🔍 Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
Microsoft’s November 2026 Patch Tuesday addresses a record 1,235 vulnerabilities, including an actively exploited zero-day affecting Outlook. The release marks one of the largest monthly security update batches on record and puts immediate focus on email client exposure inside enterprise environments.
The combination of volume and active exploitation raises patch-management pressure across Windows estates. Outlook’s role as a daily access point makes the zero-day operationally significant, while the scale of fixes increases the likelihood of missed remediation, delayed testing, and a wider short-term attack surface.
🛰️ Open sources - closed narratives
@sitreports
Microsoft’s November 2026 Patch Tuesday addresses a record 1,235 vulnerabilities, including an actively exploited zero-day affecting Outlook. The release marks one of the largest monthly security update batches on record and puts immediate focus on email client exposure inside enterprise environments.
The combination of volume and active exploitation raises patch-management pressure across Windows estates. Outlook’s role as a daily access point makes the zero-day operationally significant, while the scale of fixes increases the likelihood of missed remediation, delayed testing, and a wider short-term attack surface.
🛰️ Open sources - closed narratives
@sitreports
🔍 Trusted AWS cross-account roles abused in multi-tenant cloud breach
Attackers used compromised IAM credentials linked to Qubole’s AWS account to access multiple customer environments from October 14 to 26. Investigators said the actor assumed dormant cross-account roles, enumerated S3 access, pulled secrets from Secrets Manager and SSM Parameter Store, read Lambda environment variables, validated credentials with TruffleHog, and exfiltrated data from reachable buckets. Qubole-trusted roles were the entry point.
The case underscores the risk of stale third-party trust relationships. AWS was not breached, but inherited access from an external provider exposed downstream tenants at scale.
🛰️ Open sources - closed narratives
@sitreports
Attackers used compromised IAM credentials linked to Qubole’s AWS account to access multiple customer environments from October 14 to 26. Investigators said the actor assumed dormant cross-account roles, enumerated S3 access, pulled secrets from Secrets Manager and SSM Parameter Store, read Lambda environment variables, validated credentials with TruffleHog, and exfiltrated data from reachable buckets. Qubole-trusted roles were the entry point.
The case underscores the risk of stale third-party trust relationships. AWS was not breached, but inherited access from an external provider exposed downstream tenants at scale.
🛰️ Open sources - closed narratives
@sitreports
🔍 CISA expands KEV with four newly listed flaws
U.S. CISA added GPUStack, SignalWire FreeSWITCH, OpenSSH, and IBM Aspera Faspex vulnerabilities to its Known Exploited Vulnerabilities catalog. The entries cover improper authentication, code injection, authentication bypass, and incorrect authorization issues. CISA set November 12, 2026 as the remediation deadline for federal agencies.
The set is operationally notable for its breadth: AI infrastructure, VoIP, remote access, and managed file transfer in one update. Three entries are explicitly tied to observed exploitation, while the IBM Aspera Faspex flaw was listed without public confirmation of in-the-wild abuse in the provided reporting.
🛰️ Open sources - closed narratives
@sitreports
U.S. CISA added GPUStack, SignalWire FreeSWITCH, OpenSSH, and IBM Aspera Faspex vulnerabilities to its Known Exploited Vulnerabilities catalog. The entries cover improper authentication, code injection, authentication bypass, and incorrect authorization issues. CISA set November 12, 2026 as the remediation deadline for federal agencies.
The set is operationally notable for its breadth: AI infrastructure, VoIP, remote access, and managed file transfer in one update. Three entries are explicitly tied to observed exploitation, while the IBM Aspera Faspex flaw was listed without public confirmation of in-the-wild abuse in the provided reporting.
🛰️ Open sources - closed narratives
@sitreports
🔍 Barracuda ESG flaws chained in active exploitation
Barracuda says attackers are exploiting two patched vulnerabilities in its Email Security Gateway: CVE-2026-116606, a pre-auth authorization bypass rated 9.3, and CVE-2026-111560, an 8.6 command-injection bug affecting multiple products. In a security advisory, the company said a small number of organizations were affected and confirmed remediation support.
The chain matters because it can turn internet-exposed admin access into root-level command execution on an edge email appliance. For defenders, the immediate priorities are patch status and whether ESG administrative interfaces remain reachable from the public internet.
