Sat 14 Nov · updated 00:00 UTC
Today in security
Latest briefing
Friday 13 November edition
N-able attackers exploit N-central flaws to mine cryptocurrency
Attackers are exploiting flaws in N-able N-central to install cryptocurrency miners, with one security firm reporting infections on 21 servers. The lead has shifted from the ongoing ScreenConnect investigation to N-central exploitation, while TSMC and Caixa Vida e Previdência disclosed employee and customer data exposures. No vulnerabilities were added to CISA’s Known Exploited Vulnerabilities catalogue in this edition’s window.
Known exploited11
CISA KEV entries named in the last 48 hours of coverage, by federal deadline
- In CISA KEV
checkpoint Quantum Security GatewayCVE-2026-123039
Federal deadline 16 Nov · In CISA KEV since 13 Nov
7.8High1.3% EPSS4 articles
- In CISA KEV
UnrealIRCdCVE-2026-114713
Federal deadline 16 Nov · In CISA KEV since 13 Nov
8.6High0.3% EPSS2 articles
- In CISA KEV
Google ChromiumCVE-2026-125350
Federal deadline 24 Nov · In CISA KEV since 10 Nov
Not scored1.0% EPSS9 articles
- In CISA KEV
Cisco BroadWorksCVE-2026-20320
Federal deadline 24 Nov · In CISA KEV since 10 Nov
7.5High1.0% EPSS7 articles
Show 7 more · federal deadlines passed
- In CISA KEV
gpustackCVE-2026-102895
Federal deadline passed 12 Nov · In CISA KEV since 9 Nov
9.8Critical0.5% EPSS7 articles
- In CISA KEV
PHPCVE-2026-109618
Federal deadline passed 29 Oct · In CISA KEV since 26 Oct
9.2Critical99.9% EPSS60 articles
- In CISA KEV
PHPCVE-2026-109619
Federal deadline passed 29 Oct · In CISA KEV since 26 Oct
9.2Critical99.9% EPSS59 articles
- In CISA KEV
ConnectWise ScreenConnectCVE-2026-84869
Federal deadline passed 14 Sep · In CISA KEV since 11 Sep
9.9Critical0.9% EPSS7 articles
- In CISA KEV
PTC Windchill and FlexPLMCVE-2026-12569
Federal deadline passed 28 Jun · In CISA KEV since 25 Jun · Used in ransomware campaigns
9.3Critical46% EPSS12 articles
- In CISA KEV
GNU InetUtilsCVE-2026-24061
Federal deadline passed 16 Feb · In CISA KEV since 26 Jan
9.8Critical99% EPSS11 articles
- In CISA KEV
Meta React Server ComponentsCVE-2025-55182
Federal deadline passed 12 Dec 2025 · In CISA KEV since 5 Dec 2025 · Used in ransomware campaigns
10.0Critical99.7% EPSS16 articles
Latest news61
The last 24 hours, newest first; stories about known exploited CVEs are above
Latest story at 21:33 UTC. Red diamonds mark the 6 stories about exploited CVEs.
- 21:33 UTC. FAA Grounds US Flights After Air Traffic Communications Disruption. 1 outlet.
- 21:31 UTC. SCKit worm abuses ScreenConnect to target MSP technicians. 1 outlet. About an exploited CVE.
- 20:54 UTC. Fireworks AI breach exposed Uber drivers' licence data. 1 outlet.
- 20:20 UTC. ArcticRAT evolves into an AI powered Android spying tool. 1 outlet.
- 19:26 UTC. Cloudflare warns AI pentesting tools are accelerating attacks. 1 outlet.
- 18:54 UTC. Microsoft blames network change for day-long Microsoft 365 outage. 1 outlet.
- 18:33 UTC. CISA Confirms Active Exploitation of UnrealIRCd Command Injection Flaw. 1 outlet. About an exploited CVE.
- 18:33 UTC. CISA Adds Exploited Chromium Flaw to KEV Catalogue. 1 outlet. About an exploited CVE.
- 17:29 UTC. Microsoft will remove trust in remaining eMudhra roots in November. 1 outlet.
- 17:04 UTC. JFrog exposes fake interview campaign targeting developer machines. 1 outlet.
- 16:54 UTC. Telegram widget bug hit iOS and desktop too; Durov disputes risk. 1 outlet.
- 16:52 UTC. New York City Council votes to ban surveillance pricing. 1 outlet.
- 16:26 UTC. Windows zero day gives attackers System privileges through Defender. 1 outlet.
- 15:27 UTC. New attacks expose secrets in AMD SEV-SNP cloud VMs. 1 outlet.
- 15:22 UTC. AI pentesting tool ARTEX helps attackers exploit exposed secrets. 1 outlet.
