# Today's Top Stories

Microsoft's November 2026 Patch Tuesday addressed 1,259 vulnerabilities — the second consecutive month exceeding 1,000 fixes — including 726 Windows flaws, 174 Office bugs, and an actively exploited Outlook zero-day (CVE-2026-124194) that can expose NTLMv2 hashes. The patch volume, combined with critical Exchange, SharePoint, and LDAP bugs, makes this an urgent prioritization challenge for defenders managing large Windows estates.

Krebs on Security investigates the administrator of Qilin ransomware, identified as a 36-year-old man living in St. Petersburg, Russia, whose operational security mistakes over the past decade exposed his identity. Qilin has become the world's most active ransomware affiliate program, claiming at least 365 victim organizations in just the past three months, making threat-actor attribution here directly actionable for incident responders and law enforcement.

ConnectWise is investigating an active malware campaign in which compromised ScreenConnect environments were used to push rogue remote-access clients to customer devices across at least 288 endpoints in 48 organizations. As a precaution, ConnectWise disabled five third-party extensions in partner environments; MSPs relying on ScreenConnect should audit connected clients and third-party integrations immediately.

Microsoft researchers demonstrated that an AI model can be covertly backdoored by modifying fewer than 10 rarely activated neurons — without retraining — causing the model to execute attacker-specified commands when a hidden trigger is present. The technique requires write access to model weights and was tested on production-scale models, posing a novel supply-chain threat for organizations deploying third-party AI models in agentic workflows.

CISA added two actively exploited vulnerabilities to its KEV catalog: CVE-2026-20320 (CVSS 7.5), an XXE flaw in Cisco BroadWorks, and CVE-2026-111793 in Openwave Messaging Webtop Media Transcoder, both allowing sensitive configuration data leakage. Federal agencies have a mandatory remediation deadline, and organizations running either platform should apply available patches without delay.

A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited, granting attackers administrator privileges and enabling full takeover of XCP-ng virtualization hosts. Organizations running Xen Orchestra for VM management should treat this as an emergency patch, as successful exploitation allows arbitrary code execution as admin and lateral movement to underlying hypervisor nodes.

Fortinet released patches covering nearly 100 vulnerabilities across its product line in a single drop, attributing the unusually high volume to the integration of frontier AI models into its internal product security testing pipeline. Security teams running FortiGate, FortiManager, or other Fortinet products should review the advisory set and prioritize any critical or remotely exploitable findings immediately.

Check Point Research linked three China-nexus espionage clusters — SilentDelivery and two others — through shared infrastructure and the Sparrow malware ecosystem, targeting telecoms, government, military, and critical infrastructure across Latin America, Asia, and Europe over the past year. The shared codebase and infrastructure provide detection pivot points for defenders in affected sectors looking to identify related intrusion activity.

Certificate authority eMudhra revoked eight additional intermediate CA certificates following an investigation that found improper private key handling in an in-house Python script used during certificate generation, expanding on an October incident. While the newly revoked CAs did not have weakened keys, the procedural failures raise compliance concerns for organizations relying on eMudhra-issued certificates and PKI trust chains.

Cloud platform Railway disclosed that an October 2026 breach allowed attackers to steal customer-stored API keys and authentication secrets, resulting in approximately $740,000 in unauthorized AI provider charges across potentially up to 100,000 workspaces. Railway has committed to covering unreimbursed charges, but the incident underscores the risk of storing third-party API credentials in PaaS environments without secrets management controls.