🛰️ Open sources - closed narratives
@sitreports
Barracuda says attackers are exploiting two patched vulnerabilities in its Email Security Gateway: CVE-2026-116606, a pre-auth authorization bypass rated 9.3, and CVE-2026-111560, an 8.6 command-injection bug affecting multiple products. In a security advisory, the company said a small number of organizations were affected and confirmed remediation support.
The chain matters because it can turn internet-exposed admin access into root-level command execution on an edge email appliance. For defenders, the immediate priorities are patch status and whether ESG administrative interfaces remain reachable from the public internet.
🛰️ Open sources - closed narratives
@sitreports
🔍 Critical Xen Orchestra flaw used for admin access, enabling XCP-ng root takeover
Attackers are exploiting a critical authentication bypass in Xen Orchestra to gain administrative access. The issue affects management of XCP-ng environments and can allow a full root-level compromise of the host once the control plane is breached.
This is operationally significant because Xen Orchestra sits at the virtualization management layer. A successful admin takeover does not stay confined to one workload; it can translate into host-level control, broad visibility across managed infrastructure, and rapid impact on multiple virtual machines.
🛰️ Open sources - closed narratives
@sitreports
Attackers are exploiting a critical authentication bypass in Xen Orchestra to gain administrative access. The issue affects management of XCP-ng environments and can allow a full root-level compromise of the host once the control plane is breached.
This is operationally significant because Xen Orchestra sits at the virtualization management layer. A successful admin takeover does not stay confined to one workload; it can translate into host-level control, broad visibility across managed infrastructure, and rapid impact on multiple virtual machines.
🛰️ Open sources - closed narratives
@sitreports
🔍 Git fixes code-execution bug in recursive clones
Git has patched a flaw that allows a malicious repository to trigger code execution during recursive clone operations. The issue affects workflows where submodules are fetched automatically, turning a standard developer action into an execution path. Details were outlined in the Git patch advisory released on 10 November.
The security impact is significant because recursive cloning is common in CI/CD, build pipelines, and developer onboarding. A repository-level exploit path lowers the barrier for initial access and makes supply-chain trust assumptions around submodules harder to maintain.
🛰️ Open sources - closed narratives
@sitreports
Git has patched a flaw that allows a malicious repository to trigger code execution during recursive clone operations. The issue affects workflows where submodules are fetched automatically, turning a standard developer action into an execution path. Details were outlined in the Git patch advisory released on 10 November.
The security impact is significant because recursive cloning is common in CI/CD, build pipelines, and developer onboarding. A repository-level exploit path lowers the barrier for initial access and makes supply-chain trust assumptions around submodules harder to maintain.
🛰️ Open sources - closed narratives
@sitreports
🔍 SGLang RCE Exposure Hits NEAR AI
NEAR AI disclosed a breach tied to an SGLang remote code execution flaw that exposed data from 18 agents and about 100 users. The incident involved unauthorized access to AI-linked systems and data theft through the SGLang RCE flaw.
The case underlines how exploitable components in AI application stacks can create a direct path from model-serving infrastructure to user and agent data. The scale appears limited, but the intrusion shows that a single runtime weakness can bridge backend execution and operational datasets.
🛰️ Open sources - closed narratives
@sitreports
NEAR AI disclosed a breach tied to an SGLang remote code execution flaw that exposed data from 18 agents and about 100 users. The incident involved unauthorized access to AI-linked systems and data theft through the SGLang RCE flaw.
The case underlines how exploitable components in AI application stacks can create a direct path from model-serving infrastructure to user and agent data. The scale appears limited, but the intrusion shows that a single runtime weakness can bridge backend execution and operational datasets.
🛰️ Open sources - closed narratives
@sitreports
🔍 German military bans commercially available Chinese drones
Germany’s military has reportedly imposed an immediate ban on commercially available Chinese-made drones at barracks and training grounds, with Der Spiegel citing security concerns. The measure applies to off-the-shelf systems rather than bespoke military platforms.
The move reflects a force-protection and counterintelligence posture around training areas, where routine drone use can expose patterns, layouts, and operational procedures. It also signals tightening scrutiny of low-cost foreign-made UAVs inside military infrastructure.
