Reporting Period: November 07, 2026 – November 13, 2026

Threat Landscape

1. Adobe Connect Multiple Vulnerabilities Including Code Injection and SQL Injection – Multiple CVEs

Overview

• Multiple security vulnerabilities identified across several Adobe products including Adobe Connect, Experience Manager (AEM), After Effects, Photoshop, Content Credentials SDK, Audition, Premiere, Media Encoder, and Dimension.
• Vulnerabilities include code injection, buffer overflow, out-of-bounds memory access, path traversal, SQL injection, cross-site scripting (XSS), authentication and authorization issues, and improper input validation.
• Exploitation could allow arbitrary code execution, sensitive information disclosure, data modification or deletion, installation of programs, or creation of unauthorized user accounts.
• No current reports of exploitation in the wild.

Impact

• Severe flaws could lead to remote code execution, privilege escalation, and data compromise depending on the affected user’s privileges.

Affected / Fixed Versions

• Adobe Connect: 12.12 and earlier (Windows)
• Adobe Experience Manager (AEM): Cloud Service 2026.10.29023 and earlier; 6.5 Service Pack 25 and earlier; 6.5 LTS Service Pack 3 and earlier
• Adobe After Effects: 26.5 and earlier; 25.6.6 and earlier
• Adobe Photoshop: 2026 version 27.11 and earlier; 2025 version 26.11.8 and earlier
• Content Credentials SDK: Content Credentials Rust SDK c2pa-v0.91.10 and earlier; C2PA Tool c2patool-v0.28.5 and earlier
• Adobe Audition: 26.5 and earlier; 25.6.6 and earlier
• Adobe Premiere: 26.5.2 and earlier; 25.6.6 and earlier
• Adobe Media Encoder: 26.5.2 and earlier; 25.6.6 and earlier
• Adobe Dimension: 4.1.9 and earlier (macOS)

Recommendations

• Apply Adobe’s latest security updates for all affected products after appropriate testing.
• Identify and inventory all Adobe product versions deployed to detect vulnerable systems.
• Prioritize patching, especially on systems exposed to untrusted files or external access.

Reference link: https://www.adobe.com/trust/security/bulletins-and-advisories.html

2. Fortinet Multiple Critical Vulnerabilities Including Arbitrary Code Execution and Authentication Bypass CVE-2026-126170

Overview

• Fortinet released security updates addressing multiple critical vulnerabilities across FortiOS, FortiManager, FortiAnalyzer, and FortiSASE.
• Vulnerabilities include output encoding flaws, numeric truncation, SQL injection, authentication bypass, improper authorization, SSRF, and missing authentication in HA functionality.
• Some vulnerabilities are remotely exploitable without authentication.

Impact

• Unauthenticated attackers could execute arbitrary code or commands via specially crafted requests.
• Attackers may bypass authentication and authorization mechanisms.
• Potential for privilege escalation and unauthorized access to Virtual Domains and internal resources.
• Forged routing updates and disruption of routing operations possible.
• Super-admin command execution achievable under specific configurations.

Affected / Fixed Versions

• Detailed affected software versions and fixed releases are available in Fortinet official advisories.

Recommendations

• Apply Fortinet-provided mitigations or workarounds immediately.
• Review and monitor network configurations for signs of exploitation.
• Share threat intelligence with partners and subsidiaries.

Reference links:

• https://www.fortiguard.com/psirt
• https://www.fortiguard.com/psirt/FG-IR-26-267
• https://www.fortiguard.com/psirt/FG-IR-26-244
• https://www.fortiguard.com/psirt/FG-IR-26-275
• https://www.fortiguard.com/psirt/FG-IR-26-219
• https://www.fortiguard.com/psirt/FG-IR-26-268
• https://www.fortiguard.com/psirt/FG-IR-26-274
• https://www.fortiguard.com/psirt/FG-IR-26-276
• https://www.fortiguard.com/psirt/FG-IR-26-273

3. Progress WS_FTP Server Multiple Vulnerabilities Including Network Interception and Unauthorized File Access (CVE-2026-115338, CVE-2026-115341)

Overview

• Multiple high-severity vulnerabilities identified in Progress WS_FTP Server.
• Issues include improper protection of XFT communications, insufficient access restrictions in the Thin Client Web Transfer, improper resource management causing service crashes, and exposure of sensitive credentials via temporary files.
• OpenSSL component vulnerable to crafted client certificates causing excessive heap memory consumption during TLS handshakes.

Impact

• Network attackers can intercept or modify sensitive information over unencrypted HTTP (CVE-2026-115338).
• Authenticated FTP users may access files beyond their authorized directories (CVE-2026-115341).
• Remote attackers can cause denial-of-service by exhausting server memory or crashing the XFT service (CVE-2026-115339, CVE-2026-35189).
• Sensitive user credentials and session information risk exposure through temporary files during web transfers (CVE-2026-115340).

Affected / Fixed Versions

• Affected: WS_FTP Server versions prior to 2025.0.5 (10.0.5).
• Fixed: WS_FTP Server 2025.0.5 (10.0.5) and later.

Recommendations

• Update to WS_FTP Server version 2025.0.5 (10.0.5) or later to mitigate all identified vulnerabilities.

Reference link: https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026

4. Microsoft Outlook Spoofing Vulnerability CVE-2026-124194 Actively Exploited; Multiple Critical Remote Code Execution Vulnerabilities in Windows and Microsoft Products

Overview

• Microsoft released updates addressing 1,252 vulnerabilities in its November 2026 patch cycle.
• Includes one actively exploited zero-day vulnerability (CVE-2026-124194) in Microsoft Outlook.
• Additional critical vulnerabilities affect Windows core services, Active Directory Domain Services, LDAP, Exchange Server, Hyper-V, and Remote Desktop Services.
• Vulnerabilities enable arbitrary code execution, privilege escalation, information disclosure, and system compromise.

