N-able Pulls Its IT Management Cloud Offline After 30+ Zero-Days Go Public, Anthropic Ships Claude Fable 5.2, and Wyndham's App Hides a Database Password

By Noah Smith, Owner & Consultant, KeyChange Technologies · November 10, 2026

Pen-and-ink sketch of a small airport control tower with its blind pulled down while dozens of small planes circle overhead waiting for it to reopen, with KeyChange logo and caption

Here is your AI and IT news for Tuesday, November 10, 2026: a remote-management platform that thousands of IT providers depend on went dark on purpose, Anthropic shipped its most capable public model yet, and a hotel giant's app turned out to have a database password tucked inside it.

📌 The AI and IT news at a glance

  • 🔝 N-able pulls its N-central IT management cloud offline worldwide after 30+ alleged zero-days are posted publicly
  • 🤖 Anthropic releases Claude Fable 5.2 and Mythos 5.2, faster and cheaper than the versions they replace
  • 🤖 Meta launches Muse Ember, a 10-cent model built to do the repetitive grunt work inside AI agents
  • 🤖 OpenAI shows off "Control Room," a kill switch that can stop any research model within 35 seconds
  • 🛡️ Google patches its eighth actively exploited Chrome zero-day of the year
  • 🛡️ Vanderbilt University tells staff and students to shut down their devices as a ransomware gang claims it took everything
  • 🛡️ Wyndham's Android app contained a password to a customer database
  • 🛡️ France officially blames Iran for the supermarket freezer attacks that sparked at least 15 fires
  • 🧰 ChatGPT Enterprise can now be bought straight through AWS Marketplace
  • 🧰 Otter.ai adds 27 languages and will follow a meeting as speakers switch languages mid-conversation

🔝 Top story

N-able takes its N-central platform offline after a researcher dumps 30+ zero-days

On Monday, November 9, N-able took its hosted N-central environments offline across the Americas, Europe, and Asia-Pacific and told customers running their own N-central servers to switch them off until further notice. N-central is a remote monitoring and management (RMM) platform: it is the console many managed service providers (MSPs) and internal IT teams use to patch, monitor, and control every computer they look after. The shutdown came after security researcher Sean Bales published more than 30 alleged zero-day vulnerabilities, with working proof-of-concept exploits, in a GitHub repository late on Sunday night. The most serious chain, according to Bales, lets an attacker with no login create a rogue administrator account and run commands on the server.

N-able says it is building and validating a hotfix, has seen no evidence of active exploitation or data access, and will post updates every four hours. Bales told BleepingComputer the bugs were found with AI assistance and that he went public without warning because N-able allegedly ignored earlier reports he filed on a different product months ago. N-able did not respond to those allegations, and BleepingComputer has not independently verified every flaw, though the company's own emergency response suggests at least some are real.

In short: A widely used IT management platform was switched off globally after exploit code for dozens of unpatched flaws went public.

What it means for your business: If your IT provider uses N-central, they may be partly blind right now: patches, monitoring alerts, and remote support could all be paused. That is the right call, but it is worth knowing what your provider does when their main tool goes dark.

My take: Shutting everything off was painful and correct. An RMM tool is a master remote control for every machine it touches, so a public exploit for one is about as bad as it gets. The bigger lesson is concentration risk: one vendor's bad night can freeze support for thousands of small businesses at once. Ask your IT provider two questions this week: are you on N-central, and what is your fallback when your management tool is down?

Source: BleepingComputer: N-able takes cloud platform offline after 30+ "zero-days" published

🤖 AI

Anthropic releases Claude Fable 5.2 and Claude Mythos 5.2

Anthropic on Monday released Claude Fable 5.2 and Claude Mythos 5.2, upgrades to its top-tier models for the hardest technical work. The two are the same underlying model: Fable ships with strong cybersecurity and biology safeguards and is available to everyone, while Mythos drops those blocks and is limited to vetted organizations in Anthropic's cyber and life sciences verification programs. Anthropic says the new versions produce output up to 30% faster than the 5.1 models and come at a lower price of $8 per million input tokens and $40 per million output tokens, with an optional fast mode at double the price for up to 2.5 times the speed.

The company's showcase claims are big: Fable 5.2 helped migrate a production service from Python to Rust, designed three working electronic gadgets from a one-paragraph prompt, and, with 1,000 agents, formalized the proof of Fermat's Last Theorem in 30 hours. On Anthropic's own benchmark table it leads Claude Opus 5.5, GPT-6 Astra, and Gemini 4 Carbon on most tests, though Gemini 4 Carbon edges it on a business-workflow benchmark. Anthropic still recommends Opus 5.5 as the everyday default and Fable for the most ambitious jobs. Fable 5.2 is live now on the Claude apps and API as well as AWS, Google Cloud, and Microsoft Azure.

In short: Anthropic's most capable publicly available model got faster, cheaper, and better at coding and long multi-step work.

What it means for your business: If you are already paying for a Claude plan that includes Fable, you get a stronger model at no extra cost, and Anthropic is handing out bonus Fable usage this week. For most daily writing and analysis, the cheaper default model is still the right tool.

