Daily Security Intelligence Briefing — November 13, 2026
Tier 1 — Priority Targets (Must-Read)
1. Apache Patches Critical HTTP Server RCE Found by Anthropic, Google
Source & Article Link: SecurityWeek
Technical Severity / Domain: Web Infrastructure / CVE-2026-119618 (Critical RCE)
Why You Must Read This: A critical race-condition vulnerability in Apache HTTP Server's mod_http2 module (versions 2.4.55 through 2.4.70) allows unauthenticated remote attackers to trigger heap corruption and execute arbitrary code with the privileges of the httpd process. Discovered by Anthropic's OSS scanner and Google Cloud Vulnerability Research, this flaw impacts any public-facing Apache server with HTTP/2 enabled. Because Apache httpd underpins a massive portion of global web infrastructure, unauthenticated RCE in a core module represents a systemic risk requiring immediate remediation.
Recommended Immediate Action: Upgrade Apache HTTP Server to version 2.4.71 (or mod_h2 to 2.0.43+) immediately, or disable the HTTP/2 protocol (mod_http2) as a temporary workaround.
2. Hackers compromise 4,800 GitHub accounts to steal cloud credentials
Source & Article Link: BleepingComputer
Technical Severity / Domain: Supply Chain & Cloud / Mass Exploitation ('wfx-loot' Campaign)
Why You Must Read This: A massive automated campaign dubbed 'wfx-loot' leveraged 4,837 compromised GitHub accounts to probe 61,764 repositories, open malicious pull requests, and execute CI secret-stealing malware across more than 1,800 repositories. The operation relies on automated abuse of stolen tokens to harvest CI/CD and cloud credentials at ecosystem scale. Any organization utilizing GitHub Actions or automated build pipelines that process untrusted pull requests faces immediate risk of cloud environment compromise.
Recommended Immediate Action: Audit GitHub repository logs for unauthorized pull requests or workflow executions, restrict GitHub Actions permissions for forked PRs, and rotate any CI/CD and cloud secrets exposed to build environments.
Tier 2 — Essential Intelligence (Summaries & Analysis)
1. Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files
Domain: Network Security / Active Exploitation
Subject / Topic Summary: Threat actors are chaining the PHP2Shell vulnerabilities with a newly patched Gaia OS local privilege escalation zero-day (CVE-2026-123039) to gain root access on Check Point Security Gateways. Active since late October against Israeli and global targets, the attackers deploy the 'TSGA' backdoor and execute destructive wipers against connected VMware ESXi environments.
Key Technical & Strategic Takeaways: Initial access relies on PHP2Shell flaws, followed by CVE-2026-123039 (CVSS 7.8) for root privilege escalation.; Attackers are deploying the TSGA backdoor for persistence and wiping ESXi host files.; Apply Check Point emergency hotfixes (such as R82.20 Take 14) immediately and audit gateways for unauthorized root modifications.
Essential Direct Quote: An unknown threat actor has been observed targeting unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously unreported local privilege escalation flaw in Gaia OS to deploy a backdoor called TSGA.
Source: The Hacker News
2. Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2
Domain: Endpoint & RMM Security / Zero-Day
Subject / Topic Summary: Attackers began exploiting a new zero-day chain in N-able N-central dubbed '4EverAble2Shell' within hours of a public proof-of-concept release. The exploit chains an Apache Axis flaw (CVE-2026-90436) with an unauthenticated privilege escalation bug when the Legacy API is active, compromising at least 21 servers—19 of which already had N-able's latest Hotfix 2 installed.
Key Technical & Strategic Takeaways: Exploitation grants unauthenticated root access and has been used to deploy XMRig cryptocurrency miners.; 19 of the 21 compromised servers were already running the recent Hotfix 2 update.; Administrators must immediately disable the N-central Legacy API, update Agents and Probes, and hunt for unauthorized accounts and miners.
Essential Direct Quote: N-able on Thursday said it's taking additional precautions in the wake of public disclosure of a new set of flaws tracked as 4EverAble2Shell and Agent2Shell.
Source: The Hacker News
3. New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access
Domain: Endpoint Security / Zero-Day
Subject / Topic Summary: Security researcher Abdelhamid Naceri (Nightmare Eclipse) released public proof-of-concept code for 'SignDrop', a Windows zero-day local privilege escalation vulnerability. The exploit abuses a log-authentication feature in the Common Log File System (clfs.sys) driver and Windows Defender to trigger arbitrary file creation in the context of the antimalware process, granting SYSTEM privileges.
