U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: CVE-2026-102895 GPUStack Improper Authentication Vulnerability CVE-2026-116779 SignalWire FreeSwitch Code Injection Vulnerability CVE-2026-123158 OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability CVE-2026-123218 IBM Aspera Faspex Incorrect Authorization Vulnerability The first issue added to the catalog, CVE-2026-102895 (CVSS score of 9.8), is an improper authentication vulnerability affecting GPUStack, an open-source platform used to manage GPU clusters and AI model deployments. The flaw allows remote, unauthenticated attackers to bypass authentication and obtain administrator privileges by making requests appear to originate from the local system. Successful exploitation can expose sensitive information, create persistent administrator API keys, modify configurations and potentially execute arbitrary code. Exploitation has been observed in the wild against a GPUStack 2.1.1 deployment. Security researcher Javier Sixto reported the in-the-wild exploitation, but no specific threat group has been identified. The issue affects versions before 2.2.0. The second issue, CVE-2026-116779 (CVSS score of 9.8), is a code injection vulnerability in SignalWire FreeSWITCH, an open-source communications platform. The flaw allows attackers to send specially crafted SIP MESSAGE requests and abuse the API chat protocol to execute FreeSWITCH API commands. Depending on the configuration, this can expose credentials and configuration data, manipulate telephone calls and execute operating system commands with the privileges of the FreeSWITCH process. SignalWire confirmed that exploitation has been observed in the wild. The vulnerability was added to CISA’s KEV catalog on November 9, 2026, but no information identifying the attackers or a specific campaign has been disclosed. FreeSWITCH versions before 1.11.3 are affected. The third issue, CVE-2026-123158 (CVSS score of 8.1), is an authentication bypass vulnerability affecting OpenSSH. Under specific conditions, when OpenSSH runs on Linux systems using the musl C library without Pluggable Authentication Modules (PAM), the SSH server may incorrectly interpret password input as a password hash. A remote, unauthenticated attacker can exploit the flaw by submitting a specially crafted password to bypass authentication and access affected accounts. CISA added the vulnerability to its KEV catalog on November 6, 2026, indicating that exploitation has been observed. However, no specific threat actor or attack campaign has been publicly identified. OpenSSH versions before 10.6p2 are affected. The fourth issue, CVE-2026-123218 (CVSS score of 9.8), is an incorrect authorization vulnerability affecting IBM Aspera Faspex 5. It allows an authenticated user to craft a specific message that bypasses authorization checks and potentially gain full administrative privileges. Successful exploitation could give attackers access to sensitive information and allow them to modify or disrupt the affected system. IBM disclosed the vulnerability on November 7, 2026, and released a fix in Aspera Faspex 5.0.19 PL1. I found no public confirmation of exploitation in the wild or information identifying attackers at the time of writing. Versions 5.0.0 through 5.0.19 are affected. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the two vulnerabilities by November 12, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA) Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Nitori, a major Japanese furniture and home accessories retailer, discovered that an attacker accessed a system on its network and may have stolen 37.62 million customer records. The intrusion was detected on November 6, and the company blocked the unauthorized access. However, an investigation into the incident revealed that the attacker likely had access to the system since mid-October. Nitori, often called the “IKEA of Japan,” is a major furniture and home furnishings retailer that operates 879 stores in Japan and another 219 stores across China, South Korea, Taiwan, Thailand, Singapore, and Hong Kong. The firm has an annual revenue of $5.8 billion. According to the company's notification, the incident impacts individual customers, corporate members, and non-members who placed orders through official Nitori stores and online shops.
