IT Security News Roundup: 2026-11-12 Overnight

IT Security News: Overnight roundup, 2026-11-12

Summary

Between midnight and six CET, the stories clustered around software supply chains, AI infrastructure and credential exposure, with a strong thread of attackers exploiting trust: trusted vendor access, trusted tooling, and trusted hardware or certificates. Several incidents show a single weak link spreading outward, whether a hijacked remote-management panel, a leaked cloud identity, or a flaw in a shared inference engine. The Patch Tuesday wave and fresh vulnerability disclosures add pressure on defenders who already have too much to triage. For a reader responsible for security, the practical lesson is to audit what each trusted component can reach and to patch the flaws that attackers are already using.

1. Node.js released fixes for 16 vulnerabilities across its 22.x, 24.x and 26.x branches, seven rated high. Some flaws could expose TLS private keys or let remote attackers crash servers, so operators should move to the patched v22.23.5, v24.22.3 or v26.13.1 builds.
2. eMudhra, a certificate authority that has since been disgraced, blamed a buggy script for issuing badly weak certificates after it could not obtain the hardware it needed to generate them. The episode is a reminder that certificate issuance depends on sound key generation.
3. Attackers abused cloud-hosted ConnectWise ScreenConnect panels to push a custom toolkit called SCKit to at least 288 managed devices across 48 organizations, with Huntress seeing all hosts hit within about 90 minutes. Remote-management tools are a high-value target because they already hold trusted access.
4. CVE-2026-124848 affects Kiro CLI before version 2.27.0 on macOS and Linux, where session storage was readable by every local user. That exposed transcripts and prompt history could include credentials or source code, so users should upgrade.
5. In a Risky Business podcast episode, Tom Uren and Amberleigh Jack discuss France's attribution of freezer hacks to Iran's Revolutionary Guard cyber units, which Tom argues looks more like Russian sabotage tradecraft. They also note that Chinese operators are becoming faster, noisier and stealthier.
6. Fireworks AI said its investigation found further malicious activity beyond the earlier incident, affecting account and billing data, secrets, datasets and incomplete models for a limited set of accounts. The disclosure also ties the breach to exposure of Notion AI chats.
7. An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, to run code on a NEAR AI inference server. Requests in confidential mode, which run inside a trusted execution environment, may also have been visible to the attacker.
8. Git 2.56.1 fixes CVE-2026-111760, an integer truncation flaw in index handling that lets a malicious repository run code when cloned recursively with its submodules. Matching fixes shipped for the 2.50 through 2.55 series, so developers should update their Git installations.
9. A threat actor used compromised IAM credentials belonging to Qubole's big data platform AWS account to reach and exfiltrate data from several customers' AWS environments. The case shows how a single trusted cross-account identity can expose many downstream tenants.
10. Vates VMS warned that a critical authentication bypass in Xen Orchestra, tracked as VSA-2026-062 and not yet assigned a CVE, is being actively exploited to gain admin access. A malformed cookie passes an empty object into authentication, so administrators should patch urgently.
11. Adobe released nine bulletins covering 110 CVEs, led by an Adobe Connect update with 24 CVEs, 18 of them Critical with a top CVSS of 10.0. Microsoft's November release is again very large, at roughly 1,090 new CVEs, so prioritization matters more than raw counts.
12. Check Point Research linked three China-nexus espionage clusters through shared infrastructure and code similarities to the Sparrow malware ecosystem. They have targeted telecoms, governments, militaries and critical infrastructure across Latin America, Asia and Europe over the past year.
13. The SANS Internet Storm Center's stormcast for 12 November covered the day's threat activity, with the post itself offering no text preview beyond a link to the full podcast.
14. Barracuda disclosed "make-me-root" vulnerabilities in its email security gateways, which could let an attacker gain root on the appliances. Someone appears to be scanning for exposed devices, so administrators should check exposure and patch quickly.
15. Darkreading reports that a Claude Code command can inadvertently save files containing credentials and other sensitive data into public Git repositories. Thousands of secrets have leaked this way, creating gaps for organizations that let AI coding agents commit code.
16. A flaw tracked as CVE-2026-126087 in OpenJD Sessions for Python, and in the AWS Deadline Cloud worker agent, lets an authenticated user with job-submission rights run arbitrary code as the worker OS user. That user can then reach the AWS credentials held by the agent, so the fix is to upgrade to openjd-sessions 0.11.0 and the worker agent 0.33.0.
17. Turla, the Russian cyberespionage group, deployed a previously undocumented .NET framework called Cereal against government organizations in Romania and Kazakhstan by abusing Microsoft Exchange. ESET found its CerealBox component runs inside EdgeTransport.exe and targeted messages involving NATO and EU addresses.
18. Darkreading reports on a Chinese big-data system that scrapes large amounts of information about people abroad, which could be used to identify and target individuals in Taiwan's chip industry. The project is described as a potential tool for targeting and exploiting those people.
19. The Smashing Security podcast episode 492 covers a scheme where hackers remotely locked Chinese SUVs and demanded payment for the digital keys, alongside three men charged over deepfake impersonations of company bosses that stole around $130 million.
20. Thales and Equinix argue that private interconnection and post-quantum-ready encryption should be combined to protect AI workloads and sensitive data across clouds. The piece stresses that the useful life of data, given "Harvest Now, Decrypt Later" risks, should guide encryption and migration priorities.
21. AWS previewed the digital sovereignty sessions at re:Invent 2026, which runs in Las Vegas from November 30 to December 4 with more than 2,200 sessions. The post is a guide to content rather than a security disclosure, so it is mostly useful for planning.
22. Wordfence 9.1.0 adds a Security News Widget for WordPress alerts and research, faster firewall rule updates, and Live Traffic logging for application password and REST API login failures. Site owners get more visibility into login abuse and configurable attack alerts.
23. Vanderbilt University began restoring some services after a ransomware incident detected on Monday, which a BYOD group claimed responsibility for. The disruption affects a major academic institution and shows how quickly ransomware can hit university systems.
24. Japan is pushing emergency funding for cybersecurity as AI-assisted breaches rise. The package includes public-private cyber responders, an AI-focused team run by the economic ministry, and more room to use the government's new active cyber-defense powers.
25. IT Security Guru offers ten ways cybersecurity vendors can stand out in a crowded market, as new products and entrants keep arriving. The article is a marketing and positioning piece rather than a security incident, so it is mainly relevant to vendors.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Node.js Fixes 16 Security Flaws That Could Expose TLS Private Keys and Crash Servers Remotely
2. Disgraced former CA eMudhra blames buggy script for hopelessly weak certificates
3. Hackers Hijack ConnectWise ScreenConnect to Deploy SCKit Malware Across 288 Devices at 48 Organizations
4. CVE-2026-124848 – Incorrect default permissions on session transcripts and prompt history in Kiro CLI
5. Srsly Risky Biz: Iranian hacks with Russian characteristics
6. Fireworks AI Confirms Wider Breach Affecting Customer Datasets, Model Weights and Notion AI Chats
7. SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users
8. Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones
9. Hackers exploit trusted AWS access to breach multiple cloud environments
10. Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access
11. The November 2026 Security Update Review
12. Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem
13. ISC Stormcast For Thursday, November 12th, 2026 https://isc.sans.edu/podcastdetail/10176, (Thu, Nov 12th)
14. Barracuda’s email security gateways bitten by make-me-root vulns
15. AI Coding Agents Leak Thousands of Secrets to GitHub
16. CVE-2026-126087 – Untrusted search path in OpenJD Sessions for Python and the AWS Deadline Cloud worker agent
17. Russian Hackers Exploit Government Email Infrastructure in Romania and Kazakhstan
18. Chinese AI Project Scouts Spies in Taiwan Chip Industry
19. Smashing Security podcast #492: How hackers turned Russian cars into pumpkins
20. Beyond Connectivity: Building Trust for AI, Sovereignty, and the Quantum Era
21. Digital sovereignty at re:Invent 2026: Sessions you won’t want to miss
22. What’s New in Wordfence 9.1.0: Security News, Faster Rules and Smarter Alerts
23. Vanderbilt University reels following ransomware attack claimed by BYOD group
24. Japan Pushes Emergency Funding for Cybersecurity as AI-Assisted Breaches Rise
25. 10 Ways Cybersecurity Vendors Can Stand Out in a Crowded Market