Security news.
Today's security landscape is dominated by critical zero-day discoveries, active exploits against enterprise infrastructure, and high-impact patch cycles. Attackers are actively targeting newly surfaced flaws in Google Chrome, Barracuda Email Gateways, and N-able platforms, while SAP and Apple deliver sweeping monthly fixes. Concurrently, federal agencies and intelligence teams warn of sophisticated espionage campaigns and supply-chain intrusions across multiple sectors.
Google Patches Eighth Actively Exploited Chrome Zero-Day
Google released emergency security updates addressing CVE-2026-125350, a high-severity use-after-free flaw in the XML component that is currently being exploited in the wild.
N-able Shuts Down N-central After 33 Zero-Days Dropped Online
N-able took its hosted platforms offline and advised on-premises administrators to shut down servers following the public disclosure of over 30 vulnerabilities known as "Able2Shell" with accompanying proof-of-concept exploits.
Attackers Actively Exploiting Root-Access Barracuda ESG Flaws
Barracuda Networks warned that threat actors are exploiting two recently patched vulnerabilities in its Email Security Gateway to execute remote commands with root privileges.
SAP Fixes Four Maximum-Severity CVSS 10.0 Flaws
SAP's November patch update resolved 35 security issues, highlighted by four critical CVSS 10.0 vulnerabilities in NetWeaver and Web Dispatcher that permit unauthenticated remote code execution.
CISA Adds Four Actively Exploited Flaws to KEV Catalog
CISA added vulnerabilities affecting GPUStack, SignalWire FreeSWITCH, OpenBSD OpenSSH, and IBM Aspera Faspex (CVE-2026-123218) to its Known Exploited Vulnerabilities catalog.
Qubole Supply Chain Breach Affects Dozens of Organizations
Intruders abused compromised Qubole IAM credentials to systematically steal sensitive customer files, cloud environment variables, and authentication keys across multiple enterprises.
Turla Deploys New Cereal Malware to Intercept Government Exchange Emails
Russian state-sponsored threat group Turla is targeting Microsoft Exchange servers at government organizations with a novel modular toolset designed to silently spy on and exfiltrate email communications.
Unpatched iOS Sandbox Escape Threatens Crypto Wallet Keys
Binance warned of a newly published iOS sandbox escape dubbed "worse_query" affecting iOS 26 and 27 that allows malicious apps to read cross-application data, leaving private keys and credentials exposed.