11.11.2026

Krebs Security 10.11.2026 21:55
Microsoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software. This month's Patch Tuesday addresses 63 critical flaws — including a zero-day in Microsoft Outlook — and comes amid important security updates from other software makers, including Adobe, Apple, Google and Mozilla.

The Hacker News 10.11.2026 19:23
A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1.

The flaw, tracked as CVE-2026-111760, is an integer truncation in how Git handles its index. An

The Hacker News 10.11.2026 19:19
An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday.

The attacker could also have seen requests being processed on that server that day, including requests sent in confidential mode, the company said earlier this week. That mode processes requests inside a trusted execution environment (TEE

Spiegel Online 10.11.2026 19:04
Namen, Geburtsdaten, dienstliche E-Mail-Adressen: All das erbeuteten Unbekannte von Beschäftigten der Uni Tübingen. Möglich machte es eine Sicherheitslücke. Ähnliche Fälle gab es unlängst an anderen Hochschulen.

The Hacker News 10.11.2026 17:43
Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year.

Check Point Research is tracking the clusters under the names SilentDelivery,

The Hacker News 10.11.2026 15:33
Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month  uncovered further malicious activity, affecting account and billing information, alongside secrets, datasets, and incomplete models for a "limited set of accounts."

In a notice published on October 10, 2026, the company said it detected unauthorized use of internal Fireworks

Heise Security 10.11.2026 13:33
Der November-Patchday bei SAP stopft Code-Injection- und Speicherkorrumpierungslücken. Neun Sicherheitslecks gelten als kritisch.

Heise Security 10.11.2026 12:58
In dem rudimentären Zeichenprogramm Paint von Windows können Angreifer Schadcode einschleusen. Jetzt gibt es ein Update dagegen.

The Hacker News 10.11.2026 12:15
An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today. Apple's updates for iOS 26 and 27, released yesterday, do not list a fix.

A researcher who goes by forcequit,  in collaboration with 0xjohnny, 

Heise Security 10.11.2026 10:33
Die US-amerikanische IT-Sicherheitsbehörde CISA warnt vor Angriffen auf GPUStack, FreeSwitch, OpenSSH und IBM Aspera Faspex.

The Hacker News 10.11.2026 10:16
An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined.

As of today, other updates released yesterday for the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple

The Hacker News 10.11.2026 10:02
Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score.

Three are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the Web Dispatcher, which receives web requests from the internet and passes them on to that server.

The flaws in the Web

Heise Security 10.11.2026 10:02
Patches schließen Schwachstellen in IBM App Connect Enterprise, der Log Source Management App for IBM QRadar SIEM und der TS4500 Tape Library.

Golem 10.11.2026 09:37
Nach einem Leak von über 30 N-central-Exploits hat N-able seine Server offline genommen – mit Folgen für die IT-Verwaltung zahlreicher Unternehmen. (Sicherheitslücke, Server)

Heise Security 10.11.2026 09:12
Apple hat iOS 27.2.1, macOS 27.2.1 und diverse weitere Updates veröffentlicht. Gestopft werden unter anderem Lücken in Bluetooth und der Nachrichten-App.

Heise Security 10.11.2026 07:57
Google hat ein Update für den Webbrowser Chrome veröffentlicht. Die Entwickler warnen, dass eine Lücke bereits angegriffen wird.

Golem 10.11.2026 07:25
Ein neues Chrome-Update adressiert mehrere gefährliche Sicherheitslücken. Eine wird bereits aktiv ausgenutzt. Nutzer sollten zügig patchen. (Sicherheitslücke, Google)

The Hacker News 10.11.2026 06:44
N-able said it has taken N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice following the public disclosure of over 30 vulnerabilities collectively tracked as Able2Shell.

"As a precautionary measure, we are temporarily taking our Hosted N-central environment offline while we take the necessary actions to secure the