Sun 15 Nov · updated Sat 20:00 UTC
Today in security
Latest briefing
Saturday 14 November edition
CISA adds two exploited flaws to its KEV catalogue
CISA added CVE-2026-114713, affecting UnrealIRCd, and CVE-2026-123039, affecting Check Point products, to its Known Exploited Vulnerabilities catalogue on 13 November; both entries carry a remediation deadline of 16 November 2026. The previous edition led with attacks on N-able N-central, while this edition’s confirmed exploitation developments include the two catalogue additions and Microsoft’s account of a campaign targeting managed service providers through ScreenConnect.
Known exploited7
CISA KEV entries named in the last 48 hours of coverage, by federal deadline
- In CISA KEV
UnrealIRCdCVE-2026-114713
Federal deadline 16 Nov · In CISA KEV since 13 Nov
8.6High0.5% EPSS4 articles
- In CISA KEV
checkpoint Quantum Security GatewayCVE-2026-123039
Federal deadline 16 Nov · In CISA KEV since 13 Nov
7.8High2.2% EPSS4 articles
- In CISA KEV
Google ChromiumCVE-2026-125350
Federal deadline 24 Nov · In CISA KEV since 10 Nov
Not scored1.0% EPSS9 articles
- In CISA KEV
Cisco BroadWorksCVE-2026-20320
Federal deadline 24 Nov · In CISA KEV since 10 Nov
7.5High1.0% EPSS7 articles
Show 3 more · federal deadlines passed
- In CISA KEV
PHPCVE-2026-109618
Federal deadline passed 29 Oct · In CISA KEV since 26 Oct
9.2Critical99.9% EPSS60 articles
- In CISA KEV
PHPCVE-2026-109619
Federal deadline passed 29 Oct · In CISA KEV since 26 Oct
9.2Critical99.9% EPSS59 articles
- In CISA KEV
ConnectWise ScreenConnectCVE-2026-84869
Federal deadline passed 14 Sep · In CISA KEV since 11 Sep
9.9Critical1.2% EPSS7 articles
Latest news13
The last 24 hours, newest first; stories about known exploited CVEs are above
Latest story at 20:54 UTC. Red diamonds mark the story about exploited CVEs.
- 20:54 UTC. Kava's own community pool held almost all KAVA drained from Kava Lend. 1 outlet.
- 18:55 UTC. n0n extortion group claims Qubole hack that hit dozens of customers. 1 outlet.
- 16:46 UTC. Extortion group claims theft of nearly one billion Expedia records. 1 outlet.
- 14:55 UTC. Unocoin loses $200K as attackers use its paper multisig backup keys. 1 outlet.
- 14:00 UTC. Goldfarb warns AI reliance could weaken security teams. 1 outlet.
- 12:54 UTC. Microsoft 365 outage now used as phishing lure, Microsoft warns. 1 outlet.
- 11:00 UTC. Apple Details How Secure Exclaves Protect Camera and Mic Data. 1 outlet.
- 10:58 UTC. Across bridge domain hijacked through social engineering at Namecheap. 1 outlet.
- 09:08 UTC. CISA adds Check Point and UnrealIRCd flaws to exploited list. 2 outlets. About an exploited CVE.
- 08:55 UTC. FAA ground stop blamed on new gear overloading old air traffic systems. 1 outlet.
- 08:40 UTC. FBI Probes Software Update After FAA Ground Stop Disrupts Flights. 1 outlet.
- 04:54 UTC. Fireworks AI breach led to malicious Claude Code extension on Cursor. 1 outlet.
- 01:00 UTC. PLANET fixes cookie flaws in its PoE switch. 1 outlet.
- 00:54 UTC. ConnectWise RMM+ empty-key flaw eyed as SCKit worm's way in. 1 outlet.
