Overview
Description
Statistics
- 27 Posts
- 19 Interactions
Fediverse
Google Chrome 157.0.8103.50/157.0.8103.51 korrigiert 9 Sicherheitslücken – CVE-2026-125350 als Exploit
Google’s Chrome update fixes nine flaws, including actively exploited CVE-2026-125350. Chromium-based browsers such as Brave and Edge may also need vendor-issued fixes. Users should check for updates and restart. 🔐 #Chrome #Cybersecurity www.heise.de/en/news/Chrome-update-patches-actively-exploited-security-flaw-11518289.html
Google's Nov 9 Chrome update fixes CVE-2026-125350, a high-severity XML use-after-free. Google confirms an exploit exists in the wild but hasn't named targets or delivery methods. Stable desktop builds: Windows/Mac 157.0.8103.50/.51, Linux .50. Check managed-browser versions, update and relaunch. Rollout is gradual.
https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html
🚨 8 Chrome zero-days exploited in the wild in 2026.
Google has now released a security update for the latest one: CVE-2026-125350, a high-severity use-after-free flaw in Chrome's XML component.
An exploit exists in the wild. Attack details remain undisclosed.
Update Chrome. Details - https://thehackernews.com/2026/11/google-issues-chrome-security-update.html
🚨 Google patches 8th actively exploited Chrome zero-day of 2026, warns attackers can execute malicious code
Google has released an emergency Chrome security update addressing CVE-2026-125350, a high-severity use-after-free vulnerability in the browser's XML component that could allow attackers to execute malicious code through specially crafted webpages.
Google confirmed that an exploit exists in the wild but has not disclosed who is exploiting the vulnerability or which organizations have been targeted.
The flaw is among nine vulnerabilities patched in the latest release, marking the eighth Chrome zero-day addressed this year. Users are urged to update Chrome to version 157.0.8103.50/.51 on Windows and macOS or 157.0.8103.50 on Linux.
Source: https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html
Enterprise-level intel, without the enterprise price tag. Plans for everyone. darkwebinformer.com/pricing
Need API access? darkwebinformer.com/api-details
Check out the Telegram channel: t.me/SliceForLifeee
Google released Chrome security updates on 10 November 2026, fixing nine vulnerabilities.
One, CVE-2026-125350, is already being used in real-world attacks.
The flaw is a memory-management error in Chrome’s XML component; exploitation could cause data corruption, a crash or code execution.
Fixed versions are 157.0.8103.50/.51 on Windows and macOS, and 157.0.8103.50 on Linux.
Users of Edge, Brave, Opera and Vivaldi shoul…
Google has released a security update to address a Chrome zero-day vulnerability that is being actively exploited in the wild. Tracked as CVE-2026-125350, the flaw could allow attackers to execute malicious code within the browser.
An anonymous security researcher discovered and reported the vulnerability on November 6, 2026.
Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
Google has released a Chrome security update patching nine vulnerabilities, including CVE-2026-125350, a high-severity use-after-free flaw in Chrome’s XML component that is being actively exploited in the wild. It is the eighth Chrome zero-day exploited in attacks this year, and users are urged to update to the latest stable release. https://thehackernews.com/2026/11/google-issues-chrome-security-update.html
Here's a concise overview of the latest geopolitical, technology, and cybersecurity developments from the past 24 hours:
France has accused a cyber unit linked to Iran's Revolutionary Guard of orchestrating cyberattacks on supermarket refrigeration systems, causing significant disruption. In cybersecurity, Google released an urgent update to patch a Chrome zero-day vulnerability (CVE-2026-125350) actively exploited in the wild, while CISA added four critical flaws, including OpenSSH (SSHOle), to its exploited vulnerabilities catalog. Vanderbilt University also reported a significant ransomware incident. Technologically, AI agents are increasingly operating software autonomously, and Apple is reportedly accelerating Siri's AI capabilities. Geopolitically, US-Iran talks continue amidst heightened tensions, and Ukraine peace talks have commenced in Abu Dhabi.
