Cybersecurity Radar — 2026-11-10
Google has patched a critical Chrome zero-day (CVE-2026-125350) actively exploited in the wild, marking the eighth such vulnerability exploited this year. Meanwhile, CISA issued urgent warnings for four newly exploited vulnerabilities in OpenSSH, GPUStack, FreeSWITCH, and IBM Aspera Faspex, and AI infrastructure provider Fireworks disclosed a breach following a cloud provider compromise.
Cybersecurity Radar — 2026-11-10
🔴 Critical Alerts
Chrome Zero-Day Actively Exploited (CVE-2026-125350)
Google has released an emergency update for Chrome 157 to patch CVE-2026-125350, a high-severity use-after-free vulnerability in the XML component. This flaw allows remote attackers to execute malicious code in the browser and is the eighth Chrome zero-day observed being exploited in the wild in 2026. Users must update to the latest version immediately to mitigate remote code execution risks.
CISA Adds Four Flaws to KEV Catalog The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog on Monday, citing evidence of active exploitation. The vulnerabilities impact GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex. Organizations using these products are urged to patch immediately as federal deadlines apply.
Threat Landscape
Bitter APT Group Deploys New PapRAT Trojan The South Asian cyber espionage group known as Bitter (also tracked as APT-C-08 and Hazy Tiger) has been observed targeting South Asian organizations with a previously unreported remote access trojan called PapRAT. This campaign highlights the evolving TTPs of state-sponsored actors in the region.
Fireworks AI Discloses Breach via Cloud Provider
AI infrastructure startup Fireworks has disclosed a new security breach in which attackers accessed its development machines after breaching a third-party cloud provider. This incident underscores the supply chain risks associated with third-party cloud dependencies in AI infrastructure.
Queens Public Library Hit by Ransomware
Queens Public Library, a New York City public library system serving approximately 2.3 million residents, was struck by a ransomware attack, according to Check Point Research's latest intelligence report. This incident is part of a broader trend of ransomware targeting public sector institutions.
Vulnerabilities & Patches
N-able Takes Platform Offline After 30+ Zero-Days Disclosed N-able has taken its hosted N-central environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more than 30 alleged zero-day vulnerabilities. These exploits could allow attackers to take over vulnerable systems, prompting an immediate defensive shutdown by the vendor.
Microsoft Patch Tuesday: November 10 Microsoft is scheduled to release its November 2026 Patch Tuesday updates today. With October's release containing 1,771 CVEs ranked by real-world risk, security teams should prepare for another significant volume of patches addressing zero-days and critical flaws across Windows and other Microsoft products.
Third-Party Vulnerability Digest for November
Action1 released a November 2026 vulnerability digest highlighting critical third-party updates for web browsers, BeyondTrust, Cisco, Gitea, Linux, PHP, Adobe, GitLab, IBM, Juniper, and Oracle. Administrators should review these advisories alongside Microsoft's updates.
Breaches & Incidents
French Bank Crédit Mutuel Arkéa Targeted in $133M Fraud Attempt French cooperative bank Crédit Mutuel Arkéa was targeted in a cyberattack that enabled fraudulent transactions of up to $133 million, forcing the institution to suspend certain systems to contain the threat. This incident highlights the financial sector's exposure to sophisticated banking trojans and social engineering.
Refrigeration Systems Hacked Again in Europe
Mass-hacks targeting refrigeration systems hit European retailers again, continuing a trend of IoT-targeted attacks that disrupt physical operations. This incident, detailed in the "This Week in Security" report, shows persistent threats against industrial control systems and connected appliances.
Industry & Policy
OpenAI Launches GPT-6 Cyber OpenAI unveiled GPT-6 Cyber, reporting that the model helped discover 948 Linux privilege escalation exploits and 81 unknown Firefox flaws. This announcement signals a shift toward AI-assisted vulnerability research at scale, raising both defensive capabilities and potential offensive concerns.
Trellix Reports APT Dominance by US-Türkiye Axis Trellix's November 2026 CyberThreat Report notes that APT targeting is dominated by a two-nation axis, with the United States and Türkiye jointly representing over three-quarters of all detections. This geographic concentration requires targeted defense strategies for organizations operating in these regions.
What to Watch
- Patch Tuesday Volume: Monitor today's Microsoft Patch Tuesday for high CVSS scores, given the record-breaking 1,771 CVEs in October's cycle.
- AI-Assisted Exploitation: Track the rollout of GPT-6 Cyber and similar tools, as AI-driven vulnerability discovery may accelerate exploit development timelines.
- IoT Infrastructure Attacks: Monitor European retail sectors for further refrigeration system hacks, indicating persistent IoT botnet activity.
Reader Action Items
- Update Chrome Immediately: Ensure all Chrome browsers are updated to the latest version to protect against the actively exploited CVE-2026-125350 zero-day.
- Audit Third-Party Cloud Access: Review access controls for cloud providers linked to development environments (e.g., Fireworks AI breach) to mitigate supply chain risks.
- Apply CISA KEV Patches: Prioritize patching for OpenSSH, GPUStack, FreeSWITCH, and IBM Aspera Faspex as these are confirmed under active exploitation.
This content was collected, curated, and summarized entirely by AI — including how and what to gather. It may contain inaccuracies. Crew does not guarantee the accuracy of any information presented here. Always verify facts on your own before acting on them. Crew assumes no legal liability for any consequences arising from reliance on this content.
Powered by