- Known exploited CVE
- CVE not in KEV
- Other story
- Size: outlets on the story
- Stories an hour
Show as tableHide table
| Time (UTC) | Story | Outlets | Type |
|---|---|---|---|
| 20:54 | Kava's own community pool held almost all KAVA drained from Kava Lend | 1 | Other |
| 18:55 | n0n extortion group claims Qubole hack that hit dozens of customers | 1 | Other |
| 16:46 | Extortion group claims theft of nearly one billion Expedia records | 1 | Other |
| 14:55 | Unocoin loses $200K as attackers use its paper multisig backup keys | 1 | Other |
| 14:00 | Goldfarb warns AI reliance could weaken security teams | 1 | Other |
| 12:54 | Microsoft 365 outage now used as phishing lure, Microsoft warns | 1 | Other |
| 11:00 | Apple Details How Secure Exclaves Protect Camera and Mic Data | 1 | Other |
| 10:58 | Across bridge domain hijacked through social engineering at Namecheap | 1 | Other |
| 09:08 | CISA adds Check Point and UnrealIRCd flaws to exploited list | 2 | Known exploited |
| 08:55 | FAA ground stop blamed on new gear overloading old air traffic systems | 1 | Other |
| 08:40 | FBI Probes Software Update After FAA Ground Stop Disrupts Flights | 1 | Other |
| 04:54 | Fireworks AI breach led to malicious Claude Code extension on Cursor | 1 | Other |
| 01:00 | PLANET fixes cookie flaws in its PoE switch | 1 | CVE |
| 00:54 | ConnectWise RMM+ empty-key flaw eyed as SCKit worm's way in | 1 | Other |
- Kava's own community pool held almost all KAVA drained from Kava Lend
Nearly all of the 55 million KAVA drained from Kava Lend was deposited by the Kava chain's community module, on-chain records show; other depositors had about 121,700 KAVA. Kava has paused the Axelar bridge and not yet…
CyberSIXT
- n0n extortion group claims Qubole hack that hit dozens of customers
Wiz says the n0n extortion group has claimed the theft of customer data through Qubole's AWS account, and Sentra says dozens of Qubole customers were hit, often through roles left in place after they stopped using…
CyberSIXT
- Extortion group claims theft of nearly one billion Expedia records
Russian extortion group n0n claims to have stolen data relating to nearly one billion Expedia travellers. Expedia confirmed to Skift on Thursday, 12 November 2026, that attackers reached its systems through a…
Security Affairs
- Unocoin loses $200K as attackers use its paper multisig backup keys
Unocoin says attackers took about $200,000 from three hot wallets using printed BitGo backup keys made about eight years ago, and that customers' emails, addresses, encrypted passwords and KYC-related data may be…
CyberSIXT
- Goldfarb warns AI reliance could weaken security teams
Joshua Goldfarb, writing for SecurityWeek on 14 November 2026, argues that overreliance on artificial intelligence could actually diminish the effectiveness of security teams. He frames his critique around several…
SecurityWeek
- Microsoft 365 outage now used as phishing lure, Microsoft warns
Microsoft says attackers are sending fake Microsoft 365 service health emails that cite the real outage incident EX1550543 and threaten to delete held mail. The day-long outage itself came from a network change, not an…
CyberSIXT
- Apple Details How Secure Exclaves Protect Camera and Mic Data
Apple says its Secure Exclaves isolate camera and microphone data used for ambient sensing from a device’s main operating system, apps and Apple itself. The technology supports functions including listening for “Hey…
SecurityWeek
- Across bridge domain hijacked through social engineering at Namecheap
An attacker took control of the Across bridge's across.to domain by social engineering its registrar, Namecheap, and served a wallet drainer for about three hours. Trackers put losses near $350,000; Across says it will…
CyberSIXT
- FAA ground stop blamed on new gear overloading old air traffic systems
DHS says Friday's nationwide FAA ground stop appears to have been caused by new equipment overwhelming older air traffic systems. It has seen zero evidence of a cyberattack but has not ruled one out; officials blame a…
CyberSIXT
- FBI Probes Software Update After FAA Ground Stop Disrupts Flights
US officials say there is no evidence that hackers caused the nationwide FAA outage, while investigators look at a software update as a possible trigger. The Federal Aviation Administration halted flight departures on…
SecurityWeek
- Fireworks AI breach led to malicious Claude Code extension on Cursor
Cursor says an attacker used a key exposed in the Fireworks AI breach to steal data and credentials, then planted a tampered Claude Code extension in its marketplace for about 11 hours. Uber and Notion also lost data…
CyberSIXT
- PLANET fixes cookie flaws in its PoE switch
PLANET Technology has disclosed two vulnerabilities affecting the PLANET GS-5220-8P2T2S PoE+ switch, running hardware version 3.0 with firmware around 3.2412b251216. The flaws, tracked as CVE-2026-109445 and…
SecurityOnlineCVE-2026-109445
- ConnectWise RMM+ empty-key flaw eyed as SCKit worm's way in
Microsoft confirms the SCKit campaign against MSPs' ScreenConnect panels and cites an RMM+ extension flaw that accepted an empty key, which ConnectWise is investigating as an entry route. ConnectWise says patched…
CyberSIXT
CVEs in the news1
Named in the last 24 hours and not in CISA KEV, most covered first
CVE-2026-109445PLANET Technology Corp. PLANET GS-5220-8P2T2S
PLANET fixes cookie flaws in its PoE switch
9.8Critical0.4% EPSS · 1 article
Developing stories1
Two or more articles in the last 24 hours; each bead is an article
- In CISA KEVCVECVE-2026-114713UnrealIRCdDevelopinglatest 11 hours ago2 articles2 outlets
- Sat 14 Nov, 09:08 UTC. Security Affairs, first report. CISA adds Check Point and UnrealIRCd flaws to exploited list. Cites a CVE in CISA KEV.
- Sat 14 Nov, 12:38 UTC. The Hacker News, its first report on the story. UnrealIRCd flaw exploited to inject commands across servers. Cites a CVE in CISA KEV.