Microsoft says the November 2026 cumulative updates resolve USB audio issues plaguing Windows users who have installed security updates released since September. The company explained, when it acknowledged this known issue days after the September 2026 Patch Tuesday, that USB Audio Class 1.0 devices failed to start or produce audio on some systems after installing recent updates. Some affected users reported seeing no audio output, unresponsive volume controls and sound settings, and "This device cannot start (Code 10)." errors in Device Manager, while others said the impacted USB audio speakers fail only when using multichannel audio features, including 3D audio or 8-channel modes. These audio issues affect both server (Windows Server 2012 and later) and client (Windows 10 and Windows 11) systems.
Hackers advertise a $1,000-a-month tool claiming persistent Gmail access after password resets, but its effectiveness remains unverified. A developer of hacking tools is selling a $1,000 per month feature that allegedly gives criminals continuous access to Gmail inboxes. The cybersecurity firm Hudson Rock reports that the tool can keep reading a victim’s mailbox after a password change, after the browser closes and after sessions are revoked. “Remus Stealer is advertising a way for criminals to open a compromised Gmail inbox directly from a stolen-device record.” reads the report published by cybersecurity firm Hudson Rock. “Its latest pitch goes further: the operator claims access continues even after the victim changes their password or revokes sessions.” The tool belongs to Remus Stealer, an infostealer, meaning malware that steals data from infected computers. Remus supposedly gives its operators a searchable inbox right inside a stolen-device dashboard. Hudson Rock says it spoke with the developer and with a customer who used it, and the customer supplied screenshots of messages, timestamps and a control for sharing a mailbox with other operators. If the claims are true, the risk goes beyond a single Gmail inbox. Attackers could read password reset links and verification codes, allowing them to access other accounts linked to that email address. This makes Gmail a valuable target because many online services use it to recover accounts. “In the supplied version 1.3.9 announcement, Remus promotes email-code interception without collecting browser cookie files, claims that password changes and session revocation do not stop it, and advertises shareable mailbox links. The feature is listed as Enterprise-only; the main sales thread advertises that tier at $1,000 per month.” continues the report. “The sharing claim concerns giving other operators access to an already acquired mailbox through the service. The material does not show a victim being infected by opening one of those links.” It is still unclear how the tool works. Hudson Rock says Remus does not steal browser cookies, while its developer claims that changing the Gmail password does not stop access. The developer has not shared technical details. He only said that the malware interacts with browser memory, but this does not explain how it can maintain access after a password change or when active sessions are revoked. Hudson Rock believes Remus may obtain or create an authorization token while the victim is logged into Gmail through a browser. A remote component could then use this authorization to access emails even after the malware has stopped running, as long as Google continues to accept it. Tom’s Guide also reports that the tool can bypass Google’s anti-fraud checks and says it has contacted Google for comment. However, other reports highlight some important uncertainties. CyberInsider says Hudson Rock has not confirmed that the tool can maintain access after a password change, nor has it established that the feature exploits a Gmail vulnerability. Hudson Rock has not conducted a controlled test to show that Remus can still access newly received emails after the victim changes their password and revokes existing sessions and third-party access. According to Cybernews, the developer describes the feature as a Gmail “zero-day”. However, this claim has not been independently reproduced. The business side is more concrete. CyberInsider says the mailbox feature sits in an Enterprise tier at $1,000 per month, with shareable mailbox links so criminals can hand an inbox they’ve already compromised to others. The actor behind Remus Stealer offers the MaaS with three subscription tiers: Basic at $250, Pro at $500 and Enterprise at $1,000. This kind of claim has a history. In late 2023, a developer called PRISMA surfaced an exploit that regenerated persistent Google cookies by manipulating a token and account ID pair, and Lumma then used it so access continued after a password reset. It’s a precedent and not