Chrome bug under active attack as Apache and N-able flaws add to a heavy patch day

By The IT Security Desk

Good morning. Start with the browser. CISA's Known Exploited Vulnerabilities catalog lists CVE-2026-125350 in Google Chrome as known to be exploited. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 8.8. Google's advisory lists Chrome up to the fix in 157.0.8103.50 as affected. The same stable-channel update cycle also addressed CVE-2026-125347 (CVSS 9.6, fixed in 157.0.8103.50) and, in a later build, CVE-2026-126859 (CVSS 9.6), CVE-2026-126881 and CVE-2026-126880 (both CVSS 8.8) and CVE-2026-126883 (CVSS 7.5), all listed as fixed in 157.0.8103.78. Update Chrome to the fixed release Google names and confirm the browser has restarted to apply it.

SecurityWeek reported that Apache patched a critical HTTP Server flaw, a mod_http2 race condition found by Anthropic and Google that could let an unauthenticated attacker execute code on servers with HTTP/2 enabled. BleepingComputer reported the same HTTP/2 remote code execution fix. If you run Apache HTTP Server with HTTP/2, apply the vendor's patch.

Active exploitation ran in parallel. BleepingComputer reported attackers exploiting a newly disclosed N-able N-central zero-day dubbed "4EverAble2Shell" within hours of a proof-of-concept release to deploy cryptocurrency miners, with researchers reporting at least 21 affected systems, 19 of them on the company's latest security update. BleepingComputer also reported a worm-like malware toolkit named SCKit deployed in recent ScreenConnect attacks on managed service providers, built to spread from infected customer devices to MSP technicians' machines and reach further managed networks. MSPs should treat both as urgent.

More from the day: Help Net Security reported PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25 shipped on November 12, fixing 52 security vulnerabilities and ending support for PostgreSQL 14. BleepingComputer reported a campaign dubbed "wfx-loot" using 4,837 compromised GitHub accounts to probe 61,764 repositories and push secrets-stealing malware. CISA published an advisory on Siemens Industrial Edge Management and Node2Shell; check your setup against Siemens' guidance. Help Net Security reported EfficientIP Research Labs traced a ClickFix campaign using fake Zillow pages to install NetSupport RAT on Windows. The Record reported the DOJ and FBI announced a $1.2 billion seizure tied to the Binance theft and a FaceStealer takedown, both responding to North Korea-linked operations.

Zoom out: Two separate remote-management and MSP tools — ScreenConnect and N-able N-central — were being abused in live attacks on the same day.

Vulnerability in focus

CVE-2026-125350 — Google. CVSS 8.8 CISA lists it as known to be exploited.

Affected: chrome.

What to do: Follow the vendor advisory for the fixed release and any interim mitigation.

What we're tracking

Help Net Security: Google smart glasses privacy features cover wearers and the people around them Read it
BleepingComputer: New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks Read it
The Record: Feds announce seizure of $1.2 billion from Binance theft; also takedown of ‘FaceStealer’ tools Read it
The Register: OpenAI launches security products, tells orgs they’re doomed if they don’t use them Read it

Sources

Google smart glasses privacy features cover wearers and the people around them Help Net Security
New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks BleepingComputer
Feds announce seizure of $1.2 billion from Binance theft; also takedown of ‘FaceStealer’ tools The Record
OpenAI launches security products, tells orgs they’re doomed if they don’t use them The Register
ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories The Hacker News
Apache Patches Critical HTTP Server RCE Found by Anthropic, Google SecurityWeek
Siemens Industrial Edge Management CISA
Who Runs the Ransomware Group Qilin? Krebs on Security
Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters Help Net Security
PostgreSQL security update fixes 52 vulnerabilities, ends support for PostgreSQL 14 Help Net Security
Hackers compromise 4,800 GitHub accounts to steal cloud credentials BleepingComputer
New N-able "4EverAble2Shell" zero-day exploited hours after PoC released BleepingComputer
United to block customers from using AI agents, citing cyber threats The Record
Apache HTTP Server patches critical HTTP/2 remote code execution flaw BleepingComputer

Share this issue

Facebook · X · Reddit · LinkedIn · WhatsApp · Email · Bluesky

Summarized from the linked reports and the advisory record by the desk. Verify against the original sources before citing.

All briefings →