11 stories · 3 sources · 4 high · ~12 min read
Coverage: Last 24 hours
Today’s Highlights
Today’s risk landscape is defined by high-severity vulnerabilities in core browsers, critical supply chain threats in N-central and open source repositories, and new processor and SaaS exposures. Defenders must prioritize rapid patching, robust identity hygiene, and detection of session hijacking and supply chain attacks to limit attacker opportunities and business disruption. Leading stories include urgent Chrome and Firefox updates for over 180 vulnerabilities and active exploitation of N-central remote management software despite recent patches.
Table of Contents
- Chrome, Firefox Updates Patch Over 180 Vulnerabilities
- New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access
- Hackers Target N-central Zero-Days as N-able Rushes Patches
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs
- PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution
- Another Way Police Are Locating People from Their Smartphones
Critical High Medium Low
Top Stories
Chrome, Firefox Updates Patch Over 180 Vulnerabilities
Source: SecurityWeek | Published: Nov 12 | Risk: HIGH | Impacted: Corporate desktop fleets, VDI environments, Dev endpoints running Chrome or Firefox, Shared kiosk systems | Topics: Threat Intel / Vulnerability
What happened: Google and Mozilla released updates for Chrome and Firefox, addressing over 180 vulnerabilities. Chrome 157 fixed 83 issues, including five critical use-after-free flaws, while Firefox 160 patched 99 vulnerabilities, with 57 rated high-severity. Users are advised to update their browsers promptly.
Why it matters: Browsers remain the primary target for threat actors due to their reach and complexity, and unpatched critical use-after-free flaws present a trivial route to code execution and lateral movement, especially in enterprises with browser-based workflows.
How it works: Browsers like Chrome and Firefox are complex applications exposed to untrusted web content. Use-after-free vulnerabilities let attackers manipulate how memory is used after it is released, often leading to reliable remote code execution when combined with JavaScript triggers.
Affected / Fix: Chrome 157 and Firefox 160 contain patches for all disclosed vulnerabilities; prompt update is required.
Practitioner Perspective
Any organization relying on Chrome or Firefox for core business functions is at immediate risk if patch latency allows these vulnerabilities to be exploited. Attackers routinely weaponize browser flaws, especially use-after-free bugs, for drive-by malware delivery and session hijacking. Patch velocity for browsers must match that for operating systems given their ubiquity and attack surface. Expect attackers to reverse-engineer these updates rapidly, so unpatched endpoints should be treated as probable footholds. The urgency is heightened in environments with shared or unmanaged endpoints.
Recommended Actions
- Deploy Chrome 157 and Firefox 160 across all managed endpoints within 24 hours; verify auto-update mechanisms are functioning enterprise-wide
- Monitor endpoint and egress logs for post-update signs of exploitation attempts targeting historical use-after-free flaws in Chrome and Firefox
Exploits & CVEs
New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access
Source: The Hacker News | Published: Nov 12 | Risk: HIGH | Impacted: On-premises N-central installations, MSPs and IT outsource partners, Internal admin workstations | Topics: Ai / Ics Ot
What happened: N-able on Thursday said it’s investigating a new public disclosure containing claims of additional vulnerabilities in on-premise versions of N-central running version 2026.4.1 HF2. “Based on our initial review, the server issue described depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet,” N-able said in a new advisory. “Legacy API”
Why it matters: Public exploits targeting non-default, internet-exposed configurations in managed service tools like N-central represent a high risk of full environment compromise, potentially including root or SYSTEM access, even on servers believed to be patched.
How it works: N-central is a remote management and monitoring platform used by MSPs, exposing API interfaces for automation. Insecure, internet-exposed Legacy API endpoints allow attackers to exploit new flaws for remote code execution with full local privileges, bypassing some previous patch protections.
Affected / Fix: Affects on-premise N-central version 2026.4.1 HF2 with Legacy API exposed; N-able is investigating and emergency fixes may be required, per vendor advisory.
Practitioner Perspective
If your environment runs on-premise N-able N-central and has ever enabled the Legacy API with public internet exposure, you face severe immediate risk. Attackers are testing these configuration flaws to bypass prior patches and escalate privileges on both Linux and Windows installs. This goes beyond routine patching, it demands comprehensive configuration validation and swift isolation of internet-facing management interfaces. MSPs and IT providers should expect targeted, automated exploitation attempts. The essential control: restrict management interfaces to the internal network and validate exposure with external scanning now.