My take: The benchmark wins are vendor-reported, so treat them as a starting claim, not gospel. What I find more useful is Anthropic's own advice to start with the everyday model and step up only when a job is genuinely hard. That is how you keep AI costs sane: match the model to the task instead of defaulting to the biggest one.

Source: Anthropic: Introducing Claude Fable 5.2 and Claude Mythos 5.2

Meta launches Muse Ember, a cheap model for the busywork inside AI agents

Meta's Superintelligence Lab on Monday released Muse Ember, its smallest and most cost-efficient model to date. Meta says it is designed for "the work agents repeat all day," such as calling tools, small coding tasks, routing requests, pulling data out of documents, and parsing long files. It costs 10 cents per million input tokens, which TechCrunch notes undercuts Anthropic's Haiku and OpenAI's Luna and is competitive even with low-cost open-source models.

Ember is meant to be paired with a larger model. In Meta's framing, its frontier model Muse Wonder plans the work and Ember handles the volume, for example applying a set of customer-support rules across tens of thousands of tickets. It also reads images, screenshots, charts, scanned documents, and audio without needing a separate model.

In short: Meta released a very low-cost AI model built to do high-volume, repetitive steps inside automated workflows.

What it means for your business: The price of the "boring middle" of AI automation (sorting, extracting, routing) keeps falling, which makes high-volume tasks like invoice data entry or ticket triage cheaper to automate.

My take: This is the unglamorous part of AI that actually saves money. The big-brain model does not need to read every receipt; a cheap one can. If someone quotes you an automation project, ask which model handles the volume, because that line item is where the bill hides.

Source: TechCrunch: Meta releases Muse Ember, a new lightweight model for agent execution

OpenAI builds a "Control Room" to stop its research models fast

OpenAI on Monday described Control Room, a central system that tracks every model workload running across its research infrastructure and can halt one within 35 seconds of a decision to stop it. Every research job that uses agentic AI must be tied to an approved safety case, and the system works with OpenAI's misalignment monitors, which watch training runs and can trigger a stop. OpenAI says a monitor caught its recent DNS-related incident.

The design "fails closed": if Control Room itself goes down or is tampered with, all inference requests in research are denied until it is back. OpenAI says that is rolled out for all frontier model research now and will reach the rest of its research workloads over the next few days, and it is working to cut the 35-second lag to zero.

In short: OpenAI built a central off switch that can stop any of its research AI jobs in about half a minute.

What it means for your business: Nothing to install, but it is a good reference point: if the labs building these systems need a hard stop for AI that acts on its own, so does any business letting agents touch its systems.

My take: "Fails closed" is the phrase to steal here. If you are rolling out AI agents with access to email, files, or payments, you should know exactly how to cut them off in one move, and what happens if that switch breaks. Most small businesses I talk to have not thought about it at all.

Source: OpenAI: Control Room

🛡️ IT and security

Google patches its eighth Chrome zero-day of 2026

Google released an emergency Chrome update on Monday for CVE-2026-125350, a high-severity use-after-free memory bug in the browser's XML component that attackers are already exploiting. Google confirmed "an exploit for CVE-2026-125350 exists in the wild" but has not shared details about who is using it or against whom. The fix is in Chrome 157.0.8103.50/.51 for Windows and macOS and 157.0.8103.50 for Linux.

This is the eighth Chrome zero-day exploited in attacks that Google has patched this year. Google says the update may take days or weeks to reach everyone automatically, though BleepingComputer found it available immediately.

In short: Chrome has another flaw under active attack, and the fix is out now.

What it means for your business: Every company runs Chrome somewhere. Make sure browsers on your team's machines are actually restarting to pick up the update, because Chrome only installs it on relaunch.

My take: Eight in a year is the new normal. The weak link is rarely the patch, it is the laptop with 40 tabs that has not been restarted since October. A simple "restart your browser Fridays" habit, or a managed policy that forces it, closes most of this gap.

Source: BleepingComputer: Google patches eighth Chrome zero-day exploited in attacks this year

Vanderbilt University hit by ransomware, gang claims over a million SSNs

Vanderbilt University confirmed on Monday that it is responding to an "active cybersecurity incident" that may affect university devices, systems, and cloud services. It told students, faculty, and staff to shut down university devices, disconnect from campus Wi-Fi, and report unexpected pop-ups, changed files, or surprise login prompts to the IT service desk rather than troubleshooting on their own.

A relatively new ransomware gang called BYOD has claimed the attack on its leak site, alleging it encrypted Vanderbilt's databases, took over its network, and stole "over 1 Million SSNs" along with student, employee, and research records. These are the attackers' claims: Vanderbilt has not confirmed the group's involvement, whether systems were encrypted, or whether any data was stolen. BleepingComputer did receive a photo of a ransom note on what appears to be a Vanderbilt computer, and the same gang claimed last month's attack on the University of New Mexico Health Sciences Center.

In short: Vanderbilt is fighting an active cyberattack, and a ransomware gang claims to have stolen data on more than a million people, which the university has not confirmed.

