Certificate authority eMudhra has revoked eight additional intermediate CA certificates after an investigation into its recent certificate security incident found improper handling of private keys during the certificate-generation process. The new revocations bring the total number of affected intermediate CA certificates to 16, including eight previously compromised certificates whose private keys were so weak that anyone could recover them almost instantly. In a new incident report published Tuesday, eMudhra said that both sets of certificates were affected by a custom Python script used to transfer private keys between hardware security modules (HSMs) in April 2025. HSMs are devices designed to securely generate and store cryptographic keys, preventing sensitive private keys from being exposed outside the hardware.
Linux eBPF rootkits can hide malicious activity and evade traditional detection methods without loading kernel modules. Flare reveals how these techniques are spreading through underground forums, where threat actors are sharing rootkit source code, tutorials, and exploits targeting Linux systems.
We uncover Falcon C2, a browser-based threat framework targeting governments via malicious scripts, extensions, and the Antino implant. The post The XG Files: Falcon C2 Flying Under The (Browser) Radar appeared first on Unit 42.
N-able released hotfixes to address zero-day bugs affecting its N-central remote monitoring and management (RMM) platform, which were publicly disclosed over the weekend and forced it to take vulnerable hosted environments offline. This follows N-able's decision to take all hosted N-central environments offline across the Americas, Europe, and Asia-Pacific regions until it could patch them against potential attacks targeting the zero-day flaws in the wild. "N-able is actively responding to non-responsible communication of critical vulnerabilities in N-central late Sunday night, November 8, found by an independent researcher," N-able told BleepingComputer on Monday. "As a precautionary measure, we took our Hosted N-central environment offline today, November 9, and provided guidance to customers operating on-premises N-central servers to temporarily take their servers offline until further notice."
Microsoft says the November 2026 cumulative updates resolve USB audio issues plaguing Windows users who have installed security updates released since September. The company explained, when it acknowledged this known issue days after the September 2026 Patch Tuesday, that USB Audio Class 1.0 devices failed to start or produce audio on some systems after installing recent updates. Some affected users reported seeing no audio output, unresponsive volume controls and sound settings, and "This device cannot start (Code 10)." errors in Device Manager, while others said the impacted USB audio speakers fail only when using multichannel audio features, including 3D audio or 8-channel modes. These audio issues affect both server (Windows Server 2012 and later) and client (Windows 10 and Windows 11) systems.
Hackers advertise a $1,000-a-month tool claiming persistent Gmail access after password resets, but its effectiveness remains unverified. A developer of hacking tools is selling a $1,000 per month feature that allegedly gives criminals continuous access to Gmail inboxes. The cybersecurity firm Hudson Rock reports that the tool can keep reading a victim’s mailbox after a password change, after the browser closes and after sessions are revoked. “Remus Stealer is advertising a way for criminals to open a compromised Gmail inbox directly from a stolen-device record.” reads the report published by cybersecurity firm Hudson Rock. “Its latest pitch goes further: the operator claims access continues even after the victim changes their password or revokes sessions.” The tool belongs to Remus Stealer, an infostealer, meaning malware that steals data from infected computers. Remus supposedly gives its operators a searchable inbox right inside a stolen-device dashboard. Hudson Rock says it spoke with the developer and with a customer who used it, and the customer supplied screenshots of messages, timestamps and a control for sharing a mailbox with other operators. If the claims are true, the risk goes beyond a single Gmail inbox. Attackers could read password reset links and verification codes, allowing them to access other accounts linked to that email address. This makes Gmail a valuable target because many online services use it to recover accounts. “In the supplied version 1.3.9 announcement, Remus promotes email-code interception without collecting browser cookie files, claims that password changes and session revocation do not stop it, and advertises shareable mailbox links. The feature is listed as Enterprise-only; the main sales thread advertises that tier at $1,000 per month.” continues the report. “The sharing claim concerns giving other operators access to an already acquired mailbox through the