Impact

• Active exploitation of CVE-2026-124194 Outlook spoofing vulnerability.
• Critical remote code execution flaws with CVSS scores up to 9.8 in Windows Xbox Live Networking Service, Windows Search, Windows LDAP, Exchange Server, SMB Server, Print Spooler, and Microsoft Office components.
• Elevation of privilege vulnerabilities in Windows Remote Desktop Services and Microsoft Entra Device Registration.
• Potential for unauthorized access and widespread network compromise.

Affected / Fixed Versions

• Multiple Microsoft products and components; specific versions not detailed in advisory.

Recommendations

• Immediately apply November 2026 security updates across all affected Microsoft products.
• Prioritize patching Microsoft Outlook for CVE-2026-124194 due to active exploitation.
• Focus on securing internet-facing systems, domain controllers, Exchange servers, and Microsoft Office applications.

Reference link: https://msrc.microsoft.com/update-guide/releaseNote/2026-nov

5. SAP NetWeaver Authentication Bypass and Memory Corruption Vulnerabilities Including CVE-2026-120017 (CVSS 10.0)

Overview

• November 2026 SAP Security Patch Day addresses 38 vulnerabilities across multiple SAP products.
• Includes 9 Critical vulnerabilities affecting SAP NetWeaver, SAP Web Dispatcher, SAP Gateway, Internet Communication Manager (ICM), SAP CRM components, SAP BusinessObjects, and others.
• Four vulnerabilities scored CVSS v3.1 10.0, enabling authentication bypass, arbitrary code execution, memory corruption, and unauthorized access.

Impact

• CVE-2026-120017: SAML2 service provider in SAP NetWeaver AS ABAP and ABAP Platform allows unauthenticated remote attackers to bypass authentication and impersonate users.
• CVE-2026-89126: Heap-based buffer overflow in SAP Web Dispatcher allows remote code execution via crafted network traffic.
• CVE-2026-76964: Memory corruption in SAP ICM enables arbitrary code execution through network input.
• CVE-2026-89103: SAP Gateway default ACL with excessive privileges allows unauthorized internal application server impersonation.
• Other critical issues include code injections in SAP NetWeaver Knowledge Management and CRM components, OS command injection in ABAP platform, CSRF in Web Dispatcher and ICM, and XXE in SAP BusinessObjects Web Intelligence.

Affected / Fixed Versions

• SAP NetWeaver AS ABAP and ABAP Platform SAP_BASIS releases 702 through 920 (SAML2 vulnerability).
• SAP Web Dispatcher kernel and Web Dispatcher releases 7.53, 7.54, 7.77, 7.93, and 9.16 through 9.20.
• SAP Internet Communication Manager kernel releases for multiple SAP NetWeaver versions.
• SAP Gateway kernel releases 7.22 through 9.21.
• SAP NetWeaver Knowledge Management (XML Forms component).
• SAP CRM Components including S4CRM, S4CEXT, BBPCRM.
• SAP BusinessObjects Business Intelligence Platform Web Intelligence.

Recommendations

• Immediately apply the November 2026 SAP security patches, prioritizing all Critical vulnerabilities.
• Prioritize remediation for internet-facing SAP NetWeaver, SAP Gateway, Web Dispatcher, and ICM instances.
• Review and verify SAML2 authentication configurations to ensure proper validation of authentication assertions.

Reference link: https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?isu_page=1&anchorId=section

6. Apple iOS, iPadOS, macOS, watchOS, and visionOS Multiple Vulnerabilities Including Actively Exploited Out-of-Bounds Write CVE-2026-111497

Overview

• Apple released security updates addressing vulnerabilities across iOS, iPadOS, macOS, watchOS, and visionOS.
• Vulnerabilities include memory corruption, unauthorized access, information disclosure, and security restriction bypass.
• CVE-2026-111497 is an out-of-bounds write in Brotli compression, potentially allowing arbitrary code execution and is actively exploited in the wild.
• Other vulnerabilities affect Bluetooth pairing, AirPlay pairing, App Intents authorization, and iMessage group chat access and information disclosure.

Impact

• Memory corruption and arbitrary code execution via Brotli out-of-bounds write.
• Bluetooth vulnerabilities allowing process memory corruption and unauthorized pairing without user interaction.
• AirPlay vulnerabilities permitting bypass of pairing restrictions and unauthorized pairing including from the lock screen.
• Applications may gain unauthorized access to sensitive user data.
• Remote attackers could join iMessage group chats and access past messages.

Affected / Fixed Versions

• iOS 27.2.1 and iPadOS 27.2.1 for iPhone 11 and later, iPad Pro 12.9-inch 4th gen and later, iPad Pro 11-inch 2nd gen and later, iPad Air 4th gen and later, iPad 9th gen and later, iPad mini 6th gen and later.
• iOS 26.7.3 and iPadOS 26.7.3 for previous iPhone and iPad models.
• iOS 18.7.12 and iPadOS 18.7.12 for iPhone XS, XS Max, XR, iPad 7th gen.
• macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3, macOS Sequoia 15.8.3.
• watchOS 27.2.1 for Apple Watch Series 9 and later; watchOS 26.6.1 for Apple Watch Series 6-8, SE (2nd gen), and Ultra.
• visionOS 27.2.1 for Apple Vision Pro (all models).

Recommendations

• Install the latest software updates from Apple immediately to mitigate risks from these vulnerabilities.

Reference link: https://support.apple.com/en-ae/100100

7. Contact Form 7 WordPress Plugin Critical Unauthenticated Arbitrary File Upload Vulnerability CVE-2026-114432 (CVSS 9.8)

Overview

• A critical unauthenticated arbitrary file upload vulnerability exists in Contact Form 7 WordPress plugin versions 6.2 through 6.2.3.
• Vulnerability enabled by insufficient file type validation and improper temporary-file cleanup on form file-upload fields.
• Under certain Apache configurations, exploitation may lead to remote code execution.
• On other configurations, attackers can upload malicious content such as HTML and SVG files to the uploads directory.

Impact

• Remote attackers can upload arbitrary files without authentication, potentially resulting in remote code execution or website compromise.

