Fri 13 Nov · updated 03:35 UTC
Today in security
Latest briefing
Thursday 12 November edition
ScreenConnect panels used to spread remote-access malware
Huntress said a threat actor used hijacked ConnectWise ScreenConnect panels on 11 November to install rogue remote-access clients and the SCKit toolkit on at least 288 hosts across 48 organisations. The incident is the main new development since Wednesday’s edition, which focused on different vulnerabilities and fixes. ConnectWise disabled five third-party extensions in about 400 partner environments, but has not identified how the panels were accessed or established the full scope.
Known exploited22
CISA KEV entries named in the last 48 hours of coverage, by federal deadline
- In CISA KEV
Barracuda Networks Barracuda Email Security Gateway (ESG)CVE-2026-111560
Federal deadline 13 Nov · In CISA KEV since 10 Nov
8.6High6.2% EPSS9 articles
- In CISA KEV
Barracuda Networks Barracuda Email Security Gateway (ESG)CVE-2026-116606
Federal deadline 13 Nov · In CISA KEV since 10 Nov
9.3Critical8.9% EPSS9 articles
- In CISA KEV
Google ChromiumCVE-2026-125350
Federal deadline 24 Nov · In CISA KEV since 10 Nov
Not scored1.0% EPSS8 articles
- In CISA KEV
Microsoft 365 Apps for EnterpriseCVE-2026-124194
Federal deadline 24 Nov · In CISA KEV since 10 Nov
6.5Medium1.6% EPSS15 articles
- In CISA KEV
Openwave Messaging (Ireland) Limited Webtop Media TranscoderCVE-2026-111793
Federal deadline 24 Nov · In CISA KEV since 10 Nov
4.3Medium0.6% EPSS5 articles
- In CISA KEV
Cisco BroadWorksCVE-2026-20320
Federal deadline 24 Nov · In CISA KEV since 10 Nov
7.5High0.8% EPSS6 articles
Show 16 more · federal deadlines passed
- In CISA KEV
gpustackCVE-2026-102895
Federal deadline passed 12 Nov · In CISA KEV since 9 Nov
9.8Critical0.5% EPSS7 articles
- In CISA KEV
Google BrotliCVE-2026-111497
Federal deadline passed 10 Nov · In CISA KEV since 27 Oct
9.2Critical83% EPSS26 articles
- In CISA KEV
Cisco Secure Firewall Adaptive Security Appliance (ASA) SoftwareCVE-2026-76418
Federal deadline passed 1 Nov · In CISA KEV since 29 Oct
8.6High0.8% EPSS8 articles
- In CISA KEV
PHPCVE-2026-109618
Federal deadline passed 29 Oct · In CISA KEV since 26 Oct
9.2Critical99.9% EPSS59 articles
- In CISA KEV
PHPCVE-2026-109619
Federal deadline passed 29 Oct · In CISA KEV since 26 Oct
9.2Critical99.9% EPSS58 articles
- In CISA KEV
ConnectWise ScreenConnectCVE-2026-84869
Federal deadline passed 14 Sep · In CISA KEV since 11 Sep
9.9Critical0.9% EPSS6 articles
- In CISA KEV
PTC Windchill and FlexPLMCVE-2026-12569
Federal deadline passed 28 Jun · In CISA KEV since 25 Jun · Used in ransomware campaigns
9.3Critical46% EPSS12 articles
- In CISA KEV
Cisco Catalyst SD-WAN Controller and ManagerCVE-2026-20127
Federal deadline passed 27 Feb · In CISA KEV since 25 Feb
10.0Critical88% EPSS25 articles
- In CISA KEV
GNU InetUtilsCVE-2026-24061
Federal deadline passed 16 Feb · In CISA KEV since 26 Jan
9.8Critical99% EPSS11 articles
- In CISA KEV
Meta React Server ComponentsCVE-2025-55182
Federal deadline passed 12 Dec 2025 · In CISA KEV since 5 Dec 2025 · Used in ransomware campaigns
10.0Critical99.7% EPSS16 articles
- In CISA KEV
Qlik SenseCVE-2023-48365
Federal deadline passed 3 Feb 2025 · In CISA KEV since 13 Jan 2025 · Used in ransomware campaigns
9.6Critical48% EPSS1 article
- In CISA KEV
Veeam Backup & ReplicationCVE-2024-40711
Federal deadline passed 7 Nov 2024 · In CISA KEV since 17 Oct 2024 · Used in ransomware campaigns
9.8Critical90% EPSS1 article
- In CISA KEV
Palo Alto Networks PAN-OSCVE-2024-3400
Federal deadline passed 19 Apr 2024 · In CISA KEV since 12 Apr 2024 · Used in ransomware campaigns
10.0Critical99.9% EPSS2 articles
- In CISA KEV
Qlik SenseCVE-2023-41265
Federal deadline passed 28 Dec 2023 · In CISA KEV since 7 Dec 2023 · Used in ransomware campaigns
9.6Critical88% EPSS1 article
- In CISA KEV
Qlik SenseCVE-2023-41266
Federal deadline passed 28 Dec 2023 · In CISA KEV since 7 Dec 2023 · Used in ransomware campaigns
8.2High85% EPSS1 article
- In CISA KEV
Apache ActiveMQCVE-2023-46604
Federal deadline passed 23 Nov 2023 · In CISA KEV since 2 Nov 2023 · Used in ransomware campaigns
10.0Critical99.9% EPSS2 articles
Latest news73
The last 24 hours, newest first; stories about known exploited CVEs are above
Latest story at 02:55 UTC. Red diamonds mark the 4 stories about exploited CVEs.
- 02:55 UTC. TSMC confirms employee data leak through a cloud service provider. 1 outlet.
- 02:26 UTC. PostgreSQL fixes 52 flaws, including code execution bugs. 1 outlet.
- 02:01 UTC. DOJ and Europol Arrest 354 Suspects in Dark Web Crackdown. 1 outlet.
