Nov 4, 2026
0 new incidents, 3 with updates.
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Updated
- LivePatched
Better Auth's Expo plugin let unauthenticated attackers take over accounts (CVE-2026-121802)
Better Auth, a popular TypeScript authentication library, published a critical advisory on Nov 3 2026 for its expo() server plugin. The plugin's public /expo-authorization-proxy endpoint signed a caller-supplied state value with the application secret without checking that the server had issued it. Because Better Auth uses the same secret for email verification links and the session cookie cache, an unauthenticated attacker who knows a user's email address can sign in as that user and change the account's email, and with the cookie cache enabled, an attacker who knows a user ID can act as that user. The same endpoint was also an open redirect, and wildcard trustedOrigins entries could match URLs outside the intended scheme, host or path. You are affected if your server registers expo() from @better-auth/expo 1.4.0-beta.6 or later. Upgrade both @better-auth/expo and better-auth to 1.7.16 (or 1.8.0-beta.5), then rotate the application secret, because signatures issued before the fix stay valid until it changes.
Better Auth (@better-auth/expo, better-auth on npm)Since Nov 3, 2026
- LivePatched
Chrome 157 fixes 213 security bugs, 7 of them critical (none known exploited)
Google promoted Chrome 157 to the stable channel on Nov 3 2026 (157.0.8103.38 on Linux, 157.0.8103.38/.39 on Windows and Mac) with 213 security fixes. Seven are rated critical: buffer overflows in Dawn (CVE-2026-121156, CVE-2026-121247), memory corruption in ANGLE (CVE-2026-121229), and use-after-free bugs in WebGL (CVE-2026-121246), Prerender (CVE-2026-121035), Geometry (CVE-2026-121203) and Core (CVE-2026-121126). Many of the high-severity bugs were credited to AI-assisted research from Anthropic and OpenAI Codex Security. Google has not said any are exploited. The rollout is staged over days or weeks, so update and relaunch rather than waiting.
Google Chrome (desktop)Since Nov 3, 2026
- LivePatched
APT29 watering holes hit outdated iPhones and Android Chrome with zero-click n-day exploit chains
Sekoia reported a large watering-hole campaign it attributes with moderate to high confidence to Russia's APT29. Hacked legitimate sites in the US, Ukraine, Czech Republic and Bulgaria, lookalike domains proxying real sites (America250, Raffles London at The OWO) and a compromised Plerdy analytics tracker (loaded by thousands of mostly Ukrainian sites, Aug 27 to Sep 3 2026) fingerprinted mobile visitors and served exploit chains with no user interaction. iOS 16.7 got a Safari cookie-stealing chain, iOS 18.5 got the DarkSword kit (WhatsApp and Telegram databases, Keychain, location, photos), and Chrome for Android 139 to 145 got AndroSnitch (cookies, saved logins, history, Wi-Fi passwords). Every bug used is already patched and nothing persists after a reboot, so update iOS and Chrome.
Apple iOS (Safari/WebKit) and Chrome for AndroidSince Aug 27, 2026