proof, since Remus’ mechanism is unknown, and Hudson Rock still treats a Google password change as an essential recovery step, while saying victims should also look for other ways an attacker could keep access. The tool is marketed to “enterprise” customers, so most users are unlikely to be targeted. It will probably be used mainly against organizations and high-profile individuals. Hudson Rock recommends that victims first disconnect and clean the infected computer before accessing their trusted accounts again. They should then change compromised passwords using a clean device and review their signed-in devices to remove suspicious sessions and third-party access. Hudson Rock also advises users to check Gmail settings for unauthorized changes and secure any other accounts that use the compromised mailbox for password resets or verification codes. Other basic precautions remain important: watch out for phishing emails with urgent messages, spelling mistakes or suspicious sender addresses, and keep antivirus software up to date. Tom’s Guide expects Google to introduce additional Gmail protections if the tool proves as effective as its developer claims. For now, this is a vendor’s marketing claim supported by customer screenshots and Hudson Rock’s investigation, not a confirmed Gmail vulnerability. One important detail offers some reassurance: attackers must first infect the victim’s computer and compromise their mailbox before they can use the tool. “Remus is marketing an integrated mailbox-reading capability, and a customer has endorsed its claimed persistence. The most plausible broad model is reuse of access obtained or established during endpoint compromise.” concludes the report. “The evidence does not identify the mechanism or show fresh mail remaining accessible after comprehensive recovery.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Gmail)
The US Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday that hackers are now exploiting a high-severity Cisco BroadWorks vulnerability in attacks. Cisco BroadWorks is a cloud unified communications (UC) software platform and the underlying engine allowing telecom carriers and managed service providers (MSPs) to provide branded cloud PBX, voice, and collaboration services to business customers. Tracked as CVE-2026-20320, the security flaw stems from an improper restriction of XML External Entity (XXE) reference weakness in the Open Client Interface (OCI) XML Parser that can allow unauthenticated, remote attackers to read sensitive configuration information from vulnerable systems by sending maliciously crafted XML messages. "This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface - Provisioning (OCI-P) service," Cisco explained when it patched the bug in August.
In recent years, cyberthreats have increasingly taken a hybrid approach, combining time-tested techniques for advancing through infrastructure, modern methods of evading network filters, and automation powered by large language models. This is also the approach of Citrus Ransomware, a previously undocumented group whose toolset includes VLESS tunnels (used to disguise traffic as regular HTTPS) and a ransomware Trojan from the Sn00py family. The attackers also integrate LLMs (large language models) into the process of infrastructure compromise. In this article, we review the tactics and techniques the group used in recent incidents. Initial Access: attacks through contractors The attackers gain initial access to victims’ infrastructure through compromised contractors. They use credentials stolen from these contractors’ employees to connect to corporate VPNs or directly to internet-facing terminal servers over RDP. Execution: commands, LLMs, and Impacket The attackers run commands on compromised systems through the standard Windows command interpreter and PowerShell. As the attack progresses, they create and run PowerShell scripts, batch files, and commands generated by LLMs. One example of the latter is the commands below, which disable the account of one of the administrators. Comment translation # Disable account # Verify result Both commands come with comments, something attackers rarely bother with, so the comments very likely point to LLM use. And the models did more than generate commands. The attackers also produced full scripts, complete with the comments typical of LLM output. Comment translation # Creating background tasks for each computer with a thread limit # Concurrent task limit control # Quick ping The fragment above comes from a script Citrus used to enumerate active user sessions on domain systems. Besides LLMs, the attackers use atexec, a classic tool from the Impacket collection, to create scheduled tasks that run commands on hosts: Task name Launched executable file sIErKswD C:\Windows\System32\..