- 02:00 UTC. ISC Stormcast For Friday, November 13th, 2026 https://isc.sans.edu/podcastdetail/10178, (Fri, Nov 13th). 1 outlet.
- 01:52 UTC. Zoho fixes eight ManageEngine flaws, including CVE-2026-12591. 1 outlet.
- 01:47 UTC. DOJ and FBI dismantle Gootloader network across 100 servers. 1 outlet.
- 01:43 UTC. DOJ Disrupts North Korean Crypto Theft Schemes and Seizes $1.2B. 2 outlets.
- 01:37 UTC. Red Hat fixes critical sandbox bypass in Satellite. 1 outlet.
- 01:01 UTC. Gradle fixes code execution flaw in version catalog builds. 1 outlet.
- 00:30 UTC. Mitel fixes critical authentication bypass in MiVoice MX-ONE. 1 outlet.
- 00:00 UTC. Plone fixes flaws allowing anonymous remote code execution. 1 outlet.
- 22:55 UTC. Microsoft 365 outage hits Outlook, Teams and Defender XDR for hours. 1 outlet.
- 22:46 UTC. Organisations struggle to map cryptography for post quantum shift. 1 outlet.
- 22:42 UTC. Hudson Rock Finds School Threat Email Accounts in Stolen Data. 1 outlet.
- 21:57 UTC. Iranian cyber unit blamed for attacks on European refrigeration systems. 1 outlet.
- 21:18 UTC. Researchers warn AntiFox is driving attacks on AWS environments. 1 outlet.
- 20:54 UTC. Europol's Endgame strike hits Gootloader, CastleRAT and StealC. 1 outlet.
- 20:09 UTC. Luna Moth returns to law firms to steal Microsoft tokens. 1 outlet.
- 18:02 UTC. Microsoft reports 59 Linux kernel bugs and 33 CVEs. 1 outlet.
- 17:50 UTC. SignDrop PoC exploits Windows CLFS to seek SYSTEM access. 1 outlet.
- 17:00 UTC. Microsoft researchers expose backdoors in coding agent training. 1 outlet.
- 16:00 UTC. Fortinet Finds SQL Servers Targeted by Cryptominer and Gh0st RAT. 1 outlet.
- 15:40 UTC. Check Point says attackers exploited Gateway flaw for root access. 1 outlet.
- 15:15 UTC. 186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers. 1 outlet.
- 15:00 UTC. Unit 42 says autonomous AI targeted 19 organisations. 1 outlet.
- 15:00 UTC. Citrix fixes 31 flaws across NetScaler products. 2 outlets.
- 15:00 UTC. React fixes Flight flaw that enables unauthenticated code execution. 1 outlet.
- 14:56 UTC. Unocoin finds coins left a frozen BitGo wallet after server breach. 1 outlet.
- 14:55 UTC. SOCRadar Maps 916 Exposed ARTEX AI Pentest Consoles in US. 1 outlet.
- 14:53 UTC. European Spyware Victims Face Years of Legal Battles and Few Answers. 1 outlet.
- 14:30 UTC. Enea links SilentAir to attacks intercepting Taiwanese calls. 1 outlet.
- 14:00 UTC. Lego takes BrickLink marketplace offline after unusual activity. 2 outlets.
- 13:56 UTC. Attackers Exploit Check Point Gateways to Deploy Webshells and Wipers. 1 outlet. About an exploited CVE.
- 13:42 UTC. Chrome and Firefox Updates Fix More Than 180 Flaws. 1 outlet.
- 13:39 UTC. Attackers Target 60,000 GitHub Repositories in Credential Theft Campaign. 1 outlet.
- 13:15 UTC. nDiligence Study Finds Supply Chain Risk Across 50 Platforms. 1 outlet.
- 13:12 UTC. Daylight raises $80 million to expand AI security platform. 1 outlet.
- 13:08 UTC. SCKit exploits ScreenConnect flaw to target MSP environments. 1 outlet. About an exploited CVE.
- 12:33 UTC. Zoom fixes Windows flaws enabling unauthorised privilege escalation. 1 outlet.
- 12:09 UTC. Google warns of AMD Turin CPU flaws that could leak data. 1 outlet.
- 12:02 UTC. Webinar shows how identity context can strengthen SOC responses. 1 outlet.
- 12:02 UTC. n0n ransomware operation lists 93 victims in five weeks. 1 outlet.
- 11:56 UTC. GPUStack Authentication Bypass Exploited in Scanning Attempts. 1 outlet. About an exploited CVE.
- 11:51 UTC. Researcher discloses new N-central flaws enabling root access. 1 outlet.
- 11:51 UTC. Material Security exposes Google Calendar phishing campaign. 1 outlet.
- 11:49 UTC. Microsoft adds SOCRadar threat intelligence to Sentinel. 1 outlet.
- 11:33 UTC. PTC patches Windchill and FlexPLM flaw enabling remote code execution. 1 outlet.
- 11:08 UTC. Notion AI chat transcripts exposed in Fireworks AI breach affecting under 1% of workspaces. 1 outlet.
- 11:00 UTC. AI Assisted Attack Enabled Rapid Lateral Movement at US Retailer. 1 outlet.
- 10:52 UTC. Pushpaganda abuses browser alerts to spread scams and ads. 1 outlet.
- 10:45 UTC. Symantec analyst urges firms to move beyond patching. 1 outlet.
- 10:39 UTC. Huntress Finds ScreenConnect Malware Campaign Hitting 288 Hosts. 1 outlet.
- 10:22 UTC. NIKKE game launcher used to deliver Lua information stealer. 1 outlet.
- 10:00 UTC. Kaspersky explains how cloud pentests can cross trust boundaries. 1 outlet.
- 10:00 UTC. NCSC launches cyber testing scheme to bolster UK resilience. 1 outlet.
