Hello, stay ahead with CISO Brief 🚀

🔒 N-able temporarily took its hosted N-central RMM platform offline and issued an emergency hotfix after a researcher published 33 zero-day exploits, some enabling unauthenticated takeover. The disclosure, dubbed Able2Shell, includes proof-of-concept chains that can lead to command execution as the service user and, in some cases, root. N-able released N-central 2026.4 HF2 and advised on-premises customers to shut down servers and apply the update, while investigators reported scanning and exploitation attempts.

🔒 Microsoft released November Patch Tuesday updates addressing 1,093 vulnerabilities across Windows and supported software, including 63 critical flaws and an actively exploited Outlook zero-day. Other vendors including Apple, Google, Mozilla and Adobe also issued important updates this week. Administrators are urged to prioritize critical and exploited flaws while maintaining backups before applying patches.

🔒 AWS has renewed its ProcessUnity Global Risk Exchange assessment to help customers streamline third-party due diligence. The validated report, reviewed annually by ProcessUnity assessors, provides an updated view of AWS security posture for TPCRM integrations. The assessment replaces static spreadsheets with dynamic vendor profiles and risk analytics, and maps controls to standards such as NIST 800-53, ISO 27001, PCI DSS, and HIPAA. Customers can request access via the ProcessUnity portal.

🔒 Git patched a critical vulnerability (CVE-2026-111760) that allowed malicious repositories with extremely long paths to bypass safety checks and write shortened names like .git, enabling attackers to replace submodule .git files with symlinks to malicious hooks or configuration. The fix, released in Git 2.56.1 and backported across 2.50–2.55 branches, rejects overly long paths before truncation. GitHub and other vendors are rolling out updates and advising users to install fixed versions and avoid recursively cloning untrusted repositories until patched.

🔐 The traditional VPN-and-firewall perimeter model is increasingly inadequate and risky as remote work and cloud services expand. ZTNA replaces broad network access with fine-grained, context-aware application access, assessing user identity, device posture, and location. This reduces blast radius from compromised credentials and limits lateral movement, while enabling just-in-time access and richer logging for SOC teams. ZTNA complements, not replaces, endpoint protection and may coexist with legacy VPN where needed.

🔒 An RCE bug in SGLang, the open-source inference engine, was exploited to run code on a NEAR AI inference server, potentially exposing requests processed that day, including those in confidential mode. The attacker moved laterally to a deprecated Private Chat system and an older NEAR AI Agents deployment, exfiltrating about 100 user account details and data from 18 agents. NEAR AI revoked credentials, deployed a fix, rotated tokens, and completed forensics, and has notified impacted users.

🔒 French vendor Vates VMS warned of a critical authentication bypass in Xen Orchestra, tracked as VSA-2026-062, that is being actively exploited. The flaw allows specially crafted cookies to be parsed into an empty object which the token provider treats as an unfiltered lookup, returning a valid token and enabling Admin-level actions. Exploitation can lead to arbitrary code execution on managed pools and full XCP-ng node takeover as root. Patches are available in Xen Orchestra 6.9.1/6.10.0 and xo-server 5.211.2/5.213.1; mitigations include blocking the malicious IP/TOR, avoiding internet exposure, and rotating credentials.

📢 AWS re:Invent 2026 in Las Vegas (Nov 30–Dec 4) features sessions focused on digital sovereignty, offering breakout talks, workshops, chalk talks, and lightning sessions led by AWS experts, partners, and customers. Topics include the AWS European Sovereign Cloud, hybrid and edge AI deployments, AWS AI Factories, Outposts, Local Zones, and operational autonomy. Sessions cover technical controls, deployment choices, compliance patterns, and migration lessons to help organizations meet data residency and sovereignty requirements while scaling AI.

🔧 This post introduces CodeMender, Google’s autonomous code-security agent that integrates automated vulnerability detection, verification, and patching directly into Git pull requests using Google Cloud Run. The article outlines how CodeMender posts findings in PR timelines, supports /verify and /fix commands, and streams sandbox artifacts to Cloud Storage for audits. It emphasizes secure execution by running exploit simulations as ephemeral Cloud Run jobs with minimal service account privileges and network egress restrictions, and recommends using short-lived OIDC tokens for GitHub trust.

