Wednesday 11 November 2026 | Daily Security Briefing from APJONE.UK
🎙️ Listen
Security News
Microsoft November Patch Tuesday — Record ~1,235 CVEs
Microsoft's November Patch Tuesday is a record-breaker, covering approximately 1,235 CVEs across Windows, Office, Exchange, SharePoint, and Azure. The critical headline is CVE-2026-124194 — a zero-day remote code execution flaw in Microsoft Outlook that is actively exploited in the wild. Opening a crafted email is sufficient to trigger execution. Additional critical patches cover Exchange Server, SharePoint, the Windows LDAP stack, and Windows Search. Organisations should prioritise Outlook and Exchange deployments today.
Microsoft Security Update Guide
Barracuda Email Security Gateway — Exploit Chain Achieving Root Access
A newly disclosed exploit chain against Barracuda ESG appliances combines a pre-authentication bypass with a command injection vulnerability to achieve root-level access. The chained exploit is being actively used against unpatched devices. Barracuda has released patches and urges customers to verify firmware versions. Given the platform's prior exploitation history, treat any unverified device as potentially compromised.
Xen Orchestra Authentication Bypass — VM Hijacking in the Wild
Xen Orchestra, the management interface for XCP-ng virtualisation hosts, has an authentication bypass flaw actively exploited to seize full control of virtualisation servers. Any XCP-ng estate with Xen Orchestra network-accessible — including internal networks — should restrict access immediately and apply the available patch.
Fireworks AI Breach Expands — Notion AI Conversations Exposed
The October Fireworks AI breach has grown in scope. Investigators confirm exfiltration of billing data, proprietary training datasets, and customer model weights. Notably, Notion AI — which uses the Fireworks AI backend — had user conversation histories accessed. Organisations and individuals using Notion AI should treat their conversation history as potentially exposed.
Turla "Cereal" Malware — NATO Diplomatic Correspondence Intercepted
Russian state threat actor Turla has deployed a new malware toolset named Cereal against government Exchange servers. The campaign targets foreign ministries' Exchange infrastructure to intercept NATO and EU diplomatic correspondence. Confirmed victims include government entities in Romania and Kazakhstan. Organisations with government adjacency running on-premises Exchange should audit for indicators of compromise.
Railway Platform Breach — $740K Fraudulent AI Charges
Developer infrastructure platform Railway has disclosed a breach resulting in approximately $740,000 in fraudulent AI API charges. Up to 100,000 workspace credentials are at risk. The attackers abused Railway's deployment infrastructure to generate AI token charges at scale. Railway users should rotate credentials and audit API usage logs immediately.
Nitori — 37.6 Million Customer Records Stolen
Japanese furniture retailer Nitori has disclosed a breach affecting 37.6 million customer records, including names, addresses, purchase history, and partial payment details. One of the largest retail breaches of 2026, continuing a pattern of major Japanese consumer brands being targeted this year.
Trump Nominates Palantir CISO for CISA Director
President Trump has nominated David LoSapio, currently serving as CISO at Palantir Technologies, to lead the Cybersecurity and Infrastructure Security Agency. If confirmed by the Senate, LoSapio would be the first CISA director with a commercial intelligence technology background rather than a government or military career path.
CISA Known Exploited Vulnerabilities
Two new additions to the KEV catalogue, with a 3-day federal patch deadline:
CVE-2026-123218 — IBM Aspera Faspex: Critical vulnerability in the enterprise file transfer platform. Exploited in the wild. Federal agencies must patch by 14 November 2026.
CVE-2026-116779 — SignalWire FreeSwitch: Vulnerability in the open-source telephony platform. Federal agencies must patch by 14 November 2026.
Have I Been Pwned — New Breach
SberSpasibo (spasibosberbank.ru) — 3,288,711 accounts. Data includes bank card numbers, dates of birth, email addresses, loyalty programme details, and phone numbers. Added: 11 November 2026. Operated by Sberbank, Russia's largest state-owned bank.
Ransomware Activity
100 victims tracked across 21 active groups in the monitoring window.
Interlock (11 victims) 🇺🇸
Five US school districts: Meadows Valley School District, Ridgway School District, Indiana Area School District, Jerome School District, Richmond Public Schools. Healthcare: Southwest Orthopedic (US), Assiniboine Dental (CA), Elmcrest Children's Center (US). Additional: 2 further organisations.
N0n (48 victims)
Continuing pharmaceutical and biotech sweep active across multiple countries.
SilentRansomGroup (4 victims)
⚠️ A&O Shearman 🇬🇧 — Major international law firm (Allen & Overy + Shearman & Sterling merger), with significant government and financial sector client exposure. High-profile claim with serious data risk implications.
Booba Project (6 victims)
⚠️ Four healthcare organisations among their claimed victims.
Dark Project
⚠️ Bear Valley Community Hospital 🇺🇸 — California hospital targeted.
Climax Inc (3 victims)
⚠️ Nepal Electricity Authority — Critical infrastructure / national energy grid. Potential for real-world operational impact.
BYOD (3 victims)
⚠️ Providence (US Healthcare) — Patient data at risk.
Black X (2 victims)
⚠️ DomusVi 🇪🇸 — Major Spanish healthcare group operating residential care facilities.
Play (3 victims)
Signworx 🇬🇧 — UK signage company.
Vortex (3 victims)
⚠️ ALEXION (pharma), PYRAMID HEALTHCARE — Healthcare and pharmaceutical sector.