- 09:39 UTC. Attackers Probe N-able N-central Zero-Days After Disclosure. 2 outlets.
- 09:25 UTC. Datadog researchers detail MongoDB flaw that can crash servers. 1 outlet.
- 09:23 UTC. Red Hat Quay flaw could expose private container images. 2 outlets.
- 09:03 UTC. Former FBI Supervisor Admits Stealing $2.47 Million in Crypto. 1 outlet.
- 08:38 UTC. Maersk confirms data theft after $5 million extortion attempt. 2 outlets.
- 08:20 UTC. Node.js fixes 16 flaws exposing servers to crashes and data leaks. 1 outlet.
- 07:30 UTC. Google publishes Linux kernel exploit for privilege escalation. 1 outlet.
- 07:30 UTC. StepSecurity uncovers GitHub Actions secret stealing campaign. 1 outlet.
- 07:01 UTC. PRODAFT uncovers BBNet Linux botnet with 11 exploits. 1 outlet. About an exploited CVE.
- 06:42 UTC. Aikido links hijacked GitHub accounts to CI secret stealer. 1 outlet.
- 06:14 UTC. Check Point links three espionage campaigns to CopperDragon. 1 outlet.
- 06:10 UTC. Poland takes e-government platform offline after cyberattack. 1 outlet.
- 05:12 UTC. Apache fixes HTTP/2 flaw enabling unauthenticated remote code execution. 2 outlets.
- 04:55 UTC. Hijacked ConnectWise ScreenConnect panels push SCKit worm to 288 hosts. 1 outlet.
- 04:39 UTC. Huntress reports rogue ScreenConnect clients hit 48 organisations. 1 outlet.
- Known exploited CVE
- CVE not in KEV
- Other story
- Size: outlets on the story
- Stories an hour
Show as tableHide table
| Time (UTC) | Story | Outlets | Type |
|---|---|---|---|
| 02:55 | TSMC confirms employee data leak through a cloud service provider | 1 | Other |
| 02:26 | PostgreSQL fixes 52 flaws, including code execution bugs | 1 | CVE |
| 02:01 | DOJ and Europol Arrest 354 Suspects in Dark Web Crackdown | 1 | Other |
| 02:00 | ISC Stormcast For Friday, November 13th, 2026 https://isc.sans.edu/podcastdetail/10178, (Fri, Nov 13th) | 1 | Other |
| 01:52 | Zoho fixes eight ManageEngine flaws, including CVE-2026-12591 | 1 | CVE |
| 01:47 | DOJ and FBI dismantle Gootloader network across 100 servers | 1 | Other |
| 01:43 | DOJ Disrupts North Korean Crypto Theft Schemes and Seizes $1.2B | 2 | Other |
| 01:37 | Red Hat fixes critical sandbox bypass in Satellite | 1 | CVE |
| 01:01 | Gradle fixes code execution flaw in version catalog builds | 1 | Other |
| 00:30 | Mitel fixes critical authentication bypass in MiVoice MX-ONE | 1 | Other |
| 00:00 | Plone fixes flaws allowing anonymous remote code execution | 1 | Other |
| 22:55 | Microsoft 365 outage hits Outlook, Teams and Defender XDR for hours | 1 | Other |
| 22:46 | Organisations struggle to map cryptography for post quantum shift | 1 | Other |
| 22:42 | Hudson Rock Finds School Threat Email Accounts in Stolen Data | 1 | Other |
| 21:57 | Iranian cyber unit blamed for attacks on European refrigeration systems | 1 | CVE |
| 21:18 | Researchers warn AntiFox is driving attacks on AWS environments | 1 | Other |
| 20:54 | Europol's Endgame strike hits Gootloader, CastleRAT and StealC | 1 | Other |
| 20:09 | Luna Moth returns to law firms to steal Microsoft tokens | 1 | Other |
| 18:02 | Microsoft reports 59 Linux kernel bugs and 33 CVEs | 1 | CVE |
| 17:50 | SignDrop PoC exploits Windows CLFS to seek SYSTEM access | 1 | Other |
| 17:00 | Microsoft researchers expose backdoors in coding agent training | 1 | Other |
| 16:00 | Fortinet Finds SQL Servers Targeted by Cryptominer and Gh0st RAT | 1 | Other |
| 15:40 | Check Point says attackers exploited Gateway flaw for root access | 1 | CVE |
| 15:15 | 186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers | 1 | Other |
| 15:00 | Unit 42 says autonomous AI targeted 19 organisations | 1 | Other |
| 15:00 | Citrix fixes 31 flaws across NetScaler products | 2 | CVE |
| 15:00 | React fixes Flight flaw that enables unauthenticated code execution | 1 | CVE |
| 14:56 | Unocoin finds coins left a frozen BitGo wallet after server breach | 1 | Other |
| 14:55 | SOCRadar Maps 916 Exposed ARTEX AI Pentest Consoles in US | 1 | Other |
| 14:53 | European Spyware Victims Face Years of Legal Battles and Few Answers | 1 | Other |
| 14:30 | Enea links SilentAir to attacks intercepting Taiwanese calls | 1 | Other |
| 14:00 | Lego takes BrickLink marketplace offline after unusual activity | 2 | Other |
| 13:56 | Attackers Exploit Check Point Gateways to Deploy Webshells and Wipers | 1 | Known exploited |
| 13:42 | Chrome and Firefox Updates Fix More Than 180 Flaws | 1 | Other |
| 13:39 | Attackers Target 60,000 GitHub Repositories in Credential Theft Campaign | 1 | Other |
| 13:15 | nDiligence Study Finds Supply Chain Risk Across 50 Platforms | 1 | Other |
| 13:12 | Daylight raises $80 million to expand AI security platform | 1 | Other |
| 13:08 | SCKit exploits ScreenConnect flaw to target MSP environments | 1 | Known exploited |
| 12:33 | Zoom fixes Windows flaws enabling unauthorised privilege escalation | 1 | CVE |
| 12:09 | Google warns of AMD Turin CPU flaws that could leak data | 1 | CVE |
| 12:02 | Webinar shows how identity context can strengthen SOC responses | 1 | Other |
| 12:02 | n0n ransomware operation lists 93 victims in five weeks | 1 | Other |
| 11:56 | GPUStack Authentication Bypass Exploited in Scanning Attempts | 1 | Known exploited |
| 11:51 | Researcher discloses new N-central flaws enabling root access | 1 | CVE |
| 11:51 | Material Security exposes Google Calendar phishing campaign | 1 | Other |
| 11:49 | Microsoft adds SOCRadar threat intelligence to Sentinel | 1 | Other |
| 11:33 | PTC patches Windchill and FlexPLM flaw enabling remote code execution | 1 | CVE |
| 11:08 | Notion AI chat transcripts exposed in Fireworks AI breach affecting under 1% of workspaces | 1 | Other |
