Overview
Description
Statistics
- 25 Posts
- 27 Interactions
Fediverse
Happy Monday everyone. Google Chrome zero-day: CVE-2026-125350 (high severity) Use after free in XML
Google is aware that an exploit for CVE-2026-125350 exists in the wild.
https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html
Google Chrome 157.0.8103.50/157.0.8103.51 korrigiert 9 Sicherheitslücken – CVE-2026-125350 als Exploit
Google’s Chrome update fixes nine flaws, including actively exploited CVE-2026-125350. Chromium-based browsers such as Brave and Edge may also need vendor-issued fixes. Users should check for updates and restart. 🔐 #Chrome #Cybersecurity www.heise.de/en/news/Chrome-update-patches-actively-exploited-security-flaw-11518289.html
Google's Nov 9 Chrome update fixes CVE-2026-125350, a high-severity XML use-after-free. Google confirms an exploit exists in the wild but hasn't named targets or delivery methods. Stable desktop builds: Windows/Mac 157.0.8103.50/.51, Linux .50. Check managed-browser versions, update and relaunch. Rollout is gradual.
https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html
🚨 8 Chrome zero-days exploited in the wild in 2026.
Google has now released a security update for the latest one: CVE-2026-125350, a high-severity use-after-free flaw in Chrome's XML component.
An exploit exists in the wild. Attack details remain undisclosed.
Update Chrome. Details - https://thehackernews.com/2026/11/google-issues-chrome-security-update.html
Google fixes Chrome zero-day CVE-2026-125350, exploited in the wild, plus 8 more flaws. Install the Chrome security update to 157.0.8103.50 now.
#Chrome #ZeroDay #CVE2026125350 #GoogleChrome #BrowserSecurity #PatchNow #CyberSecurity #InfoSec
Google released Chrome security updates on 10 November 2026, fixing nine vulnerabilities.
One, CVE-2026-125350, is already being used in real-world attacks.
The flaw is a memory-management error in Chrome’s XML component; exploitation could cause data corruption, a crash or code execution.
Fixed versions are 157.0.8103.50/.51 on Windows and macOS, and 157.0.8103.50 on Linux.
Users of Edge, Brave, Opera and Vivaldi shoul…
Google has released a security update to address a Chrome zero-day vulnerability that is being actively exploited in the wild. Tracked as CVE-2026-125350, the flaw could allow attackers to execute malicious code within the browser.
An anonymous security researcher discovered and reported the vulnerability on November 6, 2026.
Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
Google has released a Chrome security update patching nine vulnerabilities, including CVE-2026-125350, a high-severity use-after-free flaw in Chrome’s XML component that is being actively exploited in the wild. It is the eighth Chrome zero-day exploited in attacks this year, and users are urged to update to the latest stable release. https://thehackernews.com/2026/11/google-issues-chrome-security-update.html
Here's a concise overview of the latest geopolitical, technology, and cybersecurity developments from the past 24 hours:
France has accused a cyber unit linked to Iran's Revolutionary Guard of orchestrating cyberattacks on supermarket refrigeration systems, causing significant disruption. In cybersecurity, Google released an urgent update to patch a Chrome zero-day vulnerability (CVE-2026-125350) actively exploited in the wild, while CISA added four critical flaws, including OpenSSH (SSHOle), to its exploited vulnerabilities catalog. Vanderbilt University also reported a significant ransomware incident. Technologically, AI agents are increasingly operating software autonomously, and Apple is reportedly accelerating Siri's AI capabilities. Geopolitically, US-Iran talks continue amidst heightened tensions, and Ukraine peace talks have commenced in Abu Dhabi.
Google fixes the eighth actively exploited Chrome zero-day of 2026
N-central Must Stay Offline, Plus 3 Tech Stories https://raymondtec.com/2026/11/n-central-vulnerabilities-plus-3-tech-stories/?utm_source=mastodon&utm_medium=social&utm_campaign=daily_brief
N-able takes N-central offline after 33 alleged vulnerabilities are disclosed. Plus Pennsylvania's AI-ad law, a Chrome zero-day, and Australia's AI oversight plan.
#TechNews #AIRegulation #Australia #CVE2026125350 #GoogleChrome #Nable #Ncentral
📰 Google Patches Eighth Actively Exploited Chrome Zero-Day This Year
Google issues an emergency patch for its EIGHTH actively exploited Chrome zero-day of 2026. The flaw, CVE-2026-125350, is a use-after-free bug in the XML component that could lead to arbitrary code execution. Update to version 157.0.8103.50 now! #Cyb...
Google’s Nov. 9 Chrome update fixes CVE-2026-125350, a high-severity XML flaw. Google says an exploit exists in the wild; attack details remain limited.
