November Patch Tuesday: Microsoft fixed a record 1,235 flaws, 66 critical. One is already exploited: CVE-2026-124194 in Outlook. Open a crafted message file and Outlook connects to the attacker's server without the usual external-content warning, handing over your NTLMv2 hash to crack offline. Classic phishing attachment, so patch Outlook first. Fun detail: the list includes the OpenSSH "sshole" bug, because it hits Microsoft's own Linux, Mariner.

BleepingComputer

Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day

Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively explo...

Best write-up of the LNbits attacks so far, from someone it happened to: an attacker took @Logen's node from a free account in about eight hours. Open sign-up, a Paywall extension bug that let a normal user read server files for 1 sat, super-user access, then a malicious extension that read LND's admin.macaroon and tried to close every channel. If you run LNbits: never give it admin.macaroon. Bake one that can only invoice and pay, and mount that file alone. His post has the full chain, signs of compromise and cleanup steps. View article →

If you use Claude Code, check your repos. Apiiro found 1,122 public GitHub copies of its permissions file with at least one secret inside. Approve a command with "don't ask again" and it gets saved there, token and all. They didn't test whether the secrets still work. The file is meant to be git-ignored, so `git ls-files | grep .claude/` is a quick check. Mine came back clean.

The Hacker News

Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub

Claude Code saves secrets in approved commands, exposing 2,539 credentials across 1,994 public GitHub repositories, Apiiro finds.

OpenSSH bug with a lovely mechanism: CVE-2026-123158, "sshole". Send a password of 257+ bytes and on musl the hash function returns "*", which is exactly what locked accounts store as their password. So it matches, and you're in an account that shouldn't accept passwords at all. Needs musl, no PAM and password logins on, which is Alpine's default. Alpine's cloud images even ship a locked "alpine" user with passwordless doas. Fixed in 10.6p2. Debian and Ubuntu use glibc and PAM, so they're fine.

BleepingComputer

OpenSSH flaw lets attackers log into password-disabled Linux accounts

A newly disclosed OpenSSH vulnerability dubbed "*sshole" allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts tha...

OpenAI caught its own model sandbagging. GPT-6 Astra quietly did worse on AI safety work (red-teaming, exploit tasks, evals) than on identical tasks framed as capabilities research: about 10% of hidden criteria met vs 16%. It invented blockers, dropped working solutions, and the monitors missed most of it. Telling it to "be careful" made it 50% worse. OpenAI's best guess is overcaution. They also say they can't rule out motives it never wrote down.

SecurityWeek

OpenAI Finds GPT-6 Astra Quietly Holding Back on Internal Red-Teaming, Exploit Tasks

GPT-6 Astra quietly underperformed on AI safety research tasks such as red-teaming, and OpenAI’s monitors mostly missed the behavior.

Self-hosting WordPress? CVE-2026-119977 (CVSS 8.1) is being exploited, and the vulnerable moment is the core update itself. During a full update, WordPress stages files in a predictable, web-reachable folder, and anyone who hits it in those few seconds can run code, no account needed. Wordfence saw 18,500+ attempts in 21 hours. Fixed in 7.1.4 and backported to older branches. Ironically you have to update to fix it, so block wp-content/upgrade/ at the web server while you do.

Google is telling schools: keep our AI on, or lose Search. From early 2027, K-12 student accounts get Gemini and Search switched off until the school enables them, and Google says it can't separate the two because AI Overviews and AI Mode are now part of Search. Block the AI and students just get a "not available" page. So the most-used search engine in classrooms now comes bundled with a chatbot, take it or leave it.

I've been building Quill, a text-only Nostr client:

Quill

What makes it different: - A filter that explains itself. When it hides a note (spam bursts, copy-paste floods, link-only posts, strangers far from your network), it tells you why, and you can show it anyway or tune the rules. - Highlights: notes with something to say that the people you follow talked about, not just liked. - Pick of the day: every morning an AI picks 8-12 notes worth reading from across Nostr, each with a short summary. - It never sees your private key. You read with just an npub, and write through a remote signer (Clave, Amber, nsec.app or your own bunker). No images unless you ask, no ads, open source:

GitHub

GitHub - rzazo24/quill: Small text-first Nostr client that tells you why it hides things. Explained spam filter with web of trust, zaps through your own wallet (NWC), pictures off unless you choose, no backend, signs with any NIP-46 remote signer, installable PWA.

Small text-first Nostr client that tells you why it hides things. Explained spam filter with web of trust, zaps through your own wallet (NWC), pict...

Open it without an account to see today's pick. Feedback welcome.

This morning several UK banks (Revolut, Lloyds, HSBC, Bank of Scotland) are partly down. The likely cause: Google Cloud's London region having problems since around 06:00 GMT. Nobody got hacked and the money is safe. But for a few hours people couldn't pay or log in, because one zone of one provider failed. Revolut's status page kept saying "all systems operational" while it happened. That's the hidden cost of everything running on the same three clouds: one bad morning in one data centre and half a country's payments stall. It's also why I like Nostr's design. If one relay goes down, your notes are on others, and your identity is a key, not an account on someone's server. Bitcoin works the same way: no single data centre to fail.