- 15:20 UTC. Researchers uncover flaws that let hackers take control of cars. 1 outlet.
- 14:35 UTC. Law enforcement disrupts Gootloader after 25,000 infections. 1 outlet.
- 14:28 UTC. FBI Says North Korean Hackers Stole $400 Million in Crypto. 1 outlet.
- 13:54 UTC. Trezor finds recovery phrase stealing implants in Safe 5 wallets. 1 outlet.
- 13:45 UTC. Proofpoint Researcher Says AI Can Weaken Cyber-Attacks. 1 outlet.
- 13:00 UTC. Binance Attackers Exploited Weak Controls to Drain $6.34 Billion. 1 outlet.
- 12:54 UTC. Unocoin says attackers bypassed BitGo freeze via wallet backup. 1 outlet.
- 12:41 UTC. Apify Confirms Customer Data Was Accessed in Cyberattack. 1 outlet.
- 12:38 UTC. Apache fixes HTTP/2 flaw that could enable remote code execution. 1 outlet.
- 12:20 UTC. SilentAir Hijacks Asian Mobile Networks to Intercept Calls and Texts. 1 outlet.
- 11:52 UTC. OWASP guidance warns AI agents may keep working after shutdown. 1 outlet.
- 11:20 UTC. Google patches five critical flaws in second Chrome update. 1 outlet.
- 11:15 UTC. Proofpoint Finds Phishing Surging Across Europe. 1 outlet.
- 11:10 UTC. Enea links SilentAir campaign to attacks on Asian telecoms. 1 outlet.
- 11:00 UTC. SOCRadar tracks ClickFix campaign targeting three continents. 1 outlet.
- 10:55 UTC. Crédit Mutuel Arkéa chair details €100M heist via fake Fortuneo IBANs. 1 outlet.
- 10:55 UTC. Operation Endgame seizes servers in malware network crackdown. 1 outlet.
- 10:48 UTC. Law enforcement disrupts Gootloader, CastleRAT and StealC. 1 outlet.
- 10:29 UTC. Microsoft 365 Outage Raises Risk of Phishing and Support Scams. 1 outlet.
- 09:36 UTC. Citrix patches critical flaws in NetScaler products. 1 outlet.
- 09:21 UTC. OpenAI launches AI tools to test and fix software flaws. 1 outlet.
- 09:15 UTC. TrendAI researcher forecasts AI driven ransomware changes in 2027. 1 outlet.
- 09:00 UTC. BlackNevas Ransomware Destroys VMware Virtualisation Estate. 1 outlet.
- 08:50 UTC. Researcher Releases SignDrop Windows Privilege Escalation Exploit. 2 outlets.
- 08:05 UTC. Check Point links PHP2Shell attacks to ESXi file wiper. 3 outlets. About an exploited CVE.
- 08:01 UTC. Cisco BroadWorks flaw exploited to expose sensitive configuration. 1 outlet. About an exploited CVE.
- 08:01 UTC. Unit 42 uncovers browser-based Falcon C2 targeting governments. 1 outlet.
- 07:39 UTC. Check Point links PHP2Shell flaws to destructive gateway attacks. 1 outlet. About an exploited CVE.
- 07:01 UTC. Wiz uncovers attacks abusing Qubole access to AWS accounts. 1 outlet.
- 06:54 UTC. Attackers mine crypto on N-able N-central servers with Hotfix 2. 1 outlet.
- 06:28 UTC. Citrus ransomware targets Russian firms using stolen credentials. 1 outlet.
- 05:43 UTC. Attackers exploit N-able N-central flaws to mine cryptocurrency. 3 outlets.
- 04:55 UTC. Caixa Vida e Previdência breach exposes data of 7.6 million customers. 1 outlet.
- 04:32 UTC. TSMC employee data breach traced to a cloud provider. 1 outlet.
- 03:41 UTC. Macfinger ClickFix campaign targets Macs with crypto stealing malware. 1 outlet.
- 02:55 UTC. TSMC confirms employee data leak through a cloud service provider. 1 outlet.
- 02:26 UTC. PostgreSQL fixes 52 flaws, including code execution bugs. 2 outlets.
- 02:01 UTC. DOJ and Europol Arrest 354 Suspects in Dark Web Crackdown. 1 outlet.
- 02:00 UTC. GPUStack flaw lets attackers bypass authentication with spoofed IP header. 1 outlet.
- 01:52 UTC. Zoho fixes eight ManageEngine flaws, including CVE-2026-12591. 1 outlet.
- 01:47 UTC. DOJ and FBI dismantle Gootloader network across 100 servers. 1 outlet.
- 01:43 UTC. DOJ Disrupts North Korean Crypto Theft Schemes and Seizes $1.2B. 4 outlets.