Affected / Fixed Versions

• Affected: Contact Form 7 versions 6.2 through 6.2.3
• Fixed: Contact Form 7 version 6.2.4 and later

Recommendations

• Upgrade Contact Form 7 to version 6.2.4 or later immediately.
• Identify and assess all WordPress installations running affected plugin versions for potential compromise.

Reference link: https://nvd.nist.gov/vuln/detail/cve-2026-114432

8. Google Chrome Multiple Memory Corruption Vulnerabilities Including Actively Exploited Use-After-Free CVE-2026-125350

Overview

• Google released security updates for Chrome Stable and Extended Stable channels addressing multiple vulnerabilities affecting Windows, macOS, Linux, and Android.
• Vulnerabilities include buffer overflow, use-after-free, type confusion, out-of-bounds write, incorrect authorization, and uninitialized resource issues.
• CVE-2026-125350 (use-after-free in XML) is confirmed to be actively exploited in the wild.

Impact

• Successful exploitation could lead to arbitrary code execution, bypassing security restrictions, or denial-of-service.
• Potential compromise of confidentiality, integrity, and availability of affected systems.
• Actively exploited vulnerability heightens risk for unpatched systems.

Affected / Fixed Versions

• Stable Channel:
• Fixed in Chrome 157.0.8103.50/.51 for Windows and macOS
• Fixed in Chrome 157.0.8103.50 for Linux
• Fixed in Chrome 157.0.8103.50 for Android
• Extended Stable Channel:
• Fixed in Chrome 156.0.8078.96 for Windows and macOS

Recommendations

• Update Google Chrome to the latest available version promptly to mitigate known vulnerabilities.

Reference links:

• https://chromereleases.googleblog.com/
• https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html
• https://chromereleases.googleblog.com/2026/11/extended-stable-update-for-desktop_0910980127.html

9. Plex Media Server Arbitrary Code Execution Vulnerabilities (Plex2Shell) Actively Exploited on QNAP NAS

Overview

• Four vulnerabilities in Plex Media Server known as Plex2Shell affect versions 1.43.2 and earlier on QNAP NAS devices.
• Vulnerabilities include SSRF, improper URI scheme neutralization, administrative token disclosure, and arbitrary file write.
• These issues can be chained to enable unauthenticated remote code execution with Plex Media Server process privileges.
• Exploitation is active and widespread, with public PoC released and compromised servers used for cryptocurrency mining and proxy deployment.

Impact

• Full server compromise.
• Unauthorized access to privileged server functions.
• Deployment of cryptocurrency miners and proxy malware.
• Potential unauthorized access through disclosed administrative tokens.

Affected / Fixed Versions

• Affected: Plex Media Server 1.43.2 and earlier on QNAP NAS devices.
• Fixed: Plex Media Server 1.43.3.10861 or later.
• QNAP operating systems (QTS, QuTS hero) and NAS devices without Plex installed are not affected.

Recommendations

• Immediately update Plex Media Server to version 1.43.3.10861 or later.
• Assess for compromise if Plex was internet-accessible in vulnerable versions; consider clean reinstall.
• Preserve logs for forensic analysis, remove suspicious codec files, and avoid restoring compromised content.
• Reset all Plex and NAS credentials, enable two-factor authentication, and rotate exposed access keys.
• Disable Plex Remote Access and remove unnecessary port-forwarding for port 32400.
• Use VPNs for remote connectivity instead of direct exposure.
• Monitor processes, network activity, logs, and CPU usage for signs of compromise.
• Keep QNAP OS, applications, Malware Remover, and QuFirewall up to date.

Reference links:

https://www.qnap.com/en/how-to/faq/article/plex2shell-check-and-remediation-faq-for-qnap-nas-users

https://www.qnap.com/en/security-news/2026/qnap-security-notice-plex-media-server-vulnerabilities-plex2shell-update-to-1-43-3-10861-or-later-immediately-no-data-loss-reported

10. React Server Components Remote Code Execution Vulnerability GHSA-xqc2-xf4c-x3h3 CVSS 9.5

Overview

• A critical remote code execution (RCE) vulnerability exists in React Server Components, impacting react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages.
• The flaw allows unauthenticated attackers to execute arbitrary code on affected servers via specially crafted payloads.
• Exploitation requires specific and uncommon conditions; client-only React applications and those not using frameworks or bundlers supporting React Server Components are not affected.

Impact

• Unauthorized code execution could compromise confidentiality, integrity, and availability of affected systems.
• No user interaction or privileges are required to exploit.
• Attack complexity is low and attack vector is network-based.

Affected / Fixed Versions

• Affected versions include 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0 of the mentioned packages.
• Fixed versions: 19.0.9, 19.1.10, 19.2.9, and 19.3.1.

Recommendations

• Immediately upgrade react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages to the fixed versions listed.

Reference link: https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3

11. JetBrains Multiple Products Critical and High-Severity Vulnerabilities Including Arbitrary Code Execution and Privilege Escalation CVE-2026-123294 (CVSS 9.6)

Overview

• JetBrains has released updates addressing multiple critical and high-severity vulnerabilities across several products.
• Issues include arbitrary code execution, privilege escalation, authentication bypass, cross-site scripting (XSS), session forgery, and improper access controls.
• Notable critical vulnerabilities:
• CVE-2026-123294: JetBrains Hub allows manipulation of email login verification to gain administrative privileges.
• CVE-2026-123279: Datalore permits users with view-only permissions to execute arbitrary code in notebook tasks.
• High-severity flaws include unauthorized REST requests in YouTrack, XSS in IntelliJ IDEA, bypass of two-factor authentication in JetBrains Hub, session forgery in Ktor, and GDB profile vulnerabilities in CLion.

Impact

• Attackers can execute arbitrary code, escalate privileges, bypass authentication, disclose information, and perform unauthorized actions.

