Today is what “blast radius” looks like when it’s measured in customers, endpoints, and MSP consoles, not just servers. Also, if you are still treating third-party SaaS and edge admin panels as “someone else’s problem,” attackers would like to thank you for your consistency.

Today's Top 5

1. 7.7M Iris Plaza cloud breach: Iris Ohyama says a hacked external cloud service tied to Iris Plaza may have exposed customer PII at huge scale, and the platform is still offline while they unwind what was touched. Source
2. Vanderbilt BYOD ransomware claim: Vanderbilt tells staff and students to shut down devices and disconnect from campus Wi‑Fi while BYOD claims it encrypted databases and stole student, employee, and research data. The most interesting part is what they say they already have. Source
3. N-able N-central yanks hosted cloud: N-able took hosted N-central offline and told on-prem customers to take servers offline after a researcher published details for 33 alleged “Able2Shell” bugs with PoCs. MSPs get to enjoy a new kind of Monday. Source
4. Chrome patched exploited XML bug: Google pushed Chrome 157 with fixes including CVE-2026-125350, an XML use-after-free where Google says an exploit exists in the wild. If your browser fleet updates “eventually,” congrats on your new attack surface. Source
5. Plex2Shell hits QNAP Plex installs: QNAP says users reported Plex Media Server compromise via the Plex2Shell chain, with advice to update Plex, rotate NAS and Plex creds, and consider internet-exposed boxes already dirty. The quiet risk is what else those NAS credentials unlock. Source

Why today matters: Three different patterns are converging: cloud services holding customer identity data, remote admin planes that sit behind “it’s just ops tooling,” and endpoints that live on the public internet by default. Attackers are not picking one lane, they are building a portfolio. CISOs should be nervous if their org relies on MSP tooling, campus-style device sprawl, or any customer platform whose “external cloud service” inventory is fuzzy.

XERJ Corpus Hub: Working the N-central “Able2Shell” situation? An AI agent loading checkov could quickly audit your internal IaC for risky patterns that turn RMM into an internet-exposed control plane (open security groups, public load balancers, weak network segmentation), then hand your infra team a prioritized diff list in minutes. More corpora at hub.xerj.org, grab one and move faster.

Okay, now the rest of the pile.

Data Breaches

1. Iris Plaza breach may have exposed 7.7 million customers: Iris Ohyama says attackers accessed a third-party cloud service used by Iris Plaza and may have stolen PII for up to 7.7 million people. The company says the service did not store credit card data and the platform remains offline during investigation and remediation. Source: SecurityWeek
2. Vanderbilt University hit in BYOD ransomware attack, data theft claimed: Vanderbilt confirmed an active cybersecurity incident and told the campus to shut down university devices and disconnect from Wi‑Fi. The BYOD ransomware group claims it encrypted databases and stole extensive student and employee data, but Vanderbilt has not confirmed the claims publicly. Source: BleepingComputer
3. Over 3 million impacted in Frontline Education breach: Frontline Education told regulators its August incident affected 3,085,266 people, more than double earlier totals. The company says attackers entered via a vulnerability in a third-party software product and stole student and employee PII from two Frontline products. Source: SecurityWeek
4. Revolve puts data breach victim count at 1.5 million: Revolve told the Indiana AG that 1,515,073 individuals were impacted by the September intrusion involving its e-commerce platform. Revolve said payment card numbers and expiration dates may have been taken for users who stored payment methods in accounts. Source: SecurityWeek
5. Amplifon Americas data breach impacts 1.3 million: Amplifon disclosed a breach tied to January to February 2026 data access and says it took months to review affected files. Exposed data may include health and insurance information and, for some, Social Security numbers and financial information. Source: SecurityWeek

