Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones

thehackernews.com Nov 11, 2026

Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones

Curated by Shubham · TechCapsules · Nov 11, 2026

AI-summarised brief · reviewed before publication

Git has patched a critical vulnerability (CVE‑2026‑111760) that allowed malicious repositories to execute code on systems performing recursive clones with submodules. The flaw stemmed from an integer truncation in Git’s index handling; an excessively long path could bypass safety checks, be shortened to “.git”, and replace a submodule’s .git file with a symlink to attacker‑controlled hooks. When Git later accessed the submodule, the malicious hooks ran automatically. The issue was addressed in Git 2.56.1 and back‑ported to 2.50.2 through 2.55.1, which now reject overly long paths before truncation. GitHub applied the fixes across its services, including GitHub.com, Enterprise Cloud, and upcoming updates for Desktop, Copilot, Codespaces, and Actions. Users are urged to upgrade to patched versions or follow mitigation steps.

💡 Why It Matters

· A repository can become a silent drop‑point for code execution, turning routine cloning into a supply‑chain attack.
· Rapid adoption of the fix is vital to protect the billions of developers who rely on Git’s default cloning behavior.

Capsules Cybersecurity

Read full article on thehackernews.com

SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution

SAP released its November Security Patch Day updates, fixing four critical CVSS 10.0 vulnerabilities that allow remote code execution without authentication. Three flaws reside in the SAP NetWeaver application server—two in the Internet Communication Manager (ICM) and Web Dispatcher, and one in the SAML 2.0 service provider—while the fourth affects SAP Gateway. The ICM and Web Dispatcher bugs, identified as ICM2SHELL, enable memory corruption and OS command execution; the Gateway flaw, PROXYGATE, permits an attacker to impersonate a trusted server and run commands as the system administrator. SAP recommends immediate application of the individual patch notes, particularly for kernels 7.40 through 7.89, and advises upgrading unsupported kernels. The patches address vulnerabilities that could lead to full system compromise and potentially affect connected SAP environments.

💡 The fixes eliminate high‑risk entry points that could let attackers gain unrestricted control over SAP systems, a critical concern for enterprises relying on SAP for core operations. Prompt patching is essential to prevent exploitation that could disrupt business continuity and expose sensitive data.

techcrunch.com · Nov 10

France blames Iran for mass-hacks targeting freezers in grocery stores and blood…

The French government officially blamed Iran for a series of cyberattacks that targeted thousands of internet‑connected industrial freezer and refrigerator units in France and across Europe. The attacks, attributed to the Islamic Revolutionary Guard Corps, raised temperatures in grocery stores and retail supermarkets, spoiling food, and also compromised medical blood banks, though no blood was lost. French Foreign Minister Jean‑Noël Barrot described the incident as unprecedented sabotage, summoned Iran’s ambassador, and announced potential European sanctions and legal action.

💡 The incident exposes the vulnerability of critical food‑storage infrastructure to state‑backed cyber threats, underscoring the need for robust security protocols in essential services.

thehackernews.com · Nov 10

Beyond the Alert: The Case for Rich Network Data

Security teams are increasingly recognizing that prevention alone cannot stop breaches, prompting a shift toward interdiction strategies that rely on rich network data to trace and disrupt attacker activity after an alert fires. While detections are easy to compare during product evaluations, they often leave analysts without the contextual information needed to follow an intrusion’s lateral movement or post‑compromise actions. Shallow data—limited to timestamps, IPs, and basic connections—can dead‑end investigations, whereas richer data captures detailed transaction logs, correlates events, and enables reconstruction of attacker behavior across hosts. The rise of AI‑driven SOC tools amplifies the importance of data depth, as more granular inputs allow algorithms to surface subtle indicators and assist analysts with scripting and query generation. However, AI outputs must still be validated, making data quality and inspectability critical for effective incident response.

💡 Richer network telemetry turns alerts from dead‑ends into actionable intelligence, directly empowering analysts and AI tools to halt attacks before they cause damage.

techcrunch.com · Nov 10

Hotel giant Wyndham exposed customer data after app security lapse

Wyndham, a major hotel and resort operator, disclosed a cybersecurity breach after security researcher Robert Wiggins uncovered a hard‑coded password in the company’s Android app. The credential granted access to a Salesforce‑hosted database containing millions of customer records, including names, emails, member numbers, and login tokens. Wyndham revoked the exposed credential immediately and reported no evidence of unauthorized access. The company declined to disclose whether it would notify affected customers or file a regulatory notice.

💡 The incident underscores the risks of hard‑coded credentials in consumer apps, a flaw that can expose vast personal data sets with minimal effort. It also highlights the growing need for transparent vulnerability disclosure processes in the hospitality sector.

quantumcomputingreport.com · Nov 10

Why Quantum Hardware Needs Its Own Threat Model

The article argues that the emerging field of quantum computing lacks a dedicated threat model, despite its rapid commercialization as a cloud service. While post‑quantum cryptography protects classical systems from future quantum attacks, no comparable effort secures the quantum hardware itself. Modern quantum machines consist of classical components—compilers, schedulers, calibration databases, and error‑correction decoders—connected to the internet for job submission via platforms such as IBM, AWS Braket, Azure Quantum, Google, IonQ and Quantinuum. This exposure creates attack surfaces ranging from supply‑chain compromises of software stacks to malicious manipulation of calibration data, decoder inputs, and multi‑tenant crosstalk. Existing research documents concrete exploits, but the findings remain fragmented, lacking a unified framework for vendors and security teams to assess and mitigate risks.

💡 Without a coherent security framework, quantum cloud providers risk undetected manipulation that could corrupt results, undermine trust, and give malicious users a covert channel to sabotage or steal computations.

thehackernews.com · Nov 9

Hackers Compromise Ethersphere’s bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware

Attackers compromised Ethersphere’s continuous‑integration credentials and used the project’s own release pipeline to publish malicious versions of its Swarm storage tools—bee‑js 13.3.0 and Swarm Desktop 0.56.2. Both packages contained a post‑install loader that fetched additional code from a remote server, exfiltrated the node’s encrypted wallet key and plaintext password, and installed a persistent backdoor on Windows, macOS and Linux. The compromised Swarm Desktop update was offered via the built‑in auto‑updater to Windows x64 and Apple‑Silicon Macs within ten minutes of release; the bee‑js package was available on npm for about 75 minutes. Both releases were withdrawn after 8.5 hours and 65 downloads (bee‑js roughly ten), and a clean Swarm Desktop 0.56.3 was issued. No thefts have been reported, but any system that installed the malicious versions is considered fully compromised.

💡 The breach demonstrates how stolen CI credentials can weaponize trusted supply‑chain channels, turning everyday developer tools into silent credential‑stealers and remote‑access implants.