The Whistle: Chrome's eighth zero-day, Qubole's trusted path, and an AI proof of Signal
Google patched Chrome’s eighth in-the-wild zero-day of the year, Wiz published an October attack that walked through the front door Qubole customers built for their own data platform, and a researcher’s 33 zero-days made an RMM vendor unplug its own hosted service. Anthropic put a security model behind a verification program and a footnote, Google’s Carbon-powered agents produced a formal proof of Signal’s protocol implementation, and AWS gave every EKS pod the option of its own hardware-isolated virtual machine at no extra charge. France named Iran’s Revolutionary Guard Corps as the source of the freezer attacks, and the queue behind those stories ran from Barracuda email appliances to SonicWall MFA skips. Security leads, then everything else.
Security: Chrome’s eighth exploited zero-day of the year
Monday’s Stable Desktop update fixes CVE-2026-125350, a use-after-free in Chrome’s XML parser. Google rates it high severity and states on the record that an exploit exists in the wild. The fix ships in 157.0.8103.50/.51 for Windows and macOS and 157.0.8103.50 for Linux, and Chrome installs it at the next launch, so the operational question is restart discipline, not discovery: BleepingComputer’s tally counts seven predecessors this year already, four in V8, one in Skia, one in Dawn and one in a font feature map, all exploited between February and September. The XML parser is a new face on that list, and it follows the usual logic: memory corruption in a parser is what an automated fuzzing budget buys, and the response nobody enjoys remains the right one, short patch cycles, then a rollout that measures how much of the fleet has actually restarted.
Security: Qubole’s vendor role became the attacker’s front door
Wiz published the full account on November 9, working with Sentra and Mandiant: between October 14 and 26, a threat actor used IAM credentials from the AWS account that Qubole’s own platform normally uses to call sts:AssumeRole against the integration roles customers had created to trust their vendor. Every request carried a valid External ID and every one succeeded. Once inside, the actor ran discovery with role session names like quiam-enum and quiam-scope-full, then went collecting: Lambda function environment variables via GetFunctionConfiguration, Secrets Manager secrets, SSM parameters, and opportunistic S3 downloads, in some cases entire buckets in a single session. It validated what it found with TruffleHog against AWS IAM keys, Entra ID service principals and Okta client credentials. Wiz also surfaced a bootable ISO that phones home for 90 minutes and then reboots to erase its own evidence; they found no deployments. A separate, unlinked set of intrusions ran October 8-11 with customer-owned keys created for Qubole integrations.
The mechanics deserve the attention because the setup is standard. Onboarding creates a role in your account that trusts the vendor’s account, usually with an External ID as the second check, and the External ID is the control people quote for this exact attack. It did nothing here. The attacker held credentials the vendor’s platform itself uses; the External ID is logged in plaintext in CloudTrail, frequently stored by the vendor and in someone’s infrastructure-as-code, and Wiz’s own recommendation is to treat it as non-secret. The more uncomfortable detail is who the doors belonged to: most of the roles the actor assumed were not otherwise in use, and in a majority of the victim environments, the actor’s requests were the only vendor-account AssumeRole activity in October. Dead integrations are live doors. Inventory every trust policy that names an external account, delete the ones whose integrations you retired, narrow the principal from the vendor account root to the specific IAM identity the vendor actually runs, and add aws:SourceIp or aws:SourceVpce conditions pinned to the vendor’s documented network ranges; Wiz states that a source IP condition alone would have blocked every role assumption it observed. If your CloudTrail shows anything back to October 1, rotate every secret, parameter and Lambda environment variable the role could read, and revoke the sessions, because rotating a credential does not kill the temporary credentials already issued.
SaaS providers get the reciprocal rule: to your customers, the principals in your account are credentials to every one of their environments at once, so publish your egress ranges and assume roles from short-lived workload identities, not long-lived IAM user keys.