- 01:37 UTC. Red Hat fixes critical sandbox bypass in Satellite. 1 outlet.
- 01:01 UTC. Gradle fixes code execution flaw in version catalog builds. 1 outlet.
- 00:30 UTC. Mitel fixes critical authentication bypass in MiVoice MX-ONE. 1 outlet.
- Known exploited CVE
- CVE not in KEV
- Other story
- Size: outlets on the story
- Stories an hour
Show as tableHide table
| Time (UTC) | Story | Outlets | Type |
|---|---|---|---|
| 21:33 | FAA Grounds US Flights After Air Traffic Communications Disruption | 1 | Other |
| 21:31 | SCKit worm abuses ScreenConnect to target MSP technicians | 1 | Known exploited |
| 20:54 | Fireworks AI breach exposed Uber drivers' licence data | 1 | Other |
| 20:20 | ArcticRAT evolves into an AI powered Android spying tool | 1 | Other |
| 19:26 | Cloudflare warns AI pentesting tools are accelerating attacks | 1 | Other |
| 18:54 | Microsoft blames network change for day-long Microsoft 365 outage | 1 | Other |
| 18:33 | CISA Confirms Active Exploitation of UnrealIRCd Command Injection Flaw | 1 | Known exploited |
| 18:33 | CISA Adds Exploited Chromium Flaw to KEV Catalogue | 1 | Known exploited |
| 17:29 | Microsoft will remove trust in remaining eMudhra roots in November | 1 | Other |
| 17:04 | JFrog exposes fake interview campaign targeting developer machines | 1 | Other |
| 16:54 | Telegram widget bug hit iOS and desktop too; Durov disputes risk | 1 | Other |
| 16:52 | New York City Council votes to ban surveillance pricing | 1 | Other |
| 16:26 | Windows zero day gives attackers System privileges through Defender | 1 | Other |
| 15:27 | New attacks expose secrets in AMD SEV-SNP cloud VMs | 1 | CVE |
| 15:22 | AI pentesting tool ARTEX helps attackers exploit exposed secrets | 1 | Other |
| 15:20 | Researchers uncover flaws that let hackers take control of cars | 1 | Other |
| 14:35 | Law enforcement disrupts Gootloader after 25,000 infections | 1 | Other |
| 14:28 | FBI Says North Korean Hackers Stole $400 Million in Crypto | 1 | Other |
| 13:54 | Trezor finds recovery phrase stealing implants in Safe 5 wallets | 1 | Other |
| 13:45 | Proofpoint Researcher Says AI Can Weaken Cyber-Attacks | 1 | Other |
| 13:00 | Binance Attackers Exploited Weak Controls to Drain $6.34 Billion | 1 | Other |
| 12:54 | Unocoin says attackers bypassed BitGo freeze via wallet backup | 1 | Other |
| 12:41 | Apify Confirms Customer Data Was Accessed in Cyberattack | 1 | Other |
| 12:38 | Apache fixes HTTP/2 flaw that could enable remote code execution | 1 | CVE |
| 12:20 | SilentAir Hijacks Asian Mobile Networks to Intercept Calls and Texts | 1 | Other |
| 11:52 | OWASP guidance warns AI agents may keep working after shutdown | 1 | Other |
| 11:20 | Google patches five critical flaws in second Chrome update | 1 | Other |
| 11:15 | Proofpoint Finds Phishing Surging Across Europe | 1 | Other |
| 11:10 | Enea links SilentAir campaign to attacks on Asian telecoms | 1 | Other |
| 11:00 | SOCRadar tracks ClickFix campaign targeting three continents | 1 | Other |
| 10:55 | Crédit Mutuel Arkéa chair details €100M heist via fake Fortuneo IBANs | 1 | Other |
| 10:55 | Operation Endgame seizes servers in malware network crackdown | 1 | Other |
| 10:48 | Law enforcement disrupts Gootloader, CastleRAT and StealC | 1 | Other |
| 10:29 | Microsoft 365 Outage Raises Risk of Phishing and Support Scams | 1 | Other |
| 09:36 | Citrix patches critical flaws in NetScaler products | 1 | CVE |
| 09:21 | OpenAI launches AI tools to test and fix software flaws | 1 | Other |
| 09:15 | TrendAI researcher forecasts AI driven ransomware changes in 2027 | 1 | Other |
| 09:00 | BlackNevas Ransomware Destroys VMware Virtualisation Estate | 1 | Other |
| 08:50 | Researcher Releases SignDrop Windows Privilege Escalation Exploit | 2 | Other |
| 08:05 | Check Point links PHP2Shell attacks to ESXi file wiper | 3 | Known exploited |
| 08:01 | Cisco BroadWorks flaw exploited to expose sensitive configuration | 1 | Known exploited |
| 08:01 | Unit 42 uncovers browser-based Falcon C2 targeting governments | 1 | Other |
| 07:39 | Check Point links PHP2Shell flaws to destructive gateway attacks | 1 | Known exploited |
| 07:01 | Wiz uncovers attacks abusing Qubole access to AWS accounts | 1 | Other |
| 06:54 | Attackers mine crypto on N-able N-central servers with Hotfix 2 | 1 | CVE |
| 06:28 | Citrus ransomware targets Russian firms using stolen credentials | 1 | Other |
| 05:43 | Attackers exploit N-able N-central flaws to mine cryptocurrency | 3 | CVE |