Google fixes the eighth actively exploited Chrome zero-day of 2026
N-central Must Stay Offline, Plus 3 Tech Stories https://raymondtec.com/2026/11/n-central-vulnerabilities-plus-3-tech-stories/?utm_source=mastodon&utm_medium=social&utm_campaign=daily_brief
N-able takes N-central offline after 33 alleged vulnerabilities are disclosed. Plus Pennsylvania's AI-ad law, a Chrome zero-day, and Australia's AI oversight plan.
#TechNews #AIRegulation #Australia #CVE2026125350 #GoogleChrome #Nable #Ncentral
📰 Google Patches Eighth Actively Exploited Chrome Zero-Day This Year
Google issues an emergency patch for its EIGHTH actively exploited Chrome zero-day of 2026. The flaw, CVE-2026-125350, is a use-after-free bug in the XML component that could lead to arbitrary code execution. Update to version 157.0.8103.50 now! #Cyb...
Google’s Nov. 9 Chrome update fixes CVE-2026-125350, a high-severity XML flaw. Google says an exploit exists in the wild; attack details remain limited.
The fix is in Stable 157.0.8103.50/.51 on Windows and Mac and 157.0.8103.50 on Linux. Check Chrome’s About page for the update, then relaunch to apply it.
https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html?amp=1
🚨 NEW on CISA KEV — exploited in the wild
🛡 Google Chromium
Google Chromium Use-After-Free Vulnerability
CVE: CVE-2026-125350 · patch by 2026-11-24
Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chr
🔗 https://ninjasignal.ninja/intel/cve/CVE-2026-125350
#cybersecurity #KEV #CVE #infosec
Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year.
"Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company said in a Monday security advisory.
As Google explained, this flaw stems from a Use-After-Free (UAF) weakness in the XML component of the Google Chrome web browser, which occurs when the browser's XML parser processes data, deletes an object from the computer's memory, but fails to clear the pointer referencing that object.
#cybersecurity
https://www.bleepingcomputer.com/news/security/google-patches-eighth-chrome-zero-day-exploited-in-attacks-this-year/
I'm late in posting today but happy Patch Tuesday. CISA added 6 new vulnerabilities to the KEV Catalog, two are zero-days but only one is new today (Microsoft):
- CVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
- CVE-2026-111560 Barracuda Networks Multiple Products OS Command Injection Vulnerability
- CVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
- CVE-2026-116606 Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
- CVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
- CVE-2026-125350 Google Chromium Use-After-Free Vulnerability
#CISA #KEV #PatchTuesday #zeroday #eitw #CVE #Microsoft #Barracuda #Chrome #Cisco #Openwave
Bluesky
Overview
Description
Statistics
- 7 Posts
- 6 Interactions
Fediverse
🚨 Microsoft confirms hackers are exploiting Outlook zero-day to steal Windows authentication hashes, CVE-2026-124194
Microsoft has patched an actively exploited vulnerability in Outlook that could allow attackers to steal NTLM authentication hashes by tricking users into opening specially crafted files.
The flaw, tracked as CVE-2026-124194 (CVSS 6.5), allows Outlook to connect to attacker-controlled locations without displaying the usual external content security warning, potentially exposing credentials to further attacks.
Microsoft confirmed exploitation in the wild as part of its November 2026 Patch Tuesday updates. Users and administrators are urged to install the latest security fixes immediately.
Source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194
No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
Need API access? darkwebinformer.com/api-details
Check out the Telegram channel: t.me/SliceForLifeee
Microsoft November 2026 Patch Tuesday fixes 1,093 vulnerabilities, including an exploited Outlook zero-day, CVE-2026-124194, and a CVSS 10.0 Entra flaw.
#Microsoft #PatchTuesday #ZeroDay #Outlook #Windows #CVE2026124194 #CyberSecurity #InfoSec
🚨 NEW on CISA KEV — exploited in the wild
🛡 Microsoft Office
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
CVE: CVE-2026-124194 · patch by 2026-11-24
Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.