🛰️ Open sources - closed narratives
@sitreports
Germany’s military has reportedly imposed an immediate ban on commercially available Chinese-made drones at barracks and training grounds, with Der Spiegel citing security concerns. The measure applies to off-the-shelf systems rather than bespoke military platforms.
The move reflects a force-protection and counterintelligence posture around training areas, where routine drone use can expose patterns, layouts, and operational procedures. It also signals tightening scrutiny of low-cost foreign-made UAVs inside military infrastructure.
🛰️ Open sources - closed narratives
@sitreports
📄 Hegseth reissues counter-drone memo with legal chain corrected
Defense Secretary Pete Hegseth issued a corrected copy of a Nov. 5 counter-drone memorandum directing Pentagon components to log any delay or denial in employing C-UAS tools as a “risk of inaction” and report cases to JIATF-401. The update removes references to a Deputy General Counsel for DRPM Programs and reroutes completed legal reviews through JIATF-401’s legal advisor.
The change does not alter the memo’s core intent to compress approval timelines for counter-UAS procurement and fielding. It does clarify who handles legal coordination inside the emerging Pentagon drone enterprise, reducing ambiguity around authority as JIATF-401 remains the central operational node.
🛰️ Open sources - closed narratives
@sitreports
Defense Secretary Pete Hegseth issued a corrected copy of a Nov. 5 counter-drone memorandum directing Pentagon components to log any delay or denial in employing C-UAS tools as a “risk of inaction” and report cases to JIATF-401. The update removes references to a Deputy General Counsel for DRPM Programs and reroutes completed legal reviews through JIATF-401’s legal advisor.
The change does not alter the memo’s core intent to compress approval timelines for counter-UAS procurement and fielding. It does clarify who handles legal coordination inside the emerging Pentagon drone enterprise, reducing ambiguity around authority as JIATF-401 remains the central operational node.
🛰️ Open sources - closed narratives
@sitreports
📡 Active ScreenConnect campaign hits MSP environments
ConnectWise and Huntress are tracking an active intrusion set abusing compromised ScreenConnect environments to push rogue remote-access clients onto customer devices. Huntress has identified 6 compromised MSPs, 286 affected endpoints, and impact across 47 organizations, while ConnectWise disabled five third-party ScreenConnect extensions in roughly 400 partner environments as a containment step.
The key point is tradecraft, not a confirmed software flaw: operators are using legitimate ScreenConnect functions, including Run Command, to establish parallel remote access and potentially compromise technician workstations during live sessions. Disabling the extensions does not remove persistence or unauthorized access already deployed.
🛰️ Open sources - closed narratives
@sitreports
ConnectWise and Huntress are tracking an active intrusion set abusing compromised ScreenConnect environments to push rogue remote-access clients onto customer devices. Huntress has identified 6 compromised MSPs, 286 affected endpoints, and impact across 47 organizations, while ConnectWise disabled five third-party ScreenConnect extensions in roughly 400 partner environments as a containment step.
The key point is tradecraft, not a confirmed software flaw: operators are using legitimate ScreenConnect functions, including Run Command, to establish parallel remote access and potentially compromise technician workstations during live sessions. Disabling the extensions does not remove persistence or unauthorized access already deployed.
🛰️ Open sources - closed narratives
@sitreports
🤖 AntiFox AI agents tied to AWS credential theft
Attackers are using Alibaba Cloud-hosted instances of AntiFox, an open-source agentic pentesting platform, in intrusions targeting web services and AWS environments. Observed activity included webshell deployment on exposed IIS servers, credential validation, configuration discovery, AWS API abuse with valid IAM users and EC2 roles, and in some cases access to production secrets and S3 objects.
The reporting shows AI-enabled offensive tooling being operationalized as an intrusion workflow layer rather than a standalone capability. The key signal is the pairing of web compromise with short bursts of authenticated AWS API activity, including repeated denied calls mixed with successful access using compromised application-held credentials.
🛰️ Open sources - closed narratives
@sitreports
Attackers are using Alibaba Cloud-hosted instances of AntiFox, an open-source agentic pentesting platform, in intrusions targeting web services and AWS environments. Observed activity included webshell deployment on exposed IIS servers, credential validation, configuration discovery, AWS API abuse with valid IAM users and EC2 roles, and in some cases access to production secrets and S3 objects.
