Cybersecurity briefing — November 12, 2026.

Git patches six flaws, including code execution during recursive clones

The Git project released fixes for six vulnerabilities that could enable code execution, unintended file writes, memory corruption or crashes when processing malicious repositories and crafted input. The most severe described flaw can let attacker-controlled code run during a recursive clone by exploiting an index-path truncation issue. Maintainers recommend upgrading to Git 2.56.1 or the patched release for each supported series, including bundled copies; GitHub also provided upgrade guidance for its products.

What changed Git now rejects excessively long index paths before truncation, closing the path-handling discrepancy used in the recursive-clone attack.

Why it matters Services that merge untrusted repositories are exposed alongside local developers: attacker-controlled merge inputs can corrupt memory, making server-side Git installations part of the patching scope.

What to watch next Patched builds for GitHub Desktop and the Copilot app remain in coordination; Codespaces and Actions are also due to receive them. The source gives no rollout dates.

SANS survey finds rising OT incidents and gaps in manual-operation readiness

In SANS’s survey of 696 ICS/OT practitioners, 34% reported an incident in the prior 12 months, 1.7 times the 2025 rate, and 72% of those incidents caused facility or system downtime. While all industrial security leaders who answered said their plants could continue operating through a full IT compromise, only 15% of practitioners said critical processes could sustain safe manual production for more than 48 hours. SANS also reported that just 14% of surveyed leaders routinely validate resilience technically; it cautioned that the leadership sample was smaller than the main survey.

What changed Detection slowed in the survey: 41% of incidents were caught within 24 hours, compared with more than half in both 2024 and 2025.

Why it matters For industrial operators, the reported incidents frequently interrupted operations rather than remaining confined to IT: nearly three-quarters caused facility or system downtime.

.NET 11 adds package-age controls as .NET 8 and 9 reach end of support

Microsoft released .NET 11, an STS release with two years of support, and said .NET 8 and .NET 9 reached end of support on November 10, 2026. The release adds a NuGet package publication-age setting that can delay selection of newly published versions, plus reproducible container image digests to help verify builds. Microsoft advises organizations to move to .NET 11 or .NET 10 for a longer support lifecycle.