Affected / Fixed Versions

• JetBrains Hub: fixed in version 2026.2.52556
• Datalore: fixed in 2026.4 or later
• YouTrack: fixed in 2026.2.19728
• Ktor: fixed in 3.6.1
• IntelliJ IDEA, WebStorm, and CLion: fixed in 2026.3 or applicable 2026.2.4.1 updates
• Junie CLI: fixed in 26.8.24
• Toolbox App: fixed in 3.9

Recommendations

• Update all affected JetBrains products to the specified fixed or later versions immediately to mitigate risk.

Reference link: https://www.jetbrains.com/privacy-security/issues-fixed/

12. IBM API Connect and Aspera Faspex Critical Vulnerabilities Including Remote Code Execution and Authentication Bypass CVE-2026-17402

Overview

• Multiple critical vulnerabilities disclosed affecting IBM API Connect and IBM Aspera Faspex.
• IBM API Connect vulnerabilities include OS command injection, LDAP injection, improper access controls, authentication bypass, use of hard-coded credentials, and path traversal.
• IBM Aspera Faspex affected by an improper authorization vulnerability allowing privilege escalation.

Impact

• Remote code execution via OS command injection.
• Authentication bypass enabling unauthorized access.
• Administrative access to other tenants or full administrative privileges.
• Potential compromise of tenant data and gateway configurations.

Affected / Fixed Versions

• IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected.
• Fixed in IBM API Connect 10.0.8.13 and 12.1.1.3.
• IBM Aspera Faspex versions 5.0.0 through 5.0.19 are affected.
• Fixed in IBM Aspera Faspex 5.0.19 PL1 (Linux).

Recommendations

• Update to the fixed versions or later releases provided by IBM.
• Review and apply security patches promptly to mitigate risks.
• Monitor for suspicious activity related to these vulnerabilities.

Reference links:

• https://www.ibm.com/support/pages/node/7295637
• https://www.ibm.com/support/pages/node/7295635
• https://www.ibm.com/support/pages/node/7295921

13. HPE Morpheus Software VM Essentials Remote Code Execution and Certificate Exposure Vulnerabilities CVE-2026-95778, CVE-2026-95779 (CVSS 8.8)

Overview

• Two high-severity vulnerabilities in HPE Morpheus Software used in VM Essentials allow remote code execution and exposure of confidential certificate information.
• Both require network access and low-level privileges to exploit.
• Vulnerabilities impact confidentiality, integrity, and availability.

Impact

• CVE-2026-95778 enables authenticated attackers with low-level privileges to execute arbitrary code remotely.
• CVE-2026-95779 allows exposure of confidential appliance certificate information, risking system security.

Affected / Fixed Versions

• Affected: HPE Morpheus Software VM Essentials, Advanced, Enterprise, and HPE VME versions 9.0 through prior to 9.0.2.
• Fixed versions: 9.0.2-3 and 9.1.0-2.

Recommendations

• Upgrade all affected HPE Morpheus Software VM Essentials and related deployments to version 9.0.2-3 or later.

Reference link: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbvs05168en_us&docLocale=en

14. USN-9090-1: Apache HTTP Server vulnerabilities

Overview

• Multiple vulnerabilities were discovered in Apache HTTP Server modules including mod_dav, mod_vhost_alias, mod_md, mod_http2, and handling of internal redirects from CGI programs.
• Issues include incorrect memory size calculation, one-byte stack buffer overflow, NULL pointer dereference, heap corruption, and improper handling of internal redirects.
• These vulnerabilities could lead to crashes (denial of service) or arbitrary code execution.

Impact

• Denial of service due to crashes.
• Potential for remote arbitrary code execution in several cases.

Affected / Fixed Versions

• Several vulnerabilities affect Ubuntu 20.04 LTS, 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10.
• Some issues affect only Ubuntu 26.04 LTS and 26.10.

Recommendations

• Apply security updates as provided by Ubuntu to mitigate these vulnerabilities.
• Monitor Apache HTTP Server deployments for suspicious activity related to these vulnerabilities.

Reference link: https://ubuntu.com/security/notices/USN-9090-1

15. USN-9068-1: Debian-LAN vulnerability

Overview

• Debian-LAN’s Kerberos admin server was found to have overly permissive access control lists (ACLs).
• The vulnerability was discovered by Wolfgang Schweer.

Impact

• An authenticated user could exploit this issue to change the credentials of other users.
• This could lead to privilege escalation on affected systems.

Recommendations

• Review and tighten ACL configurations on the Kerberos admin server to restrict unauthorized credential changes.

Reference link: https://ubuntu.com/security/notices/USN-9068-1

16. Rogue Remote-Access Campaign Spread Through ScreenConnect Add-on

Overview

• Attackers accessed multiple cloud-hosted ScreenConnect panels to push commands to managed endpoints.
• At least 288 computers across 48 organizations were infected with attacker-controlled ScreenConnect clients.
• The malicious activity exploited the RMM+ third-party extension that bypasses ScreenConnect’s user accounts, roles, and MFA by authenticating with a shared access key.
• Versions 1.0.31 and 1.0.32 of RMM+ had a default blank key, allowing unauthenticated access.
• The malware replaced legitimate ScreenConnect clients to avoid detection and attempted session cookie theft to move laterally, though the latter attempts failed.

Impact

• Rapid compromise across multiple organizations and hundreds of endpoints.
• Use of legitimate remote management tools for persistence and evasion.
• Abuse of third-party extension vulnerabilities rather than ScreenConnect platform flaws.

Recommendations

• Disable or carefully audit third-party ScreenConnect extensions, especially RMM+.
• Apply security updates and monitor for suspicious remote management activity.
• Investigate any unusual ScreenConnect client behavior or multiple unexpected installations.

Reference link: https://cyberscoop.com/connectwise-screenconnect-sckit-attack/

17. USN-9084-1: Radicale vulnerability

Overview

• Radicale did not delay failed authentication attempts when using htpasswd authentication.
• This flaw could allow a remote attacker to obtain user passwords via timing or brute-force attacks.

Impact

• Potential unauthorized access by recovering user passwords through exploitation of authentication timing.

