# Today's Top Stories

Microsoft's November 2026 Patch Tuesday set a new record with 1,235 security fixes, including an actively exploited zero-day in Microsoft Outlook (CVE-2026-124194). The release covers critical flaws across Windows, Exchange, SharePoint, LDAP, and Windows Search, making this the second consecutive month exceeding 1,000 CVEs. Security teams should prioritize the Outlook zero-day and critical Exchange/SharePoint bugs for immediate patching.

France's government officially attributed an October cyberattack on refrigeration controllers at approximately 700 French retail sites to Shahid Kaveh, an IRGC cyber unit previously linked to attacks on U.S. water utility industrial controllers. Attackers broke into controllers on the night of October 11, changed defrost settings to high temperatures, causing food losses and fires at at least 15 locations. France summoned the Iranian ambassador and announced plans to pursue European sanctions against those responsible.

N-able took its N-central Hosted Environments entirely offline and urged on-premises customers to shut down their servers after a researcher publicly disclosed 33 zero-day vulnerabilities (collectively tracked as Able2Shell) with proof-of-concept exploits. The flaws enable remote code execution, credential theft, and administrator account creation. The scale of the PoC disclosure and the severity of the vulnerabilities forced an emergency shutdown of a widely-used managed service provider platform.

Russia-linked Turla (aka Snake) has deployed a previously undocumented toolset called 'Cereal' to compromise Microsoft Exchange servers at government organizations in Kazakhstan and Romania, silently exfiltrating emails. Per a new ESET report, Cereal features a novel Exchange email collection module, a unique C2 mechanism, and sophisticated .NET execution tricks with minimal indicators of compromise. The targeting of NATO and EU correspondence via government email infrastructure represents a significant ongoing espionage operation.

A decade-old vulnerability in OpenSSH combined with the musl C library, dubbed '*sshole,' allows attackers to authenticate to affected accounts — including those configured to block password authentication — simply by submitting a password longer than 256 bytes. The flaw impacts Alpine Linux and other musl-based Linux distributions and is under active exploitation. CISA has added the OpenSSH flaw to its Known Exploited Vulnerabilities catalog, urging immediate patching.

SAP's November 2026 Security Patch Day addressed four CVSS 10.0 (maximum severity) vulnerabilities, all exploitable without authentication. Three flaws reside in the SAP NetWeaver application server and one in the Web Dispatcher; at least two enable remote code execution. Organizations running SAP NetWeaver or Web Dispatcher should treat these as emergency patches given the perfect severity scores and unauthenticated attack surface.

A critical authentication bypass vulnerability (VSA-2026-062) in Xen Orchestra — tracked by vendor Vates VMS — is being actively exploited in the wild, allowing attackers to gain administrator access to XCP-ng virtualization hosts. The flaw stems from improper REST cookie parsing where an authenticationToken is converted to an empty object, bypassing authentication entirely. Exploitation could grant full control over VM infrastructure, making immediate patching urgent for any Xen Orchestra deployment.

Google released an emergency Chrome update patching CVE-2026-125350, a high-severity use-after-free bug in Chrome's XML component reported anonymously on November 6 and already under active exploitation. This marks the eighth Chrome zero-day exploited in attacks in 2026 alone. All Chrome users should update immediately as the exploit is confirmed in-the-wild.

Japanese furniture giant Nitori disclosed that an attacker accessed its network and may have stolen 37.62 million customer records, making it one of the largest retail data breaches of 2026. The breach affects a major consumer brand with significant personal data exposure at scale. Nitori has begun notifying affected customers as investigation continues.

A newly disclosed vulnerability in Git (CVE-2026-111760) allows a malicious repository to execute attacker-controlled code on a machine that recursively clones it with submodules, exploiting an integer truncation flaw in Git's index handling. Fixes are available in Git 2.56.1 and backported to versions 2.50.2 through 2.55.1. Any developer or CI/CD pipeline performing recursive git clones should update immediately, as this is a supply chain-relevant code execution risk.