\System32\cmd.exe PpMBCCSR C:\Windows\system32\cmd.exe QwZtLmNp C:\Windows\..\Windows\System32\cmd.exe We did not see the exact commands behind these tasks, but Group Policy was refreshed after they ran, so they most likely executed gpupdate /force. When the group compromises 1C:Enterprise servers, it uses external data processors (1C-Shell) to run commands. Persistence: scheduled tasks Citrus uses scheduled tasks to launch its malicious tools automatically. The attackers create the tasks manually through PowerShell: On systems that are not regularly rebooted, such as terminal servers, they sometimes run their tools without establishing persistence at all. Privilege Escalation: vulnerabilities and configuration flaws In every case we know of, the contractor domain account used for initial access had very limited privileges, so the attackers tried to escalate them. To do this, they attempted to exploit the authentication bypass vulnerability CVE-2026-54121 (Certighost); these attempts created machine accounts with telltale names in Active Directory, such as: GHOSTAUFTAFGS GHOSTCZYQVAZS GHOSTIVPRLDZA GHOST{8 random letters} These names are generated by scripts making use of an exploit published on GitHub. The exploit works like this: on behalf of the newly created account, it requests a certificate based on the Machine template from the system holding the AD CS role. The Attributes, Subject, and SubjectAlternativeName fields contain parameters like these: <Data Name='Attributes'>CertificateTemplate:Machine\nSAN:dns=dc01.victim.domain\ncdc:91.210.109[.]118\nrmd:dc01.victim.domain </Data> <Data Name='Subject'>CN=GHOSTABUIEFAD.victim.domain</Data> <Data Name='SubjectAlternativeName'>DNS name =dc01.victim.domain\r\n</Data>The cdc attribute specifies the IP address or name of the system that the certification authority must contact to verify the data. The attackers specify the address of a system they control (in this case, 91.210.109[.]118) and send forged data from it. If exploitation succeeds, the certification authority issues a certificate with the specified parameters, based on the specified template. Once the certificate is issued, the domain controller name in its SubjectAlternativeName field lets the attackers authenticate as the domain controller account. In one case, the attackers also uploaded an executable for persistence, on behalf of which PowerShell scripts were launched with nonstandard HostName (Имя узла) field value. Field name translation Severity HostName HostVersion HostId HostApplication EngineVersion RunspaceId PipelineId CommandName CommandType ScriptName Although the file was later deleted, indirect evidence hints at its purpose. For example, the MSFConsole value may indicate that the file is a component of the Metasploit framework. The PowerShell scripts run through this file included an exploit for the CVE-2020-1337 vulnerability; the same exploit is available in the Metasploit GitHub repository. Beyond classic vulnerabilities in Microsoft products, the attackers also took an interest in 1C:Enterprise servers with insecure configurations (article in Russian). On top of the configuration flaws, 1C:Enterprise systems are frequently accessed by support staff and administrators who hold elevated privileges in Active Directory. Together, these factors make it easy for attackers to escalate privileges and start moving laterally. Stealth: covering tracks and masquerading To hinder incident response, the attackers delete their tools and output files and clear the command history. While the tools are still in use in the victim’s infrastructure, the attackers typically give them and their auxiliary objects legitimate-looking names: KasperskyGPO_Deploy_64.exe and KasperskyGPO_Deploy_64_FIXED.exe are self-extracting archives. They contain the Deploy-KasperskyGPO.ps1 script, a directory with a malicious Group Policy Object, and one of two archives, KasperskyAgent.exe or agent.exe. KasperskyAgentInstaller.exe, KasperskyAgent.exe, and agent.exe are self-extracting archives containing the ransomware Trojan executable and auxiliary files. Kaspersky GPO is the name of the Group Policy Object that distributes the ransomware Trojan in the victim’s infrastructure. KasperskyAgentInstallTask and Sysvc are names used for the scheduled task that runs the self-extracting ransomware archive files. Deploy-KasperskyGPO.ps1 is the PowerShell script that creates the malicious Kaspersky GPO. Kaspersky_GPO_Deployment.log is the log of the Deploy-KasperskyGPO.ps1 script. Note that using the Kaspersky name in malicious file names doesn’t help the attackers avoid detection. Kaspersky solutions successfully detect and block these malicious files. Defense Impairment: weak access policies for security tools play into attackers’ hands To stay under the radar longer, the attackers clear event