Security: 33 zero-days made an RMM vendor unplug itself
On November 9, a researcher publishing as Oracle-Security (Sean Bales) posted Able2Shell: 33 alleged zero-days in N-able’s N-central remote monitoring and management platform, tested against appliance build 2026.4.0.31, with four exploit chains and proof-of-concept code. The flaw classes read like a pentest report for the management plane itself: anonymous credential theft, administrator creation, root command execution, XXE into trusted-NCI calls, support-token theft, MDM impersonation, audit tampering, and a stack overflow in the GenericTCP handler that lands as root. N-able declared an active incident Monday at 15:15 UTC, took hosted N-central offline in every region, and told on-premises customers to power their servers down until further notice; The Hacker News has the running coverage. The company says it has seen no signs of exploitation, shipped Hotfix 2 (build 2026.4.1.26) on November 10 covering seven of the reported flaws, warns that Agents must be upgraded before Probes, and framed the disclosure as “non-responsible communication” while declining to say whether it was notified in advance. None of the 33 had reached CISA’s KEV catalog as of November 10.
The blast radius is the point: an RMM server holds management access to every endpoint the MSP that runs it maintains, which makes this the third act in a genre that already includes Kaseya in 2021 and 3CX’s compiler compromise. If your MSP runs N-central, two questions answer your weekend: which build is on, and has the agent fleet taken Hotfix 2, because N-able’s own guidance is to keep unpatched servers offline. If you are a customer of an MSP, this is the incident to bring to the next contract review: ask who has administrative access to the box that has administrative access to everything you own.
Security: Barracuda’s email appliances are being exploited again, root included
Barracuda confirmed Monday evening that attackers have begun exploiting two Email Security Gateway flaws patched the week before: CVE-2026-116606, an authentication weakness that lets an attacker modify an appliance’s global configuration, and CVE-2026-111560, unauthenticated OS command injection that executes as root. Chained, they hand over the box to anyone who can reach the admin interface, which is why Barracuda’s standing advice, keep the appliance off public networks and its management plane internal, is also the actual mitigation; the same second flaw affects the Load Balancer ADC, the Message Archiver, the WAF Control Center, the WAF and the Web Security Gateway, each with its own patch. Barracuda reports a small number of organizations hit and recommends automatic patching stay on if you were tempted to turn it off. The history argues for the advice: in 2023, UNC4841 exploited two Barracuda ESG zero-days for at least seven months before anyone noticed, dropped SeaSpy and Saltwater implants, and Mandiant counted about a third of the breached systems among government agencies. Appliance security has one honest posture: patch-by-default, plus network controls that assume the patch was late.
Security: France puts a name on the freezer attacks
On November 9, Foreign Minister Jean-Noël Barrot attributed the October and November cold-chain attacks, the supermarket freezer waves and the attempt on the French Blood Establishment covered last week, to Iran’s Islamic Revolutionary Guard Corps, calling it “the first large-scale act of sabotage on our national territory.” Iran’s ambassador was summoned, European-wide sanctions are planned, and the attribution arrived with the detail that matters for the reader running buildings: some of the affected Danfoss controllers are models that no longer receive security fixes. The US government is reportedly examining similar freezer incidents, including on military bases, without a formal attribution yet. A named state actor, formally attributed, for physical-supply sabotage moves this out of the ransomware risk register and into the one where the question stops being “how do we encrypt our controllers” and becomes “why can any stranger, on any network, change a setpoint.”
Security: the queue, kept short
QNAP reports that Plex2Shell is now hitting NAS devices. The four Plex Media Server flaws (CVE-2026-96652, -96654, -96655, -96656) went public October 16 and entered CISA’s KEV catalog October 20, and QNAP’s advice is blunt: if you ran a vulnerable Plex server with port 32400 exposed, treat the NAS and everything on it as compromised, reinstall the OS clean, reset Plex and NAS credentials, and keep the remote access behind a VPN or nothing at all. SonicWall’s new one is CVE-2026-19868, rated 7.1, where valid credentials for an alternate authentication method let an attacker bypass SAML-enforced MFA on SSL-VPN; CISA added it to KEV with a November 20 federal deadline, the fixes are 7.3.4-7013 and 8.2.3-8015, six more SonicOS flaws ship alongside, and this is the vendor’s fourth exploited-appliance story since July. And Microsoft’s email authentication enforcement went sideways: Outlook.com has been bouncing legitimate mail on and off since late last week, one-line personal messages included, because the platform started treating missing SPF or a missing DMARC record as suspicion without publishing an advisory or a clear error. Microsoft’s 2025 bulk-sender rules require SPF, DKIM and at least p=none DMARC, which is defensible policy executed in the worst order; check your own senders against those rules before some provider enforces them for you, and if a mail incident this week had an intermittent flavor and a vague error code, the first suspect is your own DMARC posture.
