Cyber news on November 10, 2026

1. 0105:26 UTC

   Chrome update patches XML zero-day exploited in the wild

   2 outlets · first: gbhackers.com Vulnerability

   Machine summary Google's Monday Chrome update fixed nine vulnerabilities, including CVE-2026-125350, a high-severity use-after-free in the browser's XML component that the company said is being exploited against users. On November 6, a researcher told Google about the vulnerability, and the patches arrive in Chrome 157.0.8103.50/.51 for Windows and Mac, plus 157.0.8103.50 for Linux. SecurityWeek counts it as the eighth Chrome zero-day exploited in 2026, and CISA had not listed it in its Known Exploited Vulnerabilities catalog at the time of reporting.

   1. Google's Monday Chrome update fixed nine vulnerabilities, one of which the company said is being exploited against users, according to SecurityWeek
   2. SecurityWeek counts the flaw as the eighth Chrome zero-day exploited in 2026, after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046 and CVE-2026-87491
   3. Six high-severity flaws in WebGL, FileSystem, Compositing, GPU, V8 and XML were also patched, plus two medium-severity uninitialized resource issues in the GPU component
   4. The fixes arrive with Chrome 157.0.8103.50/.51 on Windows and Mac, and with 157.0.8103.50 on Linux.
   5. CISA had not added CVE-2026-125350 to its Known Exploited Vulnerabilities catalog at the time of reporting, and Google released no details on the attacks

   Reported by gbhackers.com and securityweek.com.

   • Google
   • CISA
   • SecurityWeek
   • Chrome
   • CVE-2026-125350

2. 0210:04 UTC

   ESET: Turla used Cereal malware against government Exchange servers

   2 outlets · first: bleepingcomputer.com Threat intelligence

   Machine summary ESET researchers reported that the Turla group deployed a toolset called Cereal to intercept email on Microsoft Exchange servers at government organizations in Kazakhstan and Romania.

   1. ESET states the Romanian organization was compromised on December 23, 2025, and that the toolset selectively collected correspondence with NATO and EU representatives
   2. CerealBox injects into Exchange's EdgeTransport.exe process and hijacks existing transport agents' handlers, executing commands in memory without registering a new transport agent or interrupting mail delivery, per the report
   3. CerealNeuron awaits encrypted web requests on paths resembling legitimate Exchange services and executes a CerealRunner wrapper carrying attacker code, with commands including email retrieval and Active Directory queries for users, groups and DNS records
   4. The reports describe Turla, also called Snake, Secret Blizzard and Waterbug, as having been active for over twenty years, with ties to Russia's Federal Security Service (FSB).

   Reported by bleepingcomputer.com and The Hacker News.

   • NATO
   • Active Directory
   • ESET
   • CerealNeuron
   • Cereal
   • CerealBox

3. 0313:30 UTC

   Ring's new drone and patrol robot add moving cameras to its cloud stack

   2 outlets · first: techcrunch.com Security

   Machine summary Ring announced Ring Robotics on November 10, 2026, with an indoor drone that flies to triggered alarms and a business robot that streams continuous 4K video to the Ring mobile app. The drone is controlled through Amazon's Alexa Home Map and records in 2K with LED-assisted low-light video.

   1. Amazon-owned Ring announced a robotics division, Ring Robotics, on November 10, 2026, alongside two devices: a home security drone and an enterprise security robot (TechCrunch).
   2. Ring Drone Cam is billed by the company as a "flying indoor security camera" that records in 2K, carries LED lights for low-light video, and rests inactive in a docking bay when not flying (TechCrunch).
   3. The drone is designed to fly to the location of a triggered Ring alarm, for example a back door, and can be scheduled for patrols and controlled through Amazon's Alexa Home Map (TechCrunch).
   4. Ring Rover Cam is a roving business robot that streams continuous 4K video to the Ring mobile app and can start recording automatically when it detects a human (TechCrunch).
   5. Rover Cam can be set to follow specified patrol routes at specified times inside a user's business premises (TechCrunch).

   Reported by techcrunch.com and Seeking Alpha.

   • Amazon
   • Ring
   • Ring Drone Cam
   • Ring Robotics
   • Alexa Home Map
   • Ring Rover Cam

4. 0419:07 UTC

   Office servicing channels named in exploited Outlook advisory

   2 outlets · first: bleepingcomputer.com Security

   Machine summary Microsoft states the flaw requires a user to open a specially crafted message file, needs network connectivity, and cannot be triggered through the Preview Pane. In its advisory, the company withheld details of the incidents it saw; the flaw remained unannounced until the patch shipped.

   1. According to SecurityWeek, patches addressed 1,094 vulnerabilities, 726 affecting Windows, 174 affecting Office, 59 affecting SQL Server, 53 affecting developer tools, 27 affecting SharePoint Server, 20 affecting Azure, and nine affecting Exchange Server; Microsoft additionally republished 165 third-party CVEs.
   2. Microsoft credited two researchers for the Outlook finding, and one researcher’s acknowledgment mentioned Anthropic’s Claude AI model; BleepingComputer reported October 2026 set the prior record with 1,411 flaws.

   Reported by bleepingcomputer.com and securityweek.com.

   • Microsoft
   • Windows
   • SQL Server
   • SharePoint Server

Each summary and its key facts are a machine summary of the reports linked under it; the outlets, times and counts come from those reports' own records. How a rundown is built.