Saturday, November 14, 2026

Top story

Attackers have exploited unpatched Check Point Security Gateways since October 30, chaining PHP2Shell with CVE-2026-123039 for root, webshells, TSGA and, in Israel, an ESXi wiper. Check Point said a couple of dozen customers were hit in waves on October 30 and November 2. Install the named Jumbo Hotfix takes for affected R81 through R82.20 products.

Exploitation & threats

• Threat actors exploited N-able N-central hours after a November 12 proof of concept; disable Legacy API, since 2026.4 HF2 is not sufficient alone.
• The FBI said open-source Artex automates intrusions; CrowdStrike says China-nexus VAPOR PANDA used it against more than 200 organizations.
• The FBI says North Korea-linked FaceStealer stole more than $400 million in crypto over 18 months through fake Zoom and Teams calls.
• Aikido says attackers used 4,837 hijacked GitHub accounts to open probe pull requests in 61,764 repositories starting November 10.
• Beginning November 11, ConnectWise reported unauthorized ScreenConnect access; Microsoft says attackers then deployed the SCKit worm.
• Enea identified SilentAir, which sent signaling from hacked Asian operator gear and intercepted some two-factor texts, mainly targeting Taiwan.

Patch priorities

• Update Google Chrome to 157.0.8103.50 or later for KEV-listed CVE-2026-125350, a use-after-free in XML.
• Upgrade UnrealIRCd to 6.2.7.1 to fix KEV-listed label-tag injection CVE-2026-114713.
• Apply Microsoft's November 2026 update for Outlook spoofing CVE-2026-124194, or stop using it if mitigations are unavailable.
• Update PostgreSQL to 18.7, 17.12, 16.16, 15.20, or 14.25; CVE-2026-6460 allows authenticated code execution, with no known attacks.
• Install NetScaler ADC and Gateway 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS, or 13.1-37.293 for 28 flaws, including a critical default-install bug.
• Apply SAP's updates for unauthenticated CVSS 10 flaws, including CVE-2026-89103; SAP has not named fixed versions.

Breaches & incidents

• According to BlockAid, attackers used EIP-7702 to move about $6.34 billion from at least 11 Binance wallets on October 29.
• The Justice Department said it froze more than $2.7 billion from that alleged North Korean Binance theft, which the FBI ties to TraderTraitor.
• Osaka said a third-party email breach exposed over 1 million addresses from its city system.
• A global Microsoft 365 outage disrupted Outlook, Teams and some government email; Microsoft said it saw no cyberattack.
• Leak sites claimed Toyota, York University, Oral Roberts University, Walgreen Co. and others; those posts are gang claims, not confirmed compromises.

AI

• Nvidia's board accepted Jensen Huang's resignation; CFO Colette Kress is interim CEO after affair reports, including an alleged spy relationship.
• Bloomberg reports Anthropic's IPO is six times oversubscribed, seeking up to $64.4 billion at roughly a $1.4 trillion valuation.
• According to Unit 42, operators used Cairn with DeepSeek and GLM models to breach 10 organizations.
• Google DeepMind released Gemini 4 Carbon with API access; new Apache 2.0 weights include ZONOS3-Mini, Qwen3.8-27B-DSpine-b16 and Haru-4B.

Watchlist

• VulnCheck says at least two of 14 Copeland Dixell XWEB flaws are exploited; update controllers and keep them off the internet.
• The Justice Department said it removed Gootloader from more than 100 servers after at least 25,000 infections since 2018.
• Update Easy DragDrop File Uploader to 1.1.10 and OpenAM to 16.1.4 for unauthenticated CVSS 10 flaws.