It’s a “small seams, huge blast radius” day. A single MSP listing can spill into three organizations, and a single email preview can quietly hand over an NTLM hash. Cool, cool.

Today's Top 5

1. 3,000+ victims, one MSP: A fresh extortion write-up ties Onmion LLC to three breached client orgs, the sort of chain reaction that makes third-party risk registers feel optimistic. Source
2. Chrome zero-day, exploit in wild: Google shipped an emergency fix for CVE-2026-125350, the eighth Chrome zero-day this year. The details are thin, which usually means the victim list is not. Source
3. SAP drops four 10.0s: November Patch Day lands with four CVSS 10.0 issues in the NetWeaver stack. If you run ABAP, Gateway, ICM, or Web Dispatcher, your weekend plans just changed. Source
4. Outlook KEV: NTLM hash leak: CISA added CVE-2026-124194 to KEV. The practical outcome is familiar: user opens a crafted message, Outlook reaches out, your NTLMv2 hash goes with it. Source
5. AI infra breach via SGLang: NEAR AI says an attacker exploited an SGLang RCE to access one inference server and pull account details for about 100 users, plus legacy agent exposure and key cleanup. Source

Why today matters: We’re watching defenders lose to “default trust”: MSP access that implicitly fans out to clients, browsers that stay unpatched for days, and email clients that still treat outbound auth as a harmless side effect. The attackers do not need novel malware when your operational plumbing already routes power, identity, and data across org boundaries.

XERJ Corpus Hub: Triage the Outlook KEV item fast. An AI agent loading splunk-security-content could draft Splunk detections for suspicious outbound NTLM authentication and related Windows log patterns tied to CVE-2026-124194, then hand your SOC a runnable search and a tuning checklist in minutes. Grab a corpus at hub.xerj.org.

Alright, now the receipts.

Data Breaches

1. Onmion LLC, three clients, 3,000+ victims (extortion claim): Ransomnews’ tracker highlights an MSP-style incident write-up where Onmion LLC is framed as the single provider behind three separate client breaches, with “3,000+ victims” cited. Treat leak-site narratives as claims, but treat the supply chain lesson as real. Source: Ransomnews
2. Kneupper & Covey, PC breach notice (reporting tool admin abuse): The law firm posted a substitute notice dated November 10, 2026, saying an unauthorized party accessed a commercially available reporting tool integrated with its case-management system and created admin accounts. The notice says Social Security and payment card data were not involved. Source: Kneupper & Covey
3. Premier Business Solutions, LLC listed on Vermont AG breach notices: Vermont’s AGO breach notice index shows Premier Business Solutions, LLC reported on 11-10-2026, with “Social Security Numbers” flagged (and a small Vermont count shown). If you vendor-manage small service providers, this is your reminder that “2 impacted” can still mean high-risk data types. Source: Vermont AGO
4. SANKO TECHNO (Japan) final report on ransomware at Vietnam subsidiary: A disclosure dated November 10, 2026 describes ransomware impact at a consolidated overseas subsidiary, attributing the entry point to network device misconfiguration and listing remediation steps like cutting off external paths and changing admin creds. This is the boring root cause that keeps paying dividends for attackers. Source: Tokyo Stock Exchange filing mirror
5. NEAR AI security incident (SGLang RCE, limited user exposure): NEAR AI’s own incident report states an attacker exploited an SGLang remote code execution flaw to gain code execution on one inference server and then reached internal systems, downloading account details for approximately 100 users. It also details token resets, session revocations, and key handling. Source: NEAR AI

