Morning Threat Brief: Chrome patches its eighth exploited zero-day of 2026, Fireworks AI is breached again, CISA adds four exploited flaws, and Vanderbilt is hit

Good morning. Google patched the eighth Chrome zero-day exploited in the wild this year, a flaw in the browser's XML parser that can run attacker code when you visit a malicious page. Fireworks AI disclosed a second breach in a month, this time through a hacked cloud provider, with billing data and model weights exposed. CISA added four actively exploited flaws to its catalog, including the OpenSSH hole from Sunday's brief, all due Thursday. And Vanderbilt University was hit by a cyberattack while a ransomware group claims it stole student records, a claim nobody has verified. Update Chrome, rotate your Fireworks keys, and patch before Thursday.

1. Chrome patches its eighth exploited zero-day of 2026. Update your browser now. Google released an emergency Chrome 157 update on November 9 fixing nine flaws, including CVE-2026-125350, a high-severity use-after-free bug in the browser's XML component that is already being exploited in the wild. A malicious page can use the flaw to corrupt memory and run attacker code. An anonymous researcher reported it on November 6, and Google is keeping attack details restricted until most users have the fix. The patch is in Chrome 157.0.8103.50 and .51 for Windows and Mac, 157.0.8103.50 for Linux, and 156.0.8078.96 for Extended Stable. CISA has not added the flaw to its exploited-vulnerabilities catalog yet. This is the eighth Chrome zero-day exploited in attacks this year, after flaws in font handling, graphics, and the JavaScript engine. Open Chrome, go to Settings, About Chrome, and restart when it tells you to. The update can take days to reach everyone, so do not wait for it to find you.

2. Fireworks AI is breached again, this time through its cloud provider. AI infrastructure startup Fireworks AI disclosed on November 9 that attackers breached a third-party cloud provider hosting its research and development machines on October 23, reached its development machines the next day, and ran an unauthorized workload. The attackers accessed resource metadata, billing information including addresses, invoice and payment history, account balances and credit usage, plus incomplete model weights and datasets for some customers. Fireworks does not store payment card numbers, so those were not exposed. The company links the activity to a financially motivated group that steals large language model access and resells it through illicit routing gateways, a scheme known as LLMjacking, and is working with Palo Alto Networks Unit 42 on the response. Customers include Notion and Cursor. This is Fireworks' second incident in a month: in early October attackers accessed environment variables holding API keys and tokens for a limited number of accounts. Fireworks says its Inference, Training SDK, and Nexus services show no detected impact, and it has disabled self-serve dataset uploads and downloads for Batch Inference during the investigation. If you use Fireworks, rotate your API keys, review billing and usage for charges you did not make, and treat any model weights or datasets on the platform as potentially exposed.

3. CISA adds four actively exploited flaws, all due Thursday, November 12. CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on November 9, each with confirmed exploitation in the wild and a federal remediation deadline of November 12. OpenSSH CVE-2026-123158, the authentication bypass nicknamed sshole, affects some Linux systems using musl libc without PAM; upgrade to OpenSSH 10.6p2 or your distribution's patched package. GPUStack CVE-2026-102895, an improper authentication flaw in the AI model-serving platform, lets an unauthenticated attacker gain admin access, create API keys, and steal cloud secrets; upgrade to GPUStack 2.2.0 and review any admin API keys and inference backends created from YAML, since minted keys stay valid. SignalWire FreeSWITCH CVE-2026-116779 is a code injection flaw that can leak configuration and credentials and allow arbitrary call control and command execution; upgrade to FreeSWITCH 1.11.3. IBM Aspera Faspex CVE-2026-123218 lets an authenticated user bypass authorization and escalate privileges; upgrade to 5.0.19 PL1. CISA requires forensic triage for all four, and says to discontinue use if mitigations are unavailable. None of the four is tied to a known ransomware campaign yet. If you run any of these, patch before Thursday, and check logs for signs someone was already in.

4. Vanderbilt University is hit, and a ransomware group claims it stole student records. UNVERIFIED. Vanderbilt University confirmed a cybersecurity incident on Monday, November 9, and told students and staff to shut down devices and disconnect from campus Wi-Fi. By the evening, campus Wi-Fi was back but most university systems and applications were still restricted, with classes running on a normal schedule on Tuesday. A ransomware group calling itself BYOD claims it stole student and employee records, including Social Security numbers, locked university databases, and took control of part of the network. Vanderbilt has not confirmed that any records were taken, and has not named who is behind the incident. BYOD has also claimed recent attacks at Michigan State University and the University of New Mexico Health and Sciences Center. A retired FBI cybercrime investigator quoted in local coverage said an online claim alone cannot establish who was behind an incident or whether files were taken. If you are at Vanderbilt, watch for unexpected pop-ups, unfamiliar apps, password requests, and files that go missing or change names, and report anything odd to IT from a separate device. For everyone else, the lesson is the same one universities keep teaching: verify unexpected requests through a separate channel, and use two-factor authentication on every account that holds your records.

Warning: the VMware ESX flaw CVE-2026-41709 is due tomorrow, Wednesday, November 11. All four of today's new KEV entries are due Thursday, November 12, and the second Ivanti flaw CVE-2026-118527 is due Friday, November 13. The Apple KEV entry CVE-2024-27834 is due November 18, and the SonicWall SSL-VPN flaw CVE-2026-19868 is due Friday, November 20.

Full writeups: kevintswaney.com/vuln-watch
Indicators to hunt: kevintswaney.com/ioc-library

Four new CISA KEV entries today, all added November 9 with a November 12 deadline. The catalog stands at 1,773 entries, last updated November 9.

← kevintswaney.com