Do Son 
Details and proof-of-concept steps for five mailcow vulnerabilities are public, including a CVSS 9.1 cross-tenant RCE. Update to 2026-11.
Composer 2.11.2 and 2.2.32 fix three Composer vulnerabilities, including command execution via a crafted composer.lock file (CVSS 8.8).
The November 2026 OpenSSL security advisory fixes five Low-severity bugs in OpenSSL QUIC, AES-GCM-SIV and CMS. Releases are due December 1.
cybernewswire
Alisa Vijeo, California, 10th November 2026, CyberNewswire
Alisa Viejo, California, 10th November 2026, CyberNewswire
Alisa Viejo, California, 10th November 2026, CyberNewswire
Columbus, Ohio, United States, 10th November 2026, CyberNewswire
France attributed a destructive Iran refrigeration cyberattack impacting 700 sites to the IRGC group Shahid Kaveh, causing food spoilage and fires.
The project adopts the Asahi Linux GPL license across its repositories to stop commercial actors from using AI to launder code from Apple Silicon drivers.
A new Windows Hello login update allows simultaneous facial, fingerprint, and PIN entry, streamlining authentication in Windows 11.
Apache Commons Codec 1.23.0 addresses CVE-2026-119078 and CVE-2026-124077, while Apache HTTP Server 2.4.70 fixes a heap buffer overflow.
Attackers exploit a Barracuda ESG vulnerability chain (CVE-2026-116606, CVE-2026-111560) for root RCE after a proof-of-concept exploit went public.
Update Progress WS_FTP Server to 2025.0.5 now to patch CVE-2026-115338, CVE-2026-115341, and three other high-severity security vulnerabilities.
Apple issued the iOS 27.2.1 security update to fix critical iMessage eavesdropping flaws, zero-click Bluetooth pairing, and wireless memory bugs.
Anthropic launched Claude Fable 5.2 and Mythos 5.2, cutting API pricing by 20% while claiming the top Artificial Analysis intelligence benchmark score.
Patch critical Mongoose security flaws CVE-2026-125120 (CVSS 9.8) and CVE-2026-125117 affecting 4.8 million weekly npm users against NoSQL injection.
November SAP Security Patch Day fixes 38 CVEs, including nine Critical SAP NetWeaver, Web Dispatcher and Gateway flaws rated up to CVSS 10.0.
CERT/CC details six FrodoBots EarthRover vulnerabilities, including root remote code execution via MQTT. Patch status, risks and mitigations.
A proof-of-concept exploit for the Windows Search vulnerability CVE-2026-50679 is public. The heap overflow lets local users gain elevated privileges.
18 Apache Airflow vulnerabilities, including Celery code execution CVE-2026-68982, are fixed in Airflow 3.4.0, plus two Apache Storm flaws.
Logto vulnerabilities allow account takeover via Apple sign-in, MFA bypass and SAML login bypass. Upgrade to Logto 1.46.0 and patched packages now.