ESET found Russia-Linked APT group Turla using a new toolset, dubbed Cereal, on government Exchange servers in Kazakhstan and Romania. ESET Research detailed a previously undocumented toolset it calls Cereal, built to run on Microsoft Exchange servers. The researchers found it on 28 November 2025 at a government body in Kazakhstan, and later at a government body in Romania, which was compromised on 23 December. The researchers discovered that in Romania, it was set up to spot emails to or from NATO and the European Union. ESET attributes it with high confidence to the Turla APT group (aka Secret Blizzard, Snake, Uroburos, Waterbug, Venomous Bear and KRYPTON) that has been active since at least 2004, targeting diplomatic and government organizations and private businesses in the Middle East, Asia, Europe, North and South America, and former Soviet bloc nations. According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Russia-nexus actor is assessed to be affiliated with Center 16 of Russia’s Federal Security Service (FSB). The name Cereal comes from serialization, a process that programs use to package data and code for transfer. Most of the toolset consists of modular .NET code that arrives encrypted, unpacks itself in memory and leaves almost no files on disk. Only the first loader is saved as a regular .NET file. One unusual feature is that ESET found no attacker-controlled server. The main backdoor, CerealNeuron, doesn’t connect to an external server. Instead, it runs on the victim’s Exchange server and waits for commands through web paths that look like normal Outlook Web Access, Autodiscover and ActiveSync traffic. This makes the activity difficult to spot in firewall logs. If a request isn’t properly encrypted or fails security checks, the server simply returns a normal-looking Exchange error page. “CerealNeuron, a passive backdoor with no built-in commands but capable of executing assemblies contained in CerealRunner binaries, received in network requests;” reads the analysis published by ESET. “The consequences are significant: Malicious traffic coexists with legitimate Exchange web services – exactly the kind of traffic defenders are least likely to block.” There is no dedicated C&C infrastructure to discover, block, or take down. The victim’s own internet-facing Exchange server is the operator-accessible control point. Network-based tracking is severely limited. We were unable to identify the ingress IP addresses used by the operators. They may have connected directly, via anonymization services, or from other compromised hosts.” As a result, defenders have no external server to block or take down. ESET couldn’t even identify the attackers’ IP addresses. A second version, called CerealHermit, has no network functions and reads encrypted command files directly from disk. This means some victims had two separate ways for attackers to access their systems. Commands work like disposable programs. Instead of one backdoor with a built-in menu, the operators send each task as a small compiled .NET program carried by a component called CerealRunner. The tasks include pulling mailboxes through Exchange Web Services, querying Active Directory, running WMI queries, extracting locally stored Windows credentials and handling files. ESET saw so many near-identical binaries that it believes the operators run an internal system that builds them automatically. The .NET tricks are what set this apart. The first loader abuses a rarely used feature to run native code before any .NET code, so an analyst sees an entry point that does nothing. Operators also dropped it into the Windows management folder under names like ncobjapi.dll, and into the .NET native image cache under names like Microsoft.Exchange.Search.Mdb.ni.dll, so trusted processes loaded it for them. The email theft is the part ESET calls new. The module, CerealBox, injects itself into EdgeTransport.exe, the process that handles mail flow, and wraps the handlers of transport agents already running in memory. “CerealBox uses a stealthier approach. Instead of registering itself, it is injected directly into EdgeTransport.exe, the Exchange process that handles email flow.” continues the report. “Reaching that point, however, is not straightforward: CerealBox is delivered through an intricate chain of nested Cereal components” It registers no new agent, so nothing shows up in Exchange’s configuration. A message qualifies if it carries a .doc, .docx or .pdf file and matches hardcoded lists of senders, recipients, subject words or file names. Selected messages get compressed, encrypted and staged on disk, and the operators collect and delete them later. The victims match Turla’s usual targets. According to ESET, around 70% of the countries targeted by the group since 2022 were former Soviet republics or European countries that once had close ties with Moscow. The focus on Romanian NATO and EU email systems is consistent with Russia’s long-standing intelligence interests. ESET also links the attacks in Kazakhstan to the country’s deportation of Russian exiles since January 2026. Activity in the country increased on January 15, the day after the Old New Year holiday. Organizations running Exchange should check for suspicious activity that may not be visible in standard configurations. This includes unusual DLL files in the Windows management folder, unexpected files in the native image cache and suspicious requests to the three web paths used by the backdoor. A clean list of Exchange transport agents does not necessarily mean that the mail system is free from compromise. “The Cereal toolset is a carefully constructed instrument for long-term, stealthy cyberespionage.” concludes the report. “The Cereal toolset demonstrates that, for Turla, Exchange servers are not just mail servers – they are durable collection points, internal execution hubs, and a suitable environment for hiding sophisticated .NET tradecraft.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Microsoft released the Windows 10 KB5131096 extended security update, which includes this month's November 2026 Patch Tuesday fixes and a few bug fixes and changes. If you are running Windows 10 Enterprise LTSC or are enrolled in the ESU program, you can install this update as normal by going to Settings, clicking Windows Update, and manually running a 'Check for Updates.' After installing this update, Windows 10 will be updated to build 19045.7846, and Windows 10 Enterprise LTSC 2021 will be updated to build 19044.7846. Microsoft no longer releases new features for Windows 10, and the KB5131096 update mainly includes security updates and bug fixes. The update also includes fixes released as part of today's November 2026 Patch Tuesday, which addressed 1,235 vulnerabilities across Microsoft's products, including one actively exploited Outlook zero-day flaw.
Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability. This Patch Tuesday addresses 66 "Critical" vulnerabilities, 48 of which are Remote Code Execution (RCE), 15 are Elevation of Privilege (EoP), and three are Use-After-Free in Microsoft Edge. The approximate number of bugs in each vulnerability category is listed below: Of the 1,235 vulnerabilities, approximately 639 are categorized under Windows or Microsoft Windows products/components. When BleepingComputer reports on Patch Tuesday security updates, we only count vulnerabilities released by Microsoft on Patch Tuesday itself. Therefore, today's total excludes 108 flaws fixed earlier this month, including one Entra Device Registration, 82 Mariner, and 25 Microsoft Edge flaws.