The fix is in Stable 157.0.8103.50/.51 on Windows and Mac and 157.0.8103.50 on Linux. Check Chrome’s About page for the update, then relaunch to apply it.
https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html?amp=1
Bluesky
Overview
Description
Statistics
- 9 Posts
- 2 Interactions
Fediverse
🚨 NEW on CISA KEV — exploited in the wild
🛡 OpenBSD OpenSSH
OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability
CVE: CVE-2026-123158 · patch by 2026-11-12
📈 EPSS 1.0% exploitation probability
OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.
🔗 https://ninjasignal.ninja/intel/cve/CVE-2026-123158
#cybersecurity #KEV #CVE #infosec
CISA ha aggiunto alla KEV la CVE-2026-123158 di OpenSSH: bypass dell'autenticazione a password su Linux con musl e PAM disattivato (default sshd su Alpine). Scadenza per le agenzie federali USA: 12/11. Fix: 10.6p2.
Previdian (via THN) segnala il primo tentativo in rete meno di 9 ore dopo il CVE, root su un honeypot Alpine. Non colpiti: glibc, Dropbear, PAM attivo.
Aggiornare, cercare account senza password, controllare i log sshd.
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123158
#OpenSSH #infosec
CISA added four CVEs to its KEV catalog on Nov. 9 based on exploitation evidence: GPUStack CVE-2026-102895, FreeSWITCH CVE-2026-116779, OpenSSH CVE-2026-123158 and IBM Aspera Faspex CVE-2026-123218. OpenSSH was previously covered; this is a new catalog update. Inventory affected systems, check public exposure and prioritize vendor remediation.
CISA KEV Catalog adds CVE-2026-123158, CVE-2026-116779, CVE-2026-123218, and CVE-2026-102895 after attackers exploit these four flaws in the wild.
CISA has updated its Known Exploited Vulnerabilities (KEV) catalog with four entries currently confirmed to be under threat.
Affected products include OpenBSD OpenSSH (CVE-2026-123158), GPUStack (CVE-2026-102895), SignalWire FreeSwitch (CVE-2026-116779), and IBM Aspera Faspex (CVE-2026-123218).
The OpenSSH flaw specifically involves authentication bypass and has been linked to the use of the TAC Agent remote control tool.
CISA mandate…
CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
CISA has added four actively exploited flaws to its Known Exploited Vulnerabilities catalog: CVE-2026-123218 in IBM Aspera Faspex, CVE-2026-116779 in SignalWire FreeSWITCH, CVE-2026-123158 (SSHole) in OpenBSD OpenSSH, and CVE-2026-102895 in GPUStack. Federal civilian agencies are required to apply the fixes by November 12, 2026, and exploitation attempts against the OpenSSH flaw have been recorded since November 6. https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html
Bluesky
Overview
Description
Statistics
- 5 Posts
- 7 Interactions
Fediverse
#Ubuntu just fixed the critical #kernel vulnerability in LTS (22, 24, and 26)!
https://ubuntu.com/security/CVE-2026-98432#status
(I’ve been watching the status page since saturday)
#ubuntu #linux finally released a patched version https://ubuntu.com/security/CVE-2026-98432#status
Overview
- SAP_SE
- SAP Gateway
Description
Statistics
- 5 Posts
- 13 Interactions
Fediverse
Wow, the next 10.0/10
Note 3798345 - [CVE-2026-89103] Broken Access Control in #SAP Gateway
CVSS v3.0 Base Score: 10,0 / 10
SAP Gateway's CRITICAL flaw (CVE-2026-89103, CVSS 10) enables unauthenticated attackers to gain high privileges by exploiting default ACLs 🛡️. No fix yet — restrict network access & monitor closely. Full details: https://radar.offseq.com/threat/sap-gateway-activates-the-default-access-control-list-with-high-privileges-allowing-categorization-of-1646224a14631f16
#OffSeq #SAP #vuln #infosec
🚨 SAP patches critical 10.0-rated flaws allowing hackers to take full control of enterprise systems without authentication
SAP has released emergency security fixes for multiple critical vulnerabilities affecting NetWeaver, Web Dispatcher, and Gateway, including flaws that could allow unauthenticated attackers to remotely execute commands and completely compromise enterprise systems.
Two vulnerabilities, CVE-2026-76964 and CVE-2026-89126, collectively known as ICM2SHELL, exploit memory corruption in WebSocket handling. Researchers at Onapsis developed a working exploit demonstrating full remote code execution without credentials.
A third vulnerability, CVE-2026-89103, dubbed ProxyGate, could allow attackers to bypass network restrictions and execute commands with elevated privileges.
