Daily DefSec Brief

Attackers are using the new N-central exploit, a Check Point root flaw is being exploited, and Microsoft calls Exchange 2016 and 2019 permanently vulnerable. Every version number and every fix in this episode was checked against the vendor's advisory or the CVE record before it aired. Today's question: Is the Friday look-back useful, yes or no? Reply in the comments or at [email protected].

1. Update: new N-central exploit is being used - CVE-2026-90436 - Do: Turn off N-central's Legacy API - https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers

2. Exploited Check Point flaw gives root - CVE-2026-123039 - Fixed: R82.20 Take 14; R82.10 Take 52; R82 Take 132; R81.20 Take 174 - Do: Patch Check Point, check the Dynamic CLI log - https://support.checkpoint.com/results/sk/sk1000362

3. Citrix fixes 28 NetScaler flaws, nine critical - CVE-2026-120868, CVE-2026-107412, CVE-2026-120869 - Fixed: 14.1-73.57 or 13.1-64.39; Console 14.1-74.34 - Do: Upgrade your NetScalers, then NetScaler Console - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305

4. Red Hat Quay flaw opens every private image - CVE-2026-123710, CVE-2026-110697 - Fixed: 3.9.28, 3.10.28, 3.12.24, 3.14.10, 3.15.9, 3.16.7, 3.17.7, 3.18.3 - Do: Update Quay, then check its service keys - https://access.redhat.com/security/cve/CVE-2026-123710

5. Exchange 2016 and 2019: "permanently vulnerable" - CVE-2026-118207 - Do: Move off Exchange Server 2016 and 2019 - https://techcommunity.microsoft.com/blog/exchange/released-november-2026-exchange-server-security-updates/4570368

6. A "pinned" MCP server kept changing underneath - Do: Run MCP servers from a locked install - https://corelight.com/blog/mcp-server-supply-chain-risk

7. Looking back: the Linux TCP remote-root flaw - CVE-2026-98432 - Do: Confirm Linux servers rebooted into the fixed kernel - https://ubuntu.com/security/CVE-2026-98432

8. A hotel's admin login was on a whiteboard - Do: Give staff their own logins, with MFA - https://www.theregister.com/security/2026/11/12/london-hotel-put-admin-login-for-booking-website-on-whiteboard-behind-the-front-desk/5308889

Also today:

- PostgreSQL security fixes - https://www.helpnetsecurity.com/2026/11/13/postgresql-security-update-november-2026/

- Node.js security fixes - https://thehackernews.com/2026/11/nodejs-fixes-16-flaws-including-http2.html

- MongoDB critical fix - https://thehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html

- SignDrop Windows exploit - https://www.bleepingcomputer.com/news/security/new-windows-signdrop-zero-day-gives-hackers-system-privileges/

Rogue remote-access clients pushed through MSPs' ScreenConnect consoles, new N-central exploit code that its author says works against this week's hotfix, and a secret stealer planted in thousands of GitHub repositories. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: Which story needs a follow-up, ScreenConnect or the GitHub stealer? Reply in the comments or at [email protected].

1. Rogue clients pushed through MSP ScreenConnect - Do: Confirm the RMM+ extensions are off in ScreenConnect - https://www.huntress.com/blog/sckit-worm-rogue-screenconnect

2. Update: new N-central exploits target the hotfix - Do: Confirm N-central's Legacy API is off - https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains

3. wfx stealer planted in thousands of GitHub repos - Do: Search your GitHub org for wfx-docs branches - https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories

4. Apache fixes critical HTTP/2 code execution - CVE-2026-119618 - Fixed: 2.4.71 - Do: Upgrade Apache HTTP Server - https://access.redhat.com/security/cve/CVE-2026-119618

5. Update: Cisco BroadWorks flaw now exploited - CVE-2026-20320 - Fixed: RI.2026.07 - Do: Patch Cisco BroadWorks and rotate its keys - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt

6. Ivanti fixes critical EPM and CSA flaws - CVE-2026-121653, CVE-2026-121683 - Fixed: EPM 2024 SU8; CSA 5.0.8.1 - Do: Update Ivanti Endpoint Manager and CSA - https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-November-2026?language=en_US

