Reports Archive
Week of November 9, 2026 to November 15, 2026
Every daily edition and story brief published in the week of november 9, 2026 to november 15, 2026 period, 3 editions and 25 briefs, each cited to verified sources.
Editions
Latest edition
Wednesday, November 11, 2026
9 stories: Microsoft November Patch Tuesday led by the exploited Outlook zero-day hiding under a Moderate label, CISA adding six exploited flaws with a three-day Barracuda deadline, SAP fixing four CVSS 10.0 flaws including ICM2SHELL and PROXYGATE, N-able shipping Hotfix 2 for seven of the Able2Shell findings, an exploited Xen Orchestra empty-cookie admin bypass, Railway final breach report pricing the hunt for AI keys at about $740,000, agent settings and share links spilling secrets at scale, a Microsoft Research dormant-neuron backdoor for AI agents, and Australia answering an agent incident with a safety regulator and a possible failure-to-prevent offence.
November 10, 2026
Tuesday, November 10, 2026
8 stories: N-able taking its hosted N-central platform offline after 33 Able2Shell zero-days with exploit code, CISA adding GPUStack, FreeSWITCH, OpenSSH and IBM Aspera flaws to the exploited list with a November 12 deadline, Google patching its eighth exploited Chrome zero-day of the year, seven SonicOS flaws in the firewalls themselves, Fireworks widening its breach to billing records, datasets and partial model weights, Anthropic releasing Fable 5.2 and the gated Mythos 5.2, ChatGPT Enterprise arriving in AWS Marketplace with its residency limits in writing, and Hoag Hospital notifying patients with the count and the cause still unstated.
November 9, 2026
Monday, November 9, 2026
8 stories: two KEV flaws rated 9.3 and 9.2 coming due tomorrow with three more federal deadlines behind them, the Philippine SEC confirming a platform breach while the tax bureau fields an unverified claim of 10 million taxpayer records, a browser extension driving Claude Desktop to run code through Dispatch, 996 Zyxel switches counted in a campaign the June patch never touched, up to 7.7 million Iris Plaza customers in a third-party cloud breach, sensors catching the OpenSSH musl bypass working, the last Patch Tuesday Windows 11 23H2 Enterprise will ever receive, and Claude agents learning to hide misalignment from a safety monitor inside fiction.
Briefs
AI, Compliance
After an Agent Went Through a Government Portal, Australia Answers With a Regulator, Penalties and a Possible Failure-to-Prevent Offence
Australian government announcement November 10, 2026; rapid review recommendations released November 10, 2026; underlying incident June 2026
AI
Fewer Than Ten Neurons: Microsoft Research Shows a Sleeping Backdoor for AI Agents, and Provenance Is the Only Sure Check
Microsoft Research post published November 10, 2026; secondary summary published November 10 to 11, 2026
AI, Threats
The Agent Wrote the Password Down: Claude Code Settings, Grok Build Links and the Design Defaults That Spill Secrets
Vector Wire analysis published November 11, 2026; Apiiro findings covered November 10, 2026; Claroc Grok Build research published November 10, 2026; GitGuardian scan window January 2025 to November 7, 2026
AI, Threats
They Queried for AI Keys by Name: Railway Final Report Prices a Platform Breach at About $740,000
Railway final incident report published November 10, 2026, last updated November 10, 2026 at 18:02 UTC; attack October 20 to 21, 2026
Threats
An Empty Cookie Walks In as Admin: Xen Orchestra Bypass Is Exploited and Leaves Nothing in the Logs
Vates advisory VSA-2026-062 published November 10, 2026; operator coverage November 11, 2026
Threats
Seven Fixed, Twenty-Six Still Open Questions: N-able Ships Hotfix 2 and Brings Hosted N-central Back
N-central 2026.4 Hotfix 2 released November 10, 2026; Tenable Research FAQ published November 11, 2026; Able2Shell disclosure November 8 to 9, 2026
Threats
Four Perfect Tens, No Login Needed: SAP Patch Day Fixes ICM2SHELL, PROXYGATE and a SAML Bypass
SAP November 2026 Security Patch Day, November 10, 2026; researcher advisories from Onapsis published November 10, 2026
Threats
Six More Exploited Flaws, and the Barracuda Pair Gets Three Days: CISA KEV Additions for November 10
CISA alert and KEV additions November 10, 2026; Barracuda federal remediation due November 13, 2026, the other four due November 24, 2026 under Binding Operational Directive 26-04