🛡️ CISA has launched a revised cyber incident reporting form accessible via its Incident Reporting Portal, introducing more granular questions about malware, social engineering, hacking and insider threats and mapping observed activity to MITRE ATT&CK. The update, announced on November 9, is designed to improve data quality, enable linking of related threat activity into broader trends, and support faster, more thorough threat analysis. Federal civilian agencies remain required to report, while others can submit voluntary reports potentially protected under the PCII Program.

🛠️ The Gemini Factory is a Google Cloud co-innovation program that helps enterprise software partners turn use cases into production integrations rapidly. It unifies extensibility primitives—MCP connectors, declarative Skills, Plugins, and A2A agents—so partners can embed domain intelligence and regulated workflows directly into Gemini. Through hands-on workshops, AI-assisted development tools like Antigravity and RAD, and commercial incentives including seed credits and marketplace listing, partners can build, publish, and scale solutions with reduced engineering friction and streamlined deployment.

🧭 BigQuery introduces measures, now GA, to unify governed BI metrics with knowledge graph relationships so AI agents and dashboards see both the "what" and the "why". By defining measures directly on graph entities, BigQuery preserves entity grain, avoids overcounting, and enables traversal-based explanations without separate systems. The GA adds composite and derived measure support, semantic metadata, Knowledge Catalog integration, and visualizations in Data Studio for consistent, discoverable metrics.

🚀 Starting today, Amazon RDS for MySQL 26.10 is available in the Amazon RDS Database Preview Environment, enabling evaluation of the pre-release on RDS. MySQL 26.10 includes bug fixes, security patches, and improvements to READ COMMITTED workload performance plus enhanced purge lag warnings in the error log. Preview instances are retained up to 60 days and snapshots can only be used within the Preview Environment.

🛈 Amazon RDS for PostgreSQL now offers Extended Support for minor versions 13.23-rds.20260819, 12.22-rds.20260820 and 11.22-rds.20260822. Extended Support supplies up to three additional years of critical CVE and bug fixes beyond a major version's standard support end date, helping customers buy time to plan upgrades. Upgrades can be performed via Blue/Green Deployments, in-place upgrade, or restore from a snapshot using the Amazon RDS Management Console or AWS CLI.

🧊 French authorities accuse an IRGC-linked hacking unit of seizing control of refrigeration systems at about 700 retail and food sites on 11 October, altering defrost settings and triggering at least 15 fires and tens of millions of euros in damage. Victims included major supermarket chains and food processors, with targeted controllers reportedly running older Danfoss software. Investigators linked the operation to the Shahid Kaveh group through shared infrastructure, Farsi traces, and subsequent propaganda claims, and named three alleged IRGC operatives. Officials warn organisations to secure OT systems by removing internet exposure, updating controller software, changing default passwords, and segmenting and monitoring networks.

🔒 This post demonstrates using ClusterNetworkPolicy (CNP) in Google Kubernetes Engine (GKE) to enforce cluster-wide, multi-tier networking controls. It describes an experiment protecting an LLM workload (Gemma 4) running on TPU-backed GKE nodes and shows how CNP admin, network policy, and baseline tiers interact. The setup includes a custom VPC, Cloud NAT, GKE Dataplane V2 (eBPF), and namespace-scoped NetworkPolicies to allow only authorized clients while blocking metadata access.

🔧 AWS Partner Central now offers a new business planning experience within the AWS Console. Partners can start plans to grow their AWS engagements or collaborate on plans initiated by AWS teams, defining narratives, goals, and initiatives with partner development, technology, marketing, and specialist teams. AI-assisted readiness scores and real-time progress tracking help identify improvement areas and monitor goals, while attachments and plan export support business reviews.

🛡️ The Blind Eagle group (APT-C-36) has launched a campaign using Portuguese and Spanish judicial and administrative-themed phishing lures to deliver a remote access trojan related to AsyncRAT and DCRat. Emails target personnel handling legal, contract, or institutional requests and use weaponized XHTML/SVG files that employ HTML smuggling to assemble ZIP payloads in the browser. The JavaScript dropper pretends to be a network auditor and performs environment reconnaissance before running a VBScript that bypasses AMSI/ETW, removes artifacts, and persists via the Windows Startup folder, ultimately launching the final RAT in memory via PowerShell.