Recommended Actions
- Audit N-central servers for Legacy API exposure to the public internet and immediately disable if not strictly required
- Upgrade all N-central installs to version 2026.4.1 HF2 or newer, apply any emergency hotfixes as issued by N-able
Hackers Target N-central Zero-Days as N-able Rushes Patches
Source: SecurityWeek | Published: Nov 12 | Risk: HIGH | Impacted: On-premises N-central installations, MSPs using N-central, Admin workstations | Topics: Threat Intel / Vulnerability
What happened: The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Why it matters: Exploiting zero-days in remote management tools used by managed service providers puts numerous downstream client environments at risk, especially since exploitation can occur before patch deployment reaches all targets.
How it works: Threat actors can chain unauthenticated vulnerabilities to gain initial foothold and escalate privileges in managed networks. N-able issued patches for the most critical flaws, but risk remains where patch deployment lags or authenticated flaws are still reachable.
Affected / Fix: Patches are available for unauthenticated flaws; investigate and accelerate patching for all deployments.
Practitioner Perspective
Managed service provider environments running N-central must expect targeted exploitation given the value of these platforms in lateral movement and persistent access. Patch lag is especially hazardous given the public disclosure of over 30 zero-day vulnerabilities. Active attack means defenders must hunt for post-exploitation signs even after applying available patches. Segmentation and principle-of-least-privilege remain core tenets for limiting attacker blast radius.
Recommended Actions
- Deploy vendor-issued patches for all known N-central zero-days without delay and verify deployments across all managed environments
- Conduct threat hunting for anomalous activity indicating exploitation, such as unexpected privilege escalation or lateral movement from N-central admin hosts
Emerging Signals
Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs
Source: The Hacker News | Published: Nov 12 | Risk: HIGH | Impacted: Google Cloud VM tenants using C4D, N4D, H4D, Z4D, G4, Regulated industries with cloud workloads, SaaS providers running on AMD EPYC ‘Turin’ infrastructure | Topics: Cloud / Vulnerability
What happened: Google Cloud has identified three CPU side-channel vulnerabilities in AMD’s fifth-generation EPYC processors, known as Turin, which could allow attackers to infer data across processes within virtual machines. Affected VM series include C4D, N4D, H4D, Z4D, and G4. Users are advised to apply OS vendor patches and restart their VMs to mitigate these risks.
Why it matters: Side-channel CPU flaws in cloud infrastructure can allow attackers in one VM to infer or leak data belonging to co-located tenants, breaking core isolation guarantees and enabling sophisticated cross-tenant breaches in multi-tenant environments.
How it works: These vulnerabilities are CPU-level side-channel issues affecting AMD’s ‘Turin’ (fifth-generation EPYC) processors, potentially allowing a malicious VM to read data processed by other VMs sharing the same server hardware via low-level timing or cache attacks.
Affected / Fix: Affects Google Cloud C4D, N4D, H4D, Z4D, G4 series with AMD Turin CPUs; OS patches and VM restarts are required per vendor guidance.
Practitioner Perspective
Anyone running workloads on affected AMD Turin EPYC-based Google Cloud VMs faces elevated risk of data exposure to malicious tenants or code running on adjacent VMs. While attacker exploitation of these side channels is non-trivial, the business impact includes potential PCI, HIPAA, or sensitive IP leakage. Coordinating restarts after patching will disrupt uptime-sensitive workloads, so defenders must weigh the timing and operational costs. Cloud shared responsibility dictates patching the OS as well as following provider guidance. The key risk is silent data exfiltration that may never trigger conventional security controls.
Recommended Actions
- Apply OS vendor patches for AMD Turin (fifth-gen EPYC) CPU flaws on all C4D, N4D, H4D, Z4D, and G4 series VMs per Google guidance
- Schedule restarts for these VMs after patch application to ensure changes take effect
PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution
Source: The Hacker News | Published: Nov 12 | Risk: MEDIUM | Impacted: Windchill and FlexPLM deployments, Manufacturing sector, Product lifecycle teams | Topics: Vulnerability / Exploit
What happened: PTC has released patches for a new critical vulnerability impacting Windchill and FlexPLM software that, if successfully exploited, could result in remote code execution. The security flaw, tracked as CVE-2026-126325 (CVSS 9.2), has been described as a case of improper input validation and deserialization of untrusted data.
Why it matters: Product lifecycle management tools are integrated deeply into the manufacturing supply chain, and remote code execution against these platforms can allow attackers to manipulate sensitive product data, inject malware, or gain access to critical operational networks.
How it works: The vulnerability is due to improper input validation and unsafe deserialization, enabling attackers to send crafted data to trigger arbitrary code execution.
Affected / Fix: PTC released updates to address CVE-2026-126325; all customers should patch immediately.
