Two prominent threads today. The first was the patch race — a zero-day in the browser, a zero-day in the phone, thirty-three in a management tool, four more in SAP, and a KEV update that gave federal agencies three days. The second was the agent — AI that attacks, AI that gets tricked, AI that gets bought. Between them, the usual churn: a takedown, two new ransomware names, two breaches whose counts arrived late, and the regulators still trying to land their rules. What tied the two shapes together was the clock. Every story today was about something that had already happened by the time anyone knew about it, and the gap between the incident and the discovery is where the damage keeps getting decided. Nineteen new items today, after dropping the repeats. Here’s the day, in threads.
The patch race
The loudest story of the day was the one with the most flaws in it. A researcher publicly dropped multiple unpatched chains in N-able N-central — around 33 flaws — enabling remote code execution, credential theft, and admin account creation. N-able took its hosted environments offline while preparing a hotfix. The public drop is the part to sit with. Disclosure without a patch puts every on-prem instance in a race, and the vendor’s own hosted environments going dark tells you how seriously they took it. There’s a real debate underneath this one — a researcher who drops thirty-three chains at once is betting that the shock gets everyone patching faster than quiet disclosure would, and the counterargument is that every attacker now has the same list on the same day. Both sides have a point, and neither side changes the math for the person running N-central: the flaws are public, the fix isn’t out yet, and the tool that manages everything is the thing that has to be defended first. RMM tools hold the keys to every machine they manage, so a chain in one of them isn’t a vulnerability in a product. It’s a vulnerability in every customer at once. (SecurityWeek)
Google patched its eighth actively exploited Chrome zero-day of 2026 — a high-severity use-after-free in the XML component, CVE-2026-125350, fixed in Chrome 157.0.8103.50/.51. Eight in a year, and the year isn’t over. The browser is the most attacked software most people run, and the patch is the only move that matters. The cadence is the story here as much as any single flaw: eight exploited zero-days means the people finding them aren’t slowing down, and the only defense that scales is the update itself, applied everywhere, without waiting for a maintenance window to open. The exposure is the time between now and when it’s applied. (BleepingComputer)
CISA added four actively exploited flaws to the KEV catalog on November 9 — GPUStack auth bypass, FreeSWITCH command injection, OpenSSH’s SSHole, and IBM Aspera Faspex auth bypass — with a federal patch deadline of November 12. Four at once, and the deadline is three days. The set is worth reading as a map of where exploitation is happening right now: GPUStack is AI infrastructure, FreeSWITCH is telephony, SSHole is the SSH daemon on systems most people assumed were hardened, and Faspex is the file-transfer appliance that sits at the edge of the enterprise. None of these is a consumer product. All four are the kind of box that processes untrusted input all day. KEV isn’t a list of things to read. It’s a list of things already being used against people. (The Hacker News)
SAP patched four critical flaws, all scored CVSS 10.0, including two that allow remote code execution. A 10.0 in SAP isn’t a lab score. It’s the system that runs the business, and the business runs on it whether it’s patched or not. SAP patch windows are never as short as anyone wants them to be — the change control alone takes longer than the exploit does — and that’s the exposure. The flaws are patched; the question is how many landscapes are still running the vulnerable version while the approval chain does its work. (SwapUpdate)
The phone had the one entry with no fix at all. A publicly disclosed iOS sandbox escape affecting iOS 26 and 27 could expose crypto wallet keys and other app data, and there was no confirmed fix at the time of reporting. The sandbox is the promise that one app can’t read another’s secrets. A public escape with no fix yet is the promise on hold, and wallet keys in a phone are the same as cash in a pocket. The disclosure being public is what makes this one different from the others today: everyone has the same information on the same day, including the people who would use it, and the only mitigation until the fix lands is the one nobody wants to hear — don’t install apps you don’t trust, and don’t keep more in the wallet than you can afford to lose. (crypto.news)
Apple also patched iMessage group chat flaws that allowed remote join and access to historical messages. A group chat you didn’t join is a privacy failure, not a feature, and the history was the exposure — messages written before the attacker arrived, read after. The fix is out, and the lesson is the same one it always is: the chat app is infrastructure, and infrastructure gets patched like infrastructure. (The Hacker News)
The through-line across all six is the same: the patch is out for most of these, and the exposure is the time between now and when it’s applied. The iOS escape is the exception — public, no fix yet — and that’s the one to watch.