Recommendations

• Apply available security updates from Ubuntu to mitigate the vulnerability.

Reference link: https://ubuntu.com/security/notices/USN-9084-1

18. New N-able "4EverAble2Shell" zero-day exploited hours after PoC released

Overview

• A critical zero-day vulnerability named "4EverAble2Shell" in N-able N-central is actively exploited.
• At least 21 systems have been compromised, including 19 with the latest security update.
• Attackers deploy cryptocurrency miners on compromised servers.

Impact

• Unauthorized compromise of N-central servers.
• Illicit deployment of cryptocurrency mining malware.

Recommendations

• Monitor for signs of compromise and unauthorized mining activity.
• Apply any forthcoming patches or mitigations from N-able promptly.

Reference link: https://www.bleepingcomputer.com/news/security/new-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released/

19. Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities

Overview

• A critical compromise involving eMudhra Certificate Authorities was uncovered between October 17 and 20, 2026.
• A security researcher demonstrated private keys for eight eMudhra intermediate certificates were broken due to a severe error in their Key Generation Ceremony in April 2025.
• The flaw enables anyone to brute-force obtain these private keys within seconds.
• Cisco’s review indicates only listed products are affected; others are not impacted.
• Additional updates will be provided as new information emerges.

Impact

• Potential unauthorized issuance or misuse of certificates from compromised intermediate CAs, impacting trust and security validation relying on these certificates.

Recommendations

• Review the advisory and affected product list carefully.
• Follow guidance on distrust and mitigation steps for eMudhra root and intermediate certificate authorities.
• Monitor for further updates from Cisco and related security research.

Reference link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-emudhra-info-ScS22A1r?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Informational%20for%20Emergency%20Distrust%20of%20eMudhra%20Root%20and%20Intermediate%20Certificate%20Authorities%26vs_k=1

20. Europol Takes Down 235 Servers and 257 Domains Linked to Gootloader, CastleRAT, and StealC Malware

Overview

• Europol and partners disrupted infrastructure supporting Gootloader, CastleRAT, and StealC malware, targeting cybercrime-as-a-service operations.
• 235 servers and 257 domains were seized, with recovery of 6.4 million victim datasets.
• Gootloader used fake legal documents and search poisoning to deliver malware loaders facilitating ransomware attacks.
• CastleRAT provided remote access capabilities including keylogging, screen capture, and clipboard monitoring.
• StealC focused on password and digital identity theft fueling fraud and follow-on attacks.

Impact

• Disruption affects ransomware and credential theft operations relying on the seized infrastructure.
• Large volume of victim data recovered will aid alerting and victim notification efforts globally.

Recommendations

• WordPress site owners should change credentials, enable multifactor authentication, patch vulnerabilities, remove unknown accounts, and keep systems updated.
• Affected users must secure exposed accounts and systems despite the takedown.

Reference link: https://cybersecuritynews.com/malware-infrastructure-disrupted/

21. International operation dismantles malware networks, exposes 6.4 million stolen credentials

Overview

• Police in nine countries dismantled infrastructure behind three malware kits used for ransomware and data theft.
• The operation, named Operation Endgame, targeted the cybercrime-as-a-service market involving malware kits sold or rented to criminals.
• Participants included agencies from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the UK, the US, Europol, and Eurojust, along with private-sector partners.
• Key malware disrupted includes CastleRAT (a remote access trojan), Gootloader (a dropper spread via hacked WordPress sites), and StealC (a stealer/dropper for credentials).

Impact

• 235 servers and 257 domains seized.
• Identification of 6.4 million victim credentials.
• Gootloader infected at least 25,000 computers worldwide, tied to ransomware attacks on 44 US victims causing $28.8 million in losses.
• Extensive cleanup of 681 infected websites linked to Gootloader.

Recommendations

• WordPress users urged to update credentials, enable multi-factor authentication, and patch vulnerabilities.
• Victim credential data shared with platforms like HaveIBeenPwned, Shadowserver Foundation, and the Dutch National Cyber Security Centre to assist affected users.

Reference link: https://cyberscoop.com/operation-endgame-malware-takedown-gootloader-stealc-europol/

22. Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass

Overview

• Citrix issued patches for multiple critical security vulnerabilities affecting NetScaler ADC, NetScaler Gateway, and NetScaler Console.
• Key critical flaws include a memory overflow vulnerability that can lead to denial-of-service (DoS) or authentication bypass conditions.

Impact

• These vulnerabilities can be exploited to cause DoS or bypass authentication controls, potentially allowing unauthorized access.

Recommendations

• Apply the released security patches from Citrix promptly to mitigate risk.

Reference link: https://thehackernews.com/2026/11/citrix-patches-12-netscaler-and-secure.html

23. nDiligence Releases Four-Year Study Identifying a Critical Supply-Chain Vulnerability Across 50 Platform Types

Overview

• A four-year study by nDiligence reveals a critical vulnerability in runtime client-side rendering used by software and devices across 50 platform types.
• The vulnerability allows attackers to manipulate what users see on screen despite passing all security checks, by exploiting code loaded from multiple layered suppliers.
• This flaw can lead to deceptive alterations such as false data display, stolen input, and unauthorized actions under the user’s authority.
• The risk extends to sectors including web browsers, mobile apps, vehicle displays, medical devices, and industrial control screens.
• The study includes demonstrations, a whitepaper, and remediation playbooks freely available under TLP:CLEAR.
• Researchers warned about this threat since 2024 following an incident involving compromised code in Polyfill.io, emphasizing the lack of existing automated detection tools for such manipulation.

Impact

• Attackers can deceive, disrupt, degrade, deny, or destroy by controlling displayed information and user input without detection.
• This risk threatens trust in critical decision-making software used by governments, infrastructure, media, and other sectors.

Recommendations

• Organizations building, operating, or defending critical software systems should understand and mitigate this vulnerability.
• Collaboration with research and vendors is necessary to close this gap in security and protect the integrity of information displayed via runtime client-side rendering.

