CISA confirms active exploitation of CVE-2026-20320, a high-severity Cisco BroadWorks XXE flaw. Upgrade affected servers to RI.2026.07 now.
Do Son · Vulnerability News
PostgreSQL Arbitrary Code Execution Flaws Fixed in 18.7, 17.12, 16.16, 15.20 and 14.25
CVE-2026-12591: ManageEngine M365 Manager Plus Privilege Escalation Fixed in 4818
CVE-2026-107360: Red Hat Satellite Template Sandbox Bypass Fixed in rubygem-safemode 1.5.0-3
Gradle Version Catalog Code Execution Fixed in 9.9.1 and 8.14.7
Unit 42 uncovers the Falcon C2 framework on government portals. See how the browser-based Falcon C2 framework steals data and drops the Antino implant.
Wiz, Sentra, and Mandiant uncovered a supply chain attack abusing Qubole cross-account access and Qubole AWS cross-account access roles to steal S3 data.
Kaspersky uncovers Citrus Ransomware hitting Russian firms. See how the Sn00py Citrus Ransomware group uses VLESS tunnels, Certighost, and LLM scripts.
TSMC data breach confirmed: a TSMC employee data leak traced to a cloud provider. A seller claims 46,000 records and asks 3 BTC.
PostgreSQL security update 18.7 fixes 52 CVEs, including CVE-2026-6460 and 31 other code execution flaws. PostgreSQL 14 reaches end of life.
The DOJ and Europol arrested 354 suspects and seized $234M in the Operation TorNado dark web crackdown on fentanyl and opioid vendors.
ManageEngine critical vulnerabilities fixed: CVE-2026-12591 (CVSS 9.9) in M365 Manager Plus, CVE-2026-12507 RCE in ServiceDesk Plus, DDI Central flaws.
The DOJ and FBI executed a Gootloader malware takedown, wiping the botnet from 100+ WordPress servers after 25,000 infections and $28.8M in losses.
The DOJ and FBI disrupted the North Korea FaceStealer scheme after $400M in crypto thefts and seized $1.2B stolen in a $6B Binance exchange hack.
Red Hat Satellite vulnerabilities fixed: CVE-2026-107360 (CVSS 9.6) sandbox bypass leads 21 new Red Hat CVEs across Satellite, RHEL and Ansible.
Gradle 9.9.1 and 8.14.7 fix three Gradle vulnerabilities, including a CVSS 9.3 version catalog code injection that runs during builds and IDE sync.
Mitel fixes three MiVoice MX-ONE vulnerabilities, including a CVSS 9.4 authentication bypass and command injection. Apply 8.2 SP1 HF2 now.
Microsoft will remove trust for 10 remaining eMudhra root certificates on November 16, 2026, via automatic Windows, Edge, and WebView2 updates.
Brave Search anti-scraping defenses will soon encrypt search result links via intermediate redirect pages to block surging AI agents and web crawlers.
Google unveils Gemini 4 Hydrogen, a high-speed AI model derived from Carbon with a 1M token window, 2.5x faster speeds, and enhanced agent security.
Microsoft deployed a server-side patch for the Windows 11 KB5132061 update after Windows Sandbox conflicts caused installation failures at 99%.
Google Labs Tabletop introduces an experimental AI collaboration hub that lets friends build custom trip planners, polls, and expense splitters.
Apple announced the permanent Apple Support Community shutdown on November 20, 2026, placing the 28-year-old troubleshooting forum into read-only mode.
Indian CA eMudhra certificate revocation expands to eight RSA intermediate keys after a flawed Python migration script exposed private key material.
Microsoft is rolling out a classic Outlook interface update for Windows, introducing refreshed icons, spacing refinements, and What's New prompts.
Mitel fixes three MiVoice MX-ONE vulnerabilities, including a CVSS 9.4 authentication bypass and command injection. Apply 8.2 SP1 HF2 now.
Plone fixes an anonymous Plone remote code execution chain rated CVSS 9.8. Update to 6.2.3, 6.1.6 or 6.0.16, or install the Plone hotfix.
Check Point Gateway vulnerability CVE-2026-123039 exploited with PHP2Shell to gain root, plant backdoors and wipe ESXi. Patch to R82.20 Take 14.
Citrix NetScaler vulnerabilities fixed: CVE-2026-120868 hits default setups, CVE-2026-120869 bypasses Console login. Upgrade to 14.1-73.57 now.
A public exploit for CVE-2026-80521, an AF_UNIX use-after-free, enables Linux kernel privilege escalation. Fixed in 7.1.10, 6.12.111 and 7.2.
Telegram fixes a Telegram Android RCE flaw after V12 showed remote code execution through a bot message. No CVE yet. Update the Android app now.
ConnectWise disabled five ScreenConnect extensions in 400 environments after attackers accessed ScreenConnect partner accounts. Act now.
Google Chrome security update 157.0.8103.78 fixes 83 flaws, including five Critical use-after-free bugs such as CVE-2026-126885. Update Chrome now.
Full details and PoC exploit code for the critical pappl-retrofit path traversal flaw CVE-2026-123747 are now public. Apply commit c65a28f right away.
Zoho fixes eight ManageEngine vulnerabilities in DDI Central and ADAudit Plus, including Cisco router command injection and SQL injection flaws.
Go 1.27.4 and 1.26.11 deliver 12 Go security fixes, blocking cgo code execution at build time (CVE-2026-97033) and an HTTP/1 server crash.
Node.js fixes 17 bugs, including Node.js HTTP/2 vulnerabilities and a TLS heap leak (CVE-2026-123864). Update to 26.13.1, 24.22.3 or 22.23.5.
Microsoft will remove trust for 10 remaining eMudhra root certificates on November 16, 2026, via automatic Windows, Edge, and WebView2 updates.
Brave Search anti-scraping defenses will soon encrypt search result links via intermediate redirect pages to block surging AI agents and web crawlers.
Google unveils Gemini 4 Hydrogen, a high-speed AI model derived from Carbon with a 1M token window, 2.5x faster speeds, and enhanced agent security.
Microsoft deployed a server-side patch for the Windows 11 KB5132061 update after Windows Sandbox conflicts caused installation failures at 99%.
Google Labs Tabletop introduces an experimental AI collaboration hub that lets friends build custom trip planners, polls, and expense splitters.
Apple announced the permanent Apple Support Community shutdown on November 20, 2026, placing the 28-year-old troubleshooting forum into read-only mode.
Indian CA eMudhra certificate revocation expands to eight RSA intermediate keys after a flawed Python migration script exposed private key material.
Microsoft is rolling out a classic Outlook interface update for Windows, introducing refreshed icons, spacing refinements, and What's New prompts.
Do Son 
cybernewswire 
