OpenSSH fixes a musl error that could become a successful login ↗
A failed password calculation could match the marker for an account with no password. Specific Linux configurations are affected, and installing a patch is not the final step.
Major vulnerabilities
GhostMap crashes Android before an installed app is opened ↗
The demonstration challenges the assumption that declining permissions removes every installation risk. Researchers have not observed this persistent crash technique in real attacks.
Xen Orchestra attack exposes the gap between patching a login and securing a host ↗
Two Vates advisories describe an exploited chain with different remediation states. Fixing its first step does not resolve every route to a host.
Ray-Ban Meta glasses checked app signatures, but a paired phone could turn the check off ↗
A researcher describes running a self-signed app on borrowed smart glasses, then bypassing a signature check added in a later firmware version. The test required control of the paired phone, and the final fix has not been independently confirmed.
SignDrop turns a Windows security feature into a path to SYSTEM access ↗
A public proof of concept abuses Windows log authentication to escalate privileges. An independent team reports a successful but unreliable test; local access and specific conditions are required, and Microsoft has not confirmed the flaw.
N-central's new post-patch attack chain hinges on an exposed legacy API ↗
Huntress's November 12 update narrows the server-side risk to systems with a nondefault legacy API enabled and internet-accessible.
Apache fixes a critical HTTP/2 flaw that could let attackers run code ↗
CVE-2026-119618 affects Apache HTTP Server 2.4.55 through 2.4.70. Version 2.4.71 fixes the synchronization flaw.
Edit fewer than 10 'sleeping' neurons and an AI assistant can become a sleeper agent: Microsoft research shows a hard-to-spot backdoor ↗
AI agents can now run commands, edit files, and install software for us. On November 10, Microsoft Research described a method called Lazarus that plants a backdoor by rewriting fewer than 10 normally inactive neurons in a language model, with no retraining. The model behaves normally and passes ordinary tests until a secret trigger appears, then outputs an attacker's command. Microsoft says it has not seen anyone use the technique in the wild. This is a lab-demonstrated attack, with figures from Microsoft's own experiments and no independent replication yet.