AWS: a Nitro VM per pod
Nitro Sandboxes launched November 9 for Amazon EKS, ECS and plain EC2 at no additional charge. Opt a pod in with runtimeClassName: isolated-sandbox and it runs inside its own lightweight VM carved by the Nitro Hypervisor: separate operating system, separate kernel, no syscall path out to the node or the neighbors, while the kubelet still sees an ordinary pod and every tool from kubectl exec to Pod Identity works the same. A second mode goes further: confidential-sandbox treats even the operator as untrusted, with cryptographic attestation, AWS KMS releases a secret only to a sandbox presenting an attestation document signed for the exact system image and Cedar policy, so a cluster administrator can no longer read the pod’s memory. AWS built the launch around agent workloads and says it validated Claude Code, Codex, Strands, OpenCode and other harnesses unchanged, with the Kubernetes SIG agent-sandbox project keeping pre-booted VMs warm enough to claim in about two seconds; the use cases named in the post are CI/CD builds, agent software factories, multi-tenant SaaS and the self-hosted mode where reasoning happens in the vendor’s cloud and tool execution happens on yours. Read it next to last week’s Agent Substrate donation and October’s Strands Box and the pattern is hard to miss: every major cloud now ships or proposes a hardware boundary purpose-built for running generated code, and the boring reason to care is that “patch the shared kernel” stops being the only thing standing between a 9.8 and your neighbors on the node.
GCP: two more TPUs for agents
Google introduced TPU 8tx and 8i Max on November 9, the third and fourth systems of its eighth silicon generation and the first year the company has shipped four. 8tx is the confidential one: data and model weights stay protected in hardware while in active use, built for regulated enterprises and governments running frontier models next to their most sensitive data, with fine-tuning on the same system and up to 2x lower inference latency than 8t. 8i Max pairs two 8i dies on a single package to attack the memory wall for agent fleets: double the compute, double the SRAM and double the HBM bandwidth inside the same rack footprint, for the workload where dozens of agents chew through a whole codebase at once and memory bandwidth is the bottleneck. The part worth more than the specs is the pace claim: modular packaging around the chip turns new configurations into months rather than silicon cycles, and Google is running AlphaChip and Gemini in loop to generate chip layouts in hours. The differentiation against Nvidia is now stated plainly, confidential inference and rack density as hardware properties rather than software features, and for anyone shopping inference capacity for regulated workloads, 8tx is a real answer to a question NVIDIA answers with a whitepaper.
Open source: an eBPF breather, and a Postgres operator steps up
Linux 7.4-rc2 carried a fragment of good news about the AI-fed patch flood: on eBPF, fixes are now arriving faster than new reports, which maintainer Alexei Starovoitov claims and Torvalds repeats as “sounds lovely if true,” while noting most other kernel areas have not crossed that line. Torvalds adds the honest version: “Don’t hold your breath, but maybe cross your fingers we’ll be getting there in the not entirely distant future.” Context for why that matters: Microsoft fixed a record 974 bugs in September and Oracle 1,449 in one month, and attacker tooling now turns AI-found flaws into exploits on that same schedule. One subsystem is a data point, not a trend, and I would not plan 2027 around it; but it is the first subsystem where the flood receded, and the eBPF case is interesting because its maintainers run an unusually disciplined review process, which is the version of “be more like eBPF” that survives a budget review.
CloudNativePG reached CNCF Incubating on November 10, a rung up from Sandbox less than a year after entering it in January 2025. The EDB-created operator manages the full lifecycle of highly available PostgreSQL on Kubernetes by talking to the Kubernetes API directly and running database pods without StatefulSets, with fifty-plus production adopters including IBM, Google Cloud, Microsoft Azure and Tesla. Version 1.30.1 shipped a Lease-based primary election and a DatabaseRole resource that issues and renews TLS client certificates, so no database role needs a password at all; native Barman Cloud backup lands in 1.31, the Klio backup project ships before year-end, and graduation is targeted for 2027. If you last evaluated Postgres-on-Kubernetes operators in 2024, the failover conversation has moved to the one you actually have: certificate-based auth, declarative upgrades, and backup that lives inside the operator’s own contract.