🔗 https://ninjasignal.ninja/intel/cve/CVE-2026-124194
#cybersecurity #KEV #CVE #infosec
Microsoft's Nov 10 fixes include exploited Outlook CVE-2026-124194. Opening a crafted message file can prompt a connection to an attacker-controlled location and expose an NTLMv2 hash. Preview Pane alone is not an attack vector. Update affected Office builds and investigate suspicious NTLM traffic.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194
I'm late in posting today but happy Patch Tuesday. CISA added 6 new vulnerabilities to the KEV Catalog, two are zero-days but only one is new today (Microsoft):
- CVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
- CVE-2026-111560 Barracuda Networks Multiple Products OS Command Injection Vulnerability
- CVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
- CVE-2026-116606 Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
- CVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
- CVE-2026-125350 Google Chromium Use-After-Free Vulnerability
#CISA #KEV #PatchTuesday #zeroday #eitw #CVE #Microsoft #Barracuda #Chrome #Cisco #Openwave
Overview
Description
Statistics
- 4 Posts
- 18 Interactions
Fediverse
#Ubuntu just fixed the critical #kernel vulnerability in LTS (22, 24, and 26)!
https://ubuntu.com/security/CVE-2026-98432#status
(I’ve been watching the status page since saturday)
#ubuntu #linux finally released a patched version https://ubuntu.com/security/CVE-2026-98432#status
Overview
Description
Statistics
- 7 Posts
- 1 Interaction
Fediverse
CISA ha aggiunto alla KEV la CVE-2026-123158 di OpenSSH: bypass dell'autenticazione a password su Linux con musl e PAM disattivato (default sshd su Alpine). Scadenza per le agenzie federali USA: 12/11. Fix: 10.6p2.
Previdian (via THN) segnala il primo tentativo in rete meno di 9 ore dopo il CVE, root su un honeypot Alpine. Non colpiti: glibc, Dropbear, PAM attivo.
Aggiornare, cercare account senza password, controllare i log sshd.
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123158
#OpenSSH #infosec
CISA KEV Catalog adds CVE-2026-123158, CVE-2026-116779, CVE-2026-123218, and CVE-2026-102895 after attackers exploit these four flaws in the wild.
CISA has updated its Known Exploited Vulnerabilities (KEV) catalog with four entries currently confirmed to be under threat.
Affected products include OpenBSD OpenSSH (CVE-2026-123158), GPUStack (CVE-2026-102895), SignalWire FreeSwitch (CVE-2026-116779), and IBM Aspera Faspex (CVE-2026-123218).
The OpenSSH flaw specifically involves authentication bypass and has been linked to the use of the TAC Agent remote control tool.
CISA mandate…
CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
CISA has added four actively exploited flaws to its Known Exploited Vulnerabilities catalog: CVE-2026-123218 in IBM Aspera Faspex, CVE-2026-116779 in SignalWire FreeSWITCH, CVE-2026-123158 (SSHole) in OpenBSD OpenSSH, and CVE-2026-102895 in GPUStack. Federal civilian agencies are required to apply the fixes by November 12, 2026, and exploitation attempts against the OpenSSH flaw have been recorded since November 6. https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html
Bluesky
Overview
- SAP_SE
- SAP Gateway
Description
Statistics
- 5 Posts
- 14 Interactions
Fediverse
Wow, the next 10.0/10
Note 3798345 - [CVE-2026-89103] Broken Access Control in #SAP Gateway
CVSS v3.0 Base Score: 10,0 / 10
SAP Gateway's CRITICAL flaw (CVE-2026-89103, CVSS 10) enables unauthenticated attackers to gain high privileges by exploiting default ACLs 🛡️. No fix yet — restrict network access & monitor closely. Full details: https://radar.offseq.com/threat/sap-gateway-activates-the-default-access-control-list-with-high-privileges-allowing-categorization-of-1646224a14631f16
#OffSeq #SAP #vuln #infosec
🚨 SAP patches critical 10.0-rated flaws allowing hackers to take full control of enterprise systems without authentication
SAP has released emergency security fixes for multiple critical vulnerabilities affecting NetWeaver, Web Dispatcher, and Gateway, including flaws that could allow unauthenticated attackers to remotely execute commands and completely compromise enterprise systems.
