Chrome bug under active attack as Apache and N-able flaws add to a heavy patch day
CISA flagged an exploited Chrome bug the same day Apache patched a critical HTTP/2 RCE and attackers moved on an N-able zero-day, ScreenConnect-targeted MSPs and 4,800 GitHub accounts.
Start with the browser. CISA's Known Exploited Vulnerabilities catalog lists CVE-2026-125350 in Google Chrome as known to be exploited. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 8.8. Google's advisory lists Chrome up to the fix in 157.0.8103.50 as affected. The same stable-channel update cycle also addressed CVE-2026-125347 (CVSS 9.6, fixed in 157.0.8103.50) and, in a later build, CVE-2026-126859 (CVSS 9.6), CVE-2026-126881 and CVE-2026-126880 (both CVSS 8.8) and CVE-2026-126883 (CVSS 7.5), all listed as fixed in 157.0.8103.78. Update Chrome to the fixed release Google names and confirm the browser has restarted to apply it.
SecurityWeek reported that Apache patched a critical HTTP Server flaw, a mod_http2 race condition found by Anthropic and Google that could let an unauthenticated attacker execute code on servers with HTTP/2 enabled. BleepingComputer reported the same HTTP/2 remote code execution fix. If you run Apache HTTP Server with HTTP/2, apply the vendor's patch.
Active exploitation ran in parallel. BleepingComputer reported attackers exploiting a newly disclosed N-able N-central zero-day dubbed "4EverAble2Shell" within hours of a proof-of-concept release to deploy cryptocurrency miners, with researchers reporting at least 21 affected systems, 19 of them on the company's latest security update. BleepingComputer also reported a worm-like malware toolkit named SCKit deployed in recent ScreenConnect attacks on managed service providers, built to spread from infected customer devices to MSP technicians' machines and reach further managed networks. MSPs should treat both as urgent.
More from the day: Help Net Security reported PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25 shipped on November 12, fixing 52 security vulnerabilities and ending support for PostgreSQL 14. BleepingComputer reported a campaign dubbed "wfx-loot" using 4,837 compromised GitHub accounts to probe 61,764 repositories and push secrets-stealing malware. CISA published an advisory on Siemens Industrial Edge Management and Node2Shell; check your setup against Siemens' guidance. Help Net Security reported EfficientIP Research Labs traced a ClickFix campaign using fake Zillow pages to install NetSupport RAT on Windows. The Record reported the DOJ and FBI announced a $1.2 billion seizure tied to the Binance theft and a FaceStealer takedown, both responding to North Korea-linked operations.
Sources
- Help Net Security — Google smart glasses privacy features cover wearers and the people around them
- BleepingComputer — New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks
- The Record — Feds announce seizure of $1.2 billion from Binance theft; also takedown of ‘FaceStealer’ tools
- The Register — OpenAI launches security products, tells orgs they’re doomed if they don’t use them
- The Hacker News — ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories
- SecurityWeek — Apache Patches Critical HTTP Server RCE Found by Anthropic, Google
- CISA — Siemens Industrial Edge Management
- Krebs on Security — Who Runs the Ransomware Group Qilin?
- Help Net Security — Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters
- Help Net Security — PostgreSQL security update fixes 52 vulnerabilities, ends support for PostgreSQL 14
- BleepingComputer — Hackers compromise 4,800 GitHub accounts to steal cloud credentials
- BleepingComputer — New N-able "4EverAble2Shell" zero-day exploited hours after PoC released
- The Record — United to block customers from using AI agents, citing cyber threats
- BleepingComputer — Apache HTTP Server patches critical HTTP/2 remote code execution flaw