Microsoft has released the Patch Tuesday Windows 11 KB513261 and KB5131087 cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs and add new features. Today's updates are mandatory as they contain the November 2026 Patch Tuesday security patches for hundreds of vulnerabilities discovered in previous months. You can install today's update by going to Start > Settings > Windows Update and clicking on 'Check for Updates.' You can also manually download and install the update from the Microsoft Update Catalog. This is the eleventh 'Patch Tuesday' release in 2026, and it's based on 24H2, which means 25H2 or 26H2 get the same update. There are no exclusive or special changes. You'll get the same fixes across the two versions of Windows 11. With today's update, Microsoft is adding new customization options to Windows 11 and fixing minor issues with File Explorer.
A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts. Xen Orchestra is a web-based management platform developed by French software company Vates, used to manage XCP-ng virtualization environments, including virtual machines, hosts, and pools. The vulnerability, tracked as VSA-2026-062, affects Xen Orchestra and the Xen Orchestra Appliance (XOA) and allows remote attackers with network access to the management interface to bypass authentication using a specially crafted cookie. A CVE identifier and CVSS score have not been assigned yet. According to a Vates security advisory, the flaw stems from how Xen Orchestra processes authentication tokens sent through REST API requests.
Binance is warning about a vulnerability in Apple’s iOS 26.7.1, 27.0.1, and 27.2 that could allow third-party apps to read private files stored by other apps, including cryptocurrency seed phrases, secret keys, and login credentials. The crypto exchange clarifies that the issue is at the iOS level and does not impact only the Binance app. “A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem,” Binance says. At this time, no cryptocurrency losses have been confirmed, but Binance urges users to install the update immediately as a precaution. The company recommends that users delete any unnecessary and untrusted apps and apply the latest versions for iOS and other apps.
A public iOS sandbox escape could expose wallet keys, Binance warns. No attacks are reported and no fix is confirmed. On 10 November, Binance warned users about a public iOS sandbox escape that lets one app read the files of other apps. Seed phrases, private keys and login credentials could be exposed to a malicious app, the exchange said. “A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.” reads the warning. Binance advises users to remove apps installed from untrusted sources, update iOS and all apps to the latest official versions, and, if a breach is suspected, move funds to a new wallet on a clean device and reset all active login sessions. A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.… — Binance (@binance) November 10, 2026 A researcher known as ‘forcequitOS’ published the PoC exploit code, called worse_query, on GitHub. Apple released security updates for both iOS versions the following day, but its release notes mysteriously don’t report a fix for the issue. The good news is that neither Binance nor the researcher has reported any attacks or data theft. “worse_query is the direct successor to bad_query and essentially replaces it. To use worse_query, you’ll have to set up an App Group container for your app.” forcequitOS wrote. The proof-of-concept can access the data folders used by all apps and, on iOS 27, some system folders as well. To work, an app must create an App Group container. The researcher says the code is intended for developers and “isn’t useful by itself.” However, other developers have already used it to build apps that can be installed on iPhones. One example is WQ Files, a file manager developed by Christoph Kolbicz, TheHackerNews reports. “WQ Files is a file browser, app data manager and cache cleaner for iOS 26 and 27. “WQ” stands for worse_query, the sandbox technique it is built on. It reaches other apps’ and system containers with no jailbreak and no kernel exploit. Tested on iOS 26.7.1, 27.0.1 and 27.2.” reads the description. It can access data belonging to other apps without requiring a jailbreak or a kernel exploit. It can also edit, delete and clear that data. Users can install it through sideloading tools such as AltStore and SideStore, which automatically create the required App Group when users sign in with their Apple ID. I agree (and I wasn't planning on it), but I don't mind the loss of any potential bounty tbh, when Apple was stalling on responding to me and people started larping with it on here. — forcequit (@forcequitOS) November 8, 2026 The forcequitOS says they have no intention of seeking a bug bounty from Apple and are willing to give up any potential reward because of Apple’s delayed response and the inappropriate behavior of people publicly misusing or exaggerating the exploit. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Apple)
SAP patched 35 vulnerabilities in its November 2026 security updates, including four maximum-severity issues affecting its NetWeaver, Web Dispatcher, and Gateway software. The company addressed memory corruption (CVE-2026-76964) and missing authentication (CVE-2026-120017) flaws in the NetWeaver Application Server ABAP's Internet Communication Manager and SAML2 Service Provider components. NetWeaver is the core app platform that underpins SAP's business software and handles application integration, authentication, user management, and data processing. The other two maximum severity vulnerabilities stem from a broken access control weakness (CVE-2026-89103) in SAP Gateway and a memory corruption issue (CVE-2026-89126) in SAP Web Dispatcher. Gateway is a core framework that enables external apps to securely connect to SAP backend systems, while Web Dispatcher (deployed in almost every enterprise SAP environment) is a specialized component that acts as a load balancer and reverse proxy for web requests entering an SAP system architecture.
Confirm this action.
Leaving now will discard your changes.