Nitori, a major Japanese furniture and home accessories retailer, discovered that an attacker accessed a system on its network and may have stolen 37.62 million customer records. The intrusion was detected on November 6, and the company blocked the unauthorized access. However, an investigation into the incident revealed that the attacker likely had access to the system since mid-October. Nitori, often called the “IKEA of Japan,” is a major furniture and home furnishings retailer that operates 879 stores in Japan and another 219 stores across China, South Korea, Taiwan, Thailand, Singapore, and Hong Kong. The firm has an annual revenue of $5.8 billion. According to the company's notification, the incident impacts individual customers, corporate members, and non-members who placed orders through official Nitori stores and online shops.
A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts. Xen Orchestra is a web-based management platform developed by French software company Vates, used to manage XCP-ng virtualization environments, including virtual machines, hosts, and pools. The vulnerability, tracked as VSA-2026-062, affects Xen Orchestra and the Xen Orchestra Appliance (XOA) and allows remote attackers with network access to the management interface to bypass authentication using a specially crafted cookie. A CVE identifier and CVSS score have not been assigned yet. According to a Vates security advisory, the flaw stems from how Xen Orchestra processes authentication tokens sent through REST API requests.
Binance is warning about a vulnerability in Apple’s iOS 26.7.1, 27.0.1, and 27.2 that could allow third-party apps to read private files stored by other apps, including cryptocurrency seed phrases, secret keys, and login credentials. The crypto exchange clarifies that the issue is at the iOS level and does not impact only the Binance app. “A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem,” Binance says. At this time, no cryptocurrency losses have been confirmed, but Binance urges users to install the update immediately as a precaution. The company recommends that users delete any unnecessary and untrusted apps and apply the latest versions for iOS and other apps.
A public iOS sandbox escape could expose wallet keys, Binance warns. No attacks are reported and no fix is confirmed. On 10 November, Binance warned users about a public iOS sandbox escape that lets one app read the files of other apps. Seed phrases, private keys and login credentials could be exposed to a malicious app, the exchange said. “A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.” reads the warning. Binance advises users to remove apps installed from untrusted sources, update iOS and all apps to the latest official versions, and, if a breach is suspected, move funds to a new wallet on a clean device and reset all active login sessions. A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.… — Binance (@binance) November 10, 2026 A researcher known as ‘forcequitOS’ published the PoC exploit code, called worse_query, on GitHub. Apple released security updates for both iOS versions the following day, but its release notes mysteriously don’t report a fix for the issue. The good news is that neither Binance nor the researcher has reported any attacks or data theft. “worse_query is the direct successor to bad_query and essentially replaces it. To use worse_query, you’ll have to set up an App Group container for your app.” forcequitOS wrote. The proof-of-concept can access the data folders used by all apps and, on iOS 27, some system folders as well. To work, an app must create an App Group container. The researcher says the code is intended for developers and “isn’t useful by itself.” However, other developers have already used it to build apps that can be installed on iPhones. One example is WQ Files, a file manager developed by Christoph Kolbicz, TheHackerNews reports. “WQ Files is a file browser, app data manager and cache cleaner for iOS 26 and 27. “WQ” stands for worse_query, the sandbox technique it is built on. It reaches other apps’ and system containers with no jailbreak and no kernel exploit. Tested on iOS 26.7.1, 27.0.1 and 27.2.” reads the description. It can access data belonging to other apps without requiring a jailbreak or a kernel exploit. It can also edit, delete and clear that data. Users can install it through sideloading tools such as AltStore and SideStore, which automatically create the required App Group when users sign in with their Apple ID. I agree (and I wasn't planning on it), but I don't mind the loss of any potential bounty tbh, when Apple was stalling on responding to me and people started larping with it on here. — forcequit (@forcequitOS) November 8, 2026 The forcequitOS says they have no intention of seeking a bug bounty from Apple and are willing to give up any potential reward because of Apple’s delayed response and the inappropriate behavior of people publicly misusing or exaggerating the exploit. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Apple)
SAP patched 35 vulnerabilities in its November 2026 security updates, including four maximum-severity issues affecting its NetWeaver, Web Dispatcher, and Gateway software. The company addressed memory corruption (CVE-2026-76964) and missing authentication (CVE-2026-120017) flaws in the NetWeaver Application Server ABAP's Internet Communication Manager and SAML2 Service Provider components. NetWeaver is the core app platform that underpins SAP's business software and handles application integration, authentication, user management, and data processing. The other two maximum severity vulnerabilities stem from a broken access control weakness (CVE-2026-89103) in SAP Gateway and a memory corruption issue (CVE-2026-89126) in SAP Web Dispatcher. Gateway is a core framework that enables external apps to securely connect to SAP backend systems, while Web Dispatcher (deployed in almost every enterprise SAP environment) is a specialized component that acts as a load balancer and reverse proxy for web requests entering an SAP system architecture.
Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges. Barracuda released security updates to address the two flaws (tracked as CVE-2026-116606 and CVE-2026-111560) one week ago. The first stems from an Email Security Gateway (ESG) authentication weakness that can be exploited to modify an appliance's global configuration, while the second lets unauthenticated attackers inject OS commands that execute with root privileges. Barracuda also said that successful attacks require access to the administrative user interface (Admin UI) of targeted devices and advised customers to restrict access to trusted internal networks and use appropriate network access controls to limit exposure.
Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year. "Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company said in a Monday security advisory. As Google explained, this flaw stems from a Use-After-Free (UAF) weakness in the XML component of the Google Chrome web browser, which occurs when the browser's XML parser processes data, deletes an object from the computer's memory, but fails to clear the pointer referencing that object. Attackers can exploit this high-severity memory corruption vulnerability when the browser later tries to use or read that "freed" memory space to manipulate the memory layout and execute malicious code. While Google has found evidence of attackers exploiting this zero-day bug in the wild, it has not shared additional details about these incidents.
An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today. Apple's updates for iOS 26 and 27, released yesterday, do not list a fix. A researcher who goes by forcequit, in collaboration with 0xjohnny,
At some point your security will fail. This isn’t pessimism. It’s not because your team and tools aren’t sophisticated enough. It’s the reason we have detections in the first place. And, it’s why once we accept that prevention has its limits, we arrive at an interdiction strategy: finding and disrupting what got in. After the alert The alert tells you something happened. However, gaining
An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined. As of today, other updates released yesterday for the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple
Confirm this action.
Leaving now will discard your changes.