| 04:55 | Caixa Vida e Previdência breach exposes data of 7.6 million customers | 1 | Other |
| 04:32 | TSMC employee data breach traced to a cloud provider | 1 | Other |
| 03:41 | Macfinger ClickFix campaign targets Macs with crypto stealing malware | 1 | Other |
| 02:55 | TSMC confirms employee data leak through a cloud service provider | 1 | Other |
| 02:26 | PostgreSQL fixes 52 flaws, including code execution bugs | 2 | CVE |
| 02:01 | DOJ and Europol Arrest 354 Suspects in Dark Web Crackdown | 1 | Other |
| 02:00 | GPUStack flaw lets attackers bypass authentication with spoofed IP header | 1 | Other |
| 01:52 | Zoho fixes eight ManageEngine flaws, including CVE-2026-12591 | 1 | CVE |
| 01:47 | DOJ and FBI dismantle Gootloader network across 100 servers | 1 | Other |
| 01:43 | DOJ Disrupts North Korean Crypto Theft Schemes and Seizes $1.2B | 4 | Other |
| 01:37 | Red Hat fixes critical sandbox bypass in Satellite | 1 | CVE |
| 01:01 | Gradle fixes code execution flaw in version catalog builds | 1 | Other |
| 00:30 | Mitel fixes critical authentication bypass in MiVoice MX-ONE | 1 | Other |
- FAA Grounds US Flights After Air Traffic Communications Disruption
The Federal Aviation Administration (FAA) issued a nationwide ground stop for all U.S. airports on an Friday afternoon, citing “extraordinary circumstances” for safety. The disruption affected communications across all…
SecurityWeek
- DOJ disrupts North Korean crypto theft and seizes $1.2 billion
The U.S. Department of Justice announced coordinated actions against North Korea’s cryptocurrency theft operations, including the seizure of cloud infrastructure used in the FaceStealer social‑engineering scheme and…
Security Affairs
- Fireworks AI breach exposed Uber drivers' licence data
Uber says attackers used credentials stolen from Fireworks AI to reach its data and has notified drivers in at least five US states; filings show licence data for nearly 7,900 people in three. Notion also confirmed…
CyberSIXT
- ArcticRAT evolves into an AI powered Android spying tool
ArcticRAT, long known as an Android cryptocurrency stealer, has evolved into a sophisticated remote access Trojan (RAT) that can take full control of infected devices, harvest sensitive information, and use artificial…
Dark Reading
- Cloudflare warns AI pentesting tools are accelerating attacks
Cloudflare reports a sharp rise in AI-driven penetration testing orchestrators, with a proliferation of large language model (LLM) based frameworks that automate offensive security workflows. Since ARTEX, the…
Cloudflare
- Microsoft blames network change for day-long Microsoft 365 outage
Microsoft says the outage that hit Outlook, Teams, Copilot and Defender XDR was caused by an issue from an earlier network capacity upgrade that surfaced after a recent network change, not a cyberattack. Service has…
CyberSIXT
- Microsoft will remove trust in remaining eMudhra roots in November
Microsoft has updated its guidance on the eMudhra certificate incident, stating that Windows systems will revoke trust for the remaining ten eMudhra root certificates on 16 November 2026. The change will be delivered…
SecurityOnline
- JFrog exposes fake interview campaign targeting developer machines
Binance says its October theft of about $6.34 billion from hot wallets began after an engineer in a fake interview scenario downloaded a take‑home task onto his work laptop. JFrog has since exposed a parallel…
StepSecurity
- Telegram widget bug hit iOS and desktop too; Durov disputes risk
A public research repository shows Telegram's new message widgets allowed native code execution on old Android, iOS, Windows and macOS builds through a QuickJS-ng parser bug. Durov says users had to start a third-party…
CyberSIXT
- Researcher demonstrates PostgreSQL flaw that can enable server RCE
PostgreSQL has issued patches addressing 52 security flaws, including a high‑risk type confusion vulnerability tracked as CVE-2026-6460. The flaw could allow a database user who can create objects to execute code on…
The Hacker NewsCVE-2026-6460
- New York City Council votes to ban surveillance pricing
The New York City Council has passed Introduction 891-A, a bill aimed at banning surveillance pricing in transactions with consumers in New York City. The measure, voted through on 12 November 2026, would prohibit…
Malwarebytes
- Windows zero day gives attackers System privileges through Defender
