Latest Cybersecurity News Today: 12 November 2026

Apify said an unauthorized third party accessed parts of its internal systems between November 9 and 10, detected the next day at 12:13 UTC. The Czech web scraping platform rotated API tokens, reset active sessions, revoked some third-party OAuth connections and asked affected users to reset two-factor authentication. It said it found no indication that account data stored on the platform was affected, though 2FA codes may have been exposed.

Google and Mozilla released browser updates fixing more than 180 vulnerabilities, including 83 in Chrome and 99 in Firefox 160. Chrome's fixes include five critical use-after-free issues, while Firefox patches include 57 high-severity weaknesses. Mozilla also shipped Thunderbird 160 with 103 fixes and updated ESR lines; neither company said any flaw was exploited in the wild.

Police in nine countries working with Europol took down servers behind Gootloader, CastleRAT and StealC malware operations and recovered more than 6 million stolen credentials. The action seized 235 servers and 257 domains. Europol said the credentials had been sold for further attacks, including ransomware, and urged WordPress users to change credentials and enable multi-factor authentication.

Romania's intelligence agency said it stopped a cyberattack by Russian state-linked hackers on a government institution, detected in December 2025. The operation was attributed to Turla, linked to Moscow's FSB, which exploited vulnerabilities in Microsoft systems. ESET said the group used a previously unknown toolkit called Cereal to monitor email traffic and maintain access to Microsoft Exchange servers, with no sensitive data exfiltrated.

Microsoft's FORGE Lab project MDASH used AI agents and human researchers to find 59 Linux kernel vulnerabilities, including bugs that had remained in production code for more than 20 years. It generated 26,502 potential findings in about two weeks, produced 59 public upstream reports, and built working local privilege-escalation exploits for eight. Microsoft said 38 fixes have been merged into mainline.

Google Cloud said three side-channel flaws in AMD Turin, or fifth-generation EPYC, processors can let an attacker running code on the same core infer data from other processes or the kernel inside a virtual machine. The affected machine series include C4D, N4D, H4D, Z4D and G4, including bare-metal C4D and Z4D instances. Google said mitigations between VMs and the host are already applied, but guests need an OS patch and a stop-and-start.

N-able is investigating new flaws in on-premise N-central 2026.4.1 HF2, disclosed by Sean Bales as 4EverAble2Shell and Agent2Shell. The issues can enable unauthenticated remote code execution with root privileges and command execution on managed Windows agents as NT AUTHORITY\SYSTEM. N-able said the server issue depends on a non-default Legacy API exposed to the internet and urged customers to disable it; hosted environments are not affected.

PTC released patches for CVE-2026-126325, a critical remote code execution flaw in Windchill and FlexPLM caused by improper input validation and deserialization of untrusted data. The flaw has a CVSS v4 score of 9.2 and can be exploited through crafted requests. PTC said hosted environments have been patched, while other organizations should patch exposed systems and monitor for web shells or backdoor access.

Microsoft confirmed that November 2026 security updates can fail on some Windows 11 devices that installed the October 2026 non-security preview update KB5127936. Affected devices may repeatedly attempt installation or show error codes 0x80070306, 0x800f0989, or 0x800f0993. Microsoft said repairs should complete within 24 to 48 hours from November 11, 2026, 10 a.m. PT, after which devices will automatically download and install the update.

Notion said a small set of customers was affected when Fireworks AI disclosed that attackers accessed Notion AI chat transcripts used for its Insights feature. The breach followed an October 24 incident at Fireworks AI linked to an unauthorized workload on a third party cloud provider, and Notion said fewer than 1% of workspaces were affected.

Notion told affected customers to treat the data as exposed and rotate credentials pasted into Notion AI.

Cybersecurity firms including Intel 471, Flashpoint and IntelHawk say they have identified Aleksey Mikhailovich Yakovtsev, a 36-year-old St. Petersburg resident, as the administrator of Qilin ransomware. The group has claimed at least 365 victims in the past three months, and its administrator uses the handle Haise. Researchers said a 2022 application to the RAMP forum, seized by the FBI, linked the handle to his Telegram username.

N-able released patches for several N-central zero-days after researcher Sean Bales published details and proof-of-concept code for more than 30 flaws he called Able2Shell. The company took hosted environments offline on Monday, then brought them back online after resolving vulnerabilities exploitable without authentication. It said attackers are probing exposed instances and advised on-premises deployments to update to N-central 2026.4 HF2.

Microsoft said threat actors are using GSocket, an open source remote access tool, to keep access to Linux servers after patching. Both the server and attacker connect outbound to a relay, so the technique can bypass inbound firewall rules and does not require a public IP or dedicated command and control server. Microsoft reported a 356.2% increase in GSocket detections from March to August, with most incidents involving web apps and hosting.