Security Research

1. N-able takes N-central offline after 30+ “zero-days” posted: A researcher published a GitHub repo with PoCs for dozens of alleged N-central vulnerabilities, prompting N-able to take hosted environments offline and advise on-prem customers to shut down servers temporarily. The bigger issue is downstream MSP access concentration and how quickly an RMM bug becomes many customers’ incident. Source: BleepingComputer
2. AI-aided breach alleged via MCP assistant interface at Mittwald: German host Mittwald said attackers compromised 56 customer projects after exploiting a flaw tied to its Model Context Protocol server used to connect AI assistants to its management platform. The claim of AI speed is interesting, but the real takeaway is that “assistant connectors” are now production auth surfaces. Source: The Record
3. Google Chrome exploited-in-the-wild XML bug patched: Google shipped Chrome 157 and noted it is aware of in-the-wild exploitation for CVE-2026-125350, a use-after-free in the XML component. This is now the kind of bug chain that shows up in commodity campaigns fast. Source: Chrome Releases
4. Plex2Shell exploitation against QNAP NAS users: QNAP warned of active exploitation of the Plex2Shell chain against Plex Media Server on QNAP NAS devices, with advice to reinstall Plex on internet-exposed systems and rotate passwords. The operational headache is verifying what tokens and backups lived on the same NAS. Source: SecurityWeek
5. Google DeepMind: AI agents reduce RSA-1024 attack cost: DeepMind said human-supervised agents found methods that reduce the cost of attacks against legacy RSA-1024 systems, while noting modern 2048-bit and larger deployments remain the norm. The practical takeaway is inventory, not panic: find and kill RSA-1024 stragglers. Source: SecurityWeek

Top CVEs

1. CVE-2026-125350: A use-after-free in Google Chrome’s XML component. Google says it is aware an exploit exists in the wild, and the fix ships in Chrome 157 for desktop, so browser fleet update latency directly maps to exposure. Source
2. CVE-2026-123270: Redpanda Connect streams mode management API unauthenticated RCE when exposed, with authentication disabled by default and no auth gate on stream CRUD routes. If TCP/4195 is reachable, an attacker can post a malicious pipeline definition and execute code as the service account. Source
3. CVE-2026-58115: Missing authentication in Node-RED on Siemens SIMATIC IoT2050 Advanced can allow an unauthenticated attacker to deploy malicious flows and execute code with maximum privileges. Siemens notes it released a fix via its security advisory and cites exploitation observations against canary instances. Source
4. CVE-2026-19868: SonicWall SonicOS SSL-VPN authentication bypass that weakens VPN logins and has been reported as exploited in the wild. If you rely on SAML-enforced MFA assumptions, treat this as a “prove it” moment with logs and compensating controls. Source
5. CVE-2026-123158: OpenSSH password authentication bypass on systems using musl libc without PAM, impacting certain Linux distributions and configurations. Risk depends on how sshd is built and deployed, but the remediation is straightforward: patch OpenSSH and validate your libc and PAM assumptions. Source

Podcasts & Talks

1. Risky Business #858: “The $6.3b laptop”: A useful executive listen on how spectacular losses can still come from basic process failures and weak operational controls. Good fodder for your next board update on why “security fundamentals” remains a budget line item. Listen: Risky Business
2. SANS Stormcast (Nov 9, 2026): sshole scans, SonicWall MFA bypass, Entra issue, Claude secrets: A compact daily briefing that strings together the week’s edge-auth pain. If you are running Alpine or VPN stacks under staffing pressure, this one is a quick calibration. Listen: Apple Podcasts

Final Words

The underlying pattern today is not “ransomware” or “zero-days.” It is control-plane concentration. Customer platforms centralize identity data in third-party services, MSP tools centralize endpoint control, and browsers centralize everything users do. The uncomfortable implication: your most dangerous exposures are the ones that feel like infrastructure, not applications, because they live outside normal product security review paths.

This week, do three things:

• Push Chrome 157 fleet-wide and explicitly validate coverage for CVE-2026-125350, including unmanaged and BYOD endpoints that still reach corporate SaaS.
• If you use N-able N-central, take a hard look at internet exposure, admin access paths, and emergency shutdown runbooks, then follow vendor guidance while the Able2Shell situation stabilizes.
• Run a targeted hunt for internet-exposed Plex Media Server and NAS management surfaces, then rotate credentials and tokens on any box that could have been hit by Plex2Shell.

Your turn: If a ransomware crew posted a claim tonight saying they stole over 1 million SSNs from your university or enterprise, do you have a pre-written decision tree for what you say publicly in the first 4 hours, or do you improvise? Hit reply to this email with your take, or drop a comment on the web version. I read every reply.

Know someone whose org depends on an RMM console like N-central and still has it reachable from the open internet? Forward them this issue while the Able2Shell dust is still in the air. If you got this via a forward or the web, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!