Cybersecurity briefing, 2026-11-11

Google says Chrome is under active exploitation for an XML flaw fixed in Chrome 157.

• Apple patches pairing flaws, but Brotli remains elsewhere
• Chrome’s eighth exploited zero-day reaches users through webpages
• AhsayCBS attackers query Veeam credentials after compromise
• Turla uses government Exchange servers to command and steal mail
• Microsoft model backdoor can steer agents to run commands
• eMudhra revokes eight more CAs after key-transfer failure
• N-able N-central returns online with remote control paused
• Greeter attackers use Flowise to pursue cloud access
• ARTEX testing agent escaped isolation into WorkOS data
• Qubole breach reached customer secrets beyond stale AWS roles
• IIS web shells carried AntiFox-linked attacks into AWS
• FBI and CISA warn refrigeration attacks could threaten food safety
• Ivanti Endpoint Manager SQL flaw puts Core at code-execution risk
• GSocket keeps Linux server access alive after patching
• ShinyHunters’ Binance leak claim may fuel phishing
• Cisco BroadWorks flaw exploited to read configuration
• Barracuda ESG flaws now exploited for root access
• CopperDragon may supply tools across separate espionage groups
• Grok Build share links exposed data from 35,000 apps
• Fireworks AI breach reaches customer billing and model assets

Recent editions

• Tuesday, November 10, 2026: N-able N-central returns online with remote control paused · 20 stories
• Monday, November 9, 2026: SAP NetWeaver flaw fuels webshell planting and searches · 19 stories
• Sunday, November 8, 2026: CISA widens the SSHole story to four exploited flaws · 3 stories
• Saturday, November 7, 2026: GPT-6 Cyber’s exploit gains test its guardrails · 13 stories
• Friday, November 6, 2026: CISA widens the SSHole story to four exploited flaws · 19 stories
• Thursday, November 5, 2026: APT29's Plerdy tracker compromise reached hundreds of sites · 20 stories
• Wednesday, November 4, 2026: WordPress upgrade window opens a path to server code · 19 stories