Advisories

Attackers used a fake regulator account to breach Korea's Financial Security Institute assessment system, taking files from 48 financial firms

KBS and Yonhap report that the information protection assessment support system of Korea's Financial Security Institute was hacked on November 9, 2026; the institute confirmed some data leaked, blocked the system and reported to the Financial Services Commission, and files from about 48 financial firms, some 130 in total, are estimated to have leaked .

Zoom published two security bulletins on November 10, 2026, saying improper input validation flaw CVE-2026-108186 in Zoom Workplace for Windows may let an unauthenticated user escalate privileges via network access, rated Critical with CVSS 9.

Fortinet disclosed FortiOS flaw CVE-2026-126259 on November 10, 2026: on devices using HA FGSP with standalone-config-sync or autoscale, an unauthenticated attacker can send crafted HA packets to run commands as super admin, rated Critical with CVSSv3 9.

According to FTV News, Kang Chiao International School's Linkou campus confirmed to parents that its network systems were breached, and several parents and staff received threatening emails signed by the "Osiris ransomware group" .

Japanese car-care products maker Soft99 announced on Nov 10 that its official online shop was accessed by an outside third party, and personal data of up to 136,968 members and shoppers may have leaked .

The Japan Chamber of Commerce and Industry (JCCI) announced on Nov 10 that the external exam management server used for its online tests was accessed without authorization, and data of up to about 980,000 examinees (about 1.

OTC-listed Shen's (8921) said in a November 10 filing that customers of its Jcolor e-commerce platform reported that a third party appears to have improperly obtained data and contacted them by email .

Microsoft’s November Patch Tuesday fixes Outlook spoofing flaw CVE-2026-124194: if a user opens a crafted message file, Outlook connects to an attacker-controlled location without the usual external-content warning and leaks an NTLMv2 hash that can be used to impersonate the user .

OTC-listed Hi-Lai Foods (1268) said in a November 10 material announcement that it was notified that day by its outsourced shopping mall vendor Cyberbiz of a security incident in which part of the vendor database was accessed without authorization, involving order data of some customers of its online mall .

Listed company HeySong (1234) said in a November 10 material announcement that its outsourced online store vendor Cyberbiz notified it of unauthorized anomalous access to part of the vendor database, which includes HeySong online store order data .

France-based Vates published Xen Orchestra security advisory VSA-2026-062 on November 10, saying the REST API treats a cookie such as authenticationToken=j:%7B%7D, which holds an empty object, as an unfiltered lookup and logs the caller in as the owner of the first unexpired token, and confirmed the flaw is being actively exploited .

ESET said on November 10 that it found a previously undocumented modular .

SAP's November 10 Security Patch Day bulletin rates four flaws in ICM, Web Dispatcher, SAP Gateway and the SAML2 service provider (CVE-2026-76964, CVE-2026-89126, CVE-2026-89103, CVE-2026-120017) at CVSS 10.

Apple released iOS and iPadOS 27.

iThome reports that Maywufa (1731) filed a material disclosure on November 9 saying that on November 6 online store members reported a suspected personal data leak, which initial findings link to its outsourced e-commerce platform provider’s system, with the exact cause and scope still under investigation .

According to iThome, servers of NETivism, the vendor behind netiCRM, a donation management system used by Taiwanese nonprofits, were breached by an external attacker, and more than 20 organizations including the Awakening Foundation, Citizen Congress Watch, the Judicial Reform Foundation and Taiwan Tongzhi Hotline have issued notices .

CNA reports that Taiwanese online travel agency ezTravel detected an external attack on its member center on Nov 7, and some historical order contact data was improperly obtained, affecting more than 690,000 people .

Google updated the Chrome Stable channel on Nov 9, 2026 to 157.

A material notice republished by MoneyDJ says Taiwan Sakura (9911) was notified on Nov 9 by its e-commerce vendor Cyberbiz that some data in Cyberbiz's database, which holds orders and personal data from the SAKURA official online store, was accessed without authorization .

iThome reports that 曜亞 (4138) filed a cybersecurity material disclosure on the evening of November 9 saying the DR CYJ online store of its subsidiary 曜胜生技 was affected by a security incident at e-commerce provider 順立智慧 (Cyberbiz), with order-related data accessed without authorization .