Cyber-Physical Attacks Escalate, Major Data Breaches Impact Millions

Critical Vulnerabilities and Active Exploitation:

• Google Patches Eighth Actively Exploited Chrome Zero-Day This Year: Google has released an emergency update for Chrome (version 157.0.8103.50/.51) to fix a high-severity use-after-free vulnerability in its XML component, CVE-2026-125350. This marks the eighth actively exploited Chrome zero-day patched in 2026, highlighting the ongoing threat of browser exploits.
• SAP Patches Four Critical Flaws with Maximum 10.0 CVSS Score: SAP's November Security Patch Day addresses 35 vulnerabilities, including four critical flaws (ICM2SHELL and PROXYGATE) with a CVSS score of 10.0. These vulnerabilities, while not yet confirmed as exploited in the wild, allow for remote code execution on critical SAP systems and require immediate patching.

Major Data Breaches and Incidents:

• [UPDATE] Cyber-Physical Attack Hits 700 French Supermarkets via Refrigerators: The French government has attributed cyber-physical attacks on supermarkets to Iran's IRGC, specifically the 'Shahid Kaveh' unit. The attacks, which caused fires and data loss, have expanded to other European countries and critical sectors like blood banks, prompting France to seek EU sanctions.
• Vanderbilt University Hit by 'BYOD' Ransomware, Over 1M Records at Risk: Vanderbilt University is experiencing a ransomware attack by the 'BYOD' group, potentially exposing the sensitive data of over one million students and staff. The incident has disrupted campus systems and led to file encryption.
• Ten Philippine Government Agencies Report Data Breaches: The Philippines' National Privacy Commission has confirmed data breach notifications from ten government agencies, including the Department of Justice and DICT. The scope and impact of these breaches on sensitive government data are currently under assessment.
• Nitori Data Breach May Expose Records of 37.62 Million Customers: Japanese retailer Nitori Holdings has reported a data breach that may have compromised the personal records of up to 37.62 million customers, including email and home addresses. Financial information was not affected, but customers are advised to be vigilant against phishing.
• CIRO Reaches $8.3M Settlement for 2025 Data Breach Affecting 750k: The Canadian Investment Regulatory Organization (CIRO) has proposed an $8.3 million settlement for a class-action lawsuit stemming from a 2025 phishing-induced data breach. The incident compromised the personal and financial data of approximately 750,000 Canadians.
• Children's Foundation Data Breach Occurs via Third-Party IT Provider: The Children's Foundation experienced a data breach through its third-party IT provider, Highland Shores Children's Aid Society. Unauthorized access to the provider's network in July may have exposed the names and contact information of volunteers, donors, and applicants.