7. GSocket keeps attackers on patched Linux servers - Do: Hunt patched Linux web servers for GSocket - https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/

8. Update: eMudhra blames script for one-byte CA keys - Do: Remove revoked eMudhra intermediates from appliances - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-emudhra-info-ScS22A1r

Also today:

- Zoom fixes a critical Workplace for Windows flaw - https://www.zoom.com/en/trust/security-bulletin/ZSB-26023/

- Chrome 157 security update, 83 fixes - http://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html

- Notion: AI provider breach exposed chat transcripts - https://www.bleepingcomputer.com/news/security/notion-says-fireworks-breach-exposed-customer-ai-chat-transcripts/

Attackers are using an Outlook flaw that leaks NTLM hashes, Barracuda's email gateway root chain and a login bypass in Xen Orchestra. Plus N-central's hotfix, four maximum-severity SAP flaws, Turla's Exchange toolset, a Git recursive-clone fix, and 35,578 Grok-built apps left open to anyone. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: How do you find the apps your staff build with AI tools? Reply in the comments or at [email protected].

1. Exploited Outlook flaw leaks NTLM hashes - CVE-2026-124194 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194

2. Update: Barracuda gateway flaws now exploited - CVE-2026-116606, CVE-2026-111560 - https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection

3. Exploited Xen Orchestra flaw gives attackers admin - https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/

4. Update: N-central hotfix fixes seven CVEs - CVE-2026-125883, CVE-2026-125878, CVE-2026-125879 (+ 4 more) - https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/

5. SAP fixes four 10.0 flaws that need no login - CVE-2026-76964, CVE-2026-120017, CVE-2026-89103 (+ 1 more) - https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html

6. Turla runs its spying from inside Exchange servers - https://www.welivesecurity.com/en/eset-research/exchange-for-breakfast-turlas-cereal-tricks-are-not-for-kids/

7. Git fixes code execution on a recursive clone - CVE-2026-111760 - https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr

8. New ESXi implant hands attackers every VM - https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware

9. Public iOS escape reads other apps' data - https://github.com/forcequitOS/worse_query

10. AWS MCP server's denylist missed some API names - CVE-2026-125271 - https://aws.amazon.com/security/security-bulletins/rss/2026-176-aws/

11. Ten edited neurons turn an AI agent rogue - https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/

12. 35,578 of 37,571 Grok-built apps open to anyone - https://blog.claroc.io/ghostshares-grok-build-apps/

N-able took hosted N-central offline after a researcher published what he says are 33 unpatched flaws with exploit code, and Chrome fixed a zero-day that attackers are already using. Also: an attacker using Qubole's AWS account to get into its customers' accounts, exploited flaws in IBM Aspera Faspex, FreeSWITCH and GPUStack, a web host breached through its own MCP server, and a default admin login that let researchers start cars. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: What's on your checklist when you stop using a vendor? Reply in the comments or at [email protected].

1. N-able pulls N-central offline over 33 zero-days - Do: Keep N-central offline until N-able's fix - https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains

2. Chrome fixes its eighth exploited zero-day of 2026 - CVE-2026-125350 - Fixed: 157.0.8103.50/.51; Extended Stable 156.0.8078.96 - Do: Push the Chrome update and force the restart - https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html

3. Attacker used Qubole's AWS trust to rob customers - Do: Delete IAM roles that trust vendors you've left - https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild

4. IBM Aspera Faspex privilege flaw exploited - CVE-2026-123218 - Fixed: 5.0.19 PL1 - federal due 2026-11-12 - Do: Patch IBM Aspera Faspex - https://www.ibm.com/support/pages/node/7295921

5. FreeSWITCH flaw exploited with one SIP message - CVE-2026-116779 - Fixed: 1.11.3 - federal due 2026-11-12 - Do: Upgrade FreeSWITCH on your phone system - https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p

6. GPUStack admin takeover flaw exploited - CVE-2026-102895 - Fixed: 2.2.0 - federal due 2026-11-12 - Do: Upgrade GPUStack and delete unknown admin keys - https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr

7. Web host breached through its own MCP server - Do: Test your MCP server like your public API - https://therecord.media/cyberattack-germany-ai-mittwald

8. Default admin login let researchers start cars - Do: Remove the default admin console from ForgeRock IDM - https://samcurry.net/forgerock

Attackers are trying the SSHole long-password bypass against OpenSSH on Alpine, and a SonicWall SSL VPN flaw skips SAML MFA. Also: an AI agent going from a GitHub secret to Azure Key Vault in five minutes, a hijacked release bot that published to npm, Claude Code's settings file leaking secrets, and an AI pentest agent that got into WorkOS. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: How do you keep development credentials out of production at your shop? Reply in the comments or at [email protected].

1. SSHole long-password attacks hit OpenSSH on Alpine - CVE-2026-123158 - Fixed: 10.6p2; Alpine 3.24 10.3_p1-r2, 3.23 10.2_p1-r1, 3.22 10.0_p1-r11 - Do: Update OpenSSH on Alpine and restart sshd - https://www.openssh.com/txt/release-10.6p2

2. SonicWall SSL VPN flaw skips SAML MFA - CVE-2026-19868 - Fixed: Gen7 7.3.4-7013; Gen8 8.2.3-8015 - federal due 2026-11-20 - Do: Upgrade SonicOS on your SonicWall firewalls - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014

3. Update: AI agent mined GitHub, hit Key Vault - Do: Rotate every secret ever in a public repository - https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/

4. Hijacked release bot backdoored bee-js on npm - Do: Treat GitHub release rights as publish rights - https://safedep.io/blog/ethersphere-bee-js-npm-compromise

5. Claude Code settings file leaks secrets to GitHub - Do: Rotate secrets in Claude Code settings files - https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html

6. DNS typos let outsiders send mail as agencies - Do: Check DNS records for typos and expired domains - https://www.sh.consulting/blog/government-dangling-dns-records

7. An AI pentest agent got into WorkOS - Do: Take internal tools off the open internet - https://workos.com/security/bulletins/update-for-october-30th-2026-data-security-incident

Hackers tied to APT29 are serving exploits for already-patched flaws to out-of-date phones, the Zyxel looting exploit beats June's patch, and the White House network was a rentable proxy. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: What got your team to enforce a minimum phone OS version? Reply in the comments or at [email protected].

1. APT29 hits out-of-date phones from hacked websites - CVE-2024-27834, CVE-2025-14174, CVE-2025-27038 (+ 5 more) - federal due 2026-11-18 - Do: Require current iOS and Android versions on phones - https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain

2. Update: Zyxel exploit beats the June patch - CVE-2026-107441, CVE-2026-7273 - Fixed: 2.90(xxxx.3)C0 - Do: Patch Zyxel GS1900 switches and change passwords - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026

3. DreamHost breach exposed FTP logins for two months - Do: Check DreamHost-hosted sites for changed files - https://www.dreamhost.com/news/announcements/october-security-incident/

4. APT flaw lets a tampered download run as root - CVE-2026-109518 - Fixed: 2.6.2, 3.0.4, 3.3.3ubuntu0.1, 3.2.1ubuntu0.1, 2.8.4ubuntu0.1, 2.4.15ubuntu0.1, 2.2.5 - Do: Update APT on Debian and Ubuntu servers - https://lists.debian.org/debian-security-announce/2026/msg00526.html

5. Xen flaws let one guest VM take the host - CVE-2026-102703, CVE-2026-102704 - Fixed: xen-4.17.7-4.2.xcpng8.3 - Do: Patch and reboot Xen and XenServer hosts - https://support.citrix.com/external/article/CTX697256

6. Web traffic ZIP files can hijack Snort 3 - CVE-2026-20043 - Fixed: FTD 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2; Snort 3.12.4.0 - Do: Upgrade Cisco Secure Firewall Threat Defense - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe

7. Foglight for Databases fixes three critical flaws - CVE-2026-92188, CVE-2026-92189, CVE-2026-92190 - Fixed: 8.3 - Do: Upgrade Quest Foglight for Databases - http://www.zerodayinitiative.com/advisories/ZDI-26-854/