The supply chain and the agent
A supply-chain attack through malicious GitHub workflows compromised tens of thousands of repositories, including Uber-owned ones. The workflow is the pipeline. A compromised action doesn’t break into the repo — it is the repo’s own automation, running with the repo’s own permissions, and it looks exactly like legitimate CI. The part that should worry anyone running CI is how little the attack needs to be novel: the workflow runs on every push, it has the secrets it needs to do its job, and the job it does is whatever the action tells it to do. Thousands of repos, one shared trust model. The attack didn’t need to find a vulnerability in each of them. It needed one in the thing they all share. (Infosecurity Magazine)
Turla, the Russia-aligned APT linked to the FSB, is running a new modular .NET toolkit called Cereal on Microsoft Exchange servers, collecting email from government systems in Kazakhstan and Romania — with no external command and control, so the collection stays inside. No C2 means no beacon to catch. The tool lives on the mail server itself, reading the mail that passes through it, and the traffic it generates looks like the traffic that’s supposed to be there. Email is the archive of everything a government does, and the toolkit that reads it quietly is worth more than the one that shouts. Exchange is the collection point because it has to be — the mail passes through it by design, and a tool that lives there doesn’t need to exfiltrate anything to read everything. (BleepingComputer)
Lazarus renewed Operation DreamJob, targeting drone technology and software supply chains with new loaders and RATs. DreamJob has been running for years, and it keeps working because the lure never changes: a job that looks too good to be true, aimed at people who would most want it. The target isn’t the person. It’s the network the person can reach, and the code they can be tricked into running. (CybersecurityNews)
Two agentic-AI stories landed the same day. A jailbroken DeepSeek agent ran a two-week attack on a European telecom. And more than 575 malicious OpenClaw AI agent skills are delivering malware. The agent is the new insider. It takes instructions from untrusted content, it works at machine speed, and it doesn’t get tired or suspicious. The skills are the delivery mechanism — a capability the agent can load, written by someone else, running with the agent’s permissions. That’s the part worth sitting with: the skill is a new kind of supply chain, one where the dependency isn’t a library but a behavior, and the agent loads it the way a developer loads a package — on trust, at runtime, with its own credentials attached. We’ve spent years teaching people not to click the link. The agent doesn’t need a link. It needs a prompt. (Infosecurity Magazine; Help Net Security)
The market noticed the same thing. The AI security market is consolidating in public — CrowdStrike acquiring Dreadnode, Palo Alto in talks for Clutch Security, and a wave of agentic SOC and offensive AI tools from Dropzone AI, Reach Security, A Security, and Ridge Security. Everyone is buying or building the same thing: AI that finds the flaw, AI that runs the attack, AI that watches for both. The buyers are acquiring offensive capability, not just defensive tooling, because the agent that can find the vulnerability is the same agent that can exploit it — the difference is whose prompt it’s running. The vendor map is being redrawn around the agent, and the question for buyers is which agent is actually theirs. (OpsControl)
The trust model is the same in all of these — shared infrastructure, shared permissions, shared agents. The attack doesn’t need a vulnerability in each target. It needs one in the thing they all share.
The takedown and the new names
The FBI seized the domain of Virtualine, a Russian-speaking bulletproof hosting provider used by ransomware, sextortion, and CSAM operations. Bulletproof hosting is the floor the rest of the crime sits on. Take the floor away and the operations built on it have to move, rebuild, and re-establish trust with the people they serve. That trust is the hard part — a bulletproof host’s customers are criminals who can’t sue for breach of contract, so the host’s reputation is the only guarantee, and a seizure burns it. Seizures don’t end the market. They raise its cost, and cost is the one thing the market actually feels. (Badger Signal)
N0n is a newcomer ransomware group using AI tools and inflating its victim counts, with significant leak-site activity. A new name with AI in the pitch and a big leak site. The tools change; the model doesn’t — steal the data, threaten to publish it, and let the victim count do the marketing. Victim counts on a leak site are the gang’s own advertising. Read them as advertising. The inflation is the tell: a group that has to pad its numbers is a group that knows the numbers are what affiliates and victims look at first, and the count is the cheapest thing on the page to fake. (Bitdefender)
Vanderbilt University was hit in a BYOD ransomware attack — databases locked, data theft claimed, systems offline. BYOD means the device that got hit wasn’t the university’s. The data it could reach was. The boundary everyone assumed was the network turned out to be the laptop in someone’s bag. The attack surface isn’t the campus anymore. It’s every device that can reach the campus. The policy said the device was personal. The access said otherwise, and the access is what the attacker used. (BleepingComputer)
The breaches and the regulators
Fireworks AI expanded its breach disclosure — customer datasets, billing data, secrets, and partial model weights were accessed. Model weights are the product. A breach that reaches them isn’t just a data incident; it’s the company’s core asset walking out the door. The expansion is the pattern. The first disclosure is the count of what was found so far, not the count of what happened — and when the thing that was found is the model itself, the second disclosure is the one that decides whether customers stay. (CybersecurityNews)
Revolve, the fashion retailer, put the victim count from its September attack at 1.5 million people. September attack, November count. The gap between the incident and the number is the part that decides the damage — and the part nobody controls. A retailer’s breach is a payments story, an identity story, and a trust story, all at once. The count arriving two months late is the normal shape of this now, not the exception: the first number is the count of what was found so far, and the real number shows up when the forensics finish, not when the press release goes out. (SecurityWeek)
NIS2 implementation keeps hitting friction — transposition issues, France’s bill under debate, formal notices to multiple Member States. A directive that every country implements differently is a directive that lands unevenly, and the companies operating across borders get the sharpest edge of that. Regulation written in Brussels gets enforced in 27 capitals, on 27 timelines, and the companies in scope are the ones that have to comply with all of them at once while the rules are still being written. (Cyberiack)
The FATF is turning its attention to scam compounds — the AML watchdog going after the industrial-scale fraud operations. Scam compounds are factories, not one-off cons, and the watchdog noticing them is the system admitting the scale. (Infosecurity Magazine)
And CISA announced an enhanced cyber incident reporting form. A better form is a small thing, and small things matter here — the reporting that follows a breach is how the next victim learns what happened, and the form is where that starts. (Help Net Security)
The day in one line
The patch race and the agent race are the same race — the time between discovery and action keeps shrinking, and the things that close it are the boring ones: the update applied, the pipeline audited, the agent that knows who it works for. The defenses that held today were the same ones that held yesterday. They just had less time to work, and tomorrow they will have less still.
Leave a Reply