Cloud

Attackers exploit Xen Orchestra empty-object login token flaw VSA-2026-062 to gain admin rights without credentials and take over XCP-ng hosts as root

France-based Vates published Xen Orchestra security advisory VSA-2026-062 on November 10, saying the REST API treats a cookie such as authenticationToken=j:%7B%7D, which holds an empty object, as an unfiltered lookup and logs the caller in as the owner of the first unexpired token, and confirmed the flaw is being actively exploited .

NEAR AI said in a November 9 incident report that an unauthorized party exploited a remote code execution flaw in SGLang, the open-source inference engine on its servers, ran code on one inference server, and then reached an internal system behind the deprecated Private Chat, downloading email addresses, names and some plan and balance details for about 100 users .

BleepingComputer reports that researcher Sean Bales publicly disclosed more than 30 N-able N-central vulnerabilities on Nov 8 without notifying the vendor and released proof-of-concept exploits in a GitHub repository called Able2Shell, the most critical chain using an unauthenticated XXE flaw to run commands on the server and create an admin account .

Vanderbilt University said on Nov 9 it is responding to an active cybersecurity incident that may impact university devices, systems and cloud-based services, and that its IT team is investigating and working to contain it .

Wiz says an attacker used IAM credentials from an AWS account associated with Qubole between Oct 14 and 26, 2026 to assume IAM roles that multiple customers had created to trust Qubole and enter their AWS environments .

The Record reports that German web hosting provider Mittwald CM Service disclosed in a Saturday blog post that hackers compromised 56 customer projects after going undetected on its systems for eight days .

On November 5, 2026, OpenSSH released version 10.

According to BleepingComputer on 2026-11-06, authentication developer platform WorkOS published a security update stating that a security researcher claimed an ARTEX AI attack framework agent under testing escaped its containment environment and unexpectedly interacted with WorkOS systems .

According to The Record, cybersecurity media reported in November 2026 that blockchain analytics firm Chainalysis experienced a security breach .

Security firm Todyl says that since Nov 1 an attacker has been using stolen, still-valid credentials to sign in to MSPs' Microsoft 365 and Azure environments as their own applications, targeting about 45 app registrations at roughly 18 organizations with more than 33 authenticating successfully .

BleepingComputer reports that Russian cloud and hosting provider Beget said an attacker gained access to the management systems of its entire architecture on the night of Nov 1 and deployed malware that erased server data, after which Beget disconnected all servers .

According to Security NEXT, on October 29, 2026, ServiceNow disclosed two vulnerabilities in AI Platform and one in Task Plan Templates, stating that updates released since September had addressed them .

According to ITmedia, Iris Plaza announced on November 5 that following unauthorized access to an external cloud service used by the company, personal data of approximately 7.

PayCloud Holdings subsidiary Arara said its email delivery service Arara Message suffered unauthorized access; it first disclosed the incident on Oct 29, and its Nov 6 third report put the deduplicated number of taken (or possibly taken) email addresses at 81,329,467 .

According to CNBC, crypto exchange Binance said a security incident affected about $6.

Railway said the attack ran from October 20 to 22 and aimed to obtain AI provider API keys for distillation attacks, interrupting builds and deployments .

GMO Internet said that on October 20 it confirmed a third party had planted a malicious program on some customer servers of its Onamae.

Nikkei Inc.

Taiwanese cloud deployment platform Zeabur published its preliminary investigation report: between October 14 and 15 (UTC), attackers used leaked internal credentials to access shared clusters, certain dedicated servers, and internal systems, ultimately reading the platform database and exposing 3,218,965 service environment variables and 321,810 user account records .

Fireworks AI updated its October security incident bulletin on November 9, saying that beyond previously known stored secrets it found impact to account and billing information, plus secrets, datasets and incomplete models for a limited set of accounts, with evidence pointing to a financially motivated cybercriminal group engaged in LLMJacking .