logs on some systems using the built-in wevtutil utility. In addition, once they have sufficient privileges, they disable antivirus protection on hosts, which lets them run tools such as mimikatz. The attackers also go after the centralized management consoles for security solutions, which they then use to disable protection en masse. At the Impact stage, the attackers also use a Group Policy Object that modifies Windows Defender settings in the registry to switch it off. As a result, the antivirus did not respond when the ransomware was launched. Finally, if they have sufficient privileges, the attackers manually add their malicious tools to the antivirus exclusion list. Credential Access: mimikatz, a keylogger, and extraction of credentials from files To capture keystrokes on a compromised system, the attackers use a modified version of the peeping-tom keylogger, whose source code is available on GitHub. The keylogger executable and its log file are located at the following paths: C:\ProgramData\Oracle\Java\jhost.exe C:\Users\<username>\AppData\Roaming\Microsoft\CLR\ErrorLog.txt In the sample we found, stolen data was sent to 91.210.109[.]118. Persistence for the keylogger is provided by the scheduled task described above in the Persistence section. To dump credentials from memory, the attackers use mimikatz. Files related to mimikatz are located at the following paths: C:\ProgramData\x64\mimidrv.sys C:\ProgramData\x64\mimikatz.exe C:\ProgramData\x64\mimilib.dll C:\ProgramData\x64\mimispool.dll To hunt for credentials and other secrets (SSH keys, access tokens, and the like) in files on accessible network shares, the group uses Snaffler. To simplify running the tool, the attackers drop a configuration file on the system: Besides data from network shares, the attackers were interested in data stored in password managers (for example, KeePass) on administrator workstations. Discovery: the standard toolkit Local discovery After gaining control of a compromised system, the attackers ran a basic set of commands to identify the current user, running processes, network interface settings, the system’s external IP address, and so on: whoami tasklist quser ipconfig curl 2ip[.]io Remote discovery In the early stages, the attackers used the fscan scanner to gather information on the internal infrastructure. They were particularly interested in the following ports: 135 (RPC) 139 (NetBIOS-SSN) 1433 (Microsoft SQL) 8006 (Proxmox VE) Once they had the access they needed and had moved laterally, the attackers ran ADRecon on domain controllers and SharpHound on one of the workstations. The attackers also used PowerShell to run LDAP queries against the controllers of adjacent domains, pulling lists of domain systems, users, and groups. Russian text translation The user has no additional groups in memberOf (primary only) User not found As an alternative to PowerShell, the attackers used the net.exe utility to get information about domain users and privileged groups: net users /domain net group "Domain Admins" /domain net group "Администраторы домена" /domain Lateral Movement: SSH, RDP, and WinRM For lateral movement, the group relies on standard remote administration protocols: SSH, WinRM, and RDP. The attackers connect to systems either through previously deployed tunnels or directly from the compromised host. Command and Control: delivering tools to the system To deliver its tools to target hosts, the group uses built-in OS utilities. Specifically, the incidents involved: certutil: The Windows BITS background service (invoked in two ways): cURL: PowerShell: Creating tunnels with Xray The certutil and BITS commands shown above are what the attackers used to download Xray onto victim systems. They then used Xray to set up reverse VLESS tunnels to the command-and-control server. The configuration file, stored alongside the Xray executable, was usually named config.json. In some cases, the attackers deleted it right after starting the tunnel to hide the Xray configuration from defenders. Judging by the configuration files recovered during the analysis, the attackers used port 443 on the VLESS server to blend in with legitimate HTTPS traffic. The configuration files also contain blocks that set up the REALITY protocol, which is intended to disguise the attackers’ traffic as requests to the legitimate site mirror.yandex.ru: The traffic was also disguised as requests to another legitimate site, yastatic.net: Installing AnyDesk The PowerShell command above AnyDesk, which the attackers used to remotely control compromised hosts. After the download, the attackers installed the software with the --silent flag to avoid alerting the user, set a connection password, and used PowerShell to pull the infected machine’s ID (which AnyDesk uses for remote connections on the client side) from