Reference link: https://cybersecuritynews.com/ndiligence-releases-four-year-study-identifying-a-critical-supply-chain-vulnerability-across-50-platform-types/

24. Critical Red Hat Quay Vulnerability Allows Unauthenticated Attackers to Hijack Container Registries

Overview

• A critical vulnerability in Red Hat Quay allows unauthenticated attackers to take over token signing by exploiting a flaw in the registry’s key server.
• The vulnerability (CVE-2026-123710) has a CVSS score of 9.8.
• The issue arises because the key rotation endpoint does not verify if the token is intended for key rotation, relying only on JWT signature, audience, and issuer validation.
• Attackers can use anonymous tokens to register their own keys with infinite approval, gaining trust immediately.
• This enables attackers to sign registry tokens for any repository, allowing full read/write access to private container images and the ability to swap repository tags.

Impact

• Compromise of private images potentially exposing secrets stored within.
• Replaced tags can lead to later building and deployment of poisoned images.
• Potential for broad impact across software delivery pipelines relying on Quay.
• Similar vulnerabilities have affected other registries like Gitea.

Affected / Fixed Versions

• Red Hat Quay versions 3 and 5 are affected.
• Only deployments exposing the /keys endpoint to untrusted clients are vulnerable.
• No fixed version has been released yet.

Recommendations

• Restrict access to the /keys endpoint via proxies or load balancers to trusted internal components only.
• Audit logs for service_key_rotate and service_key_delete events with null expiration dates.
• Remove unauthorized approved service keys.
• Maintain access controls on /keys until a patch is available.
• Monitor Red Hat advisories for a released fix.
• Enhance container registry security measures as additional protection.

Reference link: https://cybersecuritynews.com/red-hat-quay-vulnerability/

25. PHP2Shell Exploitation on Check Point Gateway

Overview

• In late October 2026, attackers exploited unpatched Check Point Security Gateways through Mobile Access portals using PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) for initial access.
• Attackers escalated privileges via a local privilege-escalation vulnerability in DynamicCLI (CVE-2026-123039), deployed PHP webshells, and established persistence with TSGA and its embedded TSProxy backdoors.
• The campaign included two waves: an initial destructive wave targeting Israeli organizations, followed by a broader non-destructive wave targeting multiple countries.
• Post initial compromise, attackers moved laterally to VMware ESXi hosts via SSH, deployed the destroy_v6 wiper, and left politically themed notes rejecting ransom demands.

Impact

• Successful unauthorized access and privilege escalation on Check Point Security Gateways.
• Persistent backdoors and command execution capabilities established.
• Lateral movement to ESXi hosts and deployment of destructive wiper malware.
• Data theft, configuration tampering, and potential service disruption.

Affected / Fixed Versions

• Vulnerabilities were exploited shortly after security fixes were released (specific versions not provided).

Recommendations

• Apply available security patches promptly for Check Point Mobile Access portals and DynamicCLI interface.
• Monitor for indicators of compromise such as PHP session artifacts and unusual segmentation faults in Apache/PHP workers.
• Detect and remove PHP webshells and TSGA/TSProxy implants.
• Conduct network-wide scans and audits for lateral movement activities, especially toward ESXi hosts.
• Enhance monitoring and incident response readiness for related destructive malware.

Reference link: https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/

26. Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability

Overview

• A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks allows unauthenticated remote attackers to read sensitive configuration information.
• The issue is due to XML entries being improperly parsed because external entity resolution is enabled by default.
• Exploitation involves sending a crafted XML message to the OCI-P service.

Impact

• An attacker can view sensitive files on the filesystem with the privileges of the Cisco BroadWorks user.

Affected / Fixed Versions

• Cisco has released software updates to address this vulnerability.

Recommendations

• Apply the released software updates promptly.
• No workarounds are available for this vulnerability.

Reference link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20BroadWorks%20Out-of-Band%20Blind%20XML%20External%20Entity%20Injection%20Vulnerability%26vs_k=1

27. New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access

Overview

• N-able is investigating newly disclosed exploits targeting on-premise versions of N-central version 2026.4.1 HF2.
• The vulnerabilities depend on a non-default configuration where the Legacy API is enabled and exposed to the public internet.

Impact

• Exploitation allows attackers to gain root remote code execution (RCE) and Windows SYSTEM-level access on affected servers.

Recommendations

• Disable the Legacy API if it is not required.
• Restrict Legacy API exposure to the public internet.
• Apply any patches or mitigations provided by N-able following their advisory updates.

Reference link: https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html

28. Hackers plant GSocket on Linux servers for persistent access

Overview

• Multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, to establish persistent access on compromised Linux servers.
• They maintain access even after the exploited vulnerabilities used for initial entry are patched.

Impact

• Allows attackers to retain control of affected Linux servers persistently.
• Enables continued unauthorized access despite remediation efforts.

Recommendations

• Monitor and investigate unusual use of legitimate remote access tools like GSocket.
• Employ comprehensive endpoint detection and response strategies to detect persistence mechanisms.
• Regularly audit server environments for unauthorized backdoors or remote access tools.

Reference link: https://www.bleepingcomputer.com/news/security/hackers-plant-gsocket-on-linux-servers-for-persistent-access/

29. The global socket: how threat actors are weaponizing GSocket for stealthy C2

Overview

• Microsoft observed multiple incidents where threat actors deployed GSocket, an open source remote access tool, on compromised Linux servers.
• GSocket enables persistent access even after initial vulnerabilities are patched, by relaying traffic through a public Global Socket Relay Network (GSRN).
• The compromised host and the operator both connect outbound to the relay, avoiding any threat actor-owned IP or domain that defenders can block.
• GSocket disguises its process, uses persistence mechanisms that survive reboot, and stages files in memory-backed directories to evade detection.
• Attack chains typically start with web application remote code execution (RCE), after which GSocket is installed for command and control (C2).
• Privilege escalation attempts using Linux kernel vulnerability CVE-2026-43284 (Dirty Frag) were also observed.
• GSocket clients use a shared secret rather than IP addresses or hostnames to reconnect via the relay, enabling stealthy, resilient access.

