IT Security News Roundup: 2026-11-10 Morning

IT Security News: Morning roundup, 2026-11-10

Summary

The most pressing threads in this window were actively exploited flaws and state-linked operations. Iran-linked sabotage of French retail refrigeration, a Russia-aligned Turla campaign against government Exchange servers, and North Korean laundering of Binance-hack proceeds all surfaced at once. Enterprise patching was just as urgent, with SAP's four maximum-severity flaws, new CISA catalog entries, and N-able taking its N-central platform offline. AI tooling appeared throughout, from the Fireworks AI breach and a malicious package that backdoored AI coding tools to frontier labs pushing deeper into developer workflows. For defenders, the immediate task is patching on short deadlines, while AI platforms and developer tooling need to be treated as part of the attack surface.

1. SAP's monthly Security Patch Day fixed four flaws that need no login, each rated CVSS 10.0, including two enabling remote code execution. Three affect the NetWeaver application server, and one affects Web Dispatcher, which handles inbound web requests.
2. The author argues that cloud providers saying their AI capacity is "sold out" through 2027 muddles the market. Capacity is tight, but that is different from being unavailable, and the wording misleads enterprise architects into thinking their AI projects are blocked.
3. The French government attributed an October attack on refrigeration controllers at about 700 retail sites to a cyber unit linked to Iran's Islamic Revolutionary Guard Corps. The attackers raised defrost temperatures, causing food losses and, in at least 15 cases, fires.
4. ESET found a modular .NET toolset, named Cereal, on Exchange servers at government organizations in Kazakhstan and Romania, attributed to the Russia-aligned Turla group. It copies selected email from mail flow and hides its commands inside ordinary Outlook Web Access, Autodiscover, and ActiveSync traffic.
5. CyberScoop's coverage of the same ESET report stresses that the Cereal tools lack many obvious indicators of compromise or malicious telemetry. That makes them hard to spot in government email systems.
6. The analysis argues that Anthropic and OpenAI are extending into the developer workflow to keep users, and OpenAI agreed on November 4 to buy Pierre, the maker of Code Storage. The author warns developers against locking into one vendor and calls for shared spaces where competing agents can work together.
7. A suspected North Korean group is using disposable memecoins to move cryptocurrency stolen in the record Binance hack. Fake trading activity makes the criminal proceeds look like ordinary investment returns.
8. Windows settings backup will be enabled by default on eligible devices starting with Windows 11 version 26H2. The feature, renamed from Windows Backup for Organizations, backs up supported settings and installed Microsoft Store apps, and roaming settings management moves into the same policy tools.
9. Anthropic released Claude Fable 5.2 and Mythos 5.2, which share one model but have different safeguards. Mythos access is restricted to vetted cybersecurity and life sciences organizations, and both models are priced 20% lower than their predecessors.
10. Binance is investigating claims by ShinyHunters of a breach and says the claims appear to be a scam. No breach has been confirmed in the source material.
11. CISA added CVE-2026-123218 and CVE-2026-116779, which affect IBM Aspera Faspex and SignalWire FreeSwitch, to its Known Exploited Vulnerabilities catalog. Federal agencies were told to patch within three days because attacks are already using them.
12. CISA added four actively exploited vulnerabilities to its KEV catalog on November 9. Federal agencies have until November 12 to remediate affected systems and complete forensic triage.
13. N-able took its hosted N-central platform offline after a researcher disclosed more than 30 zero-day flaws. Attackers could use them for remote code execution, credential theft, and creating administrator accounts.
14. Cyber Security News ranks nine cyber risk quantification platforms for 2026. It groups them into FAIR-methodology vendors, telemetry-based engines, and ratings-based platforms, and notes that one vendor was listed twice in its source sheet.
15. A second report on the French attribution, from The Hacker News, says the controllers were broken into on the night of October 11 and that the attackers are tied to the IRGC. It is the same incident covered elsewhere in this roundup.
16. North Korean hackers are using decentralized exchange liquidity pools to sit between wallets holding stolen Binance assets and wallets collecting the proceeds. This makes the money harder to trace and freeze.
17. Dark Storm Team uses Telegram as both a hacktivist broadcast channel and a cybercrime storefront, advertising DDoS attacks, database dumps, compromised accounts, and surveillance access. A StealthMole investigation ties these offers to crypto payments and repeated channel migrations.
18. Cyber Security News ranks the top 10 digital forensics tools for 2026, scoring them on artifact depth, evidentiary rigor, and cost. The list covers mobile extraction, disk and artifact analysis, memory analysis, and open-source tools.
19. Fireworks AI disclosed a wider breach exposing customer account information, billing records, secrets, datasets, and incomplete model weights. Its November 9 update links the activity to LLMjacking, in which stolen access to language models is resold through illegal routing gateways.
20. Cyber Security News ranks the top 10 GRC platforms for 2026, weighting usability and time-to-value as heavily as framework depth. The ranking argues that most risk programs fail because of poor adoption, not weak analytics.
21. Apple released iOS 27.2.1 and iPadOS 27.2.1 on November 9, fixing nine vulnerabilities in iMessage, Bluetooth pairing, AirPlay, App Intents, and the brotli library. The flaws range from memory corruption to weak authorization and broken rate limits.
22. Cyber Security News ranks the top 10 GenAI SOC copilots for 2026, dividing them into assistants that summarize and draft inside analysts' workflows and agents that autonomously work tier-1 queues under policy guardrails.
23. Progress Software released its November 2026 WS_FTP Server Service Pack to fix seven flaws that could expose credentials, allow access to restricted files, or let remote attackers disrupt file transfers. Windows installations should move to WS_FTP Server 2025.0.5, also identified as version 10.0.5.
24. A fake Ruby package called strutil-core ran a credential-stealing worm on installation, targeting 51 types of credentials. It also wrote backdoors into AI coding tool settings and could delete a victim's home folder if they tried to revoke a stolen GitHub token.
25. Cyber Security News reports the same iOS 27.2.1 update, noting it runs on iPhone 11 and later and on several recent iPad models. It fixes nine flaws across Bluetooth, AirPlay, and Messages.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution
2. Panic over cloud capacity is out of hand
3. France Blames Iran For Attacks On Hundreds Of Supermarkets
4. Turla’s Cereal malware turns victims’ Exchange servers into spy hubs
5. Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments
6. Anthropic and OpenAI are coming for the development workflow
7. Hackers Use Memecoins To Launder Stolen Binance Funds
8. Windows settings backup is on by default starting with Windows 11 26H2
9. Anthropic unveils Claude Fable 5.2, Mythos 5.2 with coding gains and lower prices
10. Binance Investigates ShinyHunters Breach Claims
11. IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks
12. CISA Adds Four Exploited Flaws to KEV, Sets Nov. 12 Patch Deadline
13. N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days
14. Top 9 Best Cyber Risk Quantification (CRQ) Tools in 2026 [Ranked & Scored]
15. France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites
16. North Korean Hackers Create Fake Meme Coins to Launder Stolen Funds From $6.4 Billion Binance Hack
17. Dark Storm Team Offers DDoS Attacks, Database Dumps, and Stolen Access Through Telegram Channels
18. Top 10 Best Digital Forensics Tools in 2026 [Ranked & Scored]
19. Fireworks AI Hit by LLMJacking Cyberattack Exposing Customer Data and AI Model Weights
20. Top 10 Best GRC Platforms in 2026 [Ranked & Scored]
21. Apple iOS 27.2.1 Fixes 9 Security Vulnerabilities Affecting iMessage, Bluetooth, and AirPlay
22. Top 10 Best GenAI SOC Copilots in 2026 [Ranked & Scored]
23. Progress WS_FTP Server Fixes 7 Security Flaws Allowing Credential Theft, Path Traversal, and Remote Attacks
24. Malicious Ruby Gem Steals 51 Types of Credentials and Plants Backdoors in AI Coding Tools
25. Apple Fixes 9 Security Vulnerabilities in iOS 27.2.1, Including Bluetooth Pairing and iMessage Flaws