the configuration file: Collection & Exfiltration: data from messaging apps Right before encrypting the data, the attackers connected to one of the domain controllers and ran the PowerShell script steal_tgs.ps1, which created the tdatas directory. According to the NTFS USN journal, while the script ran, 7-Zip created archives in this directory with telltale names hinting at their contents: <system_name>_<date>_<username>_tdata.zipThe directory name tdatas and the substring tdata may refer to the C:\Users\<username>\AppData\Roaming\Telegram Desktop\tdata directory. The Telegram messaging app uses this directory to store authorization keys, session data, app settings, and other session information. So the attackers were harvesting messaging app data from remote systems they could reach, packing it with 7-Zip and uploading it to an external web service through Google Chrome. Impact: Sn00py ransomware Trojan The Citrus group uses ransomware from the Sn00py family to encrypt data. It’s written in Go and uses the RSA-2048 and ChaCha20 algorithms to encrypt user files (but not system files) on Windows systems. Encrypted files receive the .citrus extension. For now, decryption is impossible without the attackers’ private key. When launched, the ransomware opens a console on the victim’s device, where it outputs the commands it runs. It also attempts to modify the boot configuration data (BCD) by invoking a nonexistent executable, bcedit (likely a typo for bcdedit): The ransomware’s console output contains the string: We`re going to do something special today :). Made with RaaS platform Sn00py.The string likely means the ransomware is distributed under the ransomware-as-a-service model, where attackers don’t write the malware themselves but subscribe to a ready-made offering. The ransomware configuration contains the Citrus group’s public key in the pubkey parameter: -----BEGIN PUBLIC KEY----- A7+eV3M+EDIh5kId+vf46QkKpAOKxUxv97PDFj66ox+uE0GV9UQhrSmBAoGAcyNI +z7noIwrFYnHi6wtj8gLEOT0hE/cNDp0VLoUnAzi551kZA7J3Q575jwqrJcDrZSO JLkZX7pxLLSd9iQdxMxDrLYZGRtiht8ToD5OGZri36oPvnW56ijJZ/NMzlFtVr7V iSZJr5Qkz2cxShcSuhDLLXmzleclBd7HQtWTuZUCgYEAqN8WFAZxkV2e1p4v3U98 VOu4XxEfqAc2Gs2Ccs/kkWoX/1fxvuSRcF6/hMdfVwUP0z+/fnhbFMNfysBeWo1W ZfmpBF/HbnRSg2ZDLWIwXEXEsNNSRmlvwyHWSEZgyG1xjgjSZKWuxo92WVmPxb5i S6NLrZkHPHwqaBy8CnD6ft8= -----END PUBLIC KEY-----The host_blacklist parameter also lists the system names that are exempt from encryption: [ "DC01", "DC02", "DC03", "DC04" ]This list includes the domain controllers used to distribute the policy that launches the ransomware. This way, the attackers ensure the policy keeps propagating uninterrupted. As it runs, the Trojan drops CITRUS_README.txt files containing the ransom note: -[ All your data were encrypted ] | |-If you try to decrypt them yourself, you will lose your data. To decrypt all systems, you need to contact us for guidance and a data recovery tool in the future. If you ignore our offer and the conversation does not take place, we will take extreme measures against your company and your employees, as a result of which you will lose access to all resources of your network and lose your reputation. | |-To contact us - register your mail here: https://account.proton.me/mail/signup?plan=free and write to us by email: [REDACTED] |-Further negotiations regarding this situation will be conducted there. Also we have Telegram: [REDACTED] | |-Be sure to use a VPN, and do not attempt to write from other email addresses, as there is a high chance that the messages will not be delivered to either party. | |-You have 72 hours to contact us to establish negotiations and interaction, starting from the date of creation of this file. |-If you do not contact us within 3 days, we will consider this a refusal to cooperate. This will entail immediate measures, such as: Dumps of your services, personal data of employees, accounting, contracts and source code. | |-Warning: \\_ Do not delete, modify, or attempt to recover files by any means other than using our key and decryptor. This will damage your data, and we cannot guarantee its recovery. \\_ Do not try to make this public, as you will only harm yourself and your reputation.As mentioned above, the group uses malicious Group Policy Objects to launch the ransomware across victim systems en masse. The GPOs are created by self-extracting archives, of which we have seen two versions. Each archive contains: A self-extracting archive with the ransomware Trojan and auxiliary files. A directory containing the Group Policy Object. The policy drops the ransomware archive on the target system, creates a scheduled task that runs the archive with the parameters /quiet /norestart, enables the WinRM service, and disables the Volume Shadow Copy service and Windows Defender antivirus protection. It also sets a desktop