SAP patched 35 vulnerabilities in its November 2026 security updates, including four maximum-severity issues affecting its NetWeaver, Web Dispatcher, and Gateway software. The company addressed memory corruption (CVE-2026-76964) and missing authentication (CVE-2026-120017) flaws in the NetWeaver Application Server ABAP's Internet Communication Manager and SAML2 Service Provider components. NetWeaver is the core app platform that underpins SAP's business software and handles application integration, authentication, user management, and data processing. The other two maximum severity vulnerabilities stem from a broken access control weakness (CVE-2026-89103) in SAP Gateway and a memory corruption issue (CVE-2026-89126) in SAP Web Dispatcher. Gateway is a core framework that enables external apps to securely connect to SAP backend systems, while Web Dispatcher (deployed in almost every enterprise SAP environment) is a specialized component that acts as a load balancer and reverse proxy for web requests entering an SAP system architecture.
Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges. Barracuda released security updates to address the two flaws (tracked as CVE-2026-116606 and CVE-2026-111560) one week ago. The first stems from an Email Security Gateway (ESG) authentication weakness that can be exploited to modify an appliance's global configuration, while the second lets unauthenticated attackers inject OS commands that execute with root privileges. Barracuda also said that successful attacks require access to the administrative user interface (Admin UI) of targeted devices and advised customers to restrict access to trusted internal networks and use appropriate network access controls to limit exposure.
Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year. "Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company said in a Monday security advisory. As Google explained, this flaw stems from a Use-After-Free (UAF) weakness in the XML component of the Google Chrome web browser, which occurs when the browser's XML parser processes data, deletes an object from the computer's memory, but fails to clear the pointer referencing that object. Attackers can exploit this high-severity memory corruption vulnerability when the browser later tries to use or read that "freed" memory space to manipulate the memory layout and execute malicious code. While Google has found evidence of attackers exploiting this zero-day bug in the wild, it has not shared additional details about these incidents.
AI infrastructure startup Fireworks has disclosed a new security breach in which attackers accessed its development machines after breaching a third-party cloud provider. FireWorks provides a high-performance inference platform for developers who want to deploy and run open-source artificial intelligence models (such as Mistral, Meta's Llama, or Google's Gemma) without worrying about hardware bottlenecks and complex infrastructure tasks. The company notified law enforcement and customers of another security incident in early October after attackers accessed environment variables containing API keys and tokens stored as secrets for a limited number of accounts. "The evidence indicates links to a cybercriminal threat actor group, which is financially motivated and aimed at selling tokens from unauthorized access to Large Language Models (LLMs) to illicit routing gateways, known as 'LLMJacking'," Fireworks said at the time.
Iris Ohyama warns that a cloud data breach may have exposed personal information of 7.7 million customers, including names and passwords. Japanese household goods manufacturer Iris Ohyama has disclosed that attackers may have accessed personal information belonging to approximately 7.7 million people through an external cloud service used by its online shopping subsidiary, Iris Plaza. The incident highlights a security risk that often receives less attention than attacks against corporate networks: sensitive customer information can be exposed through services operated outside an organization’s own infrastructure. Iris Plaza discovered a suspicious file in an external cloud service on October 28, 2026. The company immediately shut down its online shopping platform and related systems, launched an investigation and confirmed unauthorized access by a third party. It published an initial notification on October 29, followed by an update on November 5 detailing the potential impact. In its official incident notice, the company confirmed that information stored in the external cloud environment may have been accessed or obtained by unauthorized parties. “Iris Plaza Co., Ltd. (Headquarters: Sendai City, Miyagi Prefecture, President: Ryota Iwasaki, hereinafter referred to as “the Company”), a member of the Iris Group, has investigated the unauthorized access incident that occurred on its official online shopping site for Iris Ohyama, “Iris Plaza” (hereinafter referred to as “Iris Plaza”). As a result of the investigation, it has been determined that some personal information may have been