Impact

• Persistent remote access to compromised Linux hosts beyond patching of initial vulnerabilities.
• Difficult detection and blocking of C2 traffic due to use of public relay infrastructure and outbound-only connections.
• Significant increase (over 350%) in GSocket-related detections from March to August 2026.
• Affected sectors include education, research, technology, and telecommunications, with exploitation mainly targeting web application hosting environments.

Recommendations

• Patch and harden internet-facing applications, CMS platforms, and plugins.
• Remove unused components and restrict file-upload and administrative endpoints.
• Investigate and remove GSocket clients, persistence mechanisms, and staged files on compromised hosts.
• Monitor and constrain outbound traffic with deny-by-default policies to detect and block communications with the relay infrastructure.
• Do not rely solely on patching the initial web application vulnerability as complete remediation.

Reference link: https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/

30. CVE-2026-0329 PAN-OS: Buffer Overflow Vulnerability (Severity: MEDIUM)

Overview

• A buffer overflow vulnerability has been identified in PAN-OS.
• The severity of this vulnerability is rated as Medium.

Impact

• Buffer overflow vulnerabilities can potentially allow an attacker to execute arbitrary code or cause denial of service.

Recommendations

• Review the advisory for mitigation details and apply any relevant patches or updates provided.

Reference link: https://security.paloaltonetworks.com/CVE-2026-0329

31. CVE-2026-0331 PAN-OS: Sensitive Information Disclosure Vulnerability (Severity: MEDIUM)

Overview

• A medium severity vulnerability has been identified in PAN-OS that results in sensitive information disclosure.

Impact

• Exposure of sensitive information under certain conditions.

Recommendations

• Review and apply vendor security advisories and patches as available.

Reference link: https://security.paloaltonetworks.com/CVE-2026-0331

32. CVE-2026-0323 Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability (Severity: LOW)

Overview

• A server-side request forgery (SSRF) vulnerability was identified in Checkov by Prisma Cloud.
• The vulnerability is rated with low severity.

Impact

• Successful exploitation could allow an attacker to induce the server to make unauthorized requests.

Recommendations

• Apply any available patches or mitigations as directed by Prisma Cloud.
• Follow Prisma Cloud security advisories for updates on the vulnerability.

Reference link: https://security.paloaltonetworks.com/CVE-2026-0323

33. Cisco Identity Services Engine Authorization Bypass Vulnerabilities

Overview

• Multiple vulnerabilities exist in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC).
• Issues stem from lack of server-side validation of Administrator permissions.
• Remote authenticated attackers with valid credentials can exploit these flaws by submitting crafted HTTP requests.
• Exploitation allows modification of configuration parts such as file descriptions on specific pages.

Impact

• Attackers with administrator access can alter configurations, potentially impacting device management integrity.
• Rated as Medium security impact.

Affected / Fixed Versions

• Cisco has released software updates addressing these vulnerabilities.

Recommendations

• Apply the released software updates promptly.
• No effective workarounds exist for these vulnerabilities.

Reference link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-1-MxcTNgwx?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Identity%20Services%20Engine%20Authorization%20Bypass%20Vulnerabilities%26vs_k=1

34. Critical vulnerabilities in N-able N-central prompt hosted shutdown

Overview

• N-able responded to public disclosure of 33 critical vulnerabilities in its N-central remote monitoring and management (RMM) platform.
• Vulnerabilities include unauthenticated remote code execution, privilege escalation, credential disclosure, and unauthorized account creation.
• Exploits combine XML external entity (XXE) flaws, session-handling weaknesses, and patch metadata manipulation.
• Public proof-of-concept code was published; scanning activity detected but no confirmed successful exploitation in customer environments.
• N-central is widely used by managed service providers and enterprise IT teams, making the impact of compromise severe.

Impact

• Remote attackers can execute code as the nable service account or gain root privileges.
• Compromise risks downstream managed environments controlled through the RMM platform.
• Seven CVEs addressing critical issues were patched in an emergency hotfix release.
• Hosted N-central servers across all regions were upgraded by N-able promptly after patch release.

Affected / Fixed Versions

• Vulnerable version tested: N-central Appliance 2026.4.0.31.
• Fixed in N-central 2026.4 Hotfix 2 (build 2026.4.1.26), which addresses seven specific CVEs.

Recommendations

• On-premises N-central servers should be upgraded immediately and kept offline until patched.
• Hosted servers are upgraded by N-able; customers must update Agents and Probes as well.
• Follow vendor compatibility guidance for upgrading Patch Management Engine components.
• Monitor systems for signs of compromise and engage incident response if suspicious activity is detected.
• Use available detection rules and vulnerability checks from Rapid7 and other threat intelligence sources.

Reference link: https://www.rapid7.com/blog/post/etr-critical-vulnerabilities-in-n-able-n-central-prompt-hosted-shutdown

35. U.S. urges critical infrastructure orgs to secure refrigeration systems ASAP after EU supermarket and blood bank attacks

Overview

• Recent cyberattacks on French blood banks and European supermarkets exploited vulnerabilities in industrial refrigeration and cold-chain controllers.
• Attackers are targeting unpatched flaws, misconfigurations, and weak or hard-coded passwords to remotely manipulate temperature controls, causing spoilage of blood, food, and medicines.
• The U.S. Cybersecurity and Infrastructure Security Agency (CISA), FBI, and other agencies have issued a joint advisory urging critical infrastructure sectors to secure these systems immediately.

Impact

• Remote tampering risks compromising essential products dependent on refrigeration, potentially causing public health hazards and supply chain disruptions.
• Temperature manipulation can also trigger fire hazards.
• Notable targeted devices include Danfoss AK-SM and AK-SC series controllers, Copeland, and Dixell XWEB controllers.
• The French government attributed the attacks to Iran, a claim which Iran has denied.