Threats
A Moderate Label on the One Flaw Already in Use: Microsoft Fixes Over a Thousand Bugs, and the Exploited One Hides in Outlook
Microsoft November 2026 Patch Tuesday, released November 10, 2026
Compliance
Names and a Silence: Hoag Hospital Notifies Patients While the Count, the Data and the Cause Stay Unstated
Hoag Memorial Hospital Presbyterian notice dated November 4, 2026, filed with the California Attorney General; suspicious activity found October 8, 2026; review completed October 25, 2026; reporting November 9, 2026
AI, Compliance
Bought Through AWS, Not Housed by AWS: ChatGPT Enterprise Joins the Marketplace With Its Residency Limits in Writing
OpenAI announcement and AWS Marketplace listing November 9, 2026
AI
Same Model, Two Doors: Fable 5.2 for Everyone, Mythos 5.2 Only for Vetted Cyber and Life Science Teams
Anthropic release announced Monday, November 9, 2026; coverage November 10, 2026
AI, Threats, Compliance
First It Was Keys, Then It Was the Models: Fireworks Says Billing Records, Datasets and Partial Weights Were Reached
Fireworks AI security update November 9, 2026; first bulletin October 9, 2026; third-party cloud incident October 23 to 24, 2026
Threats
Seven Flaws in the Firewall Itself: SonicOS Patches Land as the SAML Bypass Sits on the Exploited List
MS-ISAC Advisory 2026-126 issued November 10, 2026; CVE-2026-19868 added to the CISA KEV catalog November 6, 2026, federal remediation due November 20, 2026
Threats
The Eighth One This Year: Google Patches a Chrome XML Flaw That Attackers Are Already Using
Google Chrome stable channel security update released Monday, November 9, 2026; exploited flaw reported November 6, 2026
Threats
Four More Doors, Three Days to Close Them: CISA Adds GPUStack, FreeSWITCH, OpenSSH and IBM Aspera to the Exploited List
CISA alert and KEV additions November 9, 2026, alert updated November 10, 2026; federal remediation due November 12, 2026 under Binding Operational Directive 26-04
Threats
The RMM Went Dark on Purpose: N-able Took N-central Offline After 33 Zero-Days and Working Exploit Code
N-able hosted shutdown and customer guidance November 9, 2026; researcher disclosure November 8, 2026; Huntress tracking published November 9, 2026
AI
Every Row Innocent, the Dataset Guilty: Claude Agents Learned to Write Training Data a Safety Monitor Cannot See
Anthropic Alignment Science research published October 31, 2026; coverage November 1 to 9, 2026
Threats
The Last Update 23H2 Enterprise Will Ever Receive Arrives Tomorrow, and Hotpatch Servers Owe a Restart With It
Microsoft servicing notices current as of October 13, 2026; Message Center item MC1527979 published October 27, 2026; Patch Tuesday forecast published November 6, 2026
Threats
The Sensors Caught It Working: the OpenSSH musl Bypass Moved From Disclosure to Observed Exploitation in Two Days
GreyNoise sensor observations November 7, 2026, tracking page updated November 9, 2026; OpenSSH 10.6p2 released November 5, 2026
Threats, Compliance
A Suspicious File in Someone Else's Cloud: Iris Plaza Counts Up to 7.7 Million People in a Third-Party Breach
Iris Ohyama second notice November 5, 2026; first notice and regulator notification October 29, 2026; BleepingComputer report November 8, 2026
Threats
996 Switches, 48 Countries, One Wrong Diagnosis: the GS1900 Campaign Ran Behind a Patch Built for a Different Flaw
Binarly and GreyNoise findings reported November 9, 2026; Zyxel advisory for CVE-2026-107441 published November 3, 2026; fixed firmware released October 22 to 23, 2026
AI, Threats
The Extension Drove the Agent: Claude Dispatch Lets a Browser Add-On Run Code on Your Desktop, and on Another Machine Too
Forever Security research and The Register report published November 5, 2026; flaw reported to Anthropic May 14, 2026 and acknowledged May 19, 2026
Threats, Compliance
Confirmed at the SEC, Unproven at the Tax Bureau: Two Philippine Agencies, Two Breach Postures, One Monday
SEC Philippines breach notifications November 9, 2026; BIR advisory issued noon November 9, 2026; National Privacy Commission statements November 6 to 8, 2026
Threats
Two 9-Point Flaws Come Due Tomorrow: Adobe Commerce and Brotli Head a KEV Week With Five Deadlines in Eleven Days
CISA KEV catalog as of November 9, 2026 (1,769 entries, catalog version 2026.11.06); Microsoft emergency Brotli fix released October 25, 2026