wallpaper displaying the ransom note. A PowerShell script that copies the ransomware archive to the \\<current_domain_name>\SYSVOL directory on the domain controller and links the malicious GPO to the domain using the Import-GPO and New-GPLink One version of the PowerShell script contained comments suggesting that it was likely edited with an LLM: Links to Toy Ghouls While analyzing Citrus activity, we noticed several similarities to Toy Ghouls. Although their infrastructures don’t directly overlap, the two groups share TTPs: they encrypt their victims’ systems, use a similar set of tools (1C-Shell for remote command execution on 1C:Enterprise servers, mimikatz, PsExec, and ADRecon), and store these tools in the same directories. What’s more, both groups are Russian-speaking and attack Russian companies only. In several incidents, we saw the same infrastructure compromised simultaneously by both Toy Ghouls and Citrus. Conclusion What makes Citrus interesting is its unconventional approach to network tunneling and its use of AI to generate auxiliary tools. Even so, the attackers largely rely on well-known tools and techniques, which makes early detection somewhat easier. Kaspersky solutions detect all the activity described in this article. That said, the Citrus attacks are another reminder that contractor access to an organization’s infrastructure must be tightly controlled and restricted. After all, compromising contractor accounts is exactly how the attackers get into their victims’ networks. We’ll continue to track the group’s activity and report new techniques as we discover them. Indicators of compromise File hashes Xray d631627131b90d576d77f4bf530e1abe mst.exe, sabycenter.exe, webex.exe, rpchost.exe Meterpreter stager 7107fb029e7c63523e3aca5fc8e56b38 2341.exe Keylogger e251df2d0b7c3682965efb4d2009a2f4 jhost.exe Sn00py 17b29b6c9de80402a45e321bbe1168fa build_64.exe 9eee984b187423c46c10a63d080da15d build_64.exe fscan cf903e4a1629aa0582fd0363b5786676 fscan.exe File paths C:\ProgramData\ADRecon-Report-* C:\ProgramData\SharpHound.exe C:\ProgramData\Snaffler.exe C:\ProgramData\WebEx\config.json C:\ProgramData\WebEx\host_to_ip.ps1 C:\ProgramData\WebEx\ping_oldwin.bat C:\ProgramData\WebEx\web.txt C:\ProgramData\WebEx\webex.exe C:\ProgramData\ad_ru.ps1 C:\ProgramData\computers.txt C:\ProgramData\config.json C:\ProgramData\default.toml C:\ProgramData\fscan.exe C:\ProgramData\llc\*_BloodHound.zip C:\ProgramData\mst.exe C:\ProgramData\oracle\java\jhost.exe C:\ProgramData\pve.exe C:\ProgramData\rules C:\ProgramData\sabycenter.exe C:\ProgramData\steal_tgs.ps1 C:\ProgramData\tdatas C:\ProgramData\x64\mimikatz.exe C:\ProgramData\xray.exe C:\ProgramData\rpchost.exe C:\ProgramData\3777.exe C:\ProgramData\2341.exe C:\ProgramData\ChromeSetup.exe C:\ProgramData\Kaspersky\KasperskyAgent.exe C:\ProgramData\Kaspersky\KasperskyAgentInstaller.exe C:\ProgramData\1.txt C:\ProgramData\7z2603-x64.exe C:\ProgramData\Kaspersky\task.log C:\ProgramData\enum.ps1 C:\ProgramData\kp.ps1 C:\ProgramData\ping.ps1 C:\ProgramData\result.txt C:\ProgramData\user_activity_report.txt C:\Users\*\AppData\Local\Temp\7ZipSfx.000\Deploy-KasperskyGPO.ps1 C:\Users\*\AppData\Local\Temp\Kaspersky_GPO_Deployment.log C:\Users\*\AppData\Local\Temp\7ZipSfx.000\KasperskyAgent.exe C:\Users\*\Desktop\KasperskyGPO_Deploy_64.exe C:\Users\*\Desktop\KasperskyGPO_Deploy_64_FIXED.exe C:\Windows\SYSVOL\domain\KasperskyAgent.exe C:\Windows\SYSVOL\domain\build_64.exe C:\Windows\SYSVOL\domain\icon.ico C:\Windows\SYSVOL\domain\wallpaper.bmp C:\Windows\Temp\agent.exe C:\Windows\build_64.exe C:\Windows\icon.ico C:\Windows\wallpaper.bmp C:\Users\*\AppData\Roaming\Microsoft\CLR\ErrorLog.txt C:\Users\*\Desktop\webex.zip Scheduled task names Java rpchost agent KasperskyAgentInstallTask Sysvc IP addresses 91.210.109[.]118 91.210.108[.]180
Microsoft has fixed Outlook sign-in and mail delivery issues on Exchange Server systems after installing the October 2026 Windows Server security updates. Microsoft acknowledged this known issue in mid-October, confirming that users had trouble accessing email or signing in to Outlook after installing the latest updates on systems running Windows Server 2019 and later. As explained at the time, the sign-in and mail flow issues are caused by a new default limit on the amount of memory Endpoint Mapper uses when handling Endpoint Lookup calls, introduced by the October 2026 updates. "After installing the October 2026 Windows security update [..], some on-premises Exchange servers might experience issues accessing or sending email. Users might be unable to sign in to Outlook on the web (OWA), or email messages sent from Outlook might remain in the Outbox and not be delivered. Additionally, Exchange might experience issues accessing mailboxes during mailbox replication," Microsoft said at the time.