Security Research

1. Chrome zero-day exploited: Google patched CVE-2026-125350, a use-after-free in Chrome’s XML component, and confirmed exploit activity in the wild. If your enterprise Chrome rollout relies on “eventually auto-update,” you are donating time to adversaries. Source: BleepingComputer
2. SonicWall SonicOS SSL-VPN SAML auth bypass, exploited: SonicWall issued fixes for multiple SonicOS flaws, including CVE-2026-19868 where alternate auth paths can bypass SAML controls and potentially SAML-enforced MFA. It was added to CISA KEV, and the article notes SonicWall investigated a report indicating potential exploitation. Source: IT Pro
3. Plex2Shell abuse expanding on QNAP NAS: QNAP warns that older Plex Media Server versions on QNAP NAS devices are being actively exploited using the “Plex2Shell” chain (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656). The advice is blunt: patching alone is not enough if the box was internet-reachable while vulnerable. Source: TechRadar
4. SAP November Patch Day analysis (four 10.0 issues): Onapsis breaks down November’s SAP patch drop, calling out four CVSS 10.0 issues in the NetWeaver stack and additional high-impact notes. This is one of those “if you can’t patch fast, segment harder” moments. Source: Onapsis
5. Outlook bug lands in KEV: CISA’s KEV catalog entry for CVE-2026-124194 flags an Outlook issue that can enable spoofing over a network with missing user interaction warnings, aligning with the old story arc: mail clients as credential-leak engines. If you still have NTLM exposed broadly, this is your paging alert. Source: CISA

Top CVEs

1. CVE-2026-125350: Google Chrome XML use-after-free exploited in the wild. Remote attackers can use a crafted webpage to trigger memory corruption and run code in the sandbox context. Source
2. CVE-2026-124194: Microsoft Office Outlook missing user interaction issue, added to CISA KEV. Practical risk: crafted content can coerce network auth flows and leak NTLMv2 material in the wrong environments. Source
3. CVE-2026-19868: SonicWall SonicOS SSL-VPN SAML authentication enforcement weakness that can allow bypass of SAML controls and potentially SAML-enforced MFA when SAML login is enabled. Reported as exploited and added to KEV. Source
4. CVE-2026-120017: SAP NetWeaver AS ABAP SAML2 service provider issue rated CVSS 10.0 in November Patch Day coverage. High impact in SSO paths for core SAP stacks means internet exposure is not required for this to be catastrophic. Source
5. CVE-2026-76964: SAP NetWeaver stack flaw called out as CVSS 10.0 in November Patch Day reporting, impacting core comms components (ICM). Treat any externally reachable NetWeaver footprint as a priority queue item. Source

Podcasts & Talks

1. Risky Business Podcast (Nov 9, 2026): Episode page for the weekly show around the “$6.3b laptop” story, plus commentary on how messy real-world intrusions look up close. Worth it for the exec-ready framing you can reuse internally. Listen: Risky Business Media
2. SANS Stormcast (Tue, Nov 10th, 2026): A compact briefing that name-checks CVE-2026-125350 and SAP NetWeaver themes, useful when you need to align patching, comms, and SOC focus in under 10 minutes. Listen: Muck Rack episode index

Final Words

Today’s underlying pattern is delegation without guardrails. We delegate admin power to MSPs, browsing safety to auto-updaters, and identity boundaries to legacy protocols. The uncomfortable implication most coverage skips is that “patch faster” is necessary but not sufficient, you also have to reduce how much a single compromised node is allowed to represent you.

This week, do three things:

• Force-update enterprise Chrome and validate version compliance for CVE-2026-125350, including unmanaged endpoints that only show up when something breaks.
• Harden Outlook and Windows auth exposure by limiting NTLM where feasible, and hunt for suspicious outbound authentication patterns tied to CVE-2026-124194 style coercion.
• Put SAP NetWeaver patching for CVE-2026-120017 and CVE-2026-76964 on an executive-tracked timeline, then add compensating controls (segmentation, WAF rules, restricted admin paths) for anything you cannot patch quickly.

Your turn: If a single MSP you use got popped tomorrow, do you know exactly which three business units would feel it first, and who has the authority to sever access within 15 minutes? Hit reply with your one-sentence answer, or drop a comment on the web version. I read every reply.

Know someone who still treats their MSP as “trusted internal”? Forward them this issue and point them at the Onmion-style blast radius problem. If you were forwarded this or you’re reading on the site, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!