8. SonicWall won't patch end-of-life GMS flaws - CVE-2026-109593, CVE-2026-109594 - Do: Replace SonicWall GMS with Network Security Manager - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019

9. DigiCert migration left internal system exposed - Do: Re-check what's reachable after every migration - https://bugzilla.mozilla.org/show_bug.cgi?id=2084460

10. White House network was a residential proxy exit - Do: Hunt for proxyware on company machines - https://krebsonsecurity.com/2026/11/want-to-rent-an-internet-address-at-the-white-house/

Thirteen stories for defenders. Every version number and every fix in this episode was checked against the vendor's advisory or the CVE record before it aired. Today's question: What got your team to give network appliances a named patch owner? Reply in the comments or at [email protected].

1. Stolen Entra app secrets hit MSPs and customers - https://www.todyl.com/blog/stolen-app-credentials-real-access-an-actor-is-signing-into-entra-id-and-azure-devops-as-your-workloads

2. cPGuard's update channel pushed a backdoor - https://opsshield.com/notice/cpguard-update-channel-compromise.html

3. Update: open Node-RED editors are being exploited - CVE-2026-58115 - https://cert-portal.siemens.com/productcert/html/ssa-834709.html

4. WS_FTP fixes a 10.0 admin-credential leak - CVE-2026-84295, CVE-2026-90868 - https://cyber.gc.ca/en/alerts-advisories/progress-software-security-advisory-av26-1116

5. Barracuda fixes a flaw chain that reaches root - CVE-2026-116606, CVE-2026-111560 - https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection

6. Update: Linux TCP flaw fixed, Ubuntu still open - CVE-2026-98432 - https://access.redhat.com/security/vulnerabilities/RHSB-2026-016

7. Zyxel GS1900 switches get a command-execution fix - CVE-2026-107441, CVE-2026-76955 - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026

8. Chrome 157 ships 213 security fixes - CVE-2026-121156 - http://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html

9. Android's November patch fixes a no-tap code flaw - CVE-2026-58868 - https://source.android.com/docs/security/bulletin/2026/2026-11-01

10. Forged antd-img-crop commit planted a stealer - https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer

11. Network appliance flaws stay unpatched over a year - https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/

12. Defense firm pays $13M over cyber claims - https://www.justice.gov/opa/pr/defense-and-aerospace-contractors-ilc-dover-and-ilc-astrospace-agree-pay-13m-resolve

13. Fake job interview opened Binance's wallets - https://www.binance.com/en/blog/community/3229153443759566763

Ransomware is encrypting outdated Synology NAS boxes, attackers are running up six-figure AI bills with stolen cloud keys, and Trigger.dev customers need to rotate their secrets. Plus a Langflow login bypass, coding agents installing abandoned MCP servers, and a second wave of supermarket freezer attacks across Europe. Every version number and every fix in this episode was checked against the vendor's advisory or the CVE record before it aired. Today's question: Who in your shop finds out first when a cloud bill jumps overnight? Reply in the comments or at [email protected].

1. Ransomware hits outdated Synology NAS boxes - CVE-2024-10441, CVE-2026-13639, CVE-2026-13684 - Fixed: 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, 7.2.1-69057-12 - Do: Update Synology DSM and close its admin page - https://www.synology.com/en-global/security/advisory/Synology_SA_24_20

2. Stolen cloud keys run up $100K-a-day AI bills - Do: Alert when someone switches on cloud AI services - https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models/

3. Trigger.dev customers' secrets exposed - Do: Rotate every secret you keep in Trigger.dev - https://trigger.dev/blog/security-incident-nov-2026

4. Langflow fixes critical login bypass and RCE - CVE-2026-93680, CVE-2026-110186 - Fixed: 1.13.0 - Do: Upgrade Langflow and turn off auto-login - https://www.ibm.com/support/pages/node/7294467

5. Coding agents install unmaintained MCP servers - Do: Keep an approved list of MCP servers - https://www.glow.io/blogs/mcphantom-ai-coding-agents-are-installing-vulnerable-deprecated-mcp-servers-from-training-data

6. Update: freezer attacks hit six more countries - Do: Take vendor-managed controllers off the internet - https://censys.com/blog/european-refrigerator-controller-redux-a-new-wave-of-refrigeration-attacks/

Every version and fix here was checked against the vendor's advisory or the researcher's write-up before it aired. Today's question: Who approves your developers' editor extensions? Reply in the comments or at [email protected].