Key Technical & Strategic Takeaways: Abuses path redirection when a privileged process like Windows Defender opens a specially prepared CLFS log.; Targets a security feature added to clfs.sys last year to prevent log tampering.; Monitor for anomalous CLFS log creation and path redirection techniques until Microsoft issues an official patch.
Essential Direct Quote: It abuses how clfs.sys creates companion files when a privileged process opens a prepared log, using path redirection to take control of file creation.
Source: The Hacker News
4. Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry
Domain: Container & Supply Chain Security
Subject / Topic Summary: Red Hat patched a critical vulnerability (CVE-2026-123710, CVSS 9.8) in Red Hat Quay where the key server accepts an anonymous /v2/auth token to plant an attacker-controlled signing key. This allows attackers to read, overwrite, or poison private container images across every repository in a reachable registry.
Key Technical & Strategic Takeaways: Quay enables anonymous access by default, allowing unauthenticated exploitation; even with anonymous access disabled, any valid account can exploit it.; Impacts all Quay 3 and 5 builds, posing a severe container supply chain poisoning risk.; Upgrade to the fixed Red Hat Quay builds immediately and audit registry signing keys for unauthorized entries.
Essential Direct Quote: A critical flaw in Red Hat Quay allows an attacker who can access a Quay registry to read and overwrite private container images in every repository.
Source: The Hacker News
5. Palo Alto tracks a massive Chinese AI attack that sadly lives up to industry fears
Domain: Threat Intelligence & AI Security
Subject / Topic Summary: Palo Alto Networks Unit 42 documented a China-based threat actor weaponizing the open-source AI penetration testing framework 'Cairn' paired with Zhipu GLM and DeepSeek models. The attackers conducted 25 autonomous operations against 19 organizations in the defense, semiconductor, and civil society sectors, successfully breaching or exfiltrating data from 10 targets.
Key Technical & Strategic Takeaways: Attackers achieved initial access and data exfiltration at 10 organizations often by providing only a target domain and a one-line prompt.; Meanwhile, SOCRadar mapped 916 live, exposed consoles for the ARTEX autonomous AI pentesting framework across U.S. commercial hosting.; Defenders must prepare for machine-speed reconnaissance and lateral movement by tightening perimeter defenses and detecting automated script execution.
Essential Direct Quote: Palo Alto Networks Unit 42 is reporting today that it has tracked a massive China-based attack leveraging the open-source AI penetration testing framework Cairn to autonomously conduct 25 operations against at least 19 organizations.
Source: CSO Online
6. SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths
Domain: MSP & RMM Security
Subject / Topic Summary: An active campaign targeting ConnectWise ScreenConnect has compromised at least 288 endpoints across 48 organizations within 90 minutes. Researchers at Huntress and Blackpoint Cyber report that attackers are abusing third-party plugins and a critical authentication flaw (CVE-2026-84869, CVSS 9.9) to deploy 'SCKit', a worm-like toolkit that spreads from customer devices to MSP technician consoles.
Key Technical & Strategic Takeaways: SCKit hijacks support sessions to pivot from infected client machines directly to MSP administrator endpoints.; ConnectWise has forcibly disabled several third-party plugins across customer environments to contain the spread.; Ensure ScreenConnect instances are patched against CVE-2026-84869 and audit all installed extensions and rogue remote-management instances.
Essential Direct Quote: A new worm-like malware toolkit named SCKit was deployed in the recent ScreenConnect attacks targeting managed service providers (MSPs), designed to spread from infected customer devices to MSP technicians' computers and compromise additional managed networks.
Source: The Hacker News
7. Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass
Domain: Network & Perimeter Security
Subject / Topic Summary: Citrix released security updates addressing multiple critical vulnerabilities across NetScaler ADC, NetScaler Gateway, and NetScaler Console, alongside 10 flaws in XenServer. The advisories are led by CVE-2026-120868 (CVSS 9.3), a packet engine memory overflow enabling authentication bypass or DoS, and CVE-2026-107412 (CVSS 9.5).
Key Technical & Strategic Takeaways: CVE-2026-120868 impacts default NetScaler setups and can lead to authentication bypass or denial of service.; Citrix XenServer was also patched for CVE-2026-102705, allowing unauthenticated host compromise via the management network, plus AMD CPU microcode flaws.; Upgrade NetScaler ADC/Gateway to 14.1-73.58+ / 13.1-64.39+ and NetScaler Console to 14.1-74.34+ immediately.
Essential Direct Quote: Citrix has released patches for multiple critical security flaws impacting NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console that could lead to denial-of-service (DoS) or an authentication bypass.
