Cyber news, week of November 9, 2026

Machine summary A security researcher published proof-of-concept exploits for more than 30 alleged zero-day vulnerabilities in N-able's N-central RMM platform on November 8, 2026, in a GitHub repository, BleepingComputer reports.

1. Late on November 8, 2026, a security researcher made public over 30 alleged zero-day flaws affecting N-able's N-central RMM platform, also putting proof-of-concept exploits into a GitHub repository.
2. The disclosed flaws span authentication bypass, credential disclosure, arbitrary file write, directory traversal, stored XSS, XXE injection and remote code execution (BleepingComputer).
3. One documented chain abuses an unauthenticated XXE in N-central's service-import feature to steal a local session, reset a password and run commands as the nable user, and can create an enabled Default Administrator account with attacker-controlled credentials, per the researcher's demonstration described by BleepingComputer.
4. According to BleepingComputer, testing targeted pre-release N-central Appliance 2026.4.0.31, one individual said, and that person believes most, if not all, of the vulnerabilities affect earlier versions as well.
5. The researcher confirmed to BleepingComputer that the vulnerability discovery was AI-assisted.

Reported by bleepingcomputer.com and TechTarget.

• BleepingComputer
• N-able
• TechTarget
• nable user
• N-central Appliance 2026.4.0.31
• N-central

Machine summary A security researcher told TechCrunch they found a password in the source code of Wyndham's Android app that granted access to a Salesforce-hosted database containing customer names, email addresses, member numbers and stored login tokens. Wyndham confirmed an incident, said it took steps to address it, and stated its security teams have no evidence of unauthorized access. The credential was revoked after TechCrunch contacted the company, and the reports state Wyndham did not say whether it has logs showing prior access.

1. A security researcher told TechCrunch they found a password embedded in the source code of Wyndham's Android app that granted access to an internal database hosted by Salesforce.
2. According to Wiggins, the reachable data included customer names, email addresses, Wyndham member numbers, stored customer login tokens (JWTs), and Wyndham files and documents
3. After TechCrunch contacted Wyndham's cybersecurity staff, the exposed credential was revoked, which the reports say prevented further access to the database
4. A Wyndham spokesperson said the company "has taken steps to address the issue" and has "no evidence of any unauthorized access," and would not say whether server logs could show prior access

Reported by techcrunch.com.

• Salesforce
• TechCrunch
• JSON Web Tokens (JWTs)

Machine summary Google's Monday Chrome update fixed nine vulnerabilities, including CVE-2026-125350, a high-severity use-after-free in the browser's XML component that the company said is being exploited against users. On November 6, a researcher told Google about the vulnerability, and the patches arrive in Chrome 157.0.8103.50/.51 for Windows and Mac, plus 157.0.8103.50 for Linux. SecurityWeek counts it as the eighth Chrome zero-day exploited in 2026, and CISA had not listed it in its Known Exploited Vulnerabilities catalog at the time of reporting.

1. Google's Monday Chrome update fixed nine vulnerabilities, one of which the company said is being exploited against users, according to SecurityWeek
2. SecurityWeek counts the flaw as the eighth Chrome zero-day exploited in 2026, after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046 and CVE-2026-87491
3. Six high-severity flaws in WebGL, FileSystem, Compositing, GPU, V8 and XML were also patched, plus two medium-severity uninitialized resource issues in the GPU component
4. The fixes arrive with Chrome 157.0.8103.50/.51 on Windows and Mac, and with 157.0.8103.50 on Linux.
5. CISA had not added CVE-2026-125350 to its Known Exploited Vulnerabilities catalog at the time of reporting, and Google released no details on the attacks

Reported by gbhackers.com and securityweek.com.

• Google
• CISA
• SecurityWeek
• Chrome
• CVE-2026-125350

Machine summary ESET researchers reported that the Turla group deployed a toolset called Cereal to intercept email on Microsoft Exchange servers at government organizations in Kazakhstan and Romania.

1. ESET states the Romanian organization was compromised on December 23, 2025, and that the toolset selectively collected correspondence with NATO and EU representatives
2. CerealBox injects into Exchange's EdgeTransport.exe process and hijacks existing transport agents' handlers, executing commands in memory without registering a new transport agent or interrupting mail delivery, per the report
3. CerealNeuron awaits encrypted web requests on paths resembling legitimate Exchange services and executes a CerealRunner wrapper carrying attacker code, with commands including email retrieval and Active Directory queries for users, groups and DNS records
4. The reports describe Turla, also called Snake, Secret Blizzard and Waterbug, as having been active for over twenty years, with ties to Russia's Federal Security Service (FSB).

Reported by bleepingcomputer.com and The Hacker News.

• NATO
• Active Directory
• ESET
• CerealNeuron
• Cereal
• CerealBox

Machine summary Ring announced Ring Robotics on November 10, 2026, with an indoor drone that flies to triggered alarms and a business robot that streams continuous 4K video to the Ring mobile app. The drone is controlled through Amazon's Alexa Home Map and records in 2K with LED-assisted low-light video.

1. Amazon-owned Ring announced a robotics division, Ring Robotics, on November 10, 2026, alongside two devices: a home security drone and an enterprise security robot (TechCrunch).
2. Ring Drone Cam is billed by the company as a "flying indoor security camera" that records in 2K, carries LED lights for low-light video, and rests inactive in a docking bay when not flying (TechCrunch).
3. The drone is designed to fly to the location of a triggered Ring alarm, for example a back door, and can be scheduled for patrols and controlled through Amazon's Alexa Home Map (TechCrunch).
4. Ring Rover Cam is a roving business robot that streams continuous 4K video to the Ring mobile app and can start recording automatically when it detects a human (TechCrunch).
5. Rover Cam can be set to follow specified patrol routes at specified times inside a user's business premises (TechCrunch).

Reported by techcrunch.com and Seeking Alpha.

• Amazon
• Ring
• Ring Drone Cam
• Ring Robotics
• Alexa Home Map
• Ring Rover Cam