A Windows zero-day exploit named SignDrop has been disclosed by the pseudonymous researcher Nightmare Eclipse, who is publicly at odds with Microsoft. The bug resides in the Common Log File System (CLFS) and allegedly…
Ars Technica
- New attacks expose secrets in AMD SEV-SNP cloud VMs
Two new attacks disclosed this week let a rogue cloud host read data from AMD SEV-SNP protected VMs, and in Mior’s case also manipulate memory and forge the signed runtime report. The ETH Zurich team behind Mior…
The Hacker NewsCVE-2026-0462
- AI pentesting tool ARTEX helps attackers exploit exposed secrets
ARTEX is an open‑source AI‑assisted pentesting tool that runs a simulated breach with AI agents, while a human operator steers. Since its GitHub appearance on 26 July 2026, multiple state‑aligned groups, criminal…
StepSecurity
- Researchers uncover flaws that let hackers take control of cars
Baker Tilly has informed clients that personal data, including Social Security numbers, was stolen from a platform operated by one of its service providers. The intrusion occurred in early September and also affected…
SecurityWeek
- Law enforcement disrupts Gootloader after 25,000 infections
International law enforcement has disrupted the Gootloader malware operation, removing the software from more than 100 computer servers and seizing US domain names used to deliver and control the botnet. The Department…
Security Affairs
- FBI Says North Korean Hackers Stole $400 Million in Crypto
The FBI has confirmed that North Korea-linked threat actors, associated with the BlueNoroff/APT38 cluster, stole more than $400 million in cryptocurrency over the past 18 months through a social engineering scheme…
The Hacker News
- Trezor finds recovery phrase stealing implants in Safe 5 wallets
Three Trezor Safe 5 wallets purchased from the Southeast Asia reseller CryptoBilis contain an implanted extra circuit board designed to copy recovery phrases. Trezor said the implant sits between the Safe 5’s main…
The Hacker News
- Proofpoint Researcher Says AI Can Weaken Cyber-Attacks
Proofpoint principal threat researcher Selena Larson said at IRISSCON 2026 in Dublin on 11 November that AI has not substantially changed the cyber threat landscape and can make attacks less effective when criminals…
Infosecurity
- Binance Attackers Exploited Weak Controls to Drain $6.34 Billion
On 29 October 2026, cyber thieves moved around $6.34 billion in various cryptocurrencies from at least 11 Binance wallets to attacker-controlled addresses. The attackers exploited a feature of Ethereum smart accounts…
Dark Reading
- Unocoin says attackers bypassed BitGo freeze via wallet backup
Unocoin says BitGo's freeze of its wallets held, but attackers signed and broadcast transactions on-chain without BitGo by exploiting the multisig wallet's backup mechanism. It detected unauthorised activity on its…
CyberSIXT
- Apify Confirms Customer Data Was Accessed in Cyberattack
Apify, the Czech web scraping and automation platform, has disclosed that an intruder accessed customer accounts and could view personal information or stored data. The company says the breach occurred on 9–10 November…
SecurityWeek
- Apache fixes HTTP/2 flaw that could enable remote code execution
CVE-2026-119618 is a critical race-condition in Apache HTTP Server’s mod_http2 that can lead to remote code execution. Apache has released Apache HTTP Server 2.4.71 to fix the flaw, affecting servers running 2.4.55…
SOCRadarCVE-2026-119618
- SilentAir Hijacks Asian Mobile Networks to Intercept Calls and Texts
Enea has detailed the activity of a previously unknown threat actor, dubbed SilentAir, which hijacks mobile operator infrastructure to intercept calls and text messages. The researchers say the group primarily targets…
SecurityWeek
- Attackers exploit N-able N-central flaw to install Monero miners
An independent researcher disclosed 4EverAble2Shell, a two‑stage exploitation chain targeting on‑premises N-able N-central servers. The chain allows an unauthenticated attacker to execute commands as root when the…
SOCRadarCVE-2026-90436
- OWASP guidance warns AI agents may keep working after shutdown
An article from The Hacker News, published on 13 November 2026, examines how AI agents that manage workflows can continue working even after a “kill switch” is issued. It notes that an agent is typically part of a…
The Hacker News
- FBI disrupts North Korean fake video call crypto scam
The Department of Justice and the FBI said they disrupted FaceStealer, a North Korean‑linked social‑engineering operation that used hijacked accounts, replayed webcam footage and fake video calls to steal…
