cybr.cx Daily Digest — November 11, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-123158 | OpenSSH on Linux | No CVSS in NVD feed
OpenBSD's OpenSSH on Linux contains an authentication bypass triggered by an unexpected status code or return value. CISA added this to the KEV catalogue on November 9th with a patch deadline of November 12th — that's tomorrow. If you're running SSH on Linux (and you are), treat this as an emergency patch cycle. Check your exposure now.

⚠️ Actively exploited — CVE-2026-124194 | Microsoft Office Outlook | No CVSS in NVD feed
A missing user-interaction guard in Outlook allows an unauthenticated attacker to spoof content over a network. It was added to the KEV on November 10th with a November 24th remediation deadline. Phishing campaigns that abuse Outlook spoofing are notoriously effective — expect this to appear in business email compromise chains quickly if it isn't there already.

⚠️ Actively exploited — CVE-2026-111560 & CVE-2026-116606 | Barracuda Networks ESG and multiple products | No CVSS in NVD feed
Two Barracuda flaws are being actively exploited right now, with an unusually tight CISA remediation deadline of November 13th — two days away. CVE-2026-111560 is an OS command injection affecting the ESG, Load Balancer, ADC, WAF, and others. CVE-2026-116606 is an authentication bypass that lets an unauthenticated attacker import a crafted backup archive and modify configuration. Barracuda appliances have been a persistent nation-state target — the November 13th deadline is not a suggestion.

⚠️ Actively exploited — CVE-2026-20320 | Cisco BroadWorks | No CVSS in NVD feed
An XXE (XML External Entity) injection flaw in Cisco BroadWorks lets an unauthenticated remote attacker read sensitive configuration data. BroadWorks underpins enterprise and carrier-grade unified communications at scale, so credential and configuration exposure here has significant downstream blast radius. Patch deadline is November 24th, but given active exploitation, don't wait.

⚠️ Actively exploited — CVE-2026-125350 | Google Chromium | No CVSS in NVD feed
A use-after-free in Chromium's XML component allows a remote attacker to execute arbitrary code inside the sandbox via a crafted webpage. This affects Chrome and all Chromium-derived browsers. Sandbox escape chaining is the obvious next concern — push browser updates enterprise-wide today.

⚠️ Actively exploited — CVE-2026-102895 | GPUStack | No CVSS in NVD feed
GPUStack's improper authentication vulnerability allows unauthenticated access to full administrative functions: user and model management, persistent admin API-key creation, disclosure of worker and cloud-provider secrets, and remote code execution via inference backend endpoints. The CISA patch deadline was November 12th. If you're running GPUStack in any AI/ML pipeline, isolate it immediately.

CVE-2026-76966 | SAP NetWeaver / ABAP Platform | CVSS 8.9
An unauthenticated attacker can send a crafted RFC request that exploits memory management logic errors in the SAP Kernel, leading to memory corruption with high impact on confidentiality and integrity. SAP ABAP systems routinely hold financial and HR data that makes them high-value targets. Patch or restrict RFC exposure at the network perimeter.

CVE-2026-105020 / 105021 / 105023 / 105026 / 105490 | Windows Advanced Rasterization Platform (WARP) | CVSS 8.8
Five heap- and stack-based buffer overflow vulnerabilities in Windows WARP all allow a local authenticated attacker to elevate privileges. Individually these require existing access, but as a post-exploitation step in a broader chain they're attractive. Apply November Patch Tuesday updates and prioritise endpoints where untrusted users have local access.

CVE-2026-125406 | Ettercap ≤ 0.8.4.1 | CVSS 8.8
A stack buffer underwrite in Ettercap's telnet dissector allows an attacker to send a telnet stream with more backspace characters than preceding bytes, writing below the stack buffer. Since Ettercap typically runs as root, successful exploitation means full system compromise. If Ettercap is deployed in any network monitoring capacity, update immediately.

Headline News

Iran's IRGC Blamed for Coordinated Attack on French Supermarket Refrigeration Systems

France has formally attributed last month's cyberattacks on commercial refrigeration units across French supermarkets to Iran's Islamic Revolutionary Guard Corps, with French Foreign Minister Jean-Noël Barrot describing the campaign as "unprecedented in both its scale and its level of aggression." The attacks disrupted temperature-controlled storage across multiple retail chains, raising immediate food safety concerns. What makes this incident significant from a practitioner standpoint is the target class: industrial refrigeration controllers, typically OT/ICS equipment with minimal authentication, long patch cycles, and near-zero monitoring. The attribution signals that state-sponsored actors are willing to cause tangible civilian disruption through critical infrastructure attacks that stop well short of traditional definitions of armed conflict — a threshold-testing tactic that security teams defending food supply, cold chain logistics, and retail OT environments should take seriously.

Backdoored AWS Integrations Leveraged in Supply Chain Secret-Theft Campaign

Researchers have uncovered a supply chain attack in which trusted AWS integrations were backdoored to exfiltrate secrets from downstream environments. The technique exploits the implicit trust that cloud-native pipelines place in third-party integrations — once a connector or plugin is compromised, it inherits the IAM permissions and secret access of every tenant using it. The attack underscores a known but under-resourced risk: organisations audit their own code but rarely apply equivalent scrutiny to the integrations they pull into production. Practitioners should audit third-party AWS integrations for unexpected outbound network calls, review IAM permission scopes granted to connectors, and treat secrets rotation post-incident as mandatory rather than optional.

Fireworks AI Breach Cascades to Notion Users

A security breach at Fireworks AI, a third-party AI inference vendor, has impacted Notion and its customers. Notion disclosed the incident via its help centre, confirming that customer data was potentially exposed through the compromised vendor relationship. This is a textbook fourth-party risk scenario: Notion customers had no direct relationship with Fireworks AI but are nonetheless affected by its security posture. As AI inference providers become deeply embedded in SaaS product stacks — often with access to customer-submitted content — the security vetting of AI vendors is fast becoming a first-order concern for enterprise risk teams. If your organisation uses Notion, review the vendor's disclosure for scope details and assess what data may have been in scope.

Schrödinger's Feed

RIKEN has upgraded its Reimei-Fugaku hybrid quantum platform by swapping its 20-qubit Quantinuum H1 processor for the 56-qubit H2 trapped-ion system, then successfully ran end-to-end hybrid quantum-classical chemistry simulations against Japan's Fugaku supercomputer — one of the most powerful classical HPC systems on the planet. The collaboration achieved accurate biomolecular excited-state energy calculations, a problem class that is genuinely hard for classical systems alone. Trapped-ion architectures like H2 are notable for high gate fidelity rather than raw qubit count, which matters more for near-term cryptographically relevant algorithms than headline qubit numbers suggest. Practitioners tracking the cryptographic timeline should watch fidelity and error-correction milestones at least as closely as qubit counts — fault-tolerant quantum computation capable of threatening RSA and ECC is a fidelity problem as much as a scale problem.

/dev/random

Synaptics has apparently decided the most effective use of its patent portfolio is to stop open-source DisplayLink driver development in its tracks, leaving Linux users who rely on USB display adapters staring at a very expensive paperweight. The patent claims have forced a halt to driver work, meaning docking stations and multi-monitor setups using DisplayLink technology may stop functioning or lose support on Linux kernels going forward. It's a reminder that the open-source ecosystem's dependency on hardware vendors playing nicely with driver development is a fragile social contract, not a technical guarantee. At least it's not a CVE — just a perfectly ordinary way to brick a monitor with intellectual property.