Cyber Security News

Hacking Editorial Brief — November 11, 2026

Microsoft Patches Actively Exploited Outlook Zero-Day Among 1,093 November Vulnerabilities

Microsoft released November 2026 Patch Tuesday updates addressing 1,093 newly disclosed security flaws, including CVE-2026-124194, an Outlook spoofing zero-day actively exploited in attacks, according to Cyberpress. Microsoft has not disclosed exploitation scale, targeted sectors, or attacker identity. Separately, CISA added CVE-2026-20320, a high-severity Cisco BroadWorks vulnerability, to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch within two weeks, though the agency did not specify victim organizations or campaign scope. Security researchers also report active exploitation of two Barracuda Email Security Gateway flaws—CVE-2026-116606 and CVE-2026-111560—that can be chained to bypass authorization and gain root access, though exploitation timelines and affected customer counts remain unconfirmed. Additionally, researchers observed hackers actively exploiting CVE-2026-123158, the SSHole vulnerability in OpenSSH, to execute commands, steal credentials, and establish persistent access on Linux systems.

Russian State-Linked Hackers Compromised Government Email Servers in Romania and Kazakhstan for NATO, EU Espionage

Russian state-linked hackers compromised government email servers in Romania and Kazakhstan to intercept messages exchanged with NATO and European Union entities, according to The Record. Researchers have not disclosed the compromise timeline, data exfiltration volume, or specific government agencies affected. The campaign represents continued targeting of Eastern European government communications infrastructure, though attribution confidence levels and specific Russian intelligence service involvement were not detailed in available reporting. Separately, a threat actor used compromised AWS IAM credentials for Qubole's data platform to access and exfiltrate data from multiple customers' AWS environments between October 14-26, according to Bleeping Computer. The company has not disclosed the number of affected customers or data types accessed.

Additional Reported Activity: France continues to attribute October's supermarket refrigeration attacks affecting approximately 700 stores to Shahid Kaveh, a cyber unit of Iran's Islamic Revolutionary Guard Corps, with Tehran denying involvement. The FBI warned companies of growing threats to operational technology systems following the UK grocery store refrigeration attacks. Google researchers warned of Remus Stealer malware targeting email credentials, offered to hackers for $1,000 monthly subscriptions. Federal prosecutors in Seattle filed charges against a Florida man in a cryptocurrency theft case involving compromised video game accounts that allegedly facilitated theft of over $220,000. Google's Threat Analysis Group reported that the Artex AI penetration testing tool has been weaponized by threat actors to automate attack chains with reduced technical skill requirements.

Sources: Cyberpress · The Record · Bleeping Computer · Security Week · Bleeping Computer · Bleeping Computer