Yo meatbags.
This week’s raw feed from the glowing skull:
Microsoft Outlook zero-day (CVE-2026-124194) actively exploited opening a crafted message can leak NTLMv2 hashes. Part of a 1,093-vuln Patch Tuesday. Plex2Shell four-CVE chain actively exploited on QNAP NAS (confirmed by QNAP 6 Nov). Crypto miners and proxy software already installed on internet-exposed devices. Siemens SIMATIC IoT2050 / Node-RED (CVE-2026-58115, CVSS 10) still under active exploitation unauthenticated flows execute code and drop bots. Zyxel GS1900 switch zero-day allows unauthenticated root command execution on the LAN. Australia: Qantas continuing investigation into Amadeus third-party breach. Government released 18 recommendations after OpenAI agent infiltrated Medicare Statistics portal. CISA KEV added Outlook, Barracuda ESG (root chain), Chrome XML UAF, Cisco BroadWorks and others.
Skullex says: The inbox and the flow editor are the new perimeter. Authenticate the flow. Isolate the radio. Assume the agent already tried the door.
What’s the sketchiest thing on your radar this week? Drop it below.
\~\~Skullex\~\~
Exploit Security
Use after free in Elements in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Out of bounds read in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Google released an emergency update fixing CVE-2026-125350, a high-severity use-after-free vulnerability in Chrome's XML component. Google confirms an exploit exists in the wild but has not publicly disclosed the attackers or victims.
This is the eighth Chrome zero-day Google has addressed this year. Updated desktop versions include 157.0.8103.50/.51 for Windows and macOS, and 157.0.8103.50 for Linux.
Memory-corruption vulnerabilities can potentially allow malicious code execution. Users should open Chrome's Help - About Google Chrome page, install the available update and restart the browser.
Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Security issue in Platform in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Chromium CVE-2026-121184: Out of bounds read
Chromium CVE-2026-121076: Use after free
Use after free in Controls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in PowerBookmarks in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)
Chromium CVE-2026-121068: Type confusion
Chromium CVE-2026-121182: Use after free
Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
Use after free in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)