Google patches exploited Chrome zero-day

Hi there, this is your daily ☕️ Cyberpresso.

Google patches exploited Chrome zero-day LINK

• Google has fixed nine Chrome flaws, among them a V8 engine bug tracked as CVE-2026-125350 that attackers were already exploiting in real-world attacks, pushing out new versions of the browser for Windows, Mac, and Linux.
• The flaw is a use-after-free problem in XML, where the browser keeps using memory that was already freed, which can crash the app, corrupt memory, or let attackers run their own code or gain higher access.
• An anonymous source reported the bug on November 6, and Google is withholding technical details until most users are updated; it marks the eighth exploited Chrome zero-day patched so far in 2026.

SAP fixes four maximum-severity flaws LINK

• SAP patched four flaws today in its monthly Security Patch Day, each rated the top severity score of 10.0, and all exploitable by attackers over the network without logging in or any action from a user.
• Three sit in the NetWeaver application server and one in the Web Dispatcher: the ICM and Web Dispatcher bugs let attackers run code, while a SAML2 flaw (CVE-2026-120017) lets them sign in as any user, even privileged ones.
• SAP gives no workaround for the SAML2 and Gateway flaws and urges prompt patching; for the memory-corruption bugs, a patched Web Dispatcher can shield the ICM, or turning off WebSocket support works as a last resort.

Barracuda flaws hit email security devices LINK

• Barracuda warned that hackers are exploiting two recently patched flaws in its Email Security Gateway appliances, which when chained together let attackers bypass authorization and gain root access to targeted devices.
• Barracuda issued patches for the two bugs, tracked as CVE-2026-116606 and CVE-2026-111560, one week ago, and on Monday said the pair is now being abused in attacks against a small number of customers.
• Exploitation needs access to the admin interface, so Barracuda urged customers to restrict that interface to trusted internal networks, and to turn automatic patching back on if they had switched it off.

N-able pulls servers over zero-days LINK

• N-able has taken its hosted N-central servers offline and told on-premises customers to shut down their own servers after a researcher revealed more than 30 vulnerabilities, collectively named Able2Shell, in the remote management tool.
• Security researcher Sean Bales published the zero-day flaws with working proof-of-concept exploits tested against N-central version 2026.4.0.31, covering credential theft, directory traversal, cross-site scripting, and remote code execution that can grant rogue admin access and root-level commands.
• N-able said it has seen no signs of active exploitation and is building a hot fix; hosted N-central classic access is down worldwide, though Ecoverse services like Asset View, Patching, and scripting stay online.

Stolen Qubole access exposes AWS secrets LINK

• Attackers broke into the AWS accounts of several Qubole customers between October 14 and 26, stealing stored secrets and copying data from S3, cloud security firm Wiz said today, using credentials for the account Qubole's platform runs through.
• The intruder abused AssumeRole requests, which still worked because old, unused customer roles kept trusting Qubole's AWS account; the attacker then read Lambda variables, Secrets Manager, and SSM parameters, testing the stolen keys with TruffleHog.
• Wiz says a source-IP condition alone would have blocked every intrusion it saw, and urges affected firms to check CloudTrail logs from October 1, rotate exposed secrets, and remove or restrict unneeded Qubole roles.

Strategies & Tactics

> A Journey into Claude's Sandbox: A security researcher got Claude to describe and expose its own sandbox internals, extracting authentication tokens from memory and bypassing network restrictions, revealing real containment weaknesses.

> Help defend against memory poisoning in Amazon Bedrock AgentCore with multi-layer write validation: Validate content before it is written to an AI agent's long-term memory, scoring each write to allow, isolate, or block poisoned instructions that would otherwise persist across sessions.

> Beyond ARTEX: 45 Agentic Attack Frameworks, What They Hunt For, and How to Find Them: Most open-source AI hacking tools don't ship secret-scanners themselves but hand their agent a shell to download one, and dozens leave consoles exposed online.

> What building a realistic Azure attack environment teaches you about cloud security: Building a realistic Azure attack lab reveals that cloud security depends on identity and tightly guarded automation, since network perimeters no longer apply.

> Honeypots for AI Agent Insider Threats: Plant fake opportunities for malicious actions inside AI agents during deployment to catch, expose, and discourage agents that misuse their access.

> The attack chain behind the v1.107.0 LiteLLM release: An administrative key accidentally committed to public code and never revoked let attackers seize GitHub owner access and publish a poisoned release.

Other news you might like

• Binance Warns of Apple iOS Flaw That Could Expose iPhone Users' Private Keys LINK

• Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars LINK

• Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments LINK

• Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware LINK

• CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws LINK

• Malicious Ruby Gem Steals 51 Types of Credentials and Plants Backdoors in AI Coding Tools LINK

• Fireworks AI discloses new breach after cloud provider hack LINK

Trending tools

CtrlOps: a local-first desktop app for managing Linux servers with an AI-assisted terminal, real-time monitoring, and agentless SSH access across your infrastructure. LINK

Fraud Blocker: detects and blocks bots, click farms, and fake clicks on ad campaigns, so you only pay for genuine traffic and leads. LINK

Axari: an AI security teammate that works inside Slack or Teams, automating recurring tasks and goals so teams spend less time managing security workflows. LINK

Plango: monitors AI coding agents on your Mac, guarding secrets and files, blocking suspicious network activity, and scanning projects for vulnerabilities locally. LINK

AllModels: a unified OpenAI-compatible API for accessing abliterated models, letting you compare providers, latency, pricing, and capabilities from one endpoint. LINK

mcpgawk: a local guard that intercepts MCP tool calls, pausing any modified after approval until you review and permit them. LINK

Trending papers & reports

Double-blind safety audits let an outside tester grade a company's secret AI model using secret test questions, with locked-down hardware ensuring neither side sees the other's proprietary material, proven in a Google DeepMind pilot. LINK

Agent skill fingerprinting lets sellers of reusable AI task recipes prove ownership and trace which buyer leaked a copy with ~99% accuracy, surviving edits and paraphrasing without hurting how the recipe performs. LINK

Connected-car attack testing links fake traffic messages to real driving reactions in simulation, giving carmakers a reusable library of 76 attack scenarios to see how spoofed data derails autonomous vehicles before roads are affected. LINK

Chatter Attack shows how malicious prompts can trick a chatbot into endless self-doubting replies up to 31x longer than normal, running up latency and cloud bills for companies serving these models. LINK

Permission enforcement sits in front of existing apps as a gatekeeper, blocking all tested attempts to access other users' data while wrongly blocking under 0.7% of legitimate requests, with no app changes needed. LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!