Here are today’s top cybersecurity stories for Tuesday, November 10, 2026.
Microsoft November 2026 Patch Tuesday Fixes 1,235 Flaws, Including an Exploited Outlook Zero-Day
Microsoft fixed a record 1,235 vulnerabilities, 66 of them rated Critical. The only zero-day, CVE-2026-124194, is an Outlook spoofing flaw attackers used to steal NTLM hashes. A crafted message makes Outlook connect to an attacker server without the usual external content warning. Critical fixes also cover Active Directory Domain Services, Exchange Server, Office, and Microsoft Defender. BleepingComputer
N-able Takes N-central Offline After Researcher Discloses Over 30 Zero-Days
Researcher Sean Bales published proof-of-concept exploits for more than 30 N-central flaws, tracked as Able2Shell. The chains lead to rogue admin access and root command execution. N-able took Hosted N-central offline, told on-premises customers to shut down their servers until further notice, and reports no signs of active exploitation. The Hacker News
Critical Xen Orchestra Auth Bypass Exploited to Hijack VM Servers
Vates confirmed attackers exploit VSA-2026-062, an authentication bypass in Xen Orchestra and the Xen Orchestra Appliance. A crafted cookie logs an attacker in as an existing token owner with admin rights, and the attack leaves no log entries. Fixes ship in Xen Orchestra 6.9.1 and 6.10.0. TDC NET Security researchers reported the flaw. BleepingComputer
Turla Uses New Cereal Malware to Spy on Government Exchange Servers
ESET documented a modular .NET toolset from the Russian FSB-linked Turla group running inside Microsoft Exchange. One component hooks the Exchange transport process and collects emails with document attachments. Victims include a Kazakh government body and a Romanian agency, where the malware gathered emails exchanged with NATO and EU representatives. BleepingComputer
CISA Adds IBM Aspera Faspex, FreeSWITCH, GPUStack, and OpenSSH Flaws to KEV
CISA added four actively exploited flaws to its Known Exploited Vulnerabilities catalog on November 9. The list includes IBM Aspera Faspex CVE-2026-123218, SignalWire FreeSWITCH CVE-2026-116779, and GPUStack CVE-2026-102895, each rated CVSS 9.8, plus OpenSSH CVE-2026-123158. Federal civilian agencies must apply fixes by November 12, 2026. The Hacker News
Google Patches Eighth Actively Exploited Chrome Zero-Day of 2026
Google fixed CVE-2026-125350, a high-severity use-after-free in Chrome’s XML component, and says an exploit exists in the wild. The fix ships in Chrome 157.0.8103.50/.51 for Windows and macOS and 157.0.8103.50 for Linux. An anonymous researcher reported the bug on November 6. The Hacker News
SAP Patches Four CVSS 10.0 Flaws in NetWeaver, Web Dispatcher, and Gateway
SAP’s November Security Patch Day fixed four unauthenticated flaws rated CVSS 10.0. Two in ICM and Web Dispatcher allow code execution, one lets attackers log in as other users in some SAML setups, and one lets attackers impersonate an SAP application server in Gateway. SAP reported no exploitation. The Hacker News
Adobe Patches 110 Vulnerabilities Across Nine Products
Adobe’s November updates fix about 110 flaws, with critical issues in Adobe Connect and Adobe Experience Manager. Six Connect flaws carry a CVSS score of 10. Adobe says it knows of no attacks exploiting the new flaws. SecurityWeek
Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Bugs
iOS and iPadOS 27.2.1 fix CVE-2026-113961, which let a remote attacker join a group chat and receive its messages, and CVE-2026-113960, which exposed earlier messages to new members. The updates also fix a Brotli decoder flaw on CISA’s KEV list and several Bluetooth pairing issues. Apple did not say whether attackers exploited the iMessage flaws. The Hacker News
Binance Warns of Unpatched iOS Sandbox Escape Exposing Wallet Data
A researcher known as forcequit published a sandbox escape exploit named worse_query affecting iOS 26 and 27. The proof of concept lets an app read other apps’ data containers. Apple’s latest update notes do not mention a fix, and neither Binance nor the researcher reports attacks. The Hacker News
Vanderbilt University Hit by Ransomware Claimed by BYOD Group
Vanderbilt University found a ransomware attack on November 9 and ordered users to shut down university devices. Some services returned on Tuesday. The BYOD group, active since September 2026, claimed the attack and says it holds more than one million Social Security numbers. CyberScoop
Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan
Zenox tied a phishing campaign across Latin America to a Brazilian cluster of Blind Eagle (APT-C-36). Lures impersonate judicial notices and use HTML smuggling to build a protected ZIP in the browser. The final payload is an AsyncRAT fork loaded in memory. The Hacker News
Stay tuned for today’s in-depth analysis posts.