1. Exploited Drupal Commerce flaw skips authorization - CVE-2026-118539 - https://www.drupal.org/sa-contrib-2026-254

2. Tampered Claude Code extension hit Cursor users - https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/

3. Update: Ivanti VPN needs a second patch - CVE-2026-111357, CVE-2026-118527 - https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935

4. Fake help desk call led to AD CS takeover - https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/

5. Northflank breach: rotate every stored secret - https://www.bleepingcomputer.com/news/security/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys/

6. TeamViewer host can run code on the viewer - CVE-2026-111585, CVE-2026-92372, CVE-2026-92374 - https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1011/

7. Swapped vendor script drained Polymarket users - https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html

8. Attackers run AI pentest frameworks in intrusions - https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks/

9. LXD flaw lets a public certificate log you in - CVE-2026-112816 - https://discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in-canonical-lxd-and-microcloud/90557

10. One text message crashes Android phone service - CVE-2026-58882 - https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/

11. Email to Request Tracker can hijack the reader - CVE-2026-105454, CVE-2026-105455, CVE-2026-105456 - https://cert.pl/en/posts/2026/10/CVE-2026-105454/

12. n0n ransomware got in on stolen credentials - https://www.theregister.com/security/2026/10/30/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see/5306754

13. GCHQ can't account for thousands of drives - https://therecord.media/gchq-cannot-account-for-thousands-of-data-devices

A GitLab flaw that runs code on the server is now being exploited, a Linux kernel TCP flaw gives remote root while Ubuntu and RHEL wait on a fix, and the browsers built into five AI coding tools could run code or read a developer's files. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: What's the strangest password you've ever found while cleaning up an environment? Reply in the comments or at [email protected].

1. Update: GitLab 10.0 flaw now exploited - CVE-2026-97229 - Fixed: 19.4.2, 19.3.5 or 19.2.8; Ruby 3.3.13, 3.4.12 or 4.0.9 - federal due 2026-11-01 - Do: Upgrade self-managed GitLab and close open sign-up - https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/

2. Linux TCP flaw gives remote root, no Ubuntu fix - CVE-2026-98432 - Do: Install the fixed Linux kernel as it ships - https://ubuntu.com/security/CVE-2026-98432

3. Update: WordPress update flaw under attack - Fixed: 7.1.4 (backports to 4.7.39) - Do: Update WordPress core and block wp-content/upgrade - https://wordpress.org/news/2026/10/wordpress-7-1-4/

4. AI coding tools' built-in browsers leak files - Do: Keep long-lived secrets off developer laptops - https://forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers-technical

5. Malware bills its AI to your OpenAI key - Do: Alert on AI API calls from unexpected hosts - https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/

6. Report: personal AI agent got admin on DoD network - Do: Give AI agents their own scoped accounts - https://cybersecuritynews.com/accenture-contractor-allegedly-gave-claude-access/

7. Fake AI crawlers hunt for .env files and keys - Do: Block web requests for .env and key files - https://www.cequence.ai/blog/ai-agent-impersonation

8. MLflow fixes six flaws, one needs no login - CVE-2026-118628, CVE-2026-118627, CVE-2026-118626 (+ 3 more) - Fixed: 3.17.0 - Do: Upgrade MLflow and turn on its login - https://www.zerodayinitiative.com/advisories/ZDI-26-844/

9. Chrome update fixes 21 flaws, one critical - CVE-2026-76024 - Fixed: 156.0.8078.79/.80 - Do: Push the Chrome update and force the restart - https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html

10. Admin password insulted hackers, then let one in - Do: Keep admin accounts off legacy servers - https://support.microsoft.com/en-us/topic/microsoft-security-advisory-update-to-improve-credentials-protection-and-management-may-13-2014-93434251-04ac-b7f3-52aa-9f951c14b649