Chrome zero-day, 4,800 GitHub accounts hit, critical Synology NAS flaw

Google patches eighth actively exploited Chrome zero-day of 2026

Google released emergency updates for a Chrome vulnerability exploited in the wild, the eighth such zero-day patched this year. Tracked as CVE-2026-125350, the high-severity flaw is a use-after-free in Chrome’s XML component: the parser frees an object but leaves a dangling pointer, letting attackers manipulate memory and run malicious code. The fix arrived Monday in the Stable Desktop channel, with versions 157.0.8103.50/.51 for Windows and macOS and 157.0.8103.50 for Linux; Google says rollout can take days or weeks, and Chrome applies the update on its next launch. Bug details stay restricted until most users are patched. The earlier seven zero-days this year included V8 and Skia flaws.

Google patches eighth Chrome zero-day exploited in attacks this year →

Topics: Chrome securityZero-day vulnerabilities

wfx-loot campaign compromises 4,800 GitHub accounts to steal cloud credentials

A campaign dubbed wfx-loot used malicious GitHub Actions workflows to steal secrets and cloud credentials. Starting around 12:45 UTC on November 10, attackers used credentials from 4,837 compromised GitHub accounts to probe 61,764 repositories for write access, opening pull requests titled docs: dependency audit notes; 92% remain open. Aikido researchers confirmed secrets stolen from at least 1,835 targets. Victims include Fortune 100 organizations, the US General Services Administration, the French government, Nextcloud and WebdriverIO, and about 50 accounts appear to hold publishing rights on npm, PyPI, Go, crates and Packagist. A 1,500-line shell script harvested tokens, cloud keys and developer credentials, exfiltrating data in under a minute; the payload reached Packagist and Go packages. Owners should check for the wfx-docs branch and rotate secrets.

Hackers compromise 4,800 GitHub accounts to steal cloud credentials →

Topics: Supply chain attacks

Synology patches critical DSM flaw allowing unauthenticated remote access

Synology disclosed two DiskStation Manager vulnerabilities, one rated critical, that could let attackers remotely access and attack NAS devices without logging in. CVE-2026-76954, an SQL injection in DSM’s Auth API, scores 9.8 out of 10 on CVSS and allows reading or writing arbitrary files or denial-of-service attacks. CVE-2026-85101, in DSM’s rsync tool, scores 8.6 and could bypass authentication entirely to read specific files, write arbitrary files or launch limited DoS attacks. Synology published details roughly a month after shipping fixes in October 2026, a common practice giving users time to patch. Fixes cover DSM 7.4, 7.3, 7.2.2 and 7.2.1; users on manual update policies should check for new releases. Viettel Cyber Security and Aytio researchers were credited.

Synology patches a critical NAS flaw that could let attackers in without logging in →

Electron apps trusting revoked eMudhra certificates can be hijacked via unsigned updates

Electron apps that auto-update without verifying signatures and still trust compromised eMudhra certificates let an attacker on the same network install malware. In October 2026, two eMudhra intermediate CAs trusted to sign certificates for any website were found to use tiny private keys that are trivial to recover. Browsers shipped revocation lists within hours, but Electron lacks Chromium’s component updater, so it hardcoded distrust of the specific certificates, requiring a full new app version. Updates without signature verification were previously reported to Proton, Bitwarden, Internxt and Filen. Proton Mail patched quickly, yet on Windows it still updates without a signature check via Squirrel.exe and the OS trust store. Users of affected apps should uninstall them and install patched versions manually.

Electron, we have a problem →

Topics: Supply chain attacks

Google DeepMind AI formally verifies Signal protocol’s cryptographic guarantees

Google DeepMind researchers used agentic AI to formally verify, meaning mathematically prove, a number of the Signal protocol’s key cryptographic guarantees. The result is described as a landmark development both for the widely used cryptography and for AI itself. The researchers’ stated stretch goal is to do the same for all the software of the world. Further detail on the specific guarantees proved and the verification method remains in the source.

A New AI Tool From Google DeepMind Proved the Signal Protocol Is Secure | WIRED →

Topics: Google DeepMindEncryption