| 11:00 | AI Assisted Attack Enabled Rapid Lateral Movement at US Retailer | 1 | Other |
| 10:52 | Pushpaganda abuses browser alerts to spread scams and ads | 1 | Other |
| 10:45 | Symantec analyst urges firms to move beyond patching | 1 | Other |
| 10:39 | Huntress Finds ScreenConnect Malware Campaign Hitting 288 Hosts | 1 | Other |
| 10:22 | NIKKE game launcher used to deliver Lua information stealer | 1 | Other |
| 10:00 | Kaspersky explains how cloud pentests can cross trust boundaries | 1 | Other |
| 10:00 | NCSC launches cyber testing scheme to bolster UK resilience | 1 | Other |
| 09:39 | Attackers Probe N-able N-central Zero-Days After Disclosure | 2 | CVE |
| 09:25 | Datadog researchers detail MongoDB flaw that can crash servers | 1 | CVE |
| 09:23 | Red Hat Quay flaw could expose private container images | 2 | CVE |
| 09:03 | Former FBI Supervisor Admits Stealing $2.47 Million in Crypto | 1 | Other |
| 08:38 | Maersk confirms data theft after $5 million extortion attempt | 2 | Other |
| 08:20 | Node.js fixes 16 flaws exposing servers to crashes and data leaks | 1 | CVE |
| 07:30 | Google publishes Linux kernel exploit for privilege escalation | 1 | CVE |
| 07:30 | StepSecurity uncovers GitHub Actions secret stealing campaign | 1 | Other |
| 07:01 | PRODAFT uncovers BBNet Linux botnet with 11 exploits | 1 | Known exploited |
| 06:42 | Aikido links hijacked GitHub accounts to CI secret stealer | 1 | Other |
| 06:14 | Check Point links three espionage campaigns to CopperDragon | 1 | Other |
| 06:10 | Poland takes e-government platform offline after cyberattack | 1 | Other |
| 05:12 | Apache fixes HTTP/2 flaw enabling unauthenticated remote code execution | 2 | CVE |
| 04:55 | Hijacked ConnectWise ScreenConnect panels push SCKit worm to 288 hosts | 1 | Other |
| 04:39 | Huntress reports rogue ScreenConnect clients hit 48 organisations | 1 | Other |
- TSMC confirms employee data leak through a cloud service provider
TSMC told the SEC that data on current and former employees was posted online without authorisation and matches records held by a cloud service provider. It found no sign its own systems were breached; a forum seller…
CyberSIXT
- FBI Seizes $1.2 Billion in Cryptocurrency Stolen From Binance
The FBI said it had seized more than $1.2 billion in cryptocurrency reported stolen from Binance the previous month. The US Department of Justice said it had obtained court authorisation to seize or restrain that…
SecurityWeek
- PostgreSQL fixes 52 flaws, including code execution bugs
PostgreSQL released versions 18.7, 17.12, 16.16, 15.20 and 14.25 on 12 November 2026, fixing 52 CVEs: 38 rated High, 12 Medium and two Low. SecurityOnline says 32 flaws could allow an authenticated database user, or…
SecurityOnlineCVE-2026-6460
- DOJ and Europol Arrest 354 Suspects in Dark Web Crackdown
International law enforcement arrested 354 suspects in Operation TorNado, which the FBI described as its largest interagency crackdown on dark-web drug vendors and buyers to date. The operation, led by the US…
SecurityOnline
- ISC Stormcast For Friday, November 13th, 2026 https://isc.sans.edu/podcastdetail/10178, (Fri, Nov 13th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
SANS ISC
- Zoho fixes eight ManageEngine flaws, including CVE-2026-12591
Zoho published details of eight ManageEngine vulnerabilities on 12 November 2026: three rated critical and five high, with CVE-2026-12591 scoring 9.9. The flaws affect M365 Manager Plus, the ServiceDesk Plus product…
SecurityOnlineCVE-2026-12591
- DOJ and FBI dismantle Gootloader network across 100 servers
The US Department of Justice and FBI, working with international partners, removed Gootloader malware from more than 100 servers and seized US domains used to control the network. The operation, authorised by a court…
SecurityOnline
- DOJ Disrupts North Korean Crypto Theft Schemes and Seizes $1.2B
The US Department of Justice announced action against two cryptocurrency theft operations attributed to North Korean state actors. In California, the FBI seized cloud servers linked to the FaceStealer scheme and more…
SecurityOnline
- Red Hat fixes critical sandbox bypass in Satellite
Red Hat published 21 CVEs on 12 November 2026, including one critical flaw rated 9.6: CVE-2026-107360 in Red Hat Satellite’s rubygem-safemode template sandbox. Red Hat says compound assignment expressions can bypass…
SecurityOnlineCVE-2026-107360
- Gradle fixes code execution flaw in version catalog builds
Gradle has released versions 9.9.1 and 8.14.7 to fix three vulnerabilities in the Gradle build tool, according to Do Son, writing on Daily CyberSecurity on 13 November 2026. The most severe flaw is rated CVSS 9.3 and…
SecurityOnline
- Mitel fixes critical authentication bypass in MiVoice MX-ONE
Mitel fixed three MiVoice MX-ONE vulnerabilities in its enterprise PBX platform, including a critical authentication bypass rated CVSS 9.4. Disclosure from Daily CyberSecurity attributes the flaws to the Provisioning…
SecurityOnline
- Plone fixes flaws allowing anonymous remote code execution
The Plone/Zope Security Team released hotfixes on 10 November 2026 to fix a chain of remote code execution flaws affecting Plone sites. The advisory states that the issues, collectively allowing an anonymous visitor to…
SecurityOnline
- Microsoft 365 outage hits Outlook, Teams and Defender XDR for hours
A Microsoft 365 outage has cut users off from Outlook, Teams, SharePoint, Copilot and Defender XDR for more than five hours. Microsoft blames servers failing health checks and an overwhelmed core process, and has…
CyberSIXT
