Never be afraid to ask questions

Welcome to this week's edition of the Threat Source newsletter. Back in college, I took an anthropology course called “Peoples and Cultures of Southeast Asia.” While the title sounded like your everyday anthro course, this one was a little different. It had fewer students, maybe around 10, and took place from 7 – 9 p.m., most college kids’ nightmare — but it was the perfect time of day to videochat with Malaysian students on the other side of the globe with a 12-hour time difference. My university had a 14-week semester, while the university in Kuala Lumpur had seven weeks, so our class had time before meeting the students to study Malaysia’s pre- and post-colonial history, political climate, and cultural and religious dynamics; watch famous Petronas Deepavali and Chinese New Year ads ; and (of course) drool over pictures of nasi lemak and teh tarik. When both classes began videochatting with one another (yeah, we used Zoom before it was cool), our questions were quite tame. This was partly because we were afraid of offending one another, and partly due to some thorny laws around political speech. They’d ask, “Where do you store your winter clothes during the summer? They’re so puffy!” or “How often do you eat at McDonald’s?” We’d ask, “What's your favorite food at pasar malams (night markets)?” and “How do you deal with the heat and humidity?” (The answer to that one: Malaysia, which is around the size of New Mexico, has around 1,000 shopping malls with heavenly air conditioning.) Over the weeks, with encouragement from our professors, a few brave souls from both countries began to open up about their opinions on the government, social justice movements, discrimination, and more. Their vulnerability was contagious and soon encouraged others to speak up more in class, and everyone began to ask more pointed questions. They’d ask, “What is it like to be openly LGBT+ in the U.S.?” We’d ask, “Do you think the new political party gaining the prime ministership will bring more change?” We soon developed a class motto: Never be afraid to ask questions. I firmly believe that questions asked in good faith create a space where it is safe to be curious, when everyone understands that the goal is understanding, not judgment. It’s perfectly fine to be honest about your lack of knowledge, and you’re always allowed to decline a question if the topic is too complex or personal to unpack in the moment. I'm grateful to still carry this philosophy with me today. I work with Talosians from around the world, where diverse backgrounds and communication styles can make it easy to misinterpret intentions. But assuming positive intent, asking questions, and being appreciative of the answers ensures that everyone is aligned, respected, and heard. To take a page out of Bill’s book (pun intended)... “I wish we could all live in a big house with lots of rooms, and windows, and doors, and none of them locked.” – Ursula K. Le Guin “I want to know why. Why everything. I don't know the answers, but a few days ago I didn't know there were questions.” – Terry Pratchett The one big thing Cisco Talos is breaking down a huge Microsoft Patch Tuesday release for November 2026, which addresses 1,095 vulnerabilities across various products. This month's massive update features 64 critical flaws, 48 of which could allow for remote code execution (RCE). Most notably, Microsoft warned that a spoofing flaw in Microsoft Office Outlook (CVE-2026-124194) is already being actively exploited in the wild. Additionally, don’t miss Google’s patch for a zero-day in Google Chrome’s XML component (CVE-2026-125350), released on Wednesday. The vulnerability is caused by a use-after-free memory management error that could allow a remote attacker to execute arbitrary code within Chrome's sandbox through a specially crafted HTML page. Google confirmed an exploit exists in-the-wild. Why do I care? When a Patch Tuesday drops with over 1,000 vulnerabilities, it is easy to feel overwhelmed. However, the sheer volume shouldn't distract from the handful of flaws that actually require immediate attention. Address the most realistic threats to your environment first to avoid burning out your team. So now what? Take a targeted, risk-based approach to this month's rollout. Start by addressing the actively exploited Outlook vulnerability (CVE-2026-124194), the Google Chrome vulnerability, and the critical RCEs in externally facing or core services like Exchange and Active Directory. To help protect your network and buy your team some time while patching, implement the new suite of Snort rules available in the full blog post . Top security headlines of the week Recently patched Barracuda vulnerabilities exploited in attacks Threat actors have started exploiting two recently patched Barracuda vulnerabilities that could be chained to bypass authorization controls and gain root access. ( SecurityWeek ) N-able took cloud platform offline after 30+ "zero-days" published N-able took its hosted N-central environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more than 30 alleged zero-day vulnerabilities. ( Bleeping Computer ) Security flaws across U.K. government sites exposed “God-Tier” information A security researcher has found more than 100 serious vulnerabilities in publicly available UK government code, putting sensitive data at risk as a result of poor cyber hygiene. ( WIRED ) Japan pushes emergency funding for cybersecurity as AI-assisted breaches rise With Japan facing a surge in cyberattacks and breaches, the Japanese government has passed a ¥10 billion ($63 million) emergency cybersecurity package aimed at establishing teams of industry and government experts to quickly respond to attacks and better secure its infrastructure. ( Dark Reading ) Can’t get enough Talos? Beers with Talos: Come for the hacking, stay for the cheese Talos' Ashley Shen joins Hazel, Dave, Bill and Joe to talk about investigating emerging threats and building security communities. She shares her route into threat intelligence, stories behind co-founding HITCON GIRLS in Taiwan and Rhacklette in Switzerland, how she helps others find their way into security, and her own research. The VOLTA infostealer: Outsourcing cybercrime grunt work to AI Ryan Fetterman breaks down the newly discovered infostealer. Unlike traditional stealers, VOLTA integrates LLMs to analyze stolen credentials in real-time, effectively turning raw data into a prioritized, high-value dossier for the attacker. NIK C2: The new AI-enabled command-and-control framework NIK C2 contains a Windows implant, using which, an actor can dump credentials, stream the victim's keystrokes to collect the targeted victim’s sensitive data, and instruct an integrated AI model to analyze the harvested data, all within the compromised session. Upcoming events where you can find Talos COP31 (Nov. 9 – 20) Antalya, Türkiye CYBERWARCON (Nov. 20) Arlington, VA AVAR 2026 (Dec. 2 – 4) Hyderabad, India Black Hat Europe (Dec. 7 – 10) London, U.K. JSAC2027 (Jan. 19 – 22) Tokyo, Japan Insomni’hack (Feb. 1 – 5) Lausanne, Switzerland Most prevalent malware files from Talos telemetry over the past week SHA256: f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85 MD5: 95a6a4b638cfdfbe3afc883d593a1f87 Talos Rep: https://talosintelligence.com/talos_file_reputation?s=f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85 Example Filename: f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85.js Detection Name: W32.F4B1F888F2-95.SBX.TG SHA256: 7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f MD5: cca616647db9370c88998ae25da6997f Talos Rep: https://talosintelligence.com/talos_file_reputation?s=7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f Example Filename: cca616647db9370c88998ae25da6997f.exe Detection Name: Win.Tool.Kmsauto::1201 SHA256: ae59aedc4d89d7b22db5dc65cd0b2ff68b20b74863