All three vulnerabilities carry the maximum CVSS score of 10.0. SAP has released patches as part of its November security update and is urging administrators to apply them immediately.
Source: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
Need API access? darkwebinformer.com/api-details
Check out the Telegram channel: t.me/SliceForLifeee
SAP has disclosed four major security vulnerabilities affecting SAP NetWeaver and Web Dispatcher, featuring maximum CVSS severity scores.
The issues include CVE-2026-120017 in SAML 2.0 allowing unauthorized impersonation, memory corruption and code execution flaws in CVE-2026-76964 and CVE-2026-89126, and a gateway server spoofing risk in CVE-2026-89103.
These flaws can be exploited without prior authentication.
System administr…
Overview
Description
Statistics
- 5 Posts
Fediverse
SonicWall : une faille dans le VPN SSL permet de contourner le MFA et elle est exploitée https://www.it-connect.fr/sonicwall-vpn-ssl-faille-saml-mfa-cve-2026-19868/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #SonicWall
Bluesky
Overview
Description
Statistics
- 8 Posts
- 2 Interactions
Fediverse
(CISA TS+SOC) The Cyber Mind TSUITE Brief: – GPUStack Improper Authentication Vulnerability
CISA's addition of GPUStack's CVE-2026-102895 to the KEV catalog requires urgent detection engineering, API monitoring, and perimeter restriction....
(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-102895 – GPUStack Improper Authentication Vulnerability
inclusion of GPUStack's CVE-2026-102895 in the KEV catalog demands immediate executive risk oversight, asset integrity protocols, and perimeter hardening....
CISA added four CVEs to its KEV catalog on Nov. 9 based on exploitation evidence: GPUStack CVE-2026-102895, FreeSWITCH CVE-2026-116779, OpenSSH CVE-2026-123158 and IBM Aspera Faspex CVE-2026-123218. OpenSSH was previously covered; this is a new catalog update. Inventory affected systems, check public exposure and prioritize vendor remediation.
CISA KEV Catalog adds CVE-2026-123158, CVE-2026-116779, CVE-2026-123218, and CVE-2026-102895 after attackers exploit these four flaws in the wild.
CISA has updated its Known Exploited Vulnerabilities (KEV) catalog with four entries currently confirmed to be under threat.
Affected products include OpenBSD OpenSSH (CVE-2026-123158), GPUStack (CVE-2026-102895), SignalWire FreeSwitch (CVE-2026-116779), and IBM Aspera Faspex (CVE-2026-123218).
The OpenSSH flaw specifically involves authentication bypass and has been linked to the use of the TAC Agent remote control tool.
CISA mandate…
CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
CISA has added four actively exploited flaws to its Known Exploited Vulnerabilities catalog: CVE-2026-123218 in IBM Aspera Faspex, CVE-2026-116779 in SignalWire FreeSWITCH, CVE-2026-123158 (SSHole) in OpenBSD OpenSSH, and CVE-2026-102895 in GPUStack. Federal civilian agencies are required to apply the fixes by November 12, 2026, and exploitation attempts against the OpenSSH flaw have been recorded since November 6. https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html
Bluesky
Overview
- SAP_SE
- SAP Web Dispatcher
Description
Statistics
- 5 Posts
- 7 Interactions
Fediverse
Not funny anymore... (or is it?)
Note 3778556 - [CVE-2026-89126] Memory Corruption vulnerability in SAP Web Dispatcher
CVSS v3.0 Base Score: 10,0 / 10
🚨 SAP patches critical 10.0-rated flaws allowing hackers to take full control of enterprise systems without authentication
SAP has released emergency security fixes for multiple critical vulnerabilities affecting NetWeaver, Web Dispatcher, and Gateway, including flaws that could allow unauthenticated attackers to remotely execute commands and completely compromise enterprise systems.
Two vulnerabilities, CVE-2026-76964 and CVE-2026-89126, collectively known as ICM2SHELL, exploit memory corruption in WebSocket handling. Researchers at Onapsis developed a working exploit demonstrating full remote code execution without credentials.
A third vulnerability, CVE-2026-89103, dubbed ProxyGate, could allow attackers to bypass network restrictions and execute commands with elevated privileges.
All three vulnerabilities carry the maximum CVSS score of 10.0. SAP has released patches as part of its November security update and is urging administrators to apply them immediately.
Source: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
Need API access? darkwebinformer.com/api-details
Check out the Telegram channel: t.me/SliceForLifeee
SAP has disclosed four major security vulnerabilities affecting SAP NetWeaver and Web Dispatcher, featuring maximum CVSS severity scores.
The issues include CVE-2026-120017 in SAML 2.0 allowing unauthorized impersonation, memory corruption and code execution flaws in CVE-2026-76964 and CVE-2026-89126, and a gateway server spoofing risk in CVE-2026-89103.