- Organisations struggle to map cryptography for post quantum shift
Many organisations recognise post-quantum cryptography (PQC) as a priority but lack a detailed inventory of where cryptography is used, making it difficult to plan a transition. A July DigiCert study found that 87%…
Dark Reading
- Hudson Rock Finds School Threat Email Accounts in Stolen Data
Hudson Rock researchers found that two university addresses linked to Italy’s school bomb threats appeared in infostealer data. On 11 November 2026, bomb-threat emails targeted schools across Europe, with about 6,000…
Security Affairs
- Iranian cyber unit blamed for attacks on European refrigeration systems
French authorities have attributed the October 2026 refrigeration attacks to Shahid Kaveh, an offensive cyber unit within Iran’s Islamic Revolutionary Guard Corps (IRGC), a finding published in CERTFR-2026-CTI-009 and…
dti.domaintools.comCVE-2025-41450
- Researchers warn AntiFox is driving attacks on AWS environments
A month after Artex went closed-source, researchers say the agentic pentesting framework is spreading quickly and causing increasing disruption. Dark Reading cites Yuval Itzchakov, cofounder and CTO of A Security,…
Dark Reading
- Europol's Endgame strike hits Gootloader, CastleRAT and StealC
Police in nine countries took action against 235 servers and 257 domains behind Gootloader, CastleRAT and StealC. The US says Gootloader infected 25,000 computers since 2018 and fed ransomware attacks that cost 44 US…
CyberSIXT
- Luna Moth returns to law firms to steal Microsoft tokens
ReliaQuest says the Luna Moth extortion group has returned to law firms it targeted before, likely focusing on those that rejected its first ransom demand. The second approaches have come weeks or months later and seek…
Dark Reading
- Microsoft reports 59 Linux kernel bugs and 33 CVEs
Microsoft’s threat briefing this week flags 59 Linux kernel bugs, uncovered by MDASH scans of kernel subsystems between late May and mid‑June 2026, which formed the basis for 59 upstream reports and 33 CVEs. One…
The Hacker NewsCVE-2026-64563
- SignDrop PoC exploits Windows CLFS to seek SYSTEM access
A new Windows privilege‑escalation technique, named SignDrop, has been disclosed by a public exploit author claiming to deliver SYSTEM access via the Common Log File System (CLFS) driver. The PoC targets the log…
The Hacker News
- Microsoft researchers expose backdoors in coding agent training
Microsoft Security researchers warn that trusted post-training artifacts can harbour covert backdoors in coding agents, enabling attackers to hijack tools, files or credentials after deployment. The studies—conducted…
Microsoft
- Red Hat fixes Quay flaws exposing private container images
Red Hat has revealed two critical flaws in its Quay container registry that could allow attackers with access to a Quay registry to read and overwrite private container images across all repositories. The first…
The Hacker NewsCVE-2026-123710
- Fortinet Finds SQL Servers Targeted by Cryptominer and Gh0st RAT
Fortinet’s FortiGuard Labs reported a campaign targeting internet-facing Microsoft SQL Server instances that are protected by weak passwords. The operation began with a Go payload carrying the open-source Naabu port…
Infosecurity
- Check Point says attackers exploited Gateway flaw for root access
Check Point has disclosed that CVE-2026-123039 was exploited against a “couple of dozen customers” to escalate privileges on Check Point Gateway devices running Gaia OS. The researchers say attackers gained root access…
SecurityOnlineCVE-2026-123039
- Citrix patches NetScaler flaws enabling denial of service and bypass
Citrix has released patches for a set of critical vulnerabilities affecting NetScaler ADC, NetScaler Gateway, and NetScaler Console, with potential to cause denial-of-service or authentication bypass. The…
The Hacker NewsCVE-2026-120868
- Apache fixes HTTP/2 flaw that could enable remote code execution
Apache has patched a critical HTTP Server vulnerability that could allow unauthenticated remote code execution (RCE) on systems with HTTP/2 enabled, discovered independently by Anthropic and Google researchers. The…
SecurityWeekCVE-2026-119618
- 186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers
Cybersecurity researchers have found that lookalike domains masquerading as artificial intelligence (AI) tools are being used to serve ClickFix-style lures, browser-hijacking malware, and a set of extensions that…
The Hacker News
- Unit 42 says autonomous AI targeted 19 organisations
Unit 42 reports that between August and September 2026, actors using an open-source AI penetration testing framework called Cairn autonomously conducted 25 operations against at least 19 organisations. They paired…
Unit 42
- Citrix fixes 31 flaws across NetScaler products
Cloud Software Group has issued four Citrix security bulletins that fix 31 CVEs in Citrix NetScaler products, with the majority of fixes targeting NetScaler ADC and NetScaler Gateway. The NetScaler ADC and Gateway…
SecurityOnlineCVE-2026-120868
- React fixes Flight flaw that enables unauthenticated code execution
CVE-2026-126187 is an unauthenticated remote code execution flaw in React Server Components’ Flight transport. The bug affects three bundler packages implementing Flight: react-server-dom-webpack,…
StepSecurityCVE-2026-126187
- Unocoin finds coins left a frozen BitGo wallet after server breach
India's Unocoin says it detected unauthorised activity on its servers on November 6 and 9, and on November 12 found outgoing transactions from an ETH address in its frozen BitGo wallets. It cannot yet see how much left…