The reporting shows AI-enabled offensive tooling being operationalized as an intrusion workflow layer rather than a standalone capability. The key signal is the pairing of web compromise with short bursts of authenticated AWS API activity, including repeated denied calls mixed with successful access using compromised application-held credentials.
🛰️ Open sources - closed narratives
@sitreports
🔍 eBPF Rootkits Move From Research to Underground Tradecraft
A sponsored eBPF rootkits write-up highlights forum tutorials and shared code for Linux implants using kernel-supported BPF interfaces instead of loadable kernel modules. Documented techniques include process hiding via getdents64 hooks, packet-triggered activation, XDP-based traffic inspection, and filtering tied to antivirus-linked IP lists.
Operationally, this matters because eBPF abuse blends into legitimate kernel mechanisms and can evade checks built around module loads. The article also notes prior cases such as BPFDoor and LinkPro, underscoring that these methods are no longer confined to conference demos.
🛰️ Open sources - closed narratives
@sitreports
A sponsored eBPF rootkits write-up highlights forum tutorials and shared code for Linux implants using kernel-supported BPF interfaces instead of loadable kernel modules. Documented techniques include process hiding via getdents64 hooks, packet-triggered activation, XDP-based traffic inspection, and filtering tied to antivirus-linked IP lists.
Operationally, this matters because eBPF abuse blends into legitimate kernel mechanisms and can evade checks built around module loads. The article also notes prior cases such as BPFDoor and LinkPro, underscoring that these methods are no longer confined to conference demos.
🛰️ Open sources - closed narratives
@sitreports
🔍 eMudhra revokes 8 more intermediate CA certificates
Certificate authority eMudhra revoked eight additional intermediate CA certificates after finding its 2025 key-transfer script mishandled RSA private keys outside HSM protection. The action raises the total impacted intermediates to 16, after eight earlier ECDSA keys were found reducible to a single byte in an incident report. Some revoked RSA intermediates had issued TLS and code-signing certs as recently as November 3.
The case expands from weak-key compromise to broader PKI process failure: eMudhra could not prove the RSA keys remained compliant with its own handling requirements. Browser and OS distrust actions already in place remain operationally significant because trust-chain integrity, not only key strength, was affected.
🛰️ Open sources - closed narratives
@sitreports
Certificate authority eMudhra revoked eight additional intermediate CA certificates after finding its 2025 key-transfer script mishandled RSA private keys outside HSM protection. The action raises the total impacted intermediates to 16, after eight earlier ECDSA keys were found reducible to a single byte in an incident report. Some revoked RSA intermediates had issued TLS and code-signing certs as recently as November 3.
The case expands from weak-key compromise to broader PKI process failure: eMudhra could not prove the RSA keys remained compliant with its own handling requirements. Browser and OS distrust actions already in place remain operationally significant because trust-chain integrity, not only key strength, was affected.
🛰️ Open sources - closed narratives
@sitreports
🔍 Maersk confirms breach tied to legacy logistics platform
Maersk says attackers breached systems at an acquired company and stole data from a local system linked to the former LF Logistics platform. The company says no operational disruption is expected, current evidence shows no sensitive data was disclosed, and its incident notice says APIs and EDI links were not impacted. WhiteArmor is demanding $5 million and claims to hold about 100GB of data, including driver records, mobile logs, plaintext passwords, and admin accounts.
The case underlines post-acquisition risk in legacy environments: the intrusion appears outside Maersk’s core systems, but the alleged dataset still points to supply-chain identity, logistics, and device telemetry exposure. The leverage here is data, not disruption.
🛰️ Open sources - closed narratives
@sitreports
Maersk says attackers breached systems at an acquired company and stole data from a local system linked to the former LF Logistics platform. The company says no operational disruption is expected, current evidence shows no sensitive data was disclosed, and its incident notice says APIs and EDI links were not impacted. WhiteArmor is demanding $5 million and claims to hold about 100GB of data, including driver records, mobile logs, plaintext passwords, and admin accounts.
The case underlines post-acquisition risk in legacy environments: the intrusion appears outside Maersk’s core systems, but the alleged dataset still points to supply-chain identity, logistics, and device telemetry exposure. The leverage here is data, not disruption.
🛰️ Open sources - closed narratives
@sitreports