leaked.” reads the company’s notice. “Subsequent investigations have confirmed the possibility that data stored on an external cloud service may have been leaked. The total amount of personal information stored was approximately 7.7 million records, and at this time, we have confirmed the possibility that this data may have been viewed or obtained. “ The 7.7 million figure refers to records stored in the affected cloud service, not confirmed stolen data. Potentially affected individuals include 5.8 million current and former members and 1.9 million non-members. Exposed information may include names, addresses, phone numbers, email addresses, gender, dates of birth and passwords, some of which are encrypted. “The following personal information may have been leaked at this time: classificationTarget itemsNumber of peopleMember data (including information on members who have withdrawn)Name, address, phone number, email address, gender, password * , date of birth, etc.Approximately 5.8 million peopleNon-member data (including information on individuals who have purchased products without registering as a member or who have participated in campaigns)Name, address, phone number, email addressApproximately 1.9 million people Not all of the above information about our customers has been leaked. The items affected vary depending on your registration status.” continues the notice. “Some items, including passwords, are encrypted.” There is one important distinction: credit card information wasn’t stored in the affected cloud service and, according to the company, wasn’t exposed. Iris Plaza also says it hasn’t identified unauthorized access or data leaks involving its stores on other external e-commerce marketplaces. As of November 5, it had received no reports of fraudulent use of the information or financial losses linked to the incident. アイリスオーヤマ株式会社+1 The company reported the incident to Japanese police and the country’s Personal Information Protection Commission on October 29. It also blocked the unauthorized access route, suspended the affected systems and brought in external experts to support the investigation. The response extended beyond the main shopping platform. Iris Plaza suspended its SIMPLE STYLE website, while another group company, Iris Tech Service, stopped its websites and new applications for home appliance subscriptions and furniture and appliance delivery and installation services. The company says it hasn’t found evidence that these additional services were compromised. Iris Plaza has also warned customers about possible follow-up scams. Attackers could use the exposed personal information to create convincing phishing emails, SMS messages or phone calls, impersonating the company or other organizations. Fake websites and social media accounts could also appear, attempting to collect login credentials, payment details or other personal information. The company is asking customers who reused their Iris Plaza passwords on other services to change them. It also says it will contact potentially affected individuals individually as the investigation progresses. Customers should be particularly careful with messages claiming to provide information about the incident, account recovery or compensation. “We will never ask for your password, PIN, authentication code, or any other important information when we contact you.” アイリスオーヤマ株式会社 The incident is another reminder that organizations must extend security controls and monitoring beyond their own infrastructure. Third-party cloud services can hold millions of customer records, and unauthorized access to those environments can create consequences far beyond the service initially compromised. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Iris Ohyama)
An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined. As of today, other updates released yesterday for the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple
N-able said it has taken N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice following the public disclosure of over 30 vulnerabilities collectively tracked as Able2Shell. "As a precautionary measure, we are temporarily taking our Hosted N-central environment offline while we take the necessary actions to secure the
Japanese gaming giant SEGA has disclosed that a data breach at its third-party newsletter provider, ARARA, exposed the email addresses of 2.2 million newsletter subscribers. The company says the exposed data also includes 92,300 records with additional information yet to be determined. The breach affects 11 newsletters linked to SEGA and SEGA Fave products and services. The investigation found that the compromised data did not include customer names, dates of birth, gender, addresses, phone numbers, credit card details, or account passwords. Also, email addresses registered with a “SEGA Account” are handled by a separate distribution system and were not affected by this incident. The company is working with ARARA to determine what data was exposed and says it has no confirmed evidence of misuse.