Two vulnerabilities, CVE-2026-76964 and CVE-2026-89126, collectively known as ICM2SHELL, exploit memory corruption in WebSocket handling. Researchers at Onapsis developed a working exploit demonstrating full remote code execution without credentials.
A third vulnerability, CVE-2026-89103, dubbed ProxyGate, could allow attackers to bypass network restrictions and execute commands with elevated privileges.
All three vulnerabilities carry the maximum CVSS score of 10.0. SAP has released patches as part of its November security update and is urging administrators to apply them immediately.
Source: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
Need API access? darkwebinformer.com/api-details
Check out the Telegram channel: t.me/SliceForLifeee
SAP has disclosed four major security vulnerabilities affecting SAP NetWeaver and Web Dispatcher, featuring maximum CVSS severity scores.
The issues include CVE-2026-120017 in SAML 2.0 allowing unauthorized impersonation, memory corruption and code execution flaws in CVE-2026-76964 and CVE-2026-89126, and a gateway server spoofing risk in CVE-2026-89103.
These flaws can be exploited without prior authentication.
System administr…
Overview
Description
Statistics
- 5 Posts
Fediverse
SonicWall : une faille dans le VPN SSL permet de contourner le MFA et elle est exploitée https://www.it-connect.fr/sonicwall-vpn-ssl-faille-saml-mfa-cve-2026-19868/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #SonicWall
Bluesky
Overview
- SAP_SE
- SAP Web Dispatcher
Description
Statistics
- 5 Posts
- 8 Interactions
Fediverse
Not funny anymore... (or is it?)
Note 3778556 - [CVE-2026-89126] Memory Corruption vulnerability in SAP Web Dispatcher
CVSS v3.0 Base Score: 10,0 / 10
🚨 SAP patches critical 10.0-rated flaws allowing hackers to take full control of enterprise systems without authentication
SAP has released emergency security fixes for multiple critical vulnerabilities affecting NetWeaver, Web Dispatcher, and Gateway, including flaws that could allow unauthenticated attackers to remotely execute commands and completely compromise enterprise systems.
Two vulnerabilities, CVE-2026-76964 and CVE-2026-89126, collectively known as ICM2SHELL, exploit memory corruption in WebSocket handling. Researchers at Onapsis developed a working exploit demonstrating full remote code execution without credentials.
A third vulnerability, CVE-2026-89103, dubbed ProxyGate, could allow attackers to bypass network restrictions and execute commands with elevated privileges.
All three vulnerabilities carry the maximum CVSS score of 10.0. SAP has released patches as part of its November security update and is urging administrators to apply them immediately.
Source: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
Need API access? darkwebinformer.com/api-details
Check out the Telegram channel: t.me/SliceForLifeee
SAP has disclosed four major security vulnerabilities affecting SAP NetWeaver and Web Dispatcher, featuring maximum CVSS severity scores.
The issues include CVE-2026-120017 in SAML 2.0 allowing unauthorized impersonation, memory corruption and code execution flaws in CVE-2026-76964 and CVE-2026-89126, and a gateway server spoofing risk in CVE-2026-89103.
These flaws can be exploited without prior authentication.
System administr…
Bluesky
Overview
Description
Statistics
- 5 Posts
- 10 Interactions
Fediverse
Git's Nov 10 security release addresses 6 flaws. CVE-2026-111760 can allow code execution when recursively cloning a malicious repository via submodules. Fixed in 2.56.1 and patched 2.50–2.55 releases. Update installed and bundled Git versions, including CI runners. No active exploitation was established in the release.
https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/
Update to Git 2.56.1 now to fix six Git security vulnerabilities, including CVE-2026-111760 and CVE-2026-105437 for code execution and heap bugs.
Git has released security updates for version 2.56.1 and the 2.50 through 2.55 series, addressing multiple vulnerabilities.
