21
Security
Stolen GitHub Accounts Used to Plant CI Secret Stealer in Repositories
Owners of repositories where the stealer ran should revoke tokens and rotate every secret the affected repository can read.
22
Security
Chrome and Firefox ship updates patching more than 180 vulnerabilities
Most of the flaws were found internally or reported by outside researchers, and neither vendor reports any in-the-wild exploitation.
23
Security
Researcher's N-central exploits reportedly bypass recent patch on on-premise servers
N-able urges customers to disable the Legacy API now, since the server-side attack depends on that non-default setting being enabled and exposed to the internet.
24
Security
Notion Customer Chat Data Exposed in Fireworks AI Breach
Fewer than 1% of Notion workspaces were affected, and Notion is asking those users to rotate any credentials they pasted into Notion AI.
25
Security
Node.js Ships 16 Fixes, Two HTTP/2 and HTTPS Flaws Can Crash Servers or Leak Memory
Servers still on end-of-life lines get no patch, and operators on supported lines must upgrade to close the exposure.
26
Security
Unauthenticated MongoDB flaw can crash replica set members during failover
Self-managed operators must upgrade every member, while 8.2 users now face an end-of-life branch with no further security fixes.
27
Security
Attackers use GSocket to keep access to patched Linux servers
Because the tool connects outward to a relay, blocking known IP addresses or domains is much less effective against it.
28
Security
Critical Apache HTTP/2 flaw allows unauthenticated remote code execution
Servers running Apache 2.4.55 to 2.4.70 with HTTP/2 enabled should upgrade to 2.4.71, and the archived mod_h2 project has no fixed release.
29
Security
Rogue ScreenConnect clients breach at least 48 organizations through cloud-hosted panels
The attacks used stolen operator sessions and a flawed third-party extension, so patched clients and tighter session control are the main defences.
30
Security
Baker Tilly notifies clients of data breach at third-party platform
Clients and their dependents face exposure of names and Social Security numbers, with the firm offering two years of credit monitoring.
31
Security
eMudhra Revokes Eight More Intermediate CAs Over Key Handling Concerns
Affected customers are moving to replacement certificates as eMudhra exits publicly trusted TLS issuance and awaits an independent review.
32
Security
Synology patches two DSM flaws that let remote attackers read, write and disrupt NAS devices
Owners of Synology NAS units should install the latest DiskStation Manager builds now, since the more serious flaw is rated 9.8 out of 10.
33
Security
Startup unveils offline model to flag engineered and natural pathogens
Access stays limited to vetted testers while national labs and government agencies assess how well it performs.
34
Security
Maersk confirms breach of legacy system as WhiteArmor demands $5 million
Maersk says no sensitive data has been confirmed disclosed and customer systems and shipment booking are unaffected.
35
Security
Fan fiction readers and authors split as AO3 stays offline
With the archive down for up to four weeks, copied stories and a surge in rival sign-ups are testing who controls fan work.
36
Security
Tens of thousands of Grok-built apps left open on the web, some exposing internal business data
Affected organisations must now find and secure their own apps, because SpaceXSI has not committed to contacting the owners of the remaining open apps.
37
Security
CISA Flags Active Exploitation of Cisco BroadWorks and Openwave Flaws
Federal agencies face a November 24 deadline to patch two flaws that attackers are already using, even though fixes have been available.
38
Security
Railway breach led to about $740,000 in unauthorized AI charges across customer workspaces
Affected customers should rotate exposed secrets, since filing a charge dispute alone does not revoke a compromised key.
39
Security
Microsoft Shows Fewer Than 10 Neurons Can Backdoor an AI Model
The edit needs only write access to model weights, so anyone who can alter a checkpoint, from insiders to publishers on public hubs, could plant such a trigger.
40
Security
Microsoft's November Patch Tuesday fixes an actively exploited Outlook spoofing flaw
Organisations running Windows 11 23H2 Enterprise or Education editions will receive no further monthly security updates after this release.