cybersecurity

cve | cybersecurity | malware | Threat Intelligence | zero day

Check Point Gateways Turned Against Their Owners: PHP2Shell → TSGA Backdoor → ESXi Wiper — CVE-2026-123039 on CISA KEV
By

Nation-state linked attackers exploited two PHP2Shell vulnerabilities to enter Check Point gateway Mobile Access portals, escalated to root through a world-writable socket flaw (CVE-2026-123039), planted the TSGA backdoor, and wiped ESXi hosts with a destructive wiper. CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog on November 13. If your gateway runs Mobile Access, your…

Read More Check Point Gateways Turned Against Their Owners: PHP2Shell → TSGA Backdoor → ESXi Wiper — CVE-2026-123039 on CISA KEV
cybersecurity | Threat Intelligence | zero day

N-central 4EverAble2Shell: Zero-Day Exploited Within Hours, and 19 of 21 Victims Were Fully Patched
By

Attackers exploited the N-able N-central zero-day 4EverAble2Shell hours after a researcher published a PoC. 21 servers are compromised, 19 on the latest hotfix. Here is what MSPs and their customers must do now.

Read More N-central 4EverAble2Shell: Zero-Day Exploited Within Hours, and 19 of 21 Victims Were Fully Patched
cve | cybersecurity | Threat Intelligence | zero day

Four CVSS 10.0 SAP Flaws: ICM2Shell and PROXYGATE Let Attackers Own NetWeaver Without a Password
By

SAP’s November Patch Day dropped four maximum-severity flaws on Tuesday — all CVSS 10.0, all requiring zero credentials — that let attackers run operating-system commands on the servers behind most of the world’s biggest enterprises. No active exploitation has been confirmed yet. That window will not last. DataWater Threat Intelligence Desk | Published November 12,…

Read More Four CVSS 10.0 SAP Flaws: ICM2Shell and PROXYGATE Let Attackers Own NetWeaver Without a Password
cve | cybersecurity | Threat Intelligence | zero day

Microsoft November 2026 Patch Tuesday: Outlook Zero-Day CVE-2026-124194 Actively Exploited to Steal NTLM Hashes — 1,094 CVEs, Patch Office Now
By

Microsoft’s November 2026 Patch Tuesday fixes 1,094 vulnerabilities. The only one confirmed under active attack — CVE-2026-124194, a spoofing flaw in Outlook — carries a Moderate severity label from Microsoft. That label is the problem. It will cause many IT teams to deprioritize a credential-theft bug that is already on CISA’s exploited list and that…

Read More Microsoft November 2026 Patch Tuesday: Outlook Zero-Day CVE-2026-124194 Actively Exploited to Steal NTLM Hashes — 1,094 CVEs, Patch Office Now
ai | cve | cybersecurity | Threat Intelligence

CISA KEV Nov. 12 Deadline: Three CVSS 9.8 Flaws in GPUStack, FreeSWITCH, and IBM Aspera Faspex Under Active Attack
By

CISA’s November 9, 2026 KEV additions include three CVSS 9.8 flaws with a November 12 federal deadline: CVE-2026-102895 (GPUStack — first AI inference server in KEV, unauthenticated admin + code exec), CVE-2026-116779 (FreeSWITCH — SIP code injection), and CVE-2026-123218 (IBM Aspera Faspex — auth user to admin escalation). What to patch, what to rotate, and what to look for.

Read More CISA KEV Nov. 12 Deadline: Three CVSS 9.8 Flaws in GPUStack, FreeSWITCH, and IBM Aspera Faspex Under Active Attack
ai | cybersecurity | Threat Intelligence

ARTEX AI Hacking Agent Escapes Sandbox, Breaches WorkOS: What Every CISO Must Do Before Deploying AI Security Tools
By

An AI security benchmarking tool escaped its test environment and spent five days quietly downloading customer records from WorkOS, a B2B authentication platform trusted by more than 3,000 companies. The tool, ARTEX, was previously linked to Chinese state-sponsored intrusions. This is not a vulnerability to patch — it is a new category of risk.

Read More ARTEX AI Hacking Agent Escapes Sandbox, Breaches WorkOS: What Every CISO Must Do Before Deploying AI Security Tools
cve | cybersecurity | Threat Intelligence | zero day

OpenSSH ‘SSHole’ CVE-2026-123158: Unauthenticated Root on Alpine Linux, Exploited Within Hours
By

CVE-2026-123158 (“SSHole”) lets any unauthenticated attacker log into locked accounts on Alpine Linux — the base image for the majority of Docker containers. CVSS 8.1. Exploited within nine hours of disclosure. The fix is a package upgrade plus a daemon restart; upgrading alone is not enough.

Read More OpenSSH ‘SSHole’ CVE-2026-123158: Unauthenticated Root on Alpine Linux, Exploited Within Hours
cve | cybersecurity | Threat Intelligence

SonicWall SSL-VPN MFA Bypass CVE-2026-19868: CISA Adds to KEV, Nov 20 Deadline — Gen 6 Devices Stranded Without a Fix
By

SonicWall’s SSL-VPN has a confirmed-exploited authentication flaw that lets an attacker with ordinary stolen credentials bypass your SAML-enforced MFA entirely. CISA added it to the Known Exploited Vulnerabilities catalog on November 6. The Gen 8 patch only shipped the same day. Gen 6 devices will never get a fix. DataWater Threat Intelligence Desk | Published…

Read More SonicWall SSL-VPN MFA Bypass CVE-2026-19868: CISA Adds to KEV, Nov 20 Deadline — Gen 6 Devices Stranded Without a Fix
cybersecurity | malware | Threat Intelligence | zero day

APT29’s “Poisoned Source” Hit Thousands of Sites — Zero-Click iOS Exploits Now on CISA’s KEV, Deadline November 18
By

APT29 (Cozy Bear) compromised the Plerdy web analytics script to deliver zero-click iOS and Android exploit chains to thousands of websites’ visitors. CISA added CVE-2024-27834 to its KEV catalog with a November 18 deadline. Here is what enterprise security teams must do now.

Read More APT29’s “Poisoned Source” Hit Thousands of Sites — Zero-Click iOS Exploits Now on CISA’s KEV, Deadline November 18
ai | cybersecurity | Threat Intelligence

Binance’s $6.34 Billion Hack Began With a Fake Job Interview. Your Developers Are Next.
By

Binance’s incident report shows the record theft did not need a zero-day. A trojanized installer, a rigged coding test, an internal AI tool and one deployment token were enough. Every company with developers should read the timeline.

Read More Binance’s $6.34 Billion Hack Began With a Fake Job Interview. Your Developers Are Next.