What it means for your business: Vanderbilt's instructions are a good model for your own incident plan: tell people to unplug, do not let them poke around, and give them one place to report.

My take: The "shut it down and call us" message is exactly right, and most small businesses have never written theirs down. Put a one-paragraph version in your employee handbook today. On the gang's numbers, wait for confirmation; ransomware crews inflate to create pressure.

Source: BleepingComputer: Vanderbilt University hit in BYOD ransomware attack, data theft claimed

Wyndham's Android app had a database password baked into it

A security researcher found a password inside the code of Wyndham's Android app that opened an internal company database hosted on Salesforce, TechCrunch reported Monday. According to researcher Robert Wiggins, the database held customer names, email addresses, Wyndham member numbers, the login tokens that keep customers signed into the app, and company files. He said it had millions of entries but could not pin down how many customer records were exposed; Wyndham says it has about 129 million rewards members.

After TechCrunch contacted Wyndham, the credential was revoked. Wyndham says it has "no evidence of any unauthorized access," but would not say whether it has logs that could show past access, how long the password was in the app, or whether it will notify customers. Wiggins used AI tools to find it, and it is his second near-identical find in two weeks after a similar flaw in the Applebee's app.

In short: Wyndham's app shipped with a password that let anyone reach a customer database until a researcher flagged it.

What it means for your business: If you have a custom app or website built by a contractor, ask them directly whether any passwords or API keys live inside the code customers download. It is a common shortcut and now trivially easy to find with AI.

My take: This is the second big brand in two weeks with the same rookie mistake, and AI is the reason they are being found so fast. The good guys have these tools and so do the bad guys. If a stranger with an AI scanner can find your secrets in an afternoon, assume someone already has.

Source: TechCrunch: Hotel giant Wyndham exposed customer data after app security lapse

France blames Iran for the supermarket freezer attacks that started fires

France's foreign ministry on Monday formally attributed the October 11 to 12 attacks on store refrigeration systems to Shahid Kaveh, a cyber unit tied to Iran's Islamic Revolutionary Guard Corps. Investigators now say about 700 retail locations were targeted, far more than first reported, and the attacks caused at least 15 fires and tens of millions of euros in spoiled food. The hackers got into internet-connected refrigeration controllers and remotely changed defrost settings to high temperatures. Affected chains included Carrefour, Leclerc, Intermarché, Casino, Coopérative U, and Metro.

France will summon Iran's ambassador and propose new EU sanctions. It has attributed only the October French attacks to Iran, not the second wave that hit 115+ stores in six countries in November.

In short: France says Iranian state hackers were behind October's attacks that cooked supermarket freezers and started at least 15 fires.

What it means for your business: Any equipment you have on the internet, from coolers to HVAC to cameras, is a target, and a nation-state may be the one knocking. If a vendor installed a remote-access controller, it needs a strong password and should not be reachable from the open internet.

My take: We have covered these freezer attacks twice already, and what changed today is the stakes: a government is now saying this was state sabotage that started fires. Restaurants, grocers, and anyone with cold storage should call their refrigeration vendor this week and ask how the controller is connected.

Source: BleepingComputer: France blames Iranian hackers for supermarket attacks that sparked fires

🧰 Tools for vibe coders and business AI

ChatGPT Enterprise is now available in AWS Marketplace

OpenAI said Monday that organizations can now buy ChatGPT Enterprise through AWS Marketplace, using their existing AWS billing and applying eligible spend toward their AWS commitments. OpenAI says AWS customers get the same models and features as buying direct, with new features arriving at the same time. ChatGPT for Healthcare and ChatGPT for Financial Services are also available through the marketplace for eligible customers.

In short: Companies can now pay for ChatGPT Enterprise on their AWS bill.

What it means for your business: If you already have an AWS spending commitment, this can turn ChatGPT Enterprise into money you were going to spend anyway, and it skips a separate procurement process.

My take: Mostly a purchasing convenience, but a real one if you have committed AWS spend to burn. Check with your AWS account rep before signing anything direct.

Source: OpenAI: ChatGPT Enterprise now available in AWS Marketplace

Otter.ai follows meetings across languages

Otter.ai announced an upcoming multilingual transcription feature that will keep transcribing as speakers switch languages within the same meeting, for example from English to Korean to Portuguese, without anyone changing a setting. It is also adding 27 languages, its biggest expansion yet, for 31 total once the rollout is done. Thirteen are live now, including Mandarin, Korean, German, Portuguese, and Vietnamese, with 14 more, including Arabic and Hindi, coming soon.

In short: Otter is adding mixed-language meeting transcription and far more supported languages.

What it means for your business: If you work with suppliers, customers, or staff who switch between languages, meeting notes are about to get more reliable.

My take: Useful and low-risk to try. Just remember meeting recorders capture everything said in the room, so tell people they are being transcribed and know where those transcripts are stored.

Source: TechCrunch: Otter AI can now follow conversations across 30+ languages

That is the rundown for today. If you missed yesterday's recap on the Chainalysis breach and Anthropic's IPO, catch up here.