SOCRadar
- Google patches five critical flaws in second Chrome update
Malwarebytes reports that Google issued a security update to Chrome’s Stable channel on 11 November 2026, rolling out across Windows, macOS and Linux. The desktop update raises Chrome to versions 157.0.8103.78/79 for…
Malwarebytes
- Proofpoint Finds Phishing Surging Across Europe
Proofpoint researchers report that phishing threats rose 4.5 times across Europe from 2025 to 2026, compared with a global rise of 1.5 times. The UK shows a particularly sharp trajectory, with a six-fold increase over…
Infosecurity
- Enea links SilentAir campaign to attacks on Asian telecoms
Stockholm-based telecoms and cyber-security firm Enea has disclosed a newly identified spying campaign, dubbed SilentAir, which compromised equipment inside at least six Asian mobile operators to intercept calls and…
The Hacker News
- SOCRadar tracks ClickFix campaign targeting three continents
SOCRadar’s Threat Research Unit (STRU) reports a Russian-speaking threat group has updated and scaled a multi-stage phishing operation that leverages an AI-assisted toolkit. The campaign chains XaocMail, a self-hosted…
SOCRadar
- Crédit Mutuel Arkéa chair details €100M heist via fake Fortuneo IBANs
Arkéa's chair says attackers used material from a breached service provider to create fake Fortuneo IBANs and send instant payments out of the bank's own account, starting 1 November. He puts the loss at about 1% of…
CyberSIXT
- Operation Endgame seizes servers in malware network crackdown
International law enforcement has taken action against the Gootloader, CastleRAT and StealC malware networks, seizing thousands of servers and tens of thousands of domains, and removing malware from hundreds of hacked…
The Hacker News
- Law enforcement disrupts Gootloader, CastleRAT and StealC
US and European law enforcement agencies have disrupted the infrastructure behind the Gootloader, CastleRAT and StealC malware, seizing hundreds of servers and domains and affecting millions of credentials.…
SecurityWeek
- Microsoft 365 Outage Raises Risk of Phishing and Support Scams
The Microsoft 365 outage that disrupted services interacting with Exchange Online, notably Outlook, is not believed to be cyber-related, but it is expected to heighten security risk as attackers look to capitalise on…
Infosecurity
- Citrix patches critical flaws in NetScaler products
Citrix has released patches addressing 28 NetScaler ADC and NetScaler Gateway vulnerabilities, including nine rated as critical. The fixes cover memory overflow flaws across multiple components, including Packet…
SecurityWeekCVE-2026-120868
- OpenAI launches AI tools to test and fix software flaws
OpenAI announced two Daybreak cybersecurity products at its Cyber at the Frontier event on 12 November. Daybreak Red Team uses AI agents to test web applications, investigate potential weaknesses and validate…
SecurityWeek
- TrendAI researcher forecasts AI driven ransomware changes in 2027
TrendAI director of cybercrime research Bob McArdle expects AI to reshape ransomware in 2027, after what he described as a “stagnant” couple of years. Speaking at IRISSCON 2026 in Dublin on 11 November, he said…
Infosecurity
- SignDrop exploit turns Windows Defender into a privilege-escalation path
Security researcher Chaotic Eclipse has published a proof-of-concept exploit called SignDrop for a Windows local privilege-escalation flaw. The researcher says a standard user can exploit it to gain SYSTEM privileges…
Security Affairs
- BlackNevas Ransomware Destroys VMware Virtualisation Estate
Kaspersky’s Global Emergency Response Team (GERT) investigated a 10-day intrusion in which an attacker destroyed an organisation’s virtualisation estate: four ESXi hosts, their virtual machines, both vCenter Server…
securelist.com
- Researcher Releases SignDrop Windows Privilege Escalation Exploit
Security researcher Abdelhamid Naceri, known online as Nightmare Eclipse, has disclosed a Windows zero-day exploit named SignDrop that targets the Common Log File System (CLFS) and can push a local user’s privileges to…
SecurityWeek
- Unit 42 uncovers browser-based Falcon C2 targeting governments
Palo Alto Networks Unit 42 has uncovered a browser-based variant of the Falcon C2 framework, also known as XG or Xiang Ge, that targets government portals and delivers a Rust-based implant named Antino. Between March…
SecurityOnline
- N-central Zero-Day Exploited Within Hours of PoC Release