France blames Iran for supermarket fridge attacks. What’s known, what remains unclear, and how to secure exposed controllers. French Foreign Minister Jean-Noël Barrot said Iran’s Revolutionary Guard Corps was behind the attacks on supermarket fridges in France on 11 and 12 October. He said they hit 700 sites and raised refrigerator temperatures. Some stores threw away their entire stock of perishable food, and fires broke out in several. “France attributes destabilization and sabotage campaigns against French interests to the Islamic Republic of Iran (electronic and cyber center of the Islamic Revolutionary Guard Corps of Iran – IRGC-ECC).” reads the announcement published by French cybersecurity agency ANSSI. “Following its investigation, C4 is able to attribute these destructive actions to the Shahid Kaveh cyber-offensive unit, affiliated with the electronic and cyber center of the Islamic Revolutionary Guard Corps of Iran (IRGC-ECC): infrastructure characteristics, use of signing tools, relay of the attack by a propaganda organ linked to Shahid Kaveh, traces of the use of Persian in the attack infrastructure.” Foreign Minister Jean-Noël Barrot described the attack as “unprecedented in both its scale and its level of aggression” and called it the first major cyber sabotage operation on French soil. He promised EU-level sanctions, and France summoned the Iranian ambassador. EU foreign policy chief Kaja Kallas said the response should be strong, adding that she had only just learned about France’s attribution. “I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps of the Islamic Republic of Iran,” Foreign Minister Jean-Noël Barrot said of the cyberattacks on French supermarkets, which occurred on October 11 and 12, and reported Le Monde. “This attack is unprecedented in both its scale and its level of aggression,” said Barrot. “It marks the first large-scale cyberattack aimed at sabotage on our national territory, and it constitutes a major attack on the nation’s interests and the security of the French people.” “We will implement sanctions at the European level against all those responsible,” he added. Paris prosecutors opened a judicial investigation into the head of Shahid Kaveh, an offensive cyber unit tied to the Guards’ Electronic and Cyber Center, and his two deputies. Anyone else they identify can be added to the case. The attribution cites shared infrastructure, attack tools, Persian-language traces, and amplification by a group-linked propaganda outlet. French authorities say Iranian cyber operations targeting French interests date back to at least 2020. Previous incidents include a planned attack against Charlie Hebdo, a 2023 breach of its online store attributed to Emennet Pasargad, and a 2024 attempt to hijack digital advertising kiosks to display anti-Israel messages ahead of the Paris Olympics. C4 attributes these operations to the IRGC-linked Shahid Shoostari unit. France wasn’t alone. On 2 November, supermarkets in at least nine other European countries reported a suspected attack on their freezer systems. Barrot spoke only about the French case, so nothing official yet ties the second wave to Iran. This is where we need to be careful. When a government names a country as responsible for an attack, that’s a serious accusation. But the reports I’ve read don’t explain the technical evidence behind it. We should treat it as an official claim, not a proven fact, and stick to what we know. Fear and uncertainty can be used to spread distrust, and that risk applies to all sides involved in this story. The key issue isn’t just identifying the attackers, but understanding whether someone is exploiting these incidents to promote a hybrid warfare narrative. Hacktivist claims may serve propaganda and visibility more than reflect actual responsibility. If French investigations confirm Iran’s role in the October attacks, the pro-Russian groups claiming November’s incidents could face a serious credibility problem. They may have tried to take credit for someone else’s operations. Still, their involvement in some incidents remains possible. In today’s hybrid warfare, uncertain attribution, strategic ambiguity, and information manipulation make it increasingly difficult to separate real attacks from propaganda. The method used in supermarket fridge attacks, at least, is documented. On 5 November, CISA, the FBI and other US agencies published a fact sheet on the same kind of activity. The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards. The agencies list three ways in: bypassing authentication, injecting code and weak settings. They also warn that operators can lose sight of the real temperatures, which is a bad thing to discover after the cheese has gone. The fixes are dull and they work. Keep controllers off the internet, and if you need remote access, put an updated firewall in front of it. Separate industrial devices from the office network, change default passwords, add phishing-resistant multifactor authentication, patch firmware and replace devices the maker no longer supports. Then limit who can change settings with an allowlist of approved devices and IP addresses. Keep tested backups offsite and offline, turn on logging and read the logs. The last control is the cheapest: Define and maintain reasonable setpoint limits for devices operating downstream of controllers to stay within safe ranges and establish alerting for deviations. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Iran)
A data-wiping malware attack has forced Russian cloud services provider Beget to rebuild its cloud infrastructure from scratch, the company said. On the night of November 1st, the attacker gained access to the management systems of the company's entire architecture and deployed malware that erased server data. The Russian cloud provider detected the attack shortly after the malware activated and disconnected all servers from the network to stop the malicious activity from spreading across its infrastructure. Beget is a major Russian web-hosting, cloud, and domain-registration provider that serves more than 200,000 customers, including online stores, media, and educational services. More than a week after the destructive attack, Beget says that 60% of shared hosting and 40% of the dedicated servers it manages have been restored, and recovery is still in progress.
Confirm this action.
Leaving now will discard your changes.