CyberSIXT
- SOCRadar Maps 916 Exposed ARTEX AI Pentest Consoles in US
SOCRadar researchers have mapped a large U.S. footprint of ARTEX, an open-source, AI-powered autonomous penetration-testing framework. From internet-wide scanner telemetry, they de-duplicated 1,295 U.S.-hosted…
SOCRadar
- European Spyware Victims Face Years of Legal Battles and Few Answers
Europe’s spyware victims face years of legal battles and few answers as governments shield surveillance behind national security, according to a long investigation cited by Greek journalist Thanasis Koukakis and…
Security Affairs
- Enea links SilentAir to attacks intercepting Taiwanese calls
A new state-level actor, identified as SilentAir by Enea, has used compromised Asian mobile operators to intercept calls and texts, with Taiwan as the primary target. Enea has monitored the activity since early 2025…
Infosecurity
- LEGO takes BrickLink offline after detecting unusual activity
LEGO has taken its BrickLink marketplace offline after detecting what it describes as “unusual activity” and is conducting an investigation before deciding when to restore access. The company has not confirmed a hack…
Malwarebytes
- Lego takes BrickLink marketplace offline after unusual activity
Lego Group has taken its BrickLink Marketplace offline after identifying “unusual activity” on the platform, with an update posted on 11 November stating that the immediate priority was to secure the site, protect…
Infosecurity
- Chrome and Firefox Updates Fix More Than 180 Flaws
Google and Mozilla have issued security updates for Chrome and Firefox, addressing a combined total of more than 180 vulnerabilities. Chrome’s new stable build, version 157.0.8103.78/79 for Windows and macOS and…
SecurityWeek
- Attackers Target 60,000 GitHub Repositories in Credential Theft Campaign
Security researchers have attributed a credential theft campaign, nicknamed wfx-loot, to an attacker who tested stolen access across more than 60,000 GitHub repositories. Aikido Security says the operation began on 10…
SecurityWeek
- nDiligence Study Finds Supply Chain Risk Across 50 Platforms
nDiligence has published Attack the Glass (ATG), a four-year study that identifies a critical supply-chain vulnerability affecting 50 platform types, with 46 rated Critical or High risk. The research explains that many…
SecurityOnline
- Daylight raises $80 million to expand AI security platform
SecurityWeek reports that Israeli-American cybersecurity startup Daylight has raised $80 million in a Series B funding round, bringing its total funding to $120 million. The round was led by Goldman Sachs Alternatives’…
SecurityWeek
- Zoom fixes Windows flaws enabling unauthorised privilege escalation
Zoom has released security updates for Zoom Workplace on Windows to fix two flaws, one of which is classified as critical and could allow unauthenticated remote privilege escalation. The two vulnerabilities are…
Security AffairsCVE-2026-108186
- Google warns of AMD Turin CPU flaws that could leak data
Google Cloud has warned that three Transient Scheduler Attacks (TSA) affecting AMD’s Zen 5-based Turin processors could enable a guest VM to infer data from other processes or the kernel, even when mitigations exist…
The Hacker NewsCVE-2024-36350
- Webinar shows how identity context can strengthen SOC responses
The Hacker News reports on a webinar hosted to address what it calls a critical blind spot in security operations: the lack of identity context when analysing alerts. The piece argues that SOCs are drowning in alerts,…
The Hacker News
- n0n ransomware operation lists 93 victims in five weeks
SOCRadar’s Dark Web Profile on n0n Ransomware details a financially motivated data-exfiltration and destructive-extortion operation that emerged on the Dark Web in September 2026. In roughly five weeks, the group…
SOCRadar
- Researcher discloses new N-central flaws enabling root access
N-able said on 12 November 2026 that a new public disclosure alleges additional vulnerabilities in on‑premise versions of N‑central running version 2026.4.1 HF2. The company explained that the server issue described…
The Hacker NewsCVE-2026-90436
- Material Security exposes Google Calendar phishing campaign
Security researchers from Material Security have exposed a calendar-based phishing campaign that has been stealing live Google sessions from corporate users since mid‑August 2026. The operation, dubbed Operation…
The Hacker News
- Microsoft adds SOCRadar threat intelligence to Sentinel
SOCRadar has been named among the new and enhanced Microsoft Sentinel connectors announced for Ignite 2026, with the SOCRadar Alerts Azure Sentinel Directional Solution highlighted as a partner connector in an…
SOCRadar
- PTC patches Windchill and FlexPLM flaw enabling remote code execution
PTC says it has issued patches for a critical remote code execution flaw affecting Windchill and FlexPLM, tracked as CVE-2026-126325, with a CVSS v4 score of 9.2. The vulnerability stems from improper input validation…
The Hacker NewsCVE-2026-126325
- Notion AI chat transcripts exposed in Fireworks AI breach affecting under 1% of workspaces
Notion has informed a small number of customers that their information was compromised in a data breach involving Fireworks AI, a cloud platform used to run and fine-tune open‑source AI models. SecurityWeek's coverage…
SecurityWeek
- AI Assisted Attack Enabled Rapid Lateral Movement at US Retailer
A US retailer was the target of an AI-assisted cyberattack in September, according to Symantec’s post-incident analysis shared by Dark Reading. After hand-typed commands were repeatedly blocked, the threat actor used…
