Threat bulletin covers library ransomware and exploited SonicWall, OpenSSH flaws
Original title: 9th November – Threat Intelligence Report
SonicOS SAML VPN bypass and OpenSSH before 10.6p2 are described as actively exploited; Android 14–17 RCE is also patched.
Check Point’s November 9 bulletin reports ransomware at Queens Public Library, a November 1 data-wiping attack on Russian host Beget, and a cPGuard update that ran on about 2,950 servers. It links SonicWall CVE-2026-19868 and OpenSSH CVE-2026-123158 to active exploitation and notes Android and Barracuda patches. Separate sections cover APT29, BITTER, SlippyNunchucks, and HYFLOCK, which claimed eight October victims.
Unconfirmed: Backup destruction at Beget is only reported, and HYFLOCK’s eight October victims are the group’s claims.
- Queens Public Library serves about 2.3 million residents; all 66 branches stayed open.
- Beget’s attack left more than 1,000 servers needing manual inspection.
- Barracuda Email Security Gateway flaws scored CVSS 9.3 and 8.6.
- OpenSSH CVE-2026-123158 is fixed in 10.6p2 and yielded root on an Alpine honeypot.
- Tencent addressed the abused Sogou Input Method delivery path in version 16.10.
Impact: SAML MFA bypass, Android RCE, and OpenSSH authentication bypass
| Product | Affected | Fixed in |
|---|---|---|
| SonicWall SonicOS | — | — |
| Google Android | 14 through 17 | — |
| Barracuda Email Security Gateway | — | — |
| OpenSSH | Linux systems using the musl library without PAM authentication | 10.6p2 |
- 1.Install OpenSSH 10.6p2 on affected musl Linux systems that do not use PAM.
- 2.Apply November’s Android security updates, including the fix for CVE-2026-58868.
- 3.Patch SonicOS SSL VPN SAML setups and Barracuda Email Security Gateway appliances.
- ATT&CK
- T1486 Data Encrypted for ImpactT1195.002 Compromise Software Supply ChainT1190 Exploit Public-Facing ApplicationT1566.001 Spearphishing Attachment
- Threat actors
- HYFLOCKAPT29BITTERSlippyNunchucksCrafty Falcon
- Victims
- Queens Public LibraryBeget
- Organizations
- Indian Computer Emergency Response TeamTencent
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111560 | Command Injection in Barracuda Appliance Timezone Field | 8.6 | — | ||
| CVE-2026-116606 | Auth bypass in Barracuda Email Security Gateway before 9.4.0.030 | 9.3 | — | ||
| CVE-2026-123158 | Password bypass in OpenSSH before 10.6p2 on musl without PAM | 8.1 | 1% | PoC ×13 | |
| CVE-2026-19868 | SAML bypass in SonicWall SonicOS SSLVPN | 7.5 | <1% | KEVPoC | KEV |
| CVE-2026-58868 | Heap buffer overflow in Android FrameDecoder allowing RCE | 9.8 | <1% | PoC ×2 |
From the original article
3 min read at research.checkpoint.com
For the latest discoveries in cyber research for the week of 9th November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Queens Public Library, a New York City public library system serving approximately 2. 3 million residents, was struck by a ransomware attack that encrypted its systems.
research.checkpoint.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.