A critical use-after-free flaw in MongoDB Server, CVE-2026-118383, lets an unauthenticated attacker send two requests that can crash a replica set member if it is later elected primary while missing recent changes. MongoDB rated it 9.5, said it found the flaw and is not aware of exploitation, and released fixed versions. Atlas clusters receive fixes during maintenance, while self-managed deployments must update every replica set member.

An attacker used stolen GitHub credentials to open probe pull requests in 61,764 repositories and inject a CI secret stealer named wfx-loot, beginning November 10. Aikido said the stealer ran in at least 1,806 repositories, while Cybernews reported at least 1,970 confirmed runs. The script harvested Actions secrets, cloud and AI credentials, and created persistence in AWS and Azure, so organizations should revoke tokens and rotate secrets.

A critical flaw in Red Hat Quay's service key server, CVE-2026-123710, lets an unauthenticated attacker take over registry token signing and install a trusted signing key. The key can grant read and write access to any repository, exposing private images and secrets and letting attackers overwrite images. Red Hat said fixes were merged into the project's GitHub repository on November 11, but no fixed version was identified.

Maersk said it found unauthorized access and data extraction on a local legacy system from an earlier acquisition, without naming the business. The WhiteArmor group claims 100GB from an LF Logistics platform and demands $5 million in bitcoin, citing driver records, staff accounts and mobile device logs. Maersk said findings strongly suggest no sensitive data was disclosed and that customer operations are not disrupted.

Amplifon, the Milan-based hearing aid retailer, said an unauthorized party exfiltrated files between January 18 and February 8, 2026, after suspicious activity was detected on February 11. The files included names, contact details, dates of birth, driver's license copies, medical information and health insurance IDs; some financial and Social Security data may also be affected. Unconfirmed law firm claims put the number at 1,332,826.

Node.js released versions 22.23.5, 24.22.3 and 26.13.1 for its three supported lines, fixing 16 vulnerabilities, seven rated high. One HTTP/2 flaw, CVE-2026-123863, lets unauthenticated clients crash servers on 24.x and 26.x, while CVE-2026-123866 can leak server memory, including responses for other connections. A separate HTTPS flaw, CVE-2026-123864, can expose other connections' memory, including TLS private keys. Updating is the only fix.

An attacker used stolen credentials for 4,837 GitHub accounts to plant a CI secret stealer in repositories the accounts could write to, Aikido Security said. The stealer ran in at least 1,806 repositories and likely collected secrets and cloud credentials reachable by CI. It said any account that opened a test pull request is compromised, so owners should revoke tokens, rotate secrets and treat machines that ran npm install as compromised.

A critical flaw in Apache HTTP Server's HTTP/2 module, CVE-2026-119618, can let an unauthenticated remote attacker run code on servers with HTTP/2 enabled. Versions 2.4.55 through 2.4.70 are affected, and the fix is in version 2.4.71, released yesterday. Red Hat rates the flaw 9.8 on the CVSS scale and says public research showed a reliable exploit, while Wiz said no exploit was available and no exploitation in the wild was reported.

Cequence found bots impersonating AI agents and traffic that conventional bot scores missed. An online marketplace logged 414,210 failed sign-in visits under a consumer AI agent name in one week, a credential stuffing operation. At a Tier 1 telecom carrier, automated traffic completed MFA and account actions while posing as a desktop browser. Behavior, not bot scores, may be needed to catch impostors moving money or taking over accounts.

Huntress said attackers used cloud hosted ScreenConnect panels to install rogue clients on at least 288 managed endpoints across 48 organizations, first detected on November 11. ConnectWise is disabling five third party extensions in partner environments but sees no evidence of a ScreenConnect vulnerability or infrastructure compromise. Huntress said telemetry points to compromised credentials or hijacked operator sessions for initial access.

Former CA eMudhra said a buggy Python script truncated private keys during a 30 April 2025 ceremony, producing weak certificates. It said supply chain constraints led it to use a custom script to move keys between hardware security modules, and it did not test the results. A Mozilla team member later noticed the keys were weak enough for attackers to issue fraudulent certificates, so browser makers stopped recognizing eMudhra certificates.

Railway said attackers exploited a build infrastructure flaw on October 20 and, in a battle lasting nearly 26 hours, stole AI provider credentials and customer environment variables. It said the group generated about $740,000 in fraudulent AI usage charges and may have accessed up to 100,000 workspace credentials, or at most 1.85% of workspaces. Railway advised users to revoke and reapply sensitive environment variables stored before October 21.