Today's cybersecurity landscape saw a flurry of critical updates and alarming breaches. Multiple vendors, including Microsoft, SAP, Google, and Apple, released significant patches for actively exploited vulnerabilities, while several major organizations reported data breaches and ongoing exploitation campaigns.
Critical Vulnerabilities in Microsoft Products Addressed in November Patch TuesdayVulnerability
Microsoft has released its extensive November Patch Tuesday updates, fixing a staggering 1,235 vulnerabilities across its products. This includes an actively exploited zero-day vulnerability in Microsoft Outlook and 63 critical flaws, some of which impact Exchange, SharePoint, and Windows Search.
Why it matters: Regularly applying these updates is crucial to protect your systems from known attack vectors, especially critical flaws that hackers are already using.
Read more at Krebs on Security ↗
SAP Patches Four Maximum Severity VulnerabilitiesVulnerability
SAP addressed 35 vulnerabilities in its November security updates, notably including four critical flaws with a maximum CVSS score of 10.0. These vulnerabilities affect SAP NetWeaver and Web Dispatcher, with some allowing remote code execution without authentication.
Why it matters: If your business uses SAP systems, immediately apply these patches to prevent unauthorized access and potential control over your critical business applications.
Read more at The Hacker News ↗
Google Chrome Fixes Eighth Actively Exploited Zero-Day of the YearVulnerability
Google has issued an emergency security update for Chrome to address a high-severity use-after-free vulnerability in the XML component (CVE-2026-125350). This marks the eighth actively exploited zero-day flaw in Chrome this year, highlighting persistent threats to web browsers.
Why it matters: Keeping your web browser updated is essential for protecting your online activities from immediate threats that attackers are already leveraging.
Read more at The Hacker News ↗
Critical Xen Orchestra Auth Bypass Actively ExploitedVulnerability
A critical authentication bypass vulnerability (VSA-2026-062) in Xen Orchestra is being actively exploited in the wild. Attackers are leveraging this flaw to gain administrator access and potentially hijack XCP-ng virtualization hosts.
Why it matters: If you use Xen Orchestra, update immediately to prevent attackers from gaining full control over your virtualized environments and underlying infrastructure.
Read more at The Hacker News ↗
N-able Takes N-central Cloud Offline Following Disclosure of 33 Zero-DaysVulnerability
N-able has temporarily taken its Hosted N-central environment offline and urged on-premises customers to shut down their servers. This follows the public disclosure of over 30 vulnerabilities, collectively known as Able2Shell, which could lead to remote code execution and credential theft.
Why it matters: If you use N-able N-central, follow their guidance to secure your systems, as attackers could exploit these flaws to compromise your managed IT infrastructure.
Read more at The Hacker News ↗
Apple Patches iMessage and iOS VulnerabilitiesVulnerability
Apple has released updates addressing critical privacy flaws in iMessage that could allow unauthorized individuals to join group chats or access past messages. Additionally, Binance warned about an iOS sandbox escape vulnerability (iOS 26 and 27) that could expose crypto wallet keys and other sensitive app data.
Why it matters: Update all your Apple devices promptly to protect your personal communications and sensitive financial information from these critical vulnerabilities.
Read more at The Hacker News ↗
Japanese Retailer Nitori Suffers Breach, 37.6 Million Records Potentially StolenBreach
Japanese furniture and home accessories giant Nitori has disclosed a security incident where an attacker accessed one of its systems. This breach may have resulted in the theft of 37.62 million customer records, raising concerns about sensitive personal data.
Why it matters: Be vigilant for phishing attempts or suspicious communications if you are a customer of Nitori, as your personal information may be at risk.
Read more at BleepingComputer ↗
Railway Cloud Hosting Suffers Breach, $740,000 in Fraudulent AI Charges IncurredBreach
Cloud hosting provider Railway reported a breach due to infrastructure vulnerabilities, leading to the theft of customer authentication secrets. This incident resulted in approximately $740,000 in fraudulent AI usage and potentially exposed credentials for up to 100,000 workspaces.
Why it matters: If your business uses Railway, review your account for any suspicious activity and reset credentials immediately to prevent unauthorized access and charges.
Read more at BleepingComputer ↗
Fireworks AI Discloses Expanded Breach After Third-Party Cloud Provider CompromiseBreach
AI infrastructure startup Fireworks AI revealed a wider security incident, including unauthorized access to its development machines after a third-party cloud provider was breached. The incident affected account and billing information, as well as secrets, datasets, and incomplete models for a limited set of accounts.
Why it matters: If you are a Fireworks AI customer, be aware that your data may have been compromised and follow any guidance from the company regarding credential resets or security measures.
Read more at The Hacker News ↗
Russian Turla Hackers Use New 'Cereal' Malware for Government Email EspionageThreat
The Russia-aligned state-sponsored group Turla (also known as Snake) is deploying a novel cyber espionage toolset named 'Cereal.' This sophisticated modular malware targets Microsoft Exchange servers in government organizations to surreptitiously collect emails, indicating ongoing state-backed intelligence operations.
Why it matters: Organizations, especially those with government ties or sensitive data, must enhance monitoring of their Exchange servers for signs of compromise by advanced persistent threats.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.