These flaws can be exploited without prior authentication.
System administr…
Bluesky
Overview
- SAP_SE
- SAP NetWeaver AS ABAP (Internet Communication Manager)
Description
Statistics
- 5 Posts
- 7 Interactions
Fediverse
🚨 SAP patches critical 10.0-rated flaws allowing hackers to take full control of enterprise systems without authentication
SAP has released emergency security fixes for multiple critical vulnerabilities affecting NetWeaver, Web Dispatcher, and Gateway, including flaws that could allow unauthenticated attackers to remotely execute commands and completely compromise enterprise systems.
Two vulnerabilities, CVE-2026-76964 and CVE-2026-89126, collectively known as ICM2SHELL, exploit memory corruption in WebSocket handling. Researchers at Onapsis developed a working exploit demonstrating full remote code execution without credentials.
A third vulnerability, CVE-2026-89103, dubbed ProxyGate, could allow attackers to bypass network restrictions and execute commands with elevated privileges.
All three vulnerabilities carry the maximum CVSS score of 10.0. SAP has released patches as part of its November security update and is urging administrators to apply them immediately.
Source: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
Need API access? darkwebinformer.com/api-details
Check out the Telegram channel: t.me/SliceForLifeee
SAP has disclosed four major security vulnerabilities affecting SAP NetWeaver and Web Dispatcher, featuring maximum CVSS severity scores.
The issues include CVE-2026-120017 in SAML 2.0 allowing unauthorized impersonation, memory corruption and code execution flaws in CVE-2026-76964 and CVE-2026-89126, and a gateway server spoofing risk in CVE-2026-89103.
These flaws can be exploited without prior authentication.
System administr…
Bluesky
Overview
Description
Statistics
- 6 Posts
- 3 Interactions
Fediverse
🚨 NEW on CISA KEV — exploited in the wild
🛡 SignalWire FreeSwitch
SignalWire FreeSwitch Code Injection Vulnerability
CVE: CVE-2026-116779 · patch by 2026-11-12
📈 EPSS 1.3% exploitation probability
SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution.
🔗 https://ninjasignal.ninja/intel/cve/CVE-2026-116779
#cybersecurity #KEV #CVE #infosec
CISA added four CVEs to its KEV catalog on Nov. 9 based on exploitation evidence: GPUStack CVE-2026-102895, FreeSWITCH CVE-2026-116779, OpenSSH CVE-2026-123158 and IBM Aspera Faspex CVE-2026-123218. OpenSSH was previously covered; this is a new catalog update. Inventory affected systems, check public exposure and prioritize vendor remediation.
CISA KEV Catalog adds CVE-2026-123158, CVE-2026-116779, CVE-2026-123218, and CVE-2026-102895 after attackers exploit these four flaws in the wild.
CISA has updated its Known Exploited Vulnerabilities (KEV) catalog with four entries currently confirmed to be under threat.
Affected products include OpenBSD OpenSSH (CVE-2026-123158), GPUStack (CVE-2026-102895), SignalWire FreeSwitch (CVE-2026-116779), and IBM Aspera Faspex (CVE-2026-123218).
The OpenSSH flaw specifically involves authentication bypass and has been linked to the use of the TAC Agent remote control tool.
CISA mandate…
CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
CISA has added four actively exploited flaws to its Known Exploited Vulnerabilities catalog: CVE-2026-123218 in IBM Aspera Faspex, CVE-2026-116779 in SignalWire FreeSWITCH, CVE-2026-123158 (SSHole) in OpenBSD OpenSSH, and CVE-2026-102895 in GPUStack. Federal civilian agencies are required to apply the fixes by November 12, 2026, and exploitation attempts against the OpenSSH flaw have been recorded since November 6. https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html
Overview
- SAP_SE
- SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)
Description
Statistics
- 3 Posts
- 1 Interaction
Fediverse
November SAP Security Patch Day fixes 38 CVEs, including nine Critical SAP NetWeaver, Web Dispatcher and Gateway flaws rated up to CVSS 10.0.
#SAP #SAPSecurity #PatchDay #SAPNetWeaver #CVE2026120017 #ERPSecurity #CyberSecurity #InfoSec
SAP has disclosed four major security vulnerabilities affecting SAP NetWeaver and Web Dispatcher, featuring maximum CVSS severity scores.
The issues include CVE-2026-120017 in SAML 2.0 allowing unauthorized impersonation, memory corruption and code execution flaws in CVE-2026-76964 and CVE-2026-89126, and a gateway server spoofing risk in CVE-2026-89103.
These flaws can be exploited without prior authentication.
System administr…