Skip to content
Wednesday, November 11, 2026
France names Iran’s Shahid Kaveh for the supermarket fridge sabotage. the controllers were still on the internet
Chrome zero-day number eight of 2026 lives in the XML parser. update, then actually relaunch (CVE-2026-125350)
bee-js 13.3.0 had valid provenance, a real release bot, and a wallet stealer. GitHub Actions did exactly what it was told
Hunting Turla’s Cereal on Exchange: the backdoor does not call home because your mail server is home

Cybersecsloth

the security industry is a joke. we cover it anyway.

Random News
France names Iran’s Shahid Kaveh for the supermarket fridge sabotage. the controllers were still on the internet
Chrome zero-day number eight of 2026 lives in the XML parser. update, then actually relaunch (CVE-2026-125350)
bee-js 13.3.0 had valid provenance, a real release bot, and a wallet stealer. GitHub Actions did exactly what it was told
Hunting Turla’s Cereal on Exchange: the backdoor does not call home because your mail server is home

Cybersecsloth

the security industry is a joke. we cover it anyway.

Random News
Headlines
France Attributes Supermarket Fridge Cyberattacks to IRGC Unit Shahid Kaveh

France names Iran’s Shahid Kaveh for the supermarket fridge sabotage. the controllers were still on the internet

CVE-2026-125350: Chrome XML Zero-Day Exploited, Fixed in 157.0.8103.50

Chrome zero-day number eight of 2026 lives in the XML parser. update, then actually relaunch (CVE-2026-125350)

bee-js 13.3.0 Compromise: Trusted Publishing Hijack, Swarm Desktop 0.56.2

bee-js 13.3.0 had valid provenance, a real release bot, and a wallet stealer. GitHub Actions did exactly what it was told

Hunt Turla Cereal on Exchange: HTTP.sys Prefixes, ESET Hashes, Kali Lab

Hunting Turla’s Cereal on Exchange: the backdoor does not call home because your mail server is home

VSA-2026-062: Xen Orchestra Auth Bypass Exploited, Fixed in 6.10.0 / 6.9.1

Xen Orchestra let anyone log in with an empty pair of curly braces, and somebody already did (VSA-2026-062)

Able2Shell: N-able N-central Offline After 30+ Zero-Days

Able2Shell: N-able Takes N-central Offline After 30+ Zero-Days Go Public, No CVE or Hotfix Yet

CVE-2026-123218: IBM Aspera Faspex Privilege Escalation on CISA KEV

IBM Aspera Faspex 5 User-to-Admin Privilege Escalation Added to CISA KEV (CVE-2026-123218)

Claude Code "Don't Ask Again" Leaks Secrets to GitHub, Bot Closed Bug

“yes, and don’t ask again”: Claude Code saved the password, GitHub got a copy, and a bot closed the bug report

Fake OpenAI and SpaceX Event Invites: Kali365 and VoidProxy Phishing

no, you did not win three months of Grok Heavy and a SpaceX share. you won an MFA-bypassing phish.

Iris Plaza Breach: Data on 7.7 Million People May Be Exposed

Iris Plaza says a cloud service held data on 7.7 million people, and someone else may have it now

Vates