Dark Reading
- N-able N-central hotfix hit by new public zero-day exploits
Two days after N-able shipped Hotfix 2 for the Able2Shell flaws, the same researcher published new exploits that work against it, for the server and for Windows agents and probes. N-able says the server flaw needs the…
CyberSIXTCVE-2026-125883
- Pushpaganda abuses browser alerts to spread scams and ads
Two investigations into deceptive web prompts show how simply granting a browser notification can turn a short visit into ongoing advertising and fraud opportunities for scammers. Malwarebytes’ own research into…
Malwarebytes
- Symantec analyst urges firms to move beyond patching
Dick O’Brien, principal intelligence analyst at Symantec, told IRISSCON 2026 in Dublin that organisations cannot patch their way out of the AI era and must shift to mitigation after exploitation. He highlighted the…
Infosecurity
- Huntress Finds ScreenConnect Malware Campaign Hitting 288 Hosts
A fresh campaign targeting ScreenConnect customers has seen attackers compromise hundreds of endpoints by abusing a vulnerability in a third‑party extension called RMM+. Huntress reports that the activity was observed…
SecurityWeek
- NIKKE game launcher used to deliver Lua information stealer
Bitdefender researchers say attackers used Goddess of Victory: NIKKE’s legitimate PC launcher to deliver a Lua-based information stealer, dubbed k2f-agent. The campaign did not alter the game’s files or exploit a…
bitdefender.com
- Kaspersky explains how cloud pentests can cross trust boundaries
Kaspersky Security Services researchers say cloud penetration tests should focus on whether an attacker can cross trust boundaries, rather than simply finding open ports or achieving code execution. They divide cloud…
securelist.com
- NCSC launches cyber testing scheme to bolster UK resilience
The National Cyber Security Centre (NCSC) has formally launched its Cyber Adversary Simulation (CyAS) scheme to help providers of critical infrastructure test and strengthen their cyber resilience. First trialled at…
Infosecurity
- Attackers Probe N-able N-central Zero-Days After Disclosure
SecurityWeek reports that attackers have begun actively probing N-able N-central installations after researcher Sean Bales released details and PoCs for more than 30 zero-days, dubbed Able2Shell. N-able subsequently…
SecurityWeekCVE-2026-125883
- Datadog researchers detail MongoDB flaw that can crash servers
MongoDB has disclosed a critical pre-authentication vulnerability, CVE-2026-118383, that can cause a crash on a primary when a failover occurs in a replica set. The flaw, described as a use-after-free bug, can be…
The Hacker NewsCVE-2026-118383
- Red Hat Quay flaw could expose private container images
A critical vulnerability in Red Hat Quay could allow attackers to access private container images, replace repository content and maintain persistent access across an affected registry. The flaw, tracked as…
SecurityWeekCVE-2026-123710
- Former FBI Supervisor Admits Stealing $2.47 Million in Crypto
A former FBI supervisor has pled guilty to stealing about $2.47 million in cryptocurrency from wallets linked to 35 FBI investigations, including crypto tied to adversarial nation-state actors. The theft began no later…
Malwarebytes
- Maersk discloses breach after extortion group demands $5m
Maersk has disclosed a data breach affecting one of its IT systems after an extortion group claimed to have stolen 100GB of logistics-related data. In a statement dated 11 November, Maersk said it “identified…
Infosecurity
- Maersk confirms data theft after $5 million extortion attempt
Maersk has confirmed that data was extracted from a system inherited through an earlier acquisition, though the company has not named the acquired business. In a statement dated 11 November, the Danish shipping giant…
SecurityWeek
- Node.js fixes 16 flaws exposing servers to crashes and data leaks
On 12 November 2026 The Hacker News reports that Node.js released fixes for 16 vulnerabilities affecting its core HTTP/2, HTTPS and TLS code across the three supported release lines: 22.x, 24.x and 26.x. The company…
The Hacker NewsCVE-2026-123863
- Google publishes Linux kernel exploit for privilege escalation
CVE-2026-80521: Linux kernel AF_UNIX use-after-free privilege escalation has been fixed in the 7.1.10 stable line, with upstream patches also backported to several older stable branches. The issue is a use-after-free…
SecurityOnlineCVE-2026-80521
- StepSecurity uncovers GitHub Actions secret stealing campaign
StepSecurity researchers report that starting on 10 November 2026, a coordinated botnet of compromised GitHub accounts began using stolen tokens to push a CI secret stealer, named wfx, into every repository those…
StepSecurity
- Aikido links hijacked GitHub accounts to CI secret stealer
An attacker leveraged credentials for 4,837 hijacked GitHub accounts to deploy a secret stealer in repositories those accounts could write to, according to Aikido Security. The stealer is designed to exfiltrate secrets…
The Hacker News
- Check Point links three espionage campaigns to CopperDragon
Check Point Research has linked three ostensibly distinct cyber‑espionage campaigns—SilentDelivery, OceanGate and DarkWire—into a single cross‑platform toolkit driven by the CopperDragon Sparrow framework. The firms…
SecurityOnline
- Poland takes e-government platform offline after cyberattack
Poland has temporarily taken its national e-government platform, ePUAP, offline after detecting and halting a cyberattack, according to an article by Security Affairs dated 12 November 2026. The disruption means ePUAP…
