Microsoft fixes 1,235 flaws as Turla turns Exchange servers into spy tools

Microsoft Patch Tuesday hits record 1,235 flaws, including exploited Outlook zero-day

Microsoft’s November 2026 Patch Tuesday fixes a record 1,235 vulnerabilities, 66 of them Critical, including 48 remote code execution flaws. About 639 affect Windows products and components. The release excludes 108 flaws patched earlier in the month and follows 1,411 fixes in October, as Microsoft leans on AI to find and patch bugs. One flaw is being actively exploited: an Outlook spoofing vulnerability that lets an unauthenticated attacker send a crafted message file and trick a user into opening it. Outlook then connects to an attacker-controlled network location without the usual external-content warning, exposing the user’s NTLMv2 hash, which can be cracked offline to impersonate the account. Exploitation needs network connectivity and user interaction.

Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day →

Topics: Patch Tuesday & security updatesWindows securityZero-day vulnerabilities

Turla hijacks government Exchange servers with Cereal malware to spy on NATO and EU

ESET attributes a new modular .NET toolset called Cereal to Turla, the Russian FSB-linked group also known as Secret Blizzard and Waterbug. Researchers found it in late 2025 at a government body in Kazakhstan, silently monitoring outgoing email, and a month later at a Romanian government agency compromised on December 23, 2025, configured to collect correspondence with NATO and EU representatives. CerealBox injects into Exchange’s EdgeTransport.exe process and inspects mail without disrupting delivery, targeting messages with .DOC, .DOCX and .PDF attachments. CerealNeuron awaits encrypted web requests on paths resembling legitimate Exchange services. No external command-and-control infrastructure exists; the compromised server itself is the control point.

Turla hackers use new Cereal malware to spy on govt Exchange servers →

Topics: State-sponsored hacking

Researchers unlocked and started cars after finding admin:admin credentials

Security researchers Shubham Shah and Sam Curry reported in early 2026 that they could unlock doors, start and stop engines, sound horns and pull live telemetry from vehicles on two unnamed automakers’ remote-access platforms, and view location, mileage and door status for accounts they did not own. The first chain used path traversal to reach an administrative console behind a web application firewall that still accepted admin:admin, then ran code on identity servers to mint valid mobile-app tokens. The second relied on hard-coded administrator credentials in a client-side JavaScript bundle meant for staging but live in production. Both automakers used ForgeRock identity infrastructure; researchers blamed configuration, not the platform. Both fixed the issues and rotated credentials within about two hours.

Researchers Hacked Cars Because the Automaker Used ‘Admin:Admin’ as a Password →

Binance warns iOS sandbox escape Worse Query exposes wallet secrets

Binance warned that an iOS sandbox escape dubbed Worse Query could expose seed phrases, private keys and login credentials across the ecosystem, advising users who suspect a breach to move funds to a new wallet on a clean device and reset active sessions. The flaw lets malicious apps reach other apps’ private data without a jailbreak or kernel exploit. It affects iOS 26.7.1, 27.0.1 and 27.2, and a working proof-of-concept went public Monday. Apple shipped iOS 27.2.1 the same day without mentioning the flaw. Engineer Christoph Kolbicz demonstrated it with WQ Files, which on iOS 27 can access apps, backups and restores. Installation via sideloading tools such as AltStore creates the required App Group container.

iOS Sandbox Escape Puts Crypto Wallet Data at Risk →

Topics: Crypto security