-nexus actor is assessed to be affiliated with Center 16 of Russia’s Federal Security Service (FSB). The name Cereal comes from serialization, a process that programs use to package data and code for transfer. Most of the toolset consists of modular .NET code that arrives encrypted, unpacks itself in memory and leaves almost no files on disk. Only the first loader is saved as a regular .NET file. One unusual feature is that ESET found no attacker-controlled server. The main backdoor, CerealNeuron, doesn’t connect to an external server. Instead, it runs on the victim’s Exchange server and waits for commands through web paths that look like normal Outlook Web Access, Autodiscover and ActiveSync traffic. This makes the activity difficult to spot in firewall logs. If a request isn’t properly encrypted or fails security checks, the server simply returns a normal-looking Exchange error page. “CerealNeuron, a passive backdoor with no built-in commands but capable of executing assemblies contained in CerealRunner binaries, received in network requests;” reads the analysis published by ESET. “The consequences are significant: Malicious traffic coexists with legitimate Exchange web services – exactly the kind of traffic defenders are least likely to block.” There is no dedicated C&C infrastructure to discover, block, or take down. The victim’s own internet-facing Exchange server is the operator-accessible control point. Network-based tracking is severely limited. We were unable to identify the ingress IP addresses used by the operators. They may have connected directly, via anonymization services, or from other compromised hosts.” As a result, defenders have no external server to block or take down. ESET couldn’t even identify the attackers’ IP addresses. A second version, called CerealHermit, has no network functions and reads encrypted command files directly from disk. This means some victims had two separate ways for attackers to access their systems. Commands work like disposable programs. Instead of one backdoor with a built-in menu, the operators send each task as a small compiled .NET program carried by a component called CerealRunner. The tasks include pulling mailboxes through Exchange Web Services, querying Active Directory, running WMI queries, extracting locally stored Windows credentials and handling files. ESET saw so many near-identical binaries that it believes the operators run an internal system that builds them automatically. The .NET tricks are what set this apart. The first loader abuses a rarely used feature to run native code before any .NET code, so an analyst sees an entry point that does nothing. Operators also dropped it into the Windows management folder under names like ncobjapi.dll, and into the .NET native image cache under names like Microsoft.Exchange.Search.Mdb.ni.dll, so trusted processes loaded it for them. The email theft is the part ESET calls new. The module, CerealBox, injects itself into EdgeTransport.exe, the process that handles mail flow, and wraps the handlers of transport agents already running in memory. “CerealBox uses a stealthier approach. Instead of registering itself, it is injected directly into EdgeTransport.exe, the Exchange process that handles email flow.” continues the report. “Reaching that point, however, is not straightforward: CerealBox is delivered through an intricate chain of nested Cereal components” It registers no new agent, so nothing shows up in Exchange’s configuration. A message qualifies if it carries a .doc, .docx or .pdf file and matches hardcoded lists of senders, recipients, subject words or file names. Selected messages get compressed, encrypted and staged on disk, and the operators collect and delete them later. The victims match Turla’s usual targets. According to ESET, around 70% of the countries targeted by the group since 2022 were former Soviet republics or European countries that once had close ties with Moscow. The focus on Romanian NATO and EU email systems is consistent with Russia’s long-standing intelligence interests. ESET also links the attacks in Kazakhstan to the country’s deportation of Russian exiles since January 2026. Activity in the country increased on January 15, the day after the Old New Year holiday. Organizations running Exchange should check for suspicious activity that may not be visible in standard configurations. This includes unusual DLL files in the Windows management folder, unexpected files in the native image cache and suspicious requests to the three web paths used by the backdoor. A clean list of Exchange transport agents does not necessarily mean that the mail system is free from compromise. “The Cereal toolset is a carefully constructed instrument for long-term, stealthy cyberespionage.” concludes the report. “The Cereal toolset demonstrates that, for Turla, Exchange servers are not just mail servers – they are durable collection points, internal execution hubs, and a suitable environment for hiding sophisticated .NET tradecraft.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Microsoft released the Windows 10 KB5131096 extended security update, which includes this month's November 2026 Patch Tuesday fixes and a few bug fixes and changes. If you are running Windows 10 Enterprise LTSC or are enrolled in the ESU program, you can install this update as normal by going to Settings, clicking Windows Update, and manually running a 'Check for Updates.' After installing this update, Windows 10 will be updated to build 19045.7846, and Windows 10 Enterprise LTSC 2021 will be updated to build 19044.7846. Microsoft no longer releases new features for Windows 10, and the KB5131096 update mainly includes security updates and bug fixes. The update also includes fixes released as part of today's November 2026 Patch Tuesday, which addressed 1,235 vulnerabilities across Microsoft's products, including one actively exploited Outlook zero-day flaw.
A threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple customers' AWS environments. The campaign ran between October 14 and 26, and affected tens of companies whose AWS environments had IAM roles configured to trust an AWS account associated with Qubole. Qubole is an enterprise cloud data processing and analytics platform that helps companies manage large datasets and run machine learning workloads. It also offers AWS integration to allow computing resource management. Companies can grant third-party providers such as Qubole access to their AWS resources by creating cross-account IAM roles. Trust policies determine which external AWS accounts can take these roles, and permissions are set to define the resources and actions allowed.
Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability. This Patch Tuesday addresses 66 "Critical" vulnerabilities, 48 of which are Remote Code Execution (RCE), 15 are Elevation of Privilege (EoP), and three are Use-After-Free in Microsoft Edge. The approximate number of bugs in each vulnerability category is listed below: Of the 1,235 vulnerabilities, approximately 639 are categorized under Windows or Microsoft Windows products/components. When BleepingComputer reports on Patch Tuesday security updates, we only count vulnerabilities released by Microsoft on Patch Tuesday itself. Therefore, today's total excludes 108 flaws fixed earlier this month, including one Entra Device Registration, 82 Mariner, and 25 Microsoft Edge flaws.
Microsoft has released the Patch Tuesday Windows 11 KB513261 and KB5131087 cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs and add new features. Today's updates are mandatory as they contain the November 2026 Patch Tuesday security patches for hundreds of vulnerabilities discovered in previous months. You can install today's update by going to Start > Settings > Windows Update and clicking on 'Check for Updates.' You can also manually download and install the update from the Microsoft Update Catalog. This is the eleventh 'Patch Tuesday' release in 2026, and it's based on 24H2, which means 25H2 or 26H2 get the same update. There are no exclusive or special changes. You'll get the same fixes across the two versions of Windows 11. With today's update, Microsoft is adding new customization options to Windows 11 and fixing minor issues with File Explorer.
A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts. Xen Orchestra is a web-based management platform developed by French software company Vates, used to manage XCP-ng virtualization environments, including virtual machines, hosts, and pools. The vulnerability, tracked as VSA-2026-062, affects Xen Orchestra and the Xen Orchestra Appliance (XOA) and allows remote attackers with network access to the management interface to bypass authentication using a specially crafted cookie. A CVE identifier and CVSS score have not been assigned yet. According to a Vates security advisory, the flaw stems from how Xen Orchestra processes authentication tokens sent through REST API requests.
Google patched nine Chrome flaws, including a V8 vulnerability tracked as CVE-2026-125350, that attackers have been actively exploiting in the wild. Google has addressed multiple security vulnerabilities, one of which, tracked as CVE-2026-125350, has been actively exploited in the wild. The vulnerability is a use after free issue that resides in XML and was reported by an anonymous source on November 6, 2026.. “Google is aware that an exploit for CVE-2026-125350 exists in the wild.” reads the advisory. A Use-after-free (UAF) is a memory corruption vulnerability that occurs when a program continues to use a piece of memory after it has been released (freed). In simple terms, an application allocates memory to store data, then releases that memory when it is no longer needed. A use-after-free bug occurs when the application later tries to access that same memory location, even though it is no longer valid. Attackers may exploit a use-after-free vulnerability to crash an application and cause a denial-of-service condition, corrupt memory, or, under certain conditions, execute arbitrary code. Depending on the affected component and the nature of the flaw, successful exploitation could also allow attackers to escalate their privileges. The IT giant has not shared further details about how attackers are exploiting the vulnerability or who is behind the attacks. “Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.” continues the advisory. CVE-2026-125350 is the eighth exploited Chrome zero-day of 2026. Since the start of the year, Google has addressed the following zero-day flaws exploited in attacks in the wild: February 2026 – CVE-2026-2441 (CVSS score: 8.8) – Use after free in CSS. March 2026 – CVE-2026-3909 (CVSS score: 8.8) – Out-of-bounds write in the Skia 2D graphics library and CVE-2026-3910 (CVSS score: 8.8) – Flaw in the implementation of the V8 JavaScript/WebAssembly engine. April 2026 – CVE-2026-5281 (CVSS score: 8.8) – Use-after-free bug in Dawn, the WebGPU component used for graphics processing. June 2026 – CVE-2026-11645 (CVSS score: 8.8) – Out-of-bounds memory access in the V8 JavaScript engine September 2026 – CVE-2026-85046 (CVSS score: 8.8) – V8 type confusion flaw. September 2026 – CVE-2026-87491 (CVSS score of 8.8) – Out of bounds write in V8. Google has released Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. The update will roll out gradually over the coming days and weeks. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Google)
The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations. Researchers at cybersecurity company ESET documented the attacks in late 2025, initially finding modular .NET malware for Microsoft Exchange at a government body in Kazakhstan. A month later, ESET found the same toolset at a government agency in Romania, where it selectively gathered email correspondence with representatives of the North Atlantic Treaty Organization (NATO) and the European Union (EU). "After fine-tuning our detections, we found the same toolset at a governmental organization in Romania - compromised on December 23rd, 2025," the researchers say in a report today. Turla, also known as Snake, Secret Blizzard, and Waterbug, is a cyber-espionage group active for more than two decades and linked to Russia's Federal Security Service (FSB).
Confirm this action.
Leaving now will discard your changes.