This week brought another outsized Patch Tuesday, with 1,093 CVEs from Microsoft, and 12 new KEV entries. The last two editions covered malware arriving through channels developers trust, LiteLLM on PyPI and then Cursor's extension marketplace, and this week it arrived with the checks passing. Ethersphere's malicious npm release carried valid provenance next to an Apple-notarized desktop build, and every role the Qubole attacker assumed in customer AWS accounts presented the correct External ID. Each check confirmed the request came through the expected path, and in both cases the attacker controlled that path.
Just after midnight UTC on November 9, @ethersphere/bee-js 13.3.0 landed on npm, and within half an hour Swarm Desktop 0.56.2 followed on GitHub. SafeDep's analysis found both carried a loader built to steal Swarm wallet keys. The npm package had a valid provenance attestation, the macOS app was notarized by Apple, and the Windows payload used a validly signed ScreenConnect client.
The commit, tag and release were made by bee-worker, Ethersphere's own release bot. SafeDep says the attacker controlled two Ethersphere GitHub accounts, doesn't know how, and reads the bot's activity as a compromised bot account or token rather than a stolen npm token. Branch protection never came into play, because the malicious code "never went onto a branch." In SafeDep's words, "anyone who can create a release in this repository can publish code to npm with provenance."
SafeDep's scanner called the package malicious four minutes after it was published, about 70 minutes before npm removed it. The desktop release stayed up for about 8.5 hours and drew 65 downloads on GitHub. Version 13.2.0 is clean again on npm, and Swarm Desktop 0.56.3 replaces the bad build.
SafeDep found the 13.3.0 tarball still on Huawei Cloud's npm mirror after npm had removed it. Any build that resolves packages through that mirror could still have fetched it.
From October 14 to 26, someone used IAM credentials from an AWS account associated with Qubole to assume roles that customers had created for the Qubole integration. Wiz's account, published November 9 with help from Sentra and Mandiant, says every AssumeRole it attributes to the actor carried the External ID the trust policy required, "and every one succeeded." Most of those roles were otherwise unused, and in most environments these were the only vendor role assumptions in October.
Inside, the actor read Lambda environment variables, pulled values from Secrets Manager and SSM Parameter Store, and ran TruffleHog to test what it found against AWS, Entra ID and Okta. It downloaded entire S3 buckets in some sessions, and those reads don't show up in CloudTrail management events. Wiz doesn't know how the Qubole-side credentials were obtained and gives no victim count.
The External ID was never a secret. Wiz notes it "is logged in plaintext in CloudTrail," and the condition only proves the caller knows the value the customer and Qubole agreed on. Wiz also warns that "rotating a credential does not end temporary sessions that were already issued."
Check the trust policies on your vendor integration roles for a source IP condition. Qubole's legitimate traffic all came from AWS addresses while the attacker's came through Mullvad VPN exits and an OVH server, so Wiz says that condition alone would have blocked every assumption it observed.
Railway published its incident report on November 10, three weeks after the attack. Early on October 20, the attacker used a previously unknown flaw to partly escape the filesystem isolation around builds and took a build credential. An internal Temporal instance accepted that credential, and through it the attacker read the stored histories of 353 builds and copied Railway's monorepo.
The next morning, "an erroneously defined OIDC binding configuration in one of our cloud environments" gave the attacker a short-lived cloud credential. Over the next few hours it queried the variables database and, in two bursts, decrypted variables for "at most, 1.85% (~100,000) of workspaces." The queries matched variable names against the attacker's own regular expressions, ranking AI provider keys first. Tokens for 1,852 users, including GitHub OAuth tokens and bring-your-own agent keys, were exposed too.
Railway estimates about $740,000 in fraudulent AI usage, is working with providers on refunds and says it will cover some of the losses itself. It believes the attacker ran agent fanouts on "abliterated models with no safeguards." Railway evicted the attacker about 26 hours after the first exploit, and each build now runs in its own short-lived VM with a credential that can push one OCI image.
Which of your projects stores the most keys as platform variables? Railway says the attacker singled out customers with many variables.
On November 4, OpenAI described an October run against the Linux kernel. Its pipeline scanned about 5,034 security-relevant locations, roughly 7% of the codebase, narrowed them to 2,308 candidates, reproduced 1,724 and produced working local privilege-escalation exploits for 948 distinct bugs. The API bill was $1,213,430, or $1,279 per exploit, and in a sample of 166 exploits OpenAI found 10 new exploitation techniques.
OpenAI valued the results at $18.9 million to $66.3 million, using the $20,000 to $70,000 that Pwn2Own and TyphoonPWN pay, and notes that these aren't actual payouts. Security researchers reviewed each exploit, patch and proposed severity before anything went to maintainers. In an early experiment, 20 of 200 apparently successful exploits had used a different zero-day than the one assigned, and OpenAI added checks.
A day later OpenAI launched GPT-6 Cyber, the model behind the Linux run. OpenAI's launch post sets its 948 exploits against 166 for GPT-5.6 Sol on the same harness, and adds 81 previously unknown Firefox vulnerabilities that it says Mozilla rated high severity. Access is limited to selected Daybreak Red customers, and OpenAI rates the model "Critical" under its Preparedness Framework.
OpenAI's advice for the near term is that a low-privileged account on a system that isn't fully patched "should be considered functionally equivalent to root access for a well-resourced threat actor." That's every CI runner, shared build host and multi-tenant container where outsiders get a shell, and OpenAI points to isolation like Firecracker and gVisor to limit the blast radius.
• Barracuda Email Security Gateway CVE-2026-116606 and CVE-2026-111560, CVSS 9.3 and 8.6, in this week's TL;DR. A failed password change leaves request handling running, an unauthenticated upload restores a backup whose checksum is MD5 over the file plus a hardcoded secret, and a timezone value reaches a script that runs under sudo. Version 9.4.0.027 is vulnerable and 9.4.0.029 fixes it. The command injection also affects Barracuda's Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. CISA added both to KEV on November 10 with a November 13 deadline. (watchTowr, CISA)
• Cisco BroadWorks CVE-2026-20320. An unauthenticated XXE in the OCI XML parser on port 2208, which Cisco fixed in August. Malbear Labs found it as the entry point for the agent-run intrusion in this week's TL;DR. CISA added it to KEV on November 10 with a November 24 deadline. (Malbear Labs, Infosecurity, CISA)
• Microsoft Outlook CVE-2026-124194, CVSS 6.5, the only Microsoft bug under attack in November's Patch Tuesday. A crafted message file makes Outlook connect to an attacker's server without the usual external-content warning and hand over the user's NTLMv2 hash. The victim has to open the file, since the Preview Pane doesn't trigger it. It was exploited as a zero-day, and CISA added it to KEV on November 10 with a November 24 deadline. (Microsoft, ZDI, CISA)
• Google Chrome CVE-2026-125350, a use-after-free in Chrome's XML handling that Google says has an exploit in the wild, the eighth exploited Chrome zero-day of 2026 by press tallies. Fixed in 157.0.8103.50/.51 on Windows and macOS and 157.0.8103.50 on Linux. CISA added it to KEV on November 10 with a November 24 deadline. (Google, CISA)
• OpenSSH "SSHole" CVE-2026-123158. It only applies when OpenSSH before 10.6p2 runs on musl libc, without PAM, with password logins accepted, a combination Alpine-based systems can match. There, NCSC NZ says the authentication bypass may let an attacker gain root. Fixed in 10.6p2, and if you can't patch, New Zealand's NCSC says to turn off password authentication. CISA added it to KEV on November 9 with a November 12 deadline. (NCSC NZ, CISA)
• SonicWall SonicOS SSLVPN CVE-2026-19868. When SAML is enabled for SSLVPN logins, a user with valid credentials for another authentication method can get around the SAML control, and the MFA it enforces. SonicWall says it investigated a report of potential exploitation. Fixed in 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8, and if you can't upgrade, SonicWall's November 9 update says to disable or delete any active LDAP, RADIUS and TACACS+ servers on the firewall. CISA added it to KEV on November 6 with a November 20 deadline. (SonicWall, CISA)
• Zyxel GS1900 switches CVE-2026-107441, CVSS 8.8 by Zyxel's rating. The June fix for CVE-2026-7273 checked a counter after the copy that corrupts it, so all ten "fixed" releases stayed exploitable. Binarly found that the exploit behind GreyNoise's August capture, against 996 switches in 48 countries, targets this bug. That makes it a zero-day until firmware 2.90(xxx.3)C0, released October 22, which checks the counter first. Zyxel lists no workaround. It isn't on KEV yet. (Zyxel, Ostorlab, Binarly)
• Also added to KEV this week. GPUStack CVE-2026-102895 (improper authentication), SignalWire FreeSWITCH CVE-2026-116779 (code injection) and IBM Aspera Faspex CVE-2026-123218 (incorrect authorization), all on November 9 with November 12 deadlines. Openwave Webtop Media Transcoder CVE-2026-111793 on November 10. Apple's 2024 pointer-authentication bypass CVE-2024-27834 on November 4. (CISA)
• SAP NetWeaver four CVSS 10.0 flaws in November's Patch Day, all reachable over the network with no login or user interaction: - CVE-2026-76964, memory corruption in the Internet Communication Manager (Note 3778530) - CVE-2026-89126, the same class in Web Dispatcher (Note 3778556) - CVE-2026-89103, broken access control in SAP Gateway (Note 3798345, known as ProxyGate) - CVE-2026-120017, missing authentication in the ABAP SAML2 service provider (Note 3849308)
SAP doesn't report exploitation. (SAP, SecurityWeek)
- Ruby on Rails Active Storage GHSA-f3w6-w445-fwh9, CVSS 9.8. An app that accepts image uploads with the default :mini_magick processor, on an ImageMagick build without a recent hardening check such as Ubuntu 22.04's, can be made to read and write arbitrary files from a single upload, because the analyzer runs at attach time. Greg Molnar demonstrated reading config/master.key and writing it to a public path. Fixed in 8.1.4.1 and 8.0.5.2, part of a release with 21 security fixes. The new policy.xml denies several ImageMagick coders, since denying MSL alone wasn't enough. (Rails, Greg Molnar)
- Git CVE-2026-111760 and five more, fixed November 10 in Git 2.56.1, with backports to 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2 and GitHub Enterprise Server fixes. The worst lets a long index path pass validation under one name and be written under another, which turns a submodule's .git file into a symlink to attacker-controlled hooks during a recursive clone. Another lets a malicious server write outside the reference directory when you clone an empty repository. (Git, GitHub)
- N-able N-central seven CVEs in hotfix 2026.4.1.26, from the 33 alleged flaws in this week's TL;DR: - XXE, CVE-2026-125883 - OGNL injection, CVE-2026-125878 - root via a writable syslog-ng config, CVE-2026-125879 - stored XSS, CVE-2026-125880 - SSRF, CVE-2026-125881 - upload path traversal to code execution, CVE-2026-125882 - an IPC privilege escalation, CVE-2026-91000
N-able reports scanning tied to the published code but no confirmed customer compromise, and Previdian recorded 68 exploitation attempts against one of its honeypots within about 18 hours. (N-able, CSO)
• After Binance, check what your signing systems can approve (Trail of Bits) Why it's worth your time: Trail of Bits reads Binance's own account of the theft. Binance reported no evidence that wallet private keys leaked. A compromised server that was allowed to request signatures got valid ones, and an EIP-7702 delegation then worked as standing authority that kept draining funds deposited after the first theft. The checks are concrete:
• List every service that can request a signature and what it can authorize.
• Treat delegation as an admin privilege.
• Monitor changes to a wallet's authority, not only the transfers.
It's the same pattern as this week's lead, in a custody system.
• Microsoft Advisories, CVEs, and Statistics Reminder (Brian Martin) Why it's worth your time: Before you chart November's Patch Tuesday next to October's, read Martin. Microsoft advisories don't map one-to-one to vulnerabilities, and in September and October, the two largest disclosure months, not one advisory carries a CVSSv3 score between 2.2 and 3.4. He reads that as low-severity fixes shipping without advisories, even though, as he notes, bugs of that kind can feed exploit chains like PHP2Shell. His advice is to lead with the caveats, since that's the only way such a chart has value.
• Detecting sleeper agents hiding in AI model neurons (Microsoft Threat Intelligence and Microsoft Research) Why it's worth your time: Microsoft shows that editing fewer than 10 dormant neurons can plant a payload in an agent model. The model passes every evaluation, then runs an attacker's command when a trigger string shows up in its context. The defense it proposes is plain:
• Diff each checkpoint against the base model it claims to come from, and flag outlier tensors.
• Pair that diff with behavioral scanning.
Microsoft says it hasn't seen attackers use the technique.
• Threat actors use agentic AI tooling to find and abuse exposed secrets (Microsoft Threat Intelligence) Why it's worth your time: Microsoft has watched ARTEX agents search public GitHub for a target's name plus secret and cloud-service keywords since August, then sign in as service principals. In one case they went from search to exfiltrating Azure Key Vault data in five minutes, retrying failed API calls with corrected parameters within about a minute. The post gives sign-in error codes to hunt for: AADSTS7000215 or AADSTS7000222, especially one followed by a success. It also notes that tokens already issued stay valid after you block an IP.
• Even gem list can run someone else's code (Aikido, Hunter Schwartz)
Why it's worth your time: A gem that ships lib/rubygems_plugin.rb gets loaded at the end of gem install and then on every later gem command, including read-only ones like gem list and gem -v. Stable RubyGems and Bundler 4.0.x can't turn that off. The 4.1.0.beta3 opt-in (--no-install-plugin, BUNDLE_NO_INSTALL_PLUGIN=true) stops plugins from running at install time, but not code that loads when your app requires the gem. The post includes the grep to check lockfiles for the four malicious gems it found.
Every Thursday, 1,500+ security leaders get the week in AppSec cut down to a 5-minute read.
Join 1,500+ security leaders. Five minutes, once a week.
Your first issue lands Thursday.
One email a week. Unsubscribe in one click.