Security researchers have disclosed a new N-able N-central zero-day chain, dubbed 4EverAble2Shell, which threat actors began exploiting within hours of a public PoC being released. The exploit chain combines an exploit…
SecurityWeekCVE-2026-90436
- Wiz uncovers attacks abusing Qubole access to AWS accounts
Between 14 October and 26 October 2026, Wiz, Sentra and Mandiant say threat actors abused Qubole cross‑account access to breach multiple customer AWS environments. The intruder used compromised IAM credentials from…
SecurityOnline
- Attackers mine crypto on N-able N-central servers with Hotfix 2
Attackers are using the public 4EverAble2Shell exploit to take root on N-able N-central servers and install Monero miners. Huntback counted 21 infected servers, 19 already on Hotfix 2; N-able is restricting features…
CyberSIXTCVE-2026-125883
- Citrus ransomware targets Russian firms using stolen credentials
Kaspersky Labs has identified a previously undocumented threat group, dubbed Citrus Ransomware, that breaches Russian enterprises using compromised contractor credentials. The operators reportedly target Russian…
SecurityOnline
- Attackers exploit N-able N-central flaws to mine cryptocurrency
N-able disclosed on 13 November 2026 that attackers are actively exploiting a new set of flaws in N-central, tracked as 4EverAble2Shell and Agent2Shell, to compromise devices running the latest N-central. Independent…
The Hacker NewsCVE-2026-90436
- Caixa Vida e Previdência breach exposes data of 7.6 million customers
Attackers copied the customer database of Caixa Vida e Previdência, the pension arm of Brazil's Caixa group, exposing names and CPF numbers of all 7.6 million active customers and former customers. The company found…
CyberSIXT
- TSMC employee data breach traced to a cloud provider
TSMC has disclosed that personal data belonging to current and former employees appeared on an external website, with the company stating there is no evidence of compromise to its own systems. In a filing to the U.S.…
SecurityOnline
- Macfinger ClickFix campaign targets Macs with crypto stealing malware
SANS Internet Storm Centre handler Brad Duncan says the Macfinger ClickFix campaign delivered a macOS infostealer he has nicknamed DownTheDRAIN. He examined an infection from 11 November 2026. The campaign uses a fake…
SANS ISC
- TSMC confirms employee data leak through a cloud service provider
TSMC told the SEC that data on current and former employees was posted online without authorisation and matches records held by a cloud service provider. It found no sign its own systems were breached; a forum seller…
CyberSIXT
- FBI Seizes $1.2 Billion in Crypto Stolen From Binance
The FBI said on 12 November 2026 that it had seized more than $1.2 billion in cryptocurrency that had been reported stolen last month from Binance, the world’s largest crypto exchange. The theft, amounting to about…
SecurityWeek
- PostgreSQL fixes 52 flaws, including code execution bugs
PostgreSQL released versions 18.7, 17.12, 16.16, 15.20 and 14.25 on 12 November 2026, fixing 52 CVEs: 38 rated High, 12 Medium and two Low. SecurityOnline says 32 flaws could allow an authenticated database user, or…
SecurityOnlineCVE-2026-6460
- DOJ and Europol Arrest 354 Suspects in Dark Web Crackdown
International law enforcement arrested 354 suspects in Operation TorNado, which the FBI described as its largest interagency crackdown on dark-web drug vendors and buyers to date. The operation, led by the US…
SecurityOnline
- GPUStack flaw lets attackers bypass authentication with spoofed IP header
A SANS Internet Storm Center diary item reports attackers targeting GPUStack, a system that makes GPU clusters available for AI workloads. A special header, X-GPUStack-Real-IP, is added by fronting proxies and, while…
SANS ISC
- Zoho fixes eight ManageEngine flaws, including CVE-2026-12591
Zoho published details of eight ManageEngine vulnerabilities on 12 November 2026: three rated critical and five high, with CVE-2026-12591 scoring 9.9. The flaws affect M365 Manager Plus, the ServiceDesk Plus product…
SecurityOnlineCVE-2026-12591
- DOJ and FBI dismantle Gootloader network across 100 servers
The US Department of Justice and FBI, working with international partners, removed Gootloader malware from more than 100 servers and seized US domains used to control the network. The operation, authorised by a court…
SecurityOnline
- DOJ Disrupts North Korean Crypto Theft Schemes and Seizes $1.2B
The US Department of Justice announced action against two cryptocurrency theft operations attributed to North Korean state actors. In California, the FBI seized cloud servers linked to the FaceStealer scheme and more…
SecurityOnline
- Red Hat fixes critical sandbox bypass in Satellite
Red Hat published 21 CVEs on 12 November 2026, including one critical flaw rated 9.6: CVE-2026-107360 in Red Hat Satellite’s rubygem-safemode template sandbox. Red Hat says compound assignment expressions can bypass…
SecurityOnlineCVE-2026-107360
- Gradle fixes code execution flaw in version catalog builds
Gradle has released versions 9.9.1 and 8.14.7 to fix three vulnerabilities in the Gradle build tool, according to Do Son, writing on Daily CyberSecurity on 13 November 2026. The most severe flaw is rated CVSS 9.3 and…
SecurityOnline
- Mitel fixes critical authentication bypass in MiVoice MX-ONE
Mitel fixed three MiVoice MX-ONE vulnerabilities in its enterprise PBX platform, including a critical authentication bypass rated CVSS 9.4. Disclosure from Daily CyberSecurity attributes the flaws to the Provisioning…
SecurityOnline
CVEs in the news8
Named in the last 24 hours and not in CISA KEV, most covered first
CVE-2026-90436Apache Software Foundation Apache Axis 1.x (EOL)
3 articles today · Attackers exploit N-able N-central flaw to install Monero miners
9.8Critical1.1% EPSS · 4 articlesCVE-2026-6460PostgreSQL type confusion after ALTER ... SET DATA TYPE executes arbitrary code
2 articles today · Researcher demonstrates PostgreSQL flaw that can enable server RCE
8.8High0.6% EPSS · 2 articlesCVE-2026-12591Zohocorp M365 Manager Plus
Zoho fixes eight ManageEngine flaws, including CVE-2026-12591
9.9Critical1.7% EPSS · 1 articleCVE-2026-107360Red Hat Red Hat Satellite 6.16 for RHEL 8
Red Hat fixes critical sandbox bypass in Satellite
9.6Critical0.5% EPSS · 1 articleCVE-2026-120868Citrix NetScaler ADC
Citrix patches critical flaws in NetScaler products
9.3Critical0.3% EPSS · 3 articlesCVE-2026-0462Vendor not yet named
New attacks expose secrets in AMD SEV-SNP cloud VMs
Not scored1 articleCVE-2026-119618Apache Software Foundation Apache HTTP Server
Apache fixes HTTP/2 flaw that could enable remote code execution
Not scored0.4% EPSS · 4 articlesCVE-2026-125883N-able N-central
Attackers mine crypto on N-able N-central servers with Hotfix 2
Not scored0.9% EPSS · 5 articles
Developing stories4
Two or more articles in the last 24 hours; each bead is an article
- Threat actorTraderTraitorDevelopinglatest 3 hours ago4 articles4 outlets
- Fri 13 Nov, 01:43 UTC. SecurityOnline, first report. DOJ Disrupts North Korean Crypto Theft Schemes and Seizes $1.2B.
- Fri 13 Nov, 02:28 UTC. SecurityWeek, its first report on the story. FBI Seizes $1.2 Billion in Crypto Stolen From Binance.
- Fri 13 Nov, 11:34 UTC. SOCRadar, its first report on the story. FBI disrupts North Korean fake video call crypto scam.
- Fri 13 Nov, 21:19 UTC. Security Affairs, its first report on the story. DOJ disrupts North Korean crypto theft and seizes $1.2 billion.
- In CISA KEVCVECVE-2026-123039checkpoint Quantum Security GatewayDevelopinglatest 5 hours ago3 articles3 outlets
- Fri 13 Nov, 08:05 UTC. The Hacker News, first report. Check Point links PHP2Shell attacks to ESXi file wiper. Cites a CVE in CISA KEV.
- Fri 13 Nov, 11:35 UTC. Security Affairs, its first report on the story. Attackers exploit Check Point flaw to wipe gateway systems. Cites a CVE in CISA KEV.
- Fri 13 Nov, 18:33 UTC. CISA, its first report on the story. CISA adds Check Point firewall flaw allowing local users root access to KEV. Cites a CVE in CISA KEV.
- CVECVE-2026-90436Apache Software Foundation Apache Axis 1.x (EOL)Developinglatest 12 hours ago3 articles3 outlets
- Fri 13 Nov, 05:43 UTC. The Hacker News, first report. Attackers exploit N-able N-central flaws to mine cryptocurrency.
- Fri 13 Nov, 07:20 UTC. SecurityWeek, its first report on the story. N-central Zero-Day Exploited Within Hours of PoC Release.
- Fri 13 Nov, 12:02 UTC. SOCRadar, its first report on the story. Attackers exploit N-able N-central flaw to install Monero miners.
- CVECVE-2026-6460PostgreSQL type confusion after ALTER ... SET DATA TYPE executes arbitrary codeDevelopinglatest 7 hours ago2 articles2 outlets
- Fri 13 Nov, 02:26 UTC. SecurityOnline, first report. PostgreSQL fixes 52 flaws, including code execution bugs.
- Fri 13 Nov, 16:53 UTC. The Hacker News, its first report on the story. Researcher demonstrates PostgreSQL flaw that can enable server RCE.