Cybersecurity

Microsoft lists an Outlook spoofing flaw as exploited. CISA added CVE-2026-124194 to KEV, with a 24 November deadline for federal agencies.

LNbits 1.7.0 is an urgent security update. Versions before it put funds at risk of theft. Upgrade before running; a patch alone is not recovery.

Vates says a critical Xen Orchestra authentication bypass is being actively exploited and can lead to admin access and XCP-ng root takeover.

Vanta has signed a definitive agreement to acquire Pillar Security. The planned AI Governance product is due in January 2027; no price was disclosed.

NEAR AI says an SGLang flaw let an attacker into one inference server, exposing about 100 users' details. NEAR Protocol was not affected. No CVE is named.

Cisco and IBM plan to add Claude Mythos to security products. Cisco says it is coming soon for select enterprises; IBM plans early 2027.

Chrome 157 fixes an exploited XML zero-day, CVE-2026-125350. Update and relaunch now. Other Chromium browsers should watch for their own fixes.

CISA added IBM Aspera Faspex CVE-2026-123218 to KEV. Patch to 5.0.19.1; IBM lists no workarounds. CVSS says PR:N while IBM text cites an authorised user.

Vanderbilt University reports an active cybersecurity incident and orders device shutdowns. Ransomware and data-theft claims remain unverified.

France attributes the October supermarket fridge cyberattacks to IRGC unit Shahid Kaveh. Focus on defence, warrants and sanctions—not attack theatre.