Frontier AI: Anthropic ships a security model, with a footnote on its own numbers
Anthropic released Claude Fable 5.2 and Mythos 5.2 on November 9, one underlying model behind two doors. Fable, with cybersecurity and biology safeguards intact, is available to everyone at $8 and $40 per million input and output tokens, up to 30% faster than 5.1. Mythos is the same model with those safeguards lifted, gated to vetted organizations through the Cyber and Life Sciences verification programs, because that is where the useful capabilities live: Mythos 5.2 found 10.2% more vulnerabilities than Opus 5.5 and 14.4% more than Mythos 5.1 in Anthropic’s October CVE Rediscovery run against 1,829 published CVEs, took 76.3% on CyScenarioBench where OpenAI’s GPT-6 Cyber takes 61%, though Anthropic’s footnote notes each lab scores that benchmark on its own task set, and one external security company found that one in six of Mythos 5.2’s confirmed bugs were missed by every other frontier model it tested. Read the footnotes before the headline travels: Anthropic’s own caveat says those count comparisons rest on raw findings from one tester’s audit, and that on Anthropic’s internal evaluation, vulnerability identification is roughly on par with Opus 5.5. Two weeks after OpenAI led with GPT-6 Cyber, every frontier lab now sells a security model and benchmarks it in-house; for a buyer, the operative number remains the one produced on your own corpus, and the right place to press any of these vendors is a paid pilot with your data and your replay set.
Frontier AI: Google ships Carbon to everyone, then uses Carbon to prove Signal
Two Google posts from November 10 are one story. Gemini 4 Carbon went GA for all paying developers two weeks after a defender-only preview: $2 and $10 per million tokens introductory until November 30, then $4 and $20; a first-place ranking on CursorBench 4.0, Perplexity’s WANDR and Zapier’s AutomationBench; and the strongest cybersecurity capabilities Google has shipped, leading SEC-bench Pro for finding, ExploitGym for exploiting and CWE-bench v1 for patching, with that cyber scoring accessible through the Fairwind defender program rather than the open API. Then AlphaProof Code: a multi-agent framework that formally verified the compiled, running code of Signal’s protocol, which Google claims, credibly, as the first time the implementation of a widely deployed cryptographic protocol has been formally verified by any method, AI-driven or not. Agents powered by Carbon wrote over six million lines of Lean proofs, the system audited its own output and reserved about one percent of the code for human review while Lean checked the rest, the run took four weeks against the years this class of work has historically demanded, and the sanity check passed, reintroducing two previously fixed bugs into an isolated copy produced machine-checked proofs that both versions were insecure. The verification artifacts are open-source.
The pairing is the useful part: Google used the model it sells defenders to do the one security task the field had priced at man-years, and Signal’s CTO endorsed the result. Formal verification has always been the control you skip because the price is absurd; the price was the part that moved. If your architecture review keeps a list of protocols too expensive to formally verify, that list needs repricing this year, and the first line on it should be whatever crosses your trust boundary most often.
Frontier AI: OpenAI wired a stop button into research inference
Control Room, published November 9, is a central service that every research inference request must check with before an engine produces tokens, keyed to job IDs registered against approved safety cases. The maximum lag between an intervention decision and a stopped workload is 35 seconds, attributable to a caching layer OpenAI says it is driving toward zero, and the system fails closed: if Control Room is down or tampered with, inference for research workloads stops. The design detail worth borrowing has nothing to do with frontier AI: OpenAI deliberately does not trust workload code, which is varied, changes constantly, and gets written by researchers with other priorities, and instead puts enforcement in the few uniform chokepoints, the inference engines, with continual sweeps hunting engine deployments that skip the checks. Any platform with a hundred ways to say yes and one policy to enforce has the same shape; put the check where the work happens, not where the workers write code. Monitors caught the DNS misalignment incident OpenAI references here; Control Room is what makes the alert enforceable.
That’s the midweek catch-up. If something in here is wrong, or your Postgres operator needs a certificate-based excuse to retire the last shared password, info@stackref.com always works.
This post was created with a Hermes AI agent (hermesagent.ai) from a weekly news gathering workflow, then reviewed and approved by Keith before publication.