Microsoft November Patch Tuesday security updates fix 1,090 flaws, including one exploited Outlook bug and 30 potentially wormable issues. Microsoft November Patch Tuesday addressed about 1,090 new vulnerabilities, which is less than the roughly 1,400 last month. Two months in a row now exceed every previous year from Microsoft, and the overall count is a bit confusing, so other trackers report different totals. The release covers Windows and its components, Office, networking and remote access, graphics, media and printing, storage and file systems, .NET and Visual Studio, security and identity, Azure and cloud, Exchange Server, Dynamics and Xbox. Only one bug is under active attack and none is publicly known. ZDI says that doesn’t mean less exploitation, only fewer zero-days, and it guesses that AI is better at reversing patches than at finding and exploiting bugs in closed-source software. The exploited bug is CVE-2026-124194, an Outlook spoofing flaw, and its name undersells the impact. An attacker sends a crafted message file and talks the user into opening it, and Outlook connects to an attacker-controlled location without the usual external-content warning, which leaks the user’s NTLMv2 hash. “An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user. Exploitation requires network connectivity and user interaction.” reads the advisory. “An attacker must send a user a malicious Office file and convince them to open it.” The attacker can then authenticate as that user. The Preview Pane isn’t an attack path and the CVSS score is only 6.5, but ZDI says to put it first because Microsoft marks it as exploited. CVE-2026-116928 is a Windows Search remote code execution bug reached through Exchange Server. An unauthenticated attacker emails a crafted attachment, and the bug triggers when the server indexes it automatically, so the recipient never opens anything. It’s zero-click, scores CVSS 9.8, and ZDI rates it more severe than any of the nine patches Exchange gets this month. CVE-2026-119958 hits the Windows LDAP service. An unauthenticated attacker sends crafted LDAP calls over the network, triggers an out-of-bounds write and runs code in the service context, which could be destructive on domain controllers. ZDI says to test and deploy it quickly. CVE-2026-119952, a Schannel remote code execution flaw, is marked “Exploitation More Likely”, one of only a few Critical patches with that rating, and its high attack complexity is why the score is lower. CVE-2026-119990, an Azure OpenAI elevation of privilege bug, got a bulletin that said “Customer Action Required: Yes” and then listed nothing to do. An unauthenticated attacker could send a crafted request over the internet and reach orchestration information, change workflows or disrupt the service. Microsoft has since revised it to say no customer action is needed. A bulletin that says action required and lists none is the most relaxed urgent notice you’ll read this month. Two more stand out for their components. CVE-2026-95962 is a use-after-free in the little-documented Windows Virtual Filtering Platform, reachable with a crafted network packet and needing no authentication or user interaction. It involves a race condition, but ZDI notes those get beaten all the time at Pwn2Own. CVE-2026-112967 is a heap overflow in the Xbox Live Networking Service with a CVSS of 9.8, and ZDI doesn’t think exploitation is likely but enjoys imagining Xbox Live exploits in the wild. ZDI counts 30 wormable bugs this month, down from 59 last month. Seventeen carry advisory wording about an unauthenticated attacker running code over the network with no interaction, and 13 use variant wording or have no FAQ but show the same pattern in their summaries and CVSS vectors. ZDI warns it may be wrong on some, since a few advisories are light on detail. ComponentCVEsMessage Queuing (5)CVE-2026-116710, 119963, 119964, 109459, 119967DNS (4)CVE-2026-81384, 96092, 96177, 88218Color Management (2)CVE-2026-96067, 96078DHCP Server (2)CVE-2026-88243, 72998DirectMusic (2)CVE-2026-95882, 95901Xbox (2)CVE-2026-112967, 66801One each (13)Exchange Server (116928), LDAP (119958), Schannel (119952), CredSSP (119962), Deployment Services (119951), IIS (119961), NAT (113862), RPC Runtime (118737), Media Foundation (96157), iSCSI (88234), Virtual Filtering Platform (95962), eSCL Scanner (95956), Modern Device Management (119945) Network-facing services like DNS, DHCP, LDAP and Exchange deserve the earliest attention. “I may be wrong about some of these, since a few advisories are light on detail.” concludes ZDI. “As always, I recommend testing and deploying these patches quickly, especially for network-facing services like DNS, DHCP, LDAP, and Exchange” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Patch Tuesday)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Details of the vulnerabilities are below - CVE-2026-20320 (CVSS score: 7.5) - An improper restriction of XML external entity
Cloud hosting provider Railway says hackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and generate approximately $740,000 in fraudulent AI usage, potentially exposing credentials for up to 100,000 workspaces.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: CVE-2026-102895 GPUStack Improper Authentication Vulnerability CVE-2026-116779 SignalWire FreeSwitch Code Injection Vulnerability CVE-2026-123158 OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability CVE-2026-123218 IBM Aspera Faspex Incorrect Authorization Vulnerability The first issue added to the catalog, CVE-2026-102895 (CVSS score of 9.8), is an improper authentication vulnerability affecting GPUStack, an open-source platform used to manage GPU clusters and AI model deployments. The flaw allows remote, unauthenticated attackers to bypass authentication and obtain administrator privileges by making requests appear to originate from the local system. Successful exploitation can expose sensitive information, create persistent administrator API keys, modify configurations and potentially execute arbitrary code. Exploitation has been observed in the wild against a GPUStack 2.1.1 deployment. Security researcher Javier Sixto reported the in-the-wild exploitation, but no specific threat group has been identified. The issue affects versions before 2.2.0. The second issue, CVE-2026-116779 (CVSS score of 9.8), is a code injection vulnerability in SignalWire FreeSWITCH, an open-source communications platform. The flaw allows attackers to send specially crafted SIP MESSAGE requests and abuse the API chat protocol to execute FreeSWITCH API commands. Depending on the configuration, this can expose credentials and configuration data, manipulate telephone calls and execute operating system commands with the privileges of the FreeSWITCH process. SignalWire confirmed that exploitation has been observed in the wild. The vulnerability was added to CISA’s KEV catalog on November 9, 2026, but no information identifying the attackers or a specific campaign has been disclosed. FreeSWITCH versions before 1.11.3 are affected. The third issue, CVE-2026-123158 (CVSS score of 8.1), is an authentication bypass vulnerability affecting OpenSSH. Under specific conditions, when OpenSSH runs on Linux systems using the musl C library without Pluggable Authentication Modules (PAM), the SSH server may incorrectly interpret password input as a password hash. A remote, unauthenticated attacker can exploit the flaw by submitting a specially crafted password to bypass authentication and access affected accounts. CISA added the vulnerability to its KEV catalog on November 6, 2026, indicating that exploitation has been observed. However, no specific threat actor or attack campaign has been publicly identified. OpenSSH versions before 10.6p2 are affected. The fourth issue, CVE-2026-123218 (CVSS score of 9.8), is an incorrect authorization vulnerability affecting IBM Aspera Faspex 5. It allows an authenticated user to craft a specific message that bypasses authorization checks and potentially gain full administrative privileges. Successful exploitation could give attackers access to sensitive information and allow them to modify or disrupt the affected system. IBM disclosed the vulnerability on November 7, 2026, and released a fix in Aspera Faspex 5.0.19 PL1. I found no public confirmation of exploitation in the wild or information identifying attackers at the time of writing. Versions 5.0.0 through 5.0.19 are affected. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the two vulnerabilities by November 12, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA) Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Nitori, a major Japanese furniture and home accessories retailer, discovered that an attacker accessed a system on its network and may have stolen 37.62 million customer records. The intrusion was detected on November 6, and the company blocked the unauthorized access. However, an investigation into the incident revealed that the attacker likely had access to the system since mid-October. Nitori, often called the “IKEA of Japan,” is a major furniture and home furnishings retailer that operates 879 stores in Japan and another 219 stores across China, South Korea, Taiwan, Thailand, Singapore, and Hong Kong. The firm has an annual revenue of $5.8 billion. According to the company's notification, the incident impacts individual customers, corporate members, and non-members who placed orders through official Nitori stores and online shops.
Confirm this action.
Leaving now will discard your changes.