Security Affairs
- Apache fixes HTTP/2 flaw enabling unauthenticated remote code execution
A critical remote code execution flaw in Apache HTTP Server’s HTTP/2 module, mod_http2, could allow unauthenticated attackers to run code on affected servers. Tracked as CVE-2026-119618, the vulnerability affects…
The Hacker NewsCVE-2026-119618
- Hijacked ConnectWise ScreenConnect panels push SCKit worm to 288 hosts
A threat actor used cloud-hosted ScreenConnect panels to install rogue clients and a toolkit Huntress calls the SCKit worm on 288 hosts at 48 organisations. ConnectWise disabled five third-party extensions in 400…
CyberSIXT
- Huntress reports rogue ScreenConnect clients hit 48 organisations
Huntress has reported that rogue ScreenConnect clients are being deployed across managed environments after attackers gained access to cloud-hosted ScreenConnect panels. The activity, first observed on 11 November…
The Hacker News
CVEs in the news18
Named in the last 24 hours and not in CISA KEV, most covered first
CVE-2026-123710Red Hat Red Hat Quay 3
2 articles today · Red Hat fixes Quay flaws exposing private container images
9.8Critical0.4% EPSS · 2 articlesCVE-2026-120868Vendor not yet named
2 articles today · Citrix patches NetScaler flaws enabling denial of service and bypass
9.3Critical2 articlesCVE-2026-119618Apache Software Foundation Apache HTTP Server
2 articles today · Apache fixes HTTP/2 flaw that could enable remote code execution
Not scored0.4% EPSS · 3 articlesCVE-2026-125883N-able N-central
2 articles today · N-able N-central hotfix hit by new public zero-day exploits
Not scored0.9% EPSS · 5 articlesCVE-2026-12591Zohocorp M365 Manager Plus
Zoho fixes eight ManageEngine flaws, including CVE-2026-12591
9.9Critical1.7% EPSS · 1 articleCVE-2026-90436Apache Software Foundation Apache Axis 1.x (EOL)
Researcher discloses new N-central flaws enabling root access
9.8Critical1.1% EPSS · 1 articleCVE-2026-107360Red Hat Red Hat Satellite 6.16 for RHEL 8
Red Hat fixes critical sandbox bypass in Satellite
9.6Critical1 articleCVE-2026-108186Zoom Communications Zoom Workplace
Zoom fixes Windows flaws enabling unauthorised privilege escalation
9.6Critical0.4% EPSS · 4 articlesCVE-2026-126187react react
React fixes Flight flaw that enables unauthenticated code execution
9.5Critical1.8% EPSS · 1 articleCVE-2026-118383MongoDB MongoDB Server
Datadog researchers detail MongoDB flaw that can crash servers
9.5Critical0.7% EPSS · 2 articlesCVE-2026-126325PTC Windchill
PTC patches Windchill and FlexPLM flaw enabling remote code execution
9.2Critical0.5% EPSS · 1 articleCVE-2026-6460PostgreSQL type confusion after ALTER ... SET DATA TYPE executes arbitrary code
PostgreSQL fixes 52 flaws, including code execution bugs
8.8High1 articleCVE-2025-41450Danfoss AK-SM 8xxA Series
Iranian cyber unit blamed for attacks on European refrigeration systems
8.2High1.0% EPSS · 6 articlesCVE-2026-123863nodejs node
Node.js fixes 16 flaws exposing servers to crashes and data leaks
8.2High0.5% EPSS · 2 articlesCVE-2026-64563Linux Linux
Microsoft reports 59 Linux kernel bugs and 33 CVEs
7.8High0.2% EPSS · 3 articlesCVE-2026-123039checkpoint Quantum Security Gateway
Check Point says attackers exploited Gateway flaw for root access
7.8High1 articleCVE-2026-80521Linux Linux
Google publishes Linux kernel exploit for privilege escalation
7.8High0.2% EPSS · 3 articlesCVE-2024-36350AMD AMD EPYC™ 7003 Series Processors
Google warns of AMD Turin CPU flaws that could leak data
5.6Medium0.5% EPSS · 1 article
Developing stories6
Two or more articles in the last 24 hours; each bead is an article
- Threat actorTraderTraitorDevelopinglatest 2 hours ago2 articles2 outlets
- Fri 13 Nov, 01:43 UTC. SecurityOnline, first report. DOJ Disrupts North Korean Crypto Theft Schemes and Seizes $1.2B.
- Fri 13 Nov, 02:28 UTC. SecurityWeek, its first report on the story. FBI Seizes $1.2 Billion in Cryptocurrency Stolen From Binance.
- CVECVE-2026-123710Red Hat Quay 3Developinglatest 12 hours ago2 articles2 outlets
- Thu 12 Nov, 09:23 UTC. SecurityWeek, first report. Red Hat Quay flaw could expose private container images.
- Thu 12 Nov, 16:27 UTC. The Hacker News, its first report on the story. Red Hat fixes Quay flaws exposing private container images.
- CVECVE-2026-120868CVE-2026-120868Developinglatest 12 hours ago2 articles2 outlets
- Thu 12 Nov, 15:00 UTC. SecurityOnline, first report. Citrix fixes 31 flaws across NetScaler products.
- Thu 12 Nov, 15:38 UTC. The Hacker News, its first report on the story. Citrix patches NetScaler flaws enabling denial of service and bypass.
- CVECVE-2026-119618Apache Software Foundation Apache HTTP ServerDevelopinglatest 12 hours ago2 articles2 outlets
- Thu 12 Nov, 05:12 UTC. The Hacker News, first report. Apache fixes HTTP/2 flaw enabling unauthenticated remote code execution.
- Thu 12 Nov, 15:38 UTC. SecurityWeek, its first report on the story. Apache fixes HTTP/2 flaw that could enable remote code execution.
- CVECVE-2026-125883N-able N-centralDevelopinglatest 17 hours ago2 articles2 outlets
- Thu 12 Nov, 09:39 UTC. SecurityWeek, first report. Attackers Probe N-able N-central Zero-Days After Disclosure.
- Thu 12 Nov, 10:55 UTC. CyberSIXT, its first report on the story. N-able N-central hotfix hit by new public zero-day exploits.
- Threat actorWhitearmorDevelopinglatest 19 hours ago2 articles2 outlets
- Thu 12 Nov, 08:38 UTC. SecurityWeek, first report. Maersk confirms data theft after $5 million extortion attempt.
- Thu 12 Nov, 08:49 UTC. Infosecurity, its first report on the story. Maersk discloses breach after extortion group demands $5m.