Practitioner Perspective
Manufacturing firms and product development organizations running Windchill or FlexPLM should prioritize this patch to prevent attackers from leveraging the bug for deep network intrusion. Given the CVSS 9.2 rating and the software’s integration with critical IP and industrial workflows, attackers may seek to use this foothold for both direct data theft and supply chain infiltration. Patch deployment should be coordinated with audit for abuse of the vulnerable service interface.
Recommended Actions
- Update all Windchill and FlexPLM installations to the latest security release addressing CVE-2026-126325
- Review access controls and service exposure for these platforms, limiting access to trusted internal networks
Another Way Police Are Locating People from Their Smartphones
Source: Schneier on Security | Published: Nov 12 | Risk: MEDIUM | Impacted: Enterprises with BYOD policies, Mobile device users in regulated sectors, Executives with location-based app usage | Topics: Cryptography / Policy
What happened: Penlink’s Webloc app collects location data from popular apps like weather, gaming, email, and religious apps to track smartphone movements over the past year, updating hourly. Law enforcement can use Webloc to analyze billions of location data points, identifying phones present at specific places and times.
Why it matters: Mass aggregation of smartphone app location data exposes organizations and individuals to privacy loss, potentially revealing sensitive travel, meeting, or health-related information to law enforcement or other aggregators without meaningful consent or oversight.
How it works: Penlink’s Webloc aggregates smartphone app location data across a range of popular apps and analyzes it to provide historic movement analysis, enabling third parties to track devices to physical sites often without end-user knowledge or proper disclosure.
Practitioner Perspective
Organizations with mobile-heavy workforces or BYOD policies may inadvertently leak employee location information through non-obvious third-party apps. Vendors like Penlink aggregate granular movement history using location data from common apps, meaning privacy controls must extend beyond MDM-managed applications. This surveillance method threatens confidential business operations and employee safety in sensitive industries. Security teams should audit and regulate app permissions and review privacy policies to prevent unintentional data exposure. The fundamental issue: most users underestimate the precision and reach of commercial location tracking.
Recommended Actions
- Identify and audit location data permissions on all enterprise-managed and BYOD smartphones, focusing on weather, email, and non-obvious third-party apps
- Instruct employees to disable location tracking for non-essential apps and review privacy settings regularly
Also Today
- Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign: An attacker exploited over 4,800 compromised GitHub accounts to insert credential-stealing code into more than 60,000 repositories.
- Daylight Lands $80 Million for AI-Powered Security Operations: Daylight received $80 million in Series B funding to expand development of Aura, an AI-driven cyber threat detection platform.
- Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign: A phishing campaign has been stealing live Google sessions from corporate users by using tactics that evade normal link checks.
- Notion Customer Data Compromised in Fireworks AI Hack: Attackers accessed chat transcripts from fewer than 1% of Notion workspaces after breaching Fireworks AI.
- Hackers Deploy Malware in Fresh ScreenConnect Campaign: Threat actors exploited a vulnerability in a legitimate extension to bypass authentication in ScreenConnect deployments.
Defensive Actions
- Deploy Chrome 157 and Firefox 160 updates across all endpoints and verify auto-update mechanisms.
- Audit N-able N-central configurations for public exposure of Legacy API and disable if not required; upgrade all on-premise servers and monitor for abuse.
- Apply OS vendor patches for all cloud VM workloads using AMD Turin CPUs and coordinate necessary restarts.
- Review all Windchill and FlexPLM deployments to ensure patches for CVE-2026-126325 are applied.
- Identify recent malicious code inserts in organization-linked GitHub repositories and enforce dependency review processes.
- Instruct employees using managed or BYOD smartphones to review and restrict location sharing permissions, especially for non-primary apps.
- Test and document all third-party integrations in SOC workflows, focusing on closing identity-related detection blind spots.
- Monitor threat intel feeds for ongoing N-central and browser exploit activity as adversaries reverse-engineer recent patches.
What We’re Watching
- Surge in active exploitation attempts against N-central as researchers and criminals target both patched and unpatched instances.
- Patch adoption rates and exploit trends for CVE-2026-126325 (CVSS 9.2) in the manufacturing sector affecting Windchill and FlexPLM.
- Continued evolution of phishing tactics aimed at Google Workspace, notably session hijack campaigns using calendar invites and live proxies.
- Cloud service provider responses and tenant patch progress in mitigating AMD Turin CPU side-channel vulnerabilities across multi-tenant VM environments.
- Malicious code scanning and incident response actions by major open source and enterprise GitHub users following the massive credential theft campaign.
Found this briefing useful? Follow the blog to get the next one as soon as it is published, and pass it along to a colleague who owns patching.
Categories: Cybersecurity Blog, Cybersecurity News
Leave a Reply