Cyber news on November 12, 2026

1. 0106:41 UTC

   Windows SignDrop proof of concept abuses CLFS mitigation to reach SYSTEM

   2 outlets · first: gbhackers.com Vulnerability

   Machine summary Key facts from the reports:

   1. Naceri said CLFS enforces access checks at the start of log-file creation but the logic can be abused if a privileged process such as Windows Defender later opens the log file, causing the .cnpf authentication file to be created with SYSTEM privileges.

   Reported by gbhackers.com and bleepingcomputer.com.

   • SignDrop
   • Windows Defender

2. 0212:36 UTC

   AIC incident may have exposed NRIC data of 4,064 Singapore staff

   2 outlets · first: databreaches.net Data breach

   Machine summary AIC said it disconnected the Advance Care Planning IT System on November 10 after detecting a cybersecurity incident, restored it on November 12, and reported the matter to police and to the Cyber Security Agency of Singapore. The agency said up to 4,064 employees' names, contact numbers, email addresses and NRIC numbers may have been accessed.

   1. According to AIC, an incident in cybersecurity identified on November 10 could have resulted in unauthorized entry to the personal information of as many as 4,064 staff working for public health care institutions and community care providers.
   2. Information potentially accessed includes names, phone numbers, emails, and NRIC numbers, per AIC's media statement.
   3. The affected platform is the Advance Care Planning (ACP) IT System, used by trained facilitators to record individuals' future care preferences, including end-of-life and long-term care wishes.
   4. AIC took the ACP IT System offline upon detection and stated the system was restored on November 12.
   5. Police authorities received a report filed by AIC, which also alerted Singapore's Cyber Security Agency (CSA).

   Reported by databreaches.net and english.pravda.ru.

   • Cyber Security Agency of Singapore
   • Agency for Integrated Care (AIC)
   • Advance Care Planning (ACP) IT System

3. 0322:17 UTC

   Sony smart TV viewing-data case proceeds past early court stage

   2 outlets · first: The National Law Review Regulation

   Machine summary Litigation alleging Sony smart TVs used automatic content recognition to collect viewing data and share it with third parties will continue on two privacy claims after a California federal court dismissed 15 of 17 claims with leave to amend, the National Law Review reported. Declining to force arbitration as well, the court determined that the limited warranty failed to adequately alert consumers that operating the device might obligate them to arbitration.

   1. A California federal court allowed two privacy claims against Sony to proceed over allegations its smart TVs used automatic content recognition to collect viewing data and share it with third parties, the National Law Review reported.
   2. The court dismissed 15 of the 17 claims in the litigation, granting the plaintiffs leave to amend, according to the report.
   3. According to the report, Sony's request to force arbitration was denied by the court, which found that the limited warranty shipped with the TVs failed to adequately alert buyers that operating the product might obligate them to settle disputes through arbitration.
   4. The National Law Review report notes the court's conclusions remain tied to the allegations and the procedural posture of the case.

   Reported by The National Law Review and National Law Review.

   • National Law Review
   • Sony
   • Sony Smart TVs
   • California federal court

4. 0418:23 UTC

   Goodbody takes client platform offline after 10 November security incident

   2 outlets · first: irishtimes.com Security

   Machine summary Goodbody said it identified a security incident on 10 November 2026 affecting its Goodbody Connect client platform and took it offline as a precautionary measure. The company said there has been no identified impact to client funds and no evidence so far that clients' assets were affected, while whether any customer data was breached remains under investigation.

   1. Goodbody said it identified a security incident on 10 November 2026 affecting its Goodbody Connect platform and took the online platform offline as a precautionary measure
   2. The client portal remained offline for more than two days as of Thursday evening, 12 November 2026, according to a message on the firm's website
   3. According to the reports, independent cybersecurity experts and the company continue to look into whether data belonging to customers has been compromised.
   4. AIB acquired Goodbody in September 2021 for EUR 138 million; the firm employs more than 400 staff and is led by chief executive Martin Tormey

   Reported by irishtimes.com and The Irish Times.

   • The Irish Times
   • AIB
   • Goodbody
   • Goodbody Connect

5. 0510:24 UTC

   Microsoft confirms KB5132061 install failures on PCs with October preview

   2 outlets · first: bleepingcomputer.com Security

   Machine summary Microsoft confirmed that the November 2026 Windows 11 security update KB5132061 fails to install on devices that had the October 2026 non-security preview update KB5127936, with users reporting error codes 0x80070306, 0x800f0989 and 0x800f0993. BleepingComputer also lists earlier 2026 update installation failures involving KB5079391 and KB5089549.

   1. Microsoft blames the failures on machines that had installed the non-security preview update KB5127936 from October 2026, adding that any device without that preview is unaffected.
   2. Affected devices may loop on repeated installation attempts or show error codes 0x80070306, 0x800f0989 or 0x800f0993, both outlets reported.
   3. ZDNET lists the update in Windows Update as 2026-11 Security Update (KB5132061) (26300.9974) and reports the failure was reproduced on a Windows 11 virtual machine.
   4. BleepingComputer notes earlier 2026 update installation problems: KB5079391 pulled in March over 0x80073712 errors and fixes in May for KB5089549 installation failures with 0x800f0922 errors.

   Reported by bleepingcomputer.com and zdnet.com.

   • Microsoft
   • BleepingComputer
   • Windows 11
   • ZDNET
   • KB5132061
   • KB5089549

6. 0618:22 UTC

   Coverage recordmehmetince.net: “22-Year-Old PostgreSQL Bug Turned into Remote Code Execution”

   1 outlet · first: Mehmet Ince Vulnerability

   The outlets that reported this event are listed with links to their reports; no summary of ours passed our automated checks for it, which says nothing about the event (how they work).

   Reported by Mehmet Ince.

   • PostgreSQL

Each summary and its key facts are a machine summary of the reports linked under it; the outlets, times and counts come from those reports' own records. How a rundown is built.