Recommendations

• Implement strong authentication and change default passwords.
• Patch vulnerabilities promptly and replace end-of-life devices.
• Identify and eliminate unnecessary internet-accessible and remote access points.
• Isolate operational technology (OT) systems from business networks.
• Maintain offsite backups.
• Increase asset visibility to prevent lateral movement and prioritize remediation efforts in converged IT/OT environments.

Reference link: https://www.tenable.com/blog/u-s-urges-critical-infrastructure-orgs-to-secure-refrigeration-systems-asap-after-eu

36. Microsoft Fixes RCE Bug in Windows Paint After Weeks of Confusion

Overview

• Microsoft disclosed a remote code execution vulnerability in Microsoft Paint.
• Initial communications about the patch and mitigation were unclear, causing confusion.

Impact

• The vulnerability allows remote code execution, potentially enabling attackers to run arbitrary code on affected systems.

Recommendations

• Apply the official Microsoft security updates for Microsoft Paint once clearly released.
• Follow best practices for patch management and monitor official vendor communications for clarifications.

Reference link: https://www.darkreading.com/application-security/microsoft-rce-bug-windows-paint-confusion

AI SOC

1. Lessons from 59 Linux Kernel Bug Reports: Scaling Vulnerability Discovery with AI at Microsoft FORGE Lab

Overview

• Microsoft’s FORGE Lab conducted an extensive AI-assisted Linux kernel vulnerability research project, scanning core kernel subsystems like networking, filesystems, and security modules.
• Using custom AI tools (codename MDASH) combining Sonnet 4.6 and GPT-5.x models, the team processed 26,502 initial raw findings, filtering down to 621 with proof-of-concept (PoC) reproductions.
• Experts collaborated with maintainers to convert these into 59 public upstream reports with 33 assigned CVEs and 38 patches merged into the Linux mainline kernel.
• AI agents performed raw scanning, fast screening, and PoC generation, while human experts handled validation, root cause analysis, and patch reviews.
• The bulk of bugs were deeply latent, with average age over 8 years; some were over two decades old.

Impact

• Confirmed working local root privilege-escalation exploits for eight CVEs in kernel subsystems.
• AI-enabled scanning and triaging drastically improved scale and efficiency, demonstrating practical AI-human collaboration in vulnerability management for critical open-source software.

Recommendations

• Combine AI-driven code scanning and PoC generation with expert review to improve vulnerability discovery and remediation workflows.
• Continue enhancing AI models and validation pipelines for more accurate filtering and exploitation confirmation.
• Maintain collaboration with upstream maintainers to integrate fixes and remediate legacy vulnerabilities.

Reference link: https://www.microsoft.com/en-us/security/blog/2026/11/11/lessons-from-59-linux-kernel-bug-reports/

AI Threat Landscape

1. Trained to betray: How post-training supply chain attacks hijack coding agents

Overview

• Two Microsoft studies expose post-training supply chain attacks on AI coding and terminal agents: dataset poisoning and model poisoning.
• Dataset poisoning injects crafted examples into fine-tuning data to teach models unsafe conditional behaviors, leading agents to misuse command-execution tools upon benign-seeming triggers.
• Model poisoning involves attackers controlling training to implant reliable backdoors using supervised fine-tuning combined with reinforcement learning.
• Backdoors in agents can trigger unsafe tool invocations affecting code, files, data, credentials, or network resources while returning benign text responses.
• Attack triggers can be ordinary user requests or external content like filenames or code comments, evading prompt-injection defenses.
• Dataset poisoning success measured at approximately 78% on known harnesses, with some transferability; model poisoning success ranges from 84.1% to 94.8% on unseen repositories.
• Attacks exploit trust in training data and model checkpoints, which are difficult to validate for hidden unsafe behaviors.
• Findings highlight risks of using AI agents with autonomous tool execution capabilities in development environments.

Impact

• Compromised AI agents can silently execute malicious commands under normal-looking user queries.
• Potential to execute remote code, modify files, or access sensitive data and credentials.
• Such backdoors can degrade trust in AI-assisted development tooling and amplify supply chain risks.

Recommendations

• Rigorously validate and secure training data pipelines to detect poisoned inputs.
• Enforce provenance checks and deployment-specific evaluations of AI model checkpoints.
• Strictly limit permissions of tools accessible to AI agents.
• Implement external, independent observability and control mechanisms for AI agents beyond model-level assurances.

Reference link: https://www.microsoft.com/en-us/security/blog/2026/11/12/trained-to-betray-how-post-training-supply-chain-attacks-hijack-coding-agents/

2. 9th November – Threat Intelligence Report

Overview

• Queens Public Library and Russian web hosting provider Beget were targeted by ransomware and destructive cyberattacks, respectively.
• OPSSHIELD suffered a supply-chain attack distributing malicious updates to nearly 3,000 servers.
• Ukraine’s Air Alert emergency notification app was compromised to send false alerts; Russia’s emergency app also affected with core systems intact.
• AI-powered threats include ARTEX, an autonomous exploit framework active on over 1,600 systems, harvesting iOS certificates and gaming credentials.
• Haiou jailbreak bundle weakens OpenAI Codex safeguards and installs security features; infrastructure shows links to cybercrime tools.
• India’s CERT identified Crafty Falcon using AI-assisted tools for complex attacks on financial and crypto sectors, exploiting payment APIs and stolen wallet credentials.

Impact

• Disruption of public and cloud services, theft of credentials and sensitive data.
• Active exploitation of vulnerabilities enabling bypass of multi-factor authentication and command injection in enterprise environments.
• AI-enhanced attack automation and tailored exploit generation increasing threat sophistication.

Recommendations

• Patch affected systems promptly including SonicWall SSL VPN services, Android versions 14-17, Barracuda Email Security Gateway appliances, and OpenSSH musl library implementations.
• Monitor for signs of suspicious credential use, malicious update installations, and anomalous alert notifications.
• Enhance network and endpoint defenses to detect and mitigate AI-driven autonomous exploitation frameworks and AI-assisted intrusion attempts.

Reference link: https://research.checkpoint.com/2026/9th-november-threat-intelligence-report/