Cybersecurity briefing, 2026-11-12

Apple has patched ten vulnerabilities across its platforms, including flaws that weakened Bluetooth and AirPlay pairing.

• GPUStack's localhost spoofing skips authentication on exposed managers
• ScreenConnect malware spreads through technicians’ support sessions
• GitHub account hijacks put CI secrets at risk
• Cairn scales tailored intrusions across 19 organizations
• Fireworks AI breach reaches customer billing and model assets
• eMudhra revokes eight more CAs after key-transfer failure
• Quay signing flaw lets attackers mint registry-wide tokens
• Turla uses government Exchange servers to command and steal mail
• XWEB EVO configuration flaw exploited within 100 minutes
• Railway breach may expose workspace secrets beyond AI charges
• PHP2Shell chain leaves Check Point gateways with root footholds
• Xen Orchestra flaws expose pools and XCP-ng hosts
• PHP and Node.js runtime flaws put every app at risk
• Apple patches pairing flaws, but Brotli remains elsewhere
• Microsoft 365 outage hit email and security visibility
• GSocket keeps Linux server access alive after patching
• Silent Lynx used one rail account to reach government files
• Maersk confirms legacy-system theft as WhiteArmor’s haul remains unverified
• Microsoft model backdoor can steer agents to run commands
• Grok Build share links exposed data from 35,000 apps

Recent editions

• Wednesday, November 11, 2026: Apple patches pairing flaws, but Brotli remains elsewhere · 20 stories
• Tuesday, November 10, 2026: N-able N-central returns online with remote control paused · 20 stories
• Monday, November 9, 2026: SAP NetWeaver flaw fuels webshell planting and searches · 19 stories
• Sunday, November 8, 2026: CISA widens the SSHole story to four exploited flaws · 3 stories
• Saturday, November 7, 2026: GPT-6 Cyber’s exploit gains test its guardrails · 13 stories
• Friday, November 6, 2026: CISA widens the SSHole story to four exploited flaws · 19 stories
• Thursday, November 5, 2026: APT29's Plerdy tracker compromise reached hundreds of sites · 20 stories