The primary issue, CVE-2026-111760, allowed code execution via malicious repositories during recursive cloning due to a flaw in handling extremely large file paths that could overwrite system files.
Five additional vulnerabilities were patched: CVE-2026-113408, CVE-2026-114467, CVE-2026-114469, CVE-202…
#Git vulnerabilities announced:
- CVE-2026-111760: Code execution during recursive clones
- CVE-2026-113408: Path traversal through a server’s advertised HEAD
- CVE-2026-114467: Stack corruption when removing signatures
- CVE-2026-114469: Out-of-bounds reads when applying binary patches
- CVE-2026-105437: Heap corruption during large merges
- CVE-2026-114466: Filesystem access through fast-import streams
https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/
Overview
Description
Statistics
- 7 Posts
- 1 Interaction
Fediverse
(CISA TS+SOC) The Cyber Mind TSUITE Brief: – GPUStack Improper Authentication Vulnerability
CISA's addition of GPUStack's CVE-2026-102895 to the KEV catalog requires urgent detection engineering, API monitoring, and perimeter restriction....
(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-102895 – GPUStack Improper Authentication Vulnerability
inclusion of GPUStack's CVE-2026-102895 in the KEV catalog demands immediate executive risk oversight, asset integrity protocols, and perimeter hardening....
CISA KEV Catalog adds CVE-2026-123158, CVE-2026-116779, CVE-2026-123218, and CVE-2026-102895 after attackers exploit these four flaws in the wild.
CISA has updated its Known Exploited Vulnerabilities (KEV) catalog with four entries currently confirmed to be under threat.
Affected products include OpenBSD OpenSSH (CVE-2026-123158), GPUStack (CVE-2026-102895), SignalWire FreeSwitch (CVE-2026-116779), and IBM Aspera Faspex (CVE-2026-123218).
The OpenSSH flaw specifically involves authentication bypass and has been linked to the use of the TAC Agent remote control tool.
CISA mandate…
CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
CISA has added four actively exploited flaws to its Known Exploited Vulnerabilities catalog: CVE-2026-123218 in IBM Aspera Faspex, CVE-2026-116779 in SignalWire FreeSWITCH, CVE-2026-123158 (SSHole) in OpenBSD OpenSSH, and CVE-2026-102895 in GPUStack. Federal civilian agencies are required to apply the fixes by November 12, 2026, and exploitation attempts against the OpenSSH flaw have been recorded since November 6. https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html
Bluesky
Overview
- SAP_SE
- SAP NetWeaver AS ABAP (Internet Communication Manager)
Description
Statistics
- 5 Posts
- 8 Interactions
Fediverse
🚨 SAP patches critical 10.0-rated flaws allowing hackers to take full control of enterprise systems without authentication
SAP has released emergency security fixes for multiple critical vulnerabilities affecting NetWeaver, Web Dispatcher, and Gateway, including flaws that could allow unauthenticated attackers to remotely execute commands and completely compromise enterprise systems.
Two vulnerabilities, CVE-2026-76964 and CVE-2026-89126, collectively known as ICM2SHELL, exploit memory corruption in WebSocket handling. Researchers at Onapsis developed a working exploit demonstrating full remote code execution without credentials.
A third vulnerability, CVE-2026-89103, dubbed ProxyGate, could allow attackers to bypass network restrictions and execute commands with elevated privileges.
All three vulnerabilities carry the maximum CVSS score of 10.0. SAP has released patches as part of its November security update and is urging administrators to apply them immediately.
Source: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
Need API access? darkwebinformer.com/api-details
Check out the Telegram channel: t.me/SliceForLifeee
SAP has disclosed four major security vulnerabilities affecting SAP NetWeaver and Web Dispatcher, featuring maximum CVSS severity scores.
The issues include CVE-2026-120017 in SAML 2.0 allowing unauthorized impersonation, memory corruption and code execution flaws in CVE-2026-76964 and CVE-2026-89126, and a gateway server spoofing risk in CVE-2026-89103.
These flaws can be exploited without prior authentication.
System administr…