Google's November bulletin covers Android 14 through 17. The worst bug, CVE-2026-58868, could let an attacker run code on a phone without any tap from the owner. Google has not reported any of the flaws as exploited.
A Siemens advisory rates CVE-2026-58115 at the maximum CVSS score of 10.0. Since October 30, VulnCheck has seen attackers use it against decoy systems to drop a Linux bot and backdoors. Headlines say hackers are backdooring Siemens devices, but no compromise of a real device has been confirmed.
Apple's MacBook Pro with a tandem OLED touch display and M5 Pro or M5 Max chips goes on sale on November 6. It is the first Mac with a touchscreen and brings the Dynamic Island to macOS. Prices start at $2,899 in the US.
Google moved Chrome 157 to the stable channel on November 3 with 213 security fixes, seven of them critical. None is reported as exploited. Twenty-one of the flaws were credited to researchers working with Claude or to OpenAI's Codex Security.
Google's Gemini API release notes for early November bring a generally available video model, Gemini Omni 1.2 Flash, and the retirement of Gemini 2.5 Pro and 2.5 Flash. From December 1, requests to the old names go to newer models, with breaking changes. New paid projects also store requests by default.
CISA says attackers are chaining flaws in Ivanti Connect Secure VPN appliances to run commands without logging in, steal credentials and take data. Two more flaws joined its exploited list on October 30, and one of their CVE records was published on November 3.
CISA added CVE-2024-27834 to its list of exploited vulnerabilities on November 4, 2026. The bug lets an attacker who can already read and write memory bypass Pointer Authentication. Apple fixed it in May 2024, so updated devices are protected.
Between October 26 and 29, 2026, CISA added eight vulnerabilities to its list of flaws used in real attacks. They hit code servers, online stores, PHP sites, a compression library, Cisco firewalls, the Linux kernel and VMware hosts. Here is what each one affects and what to install.
A race condition in the WordPress Core updater lets an unauthenticated attacker run code on the server while an upgrade is in progress. CISA confirmed active exploitation on November 3. WordPress 7.1.4 fixes it.
Vulnerabilities disclosed recently. Each entry opens our analysis.
Releases, platforms and the products people use every day.
Models, tools and the decisions behind them.
Security updates and threats, with what to do next.
Step-by-step help that stays useful after the news cycle moves on.