Source: The Hacker News
8. PostgreSQL security update fixes 52 vulnerabilities, ends support for PostgreSQL 14
Domain: Database Security
Subject / Topic Summary: The PostgreSQL Global Development Group released versions 18.7, 17.12, 16.16, 15.20, and 14.25 to remediate 52 security vulnerabilities, including 32 code execution flaws. The headline bug, CVE-2026-6460 (CVSS 8.8), is a 22-year-old type confusion flaw exploitable via prepared statements by any authenticated user.
Key Technical & Strategic Takeaways: Most of the 52 patched vulnerabilities involve memory errors or type confusion in PL/Perl, PL/Tcl, text search, and parallel queries.; CVE-2026-6460 allows authenticated network users to achieve remote code execution.; PostgreSQL 14 has officially reached end-of-life with version 14.25; administrators must upgrade to supported branches.
Essential Direct Quote: The PostgreSQL Global Development Group released PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25 on November 12, fixing 52 security vulnerabilities and more than 140 other bugs.
Source: Help Net Security
9. NvRoot (CVE-2026-47591) where in neocloud multi-tenant GPU environments, rent = root
Domain: Cloud & Hardware Security
Subject / Topic Summary: Researchers at Stealthium detailed two Linux kernel-mode NVIDIA GPU driver vulnerabilities, NvRoot (CVE-2026-47591) and ForgePtr (CVE-2026-47501), which allow unprivileged users to escalate to root. NvRoot acts as a dirty page cache local privilege escalation using the GPU as a catalyst, enabling tenants on shared GPU nodes to overwrite read-only shared files.
Key Technical & Strategic Takeaways: Critically impacts multi-tenant 'neocloud' AI environments where multiple customers share underlying GPU hardware.; No sysctl or seccomp workarounds exist for NvRoot.; Ensure NVIDIA GPU drivers are updated to fixed versions 610.57.04, 595.91.07, or 580.178.04.
Essential Direct Quote: NvRoot a bit more direct, lets any tenant on a shared GPU node rewrite files it can read, including files it shares with the host.
Source: Technical Information Security Content & Discussion
10. Synology shipped 27 fixes across two advisories — SA-26:19 and SA-26:18
Domain: Storage & Enterprise Hardware
Subject / Topic Summary: Synology patched 27 vulnerabilities across DiskStation Manager (DSM) in advisories SA-26:18 and SA-26:19. The most severe flaw is CVE-2026-76954 (CVSS 9.8), an unauthenticated pre-auth SQL injection in the Auth API that allows arbitrary file read and write without user interaction.
Key Technical & Strategic Takeaways: Includes an unauthenticated rsync auth bypass (CVSS 8.6), three CVSS 8.8 flaws in SSOAuth/Sharing API/Auth API, and an OTP bypass (CVSS 8.1).; Synology states no workarounds exist for CVE-2026-76954.; Apply the latest DSM updates immediately and restrict external network access to Synology management interfaces.
Essential Direct Quote: The headline: CVE-2026-76954, CVSS 9.8, pre-auth SQL injection in the Auth API. Arbitrary file read/write, no credentials, no user interaction.
Source: #infosec
11. Trained to betray: How post-training supply chain attacks hijack coding agents
Domain: AI & Application Security
Subject / Topic Summary: Microsoft Security published research detailing how post-training supply chain attacks—via dataset and model poisoning—can implant persistent backdoors in coding agents. Simultaneously, Corelight researchers warned that 'pinned' Model Context Protocol (MCP) servers silently drifted through 15 different dependency sets over five weeks, changing 23 of 69 packages including cryptography and JWT libraries.
Key Technical & Strategic Takeaways: Poisoned models can teach coding agents to autonomously discover and misuse local tools while transferring backdoors across fine-tuning.; Pinned MCP server releases can still pull unpinned transitive dependencies at runtime, creating a stealthy supply chain vector.; Enforce strict dependency lockfiles, sandbox agent execution environments, and validate model provenance.
Essential Direct Quote: As organizations increasingly deploy specialized AI agents, trust cannot depend solely on a model behaving as expected.
Source: Microsoft Security Blog
12. Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure
Domain: Threat Intelligence & Law Enforcement
Subject / Topic Summary: In the latest phase of Operation Endgame, Europol and law enforcement across nine countries seized 235 servers and 257 domains supporting the Gootloader, CastleRAT, and StealC malware operations. Separately, Operation TorNado resulted in the arrest of 354 dark web vendors and buyers across 14 countries.
Key Technical & Strategic Takeaways: Investigators recovered 6.4 million stolen victim credentials from the dismantled StealC, CastleRAