# Archive
Browse past daily curated stories
Thursday, November 12, 2026
-
1The Hacker News generalMicrosoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes
Microsoft's November 2026 Patch Tuesday addressed 1,259 vulnerabilities — the second consecutive month exceeding 1,000 fixes — including 726 Windows flaws, 174 Office bugs, and an actively exploited Outlook zero-day (CVE-2026-124194) that can expose NTLMv2 hashes. The patch volume, combined with critical Exchange, SharePoint, and LDAP bugs, makes this an urgent prioritization challenge for defenders managing large Windows estates.
-
2Krebs on Security threat-intelWho Runs the Ransomware Group Qilin?
Krebs on Security investigates the administrator of Qilin ransomware, identified as a 36-year-old man living in St. Petersburg, Russia, whose operational security mistakes over the past decade exposed his identity. Qilin has become the world's most active ransomware affiliate program, claiming at least 365 victim organizations in just the past three months, making threat-actor attribution here directly actionable for incident responders and law enforcement.
-
3BleepingComputer generalActive ScreenConnect attacks breach MSPs, impact dozens of organizations
ConnectWise is investigating an active malware campaign in which compromised ScreenConnect environments were used to push rogue remote-access clients to customer devices across at least 288 endpoints in 48 organizations. As a precaution, ConnectWise disabled five third-party extensions in partner environments; MSPs relying on ScreenConnect should audit connected clients and third-party integrations immediately.
-
4The Hacker News generalMicrosoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons
Microsoft researchers demonstrated that an AI model can be covertly backdoored by modifying fewer than 10 rarely activated neurons — without retraining — causing the model to execute attacker-specified commands when a hidden trigger is present. The technique requires write access to model weights and was tested on production-scale models, posing a novel supply-chain threat for organizations deploying third-party AI models in agentic workflows.
-
5The Hacker News generalCisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches
CISA added two actively exploited vulnerabilities to its KEV catalog: CVE-2026-20320 (CVSS 7.5), an XXE flaw in Cisco BroadWorks, and CVE-2026-111793 in Openwave Messaging Webtop Media Transcoder, both allowing sensitive configuration data leakage. Federal agencies have a mandatory remediation deadline, and organizations running either platform should apply available patches without delay.
-
6BleepingComputer generalCritical Xen Orchestra auth bypass flaw exploited to hijack VM servers
A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited, granting attackers administrator privileges and enabling full takeover of XCP-ng virtualization hosts. Organizations running Xen Orchestra for VM management should treat this as an emergency patch, as successful exploitation allows arbitrary code execution as admin and lateral movement to underlying hypervisor nodes.
-
7SecurityWeek generalFortinet Patches Nearly 100 Vulnerabilities
Fortinet released patches covering nearly 100 vulnerabilities across its product line in a single drop, attributing the unusually high volume to the integration of frontier AI models into its internal product security testing pipeline. Security teams running FortiGate, FortiManager, or other Fortinet products should review the advisory set and prioritize any critical or remotely exploitable findings immediately.
-
8The Hacker News generalThree China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem
Check Point Research linked three China-nexus espionage clusters — SilentDelivery and two others — through shared infrastructure and the Sparrow malware ecosystem, targeting telecoms, government, military, and critical infrastructure across Latin America, Asia, and Europe over the past year. The shared codebase and infrastructure provide detection pivot points for defenders in affected sectors looking to identify related intrusion activity.
-
9The Hacker News generaleMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise
Certificate authority eMudhra revoked eight additional intermediate CA certificates following an investigation that found improper private key handling in an in-house Python script used during certificate generation, expanding on an October incident. While the newly revoked CAs did not have weakened keys, the procedural failures raise compliance concerns for organizations relying on eMudhra-issued certificates and PKI trust chains.
-
10The Hacker News generalRailway Says Stolen Customer AI Keys Led to $740,000 in Estimated Unauthorized Usage Charges
Cloud platform Railway disclosed that an October 2026 breach allowed attackers to steal customer-stored API keys and authentication secrets, resulting in approximately $740,000 in unauthorized AI provider charges across potentially up to 100,000 workspaces. Railway has committed to covering unreimbursed charges, but the incident underscores the risk of storing third-party API credentials in PaaS environments without secrets management controls.