service. The material does not show a victim being infected by opening one of those links.” It is still unclear how the tool works. Hudson Rock says Remus does not steal browser cookies, while its developer claims that changing the Gmail password does not stop access. The developer has not shared technical details. He only said that the malware interacts with browser memory, but this does not explain how it can maintain access after a password change or when active sessions are revoked. Hudson Rock believes Remus may obtain or create an authorization token while the victim is logged into Gmail through a browser. A remote component could then use this authorization to access emails even after the malware has stopped running, as long as Google continues to accept it. Tom’s Guide also reports that the tool can bypass Google’s anti-fraud checks and says it has contacted Google for comment. However, other reports highlight some important uncertainties. CyberInsider says Hudson Rock has not confirmed that the tool can maintain access after a password change, nor has it established that the feature exploits a Gmail vulnerability. Hudson Rock has not conducted a controlled test to show that Remus can still access newly received emails after the victim changes their password and revokes existing sessions and third-party access. According to Cybernews, the developer describes the feature as a Gmail “zero-day”. However, this claim has not been independently reproduced. The business side is more concrete. CyberInsider says the mailbox feature sits in an Enterprise tier at $1,000 per month, with shareable mailbox links so criminals can hand an inbox they’ve already compromised to others. The actor behind Remus Stealer offers the MaaS with three subscription tiers: Basic at $250, Pro at $500 and Enterprise at $1,000. This kind of claim has a history. In late 2023, a developer called PRISMA surfaced an exploit that regenerated persistent Google cookies by manipulating a token and account ID pair, and Lumma then used it so access continued after a password reset. It’s a precedent and not proof, since Remus’ mechanism is unknown, and Hudson Rock still treats a Google password change as an essential recovery step, while saying victims should also look for other ways an attacker could keep access. The tool is marketed to “enterprise” customers, so most users are unlikely to be targeted. It will probably be used mainly against organizations and high-profile individuals. Hudson Rock recommends that victims first disconnect and clean the infected computer before accessing their trusted accounts again. They should then change compromised passwords using a clean device and review their signed-in devices to remove suspicious sessions and third-party access. Hudson Rock also advises users to check Gmail settings for unauthorized changes and secure any other accounts that use the compromised mailbox for password resets or verification codes. Other basic precautions remain important: watch out for phishing emails with urgent messages, spelling mistakes or suspicious sender addresses, and keep antivirus software up to date. Tom’s Guide expects Google to introduce additional Gmail protections if the tool proves as effective as its developer claims. For now, this is a vendor’s marketing claim supported by customer screenshots and Hudson Rock’s investigation, not a confirmed Gmail vulnerability. One important detail offers some reassurance: attackers must first infect the victim’s computer and compromise their mailbox before they can use the tool. “Remus is marketing an integrated mailbox-reading capability, and a customer has endorsed its claimed persistence. The most plausible broad model is reuse of access obtained or established during endpoint compromise.” concludes the report. “The evidence does not identify the mechanism or show fresh mail remaining accessible after comprehensive recovery.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Gmail)
Microsoft has fixed Outlook sign-in and mail delivery issues on Exchange Server systems after installing the October 2026 Windows Server security updates. Microsoft acknowledged this known issue in mid-October, confirming that users had trouble accessing email or signing in to Outlook after installing the latest updates on systems running Windows Server 2019 and later. As explained at the time, the sign-in and mail flow issues are caused by a new default limit on the amount of memory Endpoint Mapper uses when handling Endpoint Lookup calls, introduced by the October 2026 updates. "After installing the October 2026 Windows security update [..], some on-premises Exchange servers might experience issues accessing or sending email. Users might be unable to sign in to Outlook on the web (OWA), or email messages sent from Outlook might remain in the Outbox and not be delivered. Additionally, Exchange might experience issues accessing mailboxes during mailbox replication," Microsoft said at the time.
Microsoft November Patch Tuesday security updates fix 1,090 flaws, including one exploited Outlook bug and 30 potentially wormable issues. Microsoft November Patch Tuesday addressed about 1,090 new vulnerabilities, which is less than the roughly 1,400 last month. Two months in a row now exceed every previous year from Microsoft, and the overall count is a bit confusing, so other trackers report different totals. The release covers Windows and its components, Office, networking and remote access, graphics, media and printing, storage and file systems, .NET and Visual Studio, security and identity, Azure and cloud, Exchange Server, Dynamics and Xbox. Only one bug is under active attack and none is publicly known. ZDI says that doesn’t mean less exploitation, only fewer zero-days, and it guesses that AI is better at reversing patches than at finding and exploiting bugs in closed-source software. The exploited bug is CVE-2026-124194, an Outlook spoofing flaw, and its name undersells the impact. An attacker sends a crafted message file and talks the user into opening it, and Outlook connects to an attacker-controlled location without the usual external-content warning, which leaks the user’s NTLMv2 hash. “An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user. Exploitation requires network connectivity and user interaction.” reads the advisory. “An attacker must send a user a malicious Office file and convince them to open it.” The attacker can then authenticate as that user. The Preview Pane isn’t an attack path and the CVSS score is only 6.5, but ZDI says to put it first because Microsoft marks it as exploited. CVE-2026-116928 is a Windows Search remote code execution bug reached through Exchange Server. An unauthenticated attacker emails a crafted attachment, and the bug triggers when the server indexes it automatically, so the recipient never opens anything. It’s zero-click, scores CVSS 9.8, and ZDI rates it more severe than any of the nine patches Exchange gets this month. CVE-2026-119958 hits the Windows LDAP service. An unauthenticated attacker sends crafted LDAP calls over the network, triggers an out-of-bounds write and runs code in the service context, which could be destructive on domain controllers. ZDI says to test and deploy it quickly. CVE-2026-119952, a Schannel remote code execution flaw, is marked “Exploitation More Likely”, one of only a few Critical patches with that rating, and its high attack complexity is why the score is lower. CVE-2026-119990, an Azure OpenAI elevation of privilege bug, got a bulletin that said “Customer Action Required: Yes” and then listed nothing to do. An unauthenticated attacker could send a crafted request over the internet and reach orchestration information, change workflows or disrupt the service. Microsoft has since revised it to say no customer action is needed. A bulletin that says action required and lists none is the most relaxed urgent notice you’ll read this month. Two more stand out for their components. CVE-2026-95962 is a use-after-free in the little-documented Windows Virtual Filtering Platform, reachable with a crafted network packet and needing no authentication or user interaction. It involves a race condition, but ZDI notes those get beaten all the time at Pwn2Own. CVE-2026-112967 is a heap overflow in the Xbox Live Networking Service with a CVSS of 9.8, and ZDI doesn’t think exploitation is likely but enjoys imagining Xbox Live exploits in the wild. ZDI counts 30 wormable bugs this month, down from 59 last month. Seventeen carry advisory wording about an unauthenticated attacker running code over the network with no interaction, and 13 use variant wording or have no FAQ but show the same pattern in their summaries and CVSS vectors. ZDI warns it may be wrong on some, since a few advisories are light on detail. ComponentCVEsMessage Queuing (5)CVE-2026-116710, 119963, 119964, 109459, 119967DNS (4)CVE-2026-81384, 96092, 96177, 88218Color Management (2)CVE-2026-96067, 96078DHCP Server (2)CVE-2026-88243, 72998DirectMusic (2)CVE-2026-95882, 95901Xbox (2)CVE-2026-112967, 66801One each (13)Exchange Server (116928), LDAP (119958), Schannel (119952), CredSSP (119962), Deployment Services (119951), IIS (119961), NAT (113862), RPC Runtime (118737), Media Foundation (96157), iSCSI (88234), Virtual Filtering Platform (95962), eSCL Scanner (95956), Modern Device Management (119945) Network-facing services like DNS, DHCP, LDAP and Exchange deserve the earliest attention. “I may be wrong about some of these, since a few advisories are light on detail.” concludes ZDI. “As always, I recommend testing and deploying these patches quickly, especially for network-facing services like DNS, DHCP, LDAP, and Exchange” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Patch Tuesday)
Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems. The vulnerabilities are listed below - CVE-2026-108186 (CVSS score: 9.6) - An improper input validation vulnerability that could allow an unauthenticated user to conduct an escalation of privilege via
Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026. Cynet's CyOps and Research teams said they identified the suspicious activity in October 2026 against several E.U.-based customers within a narrow window of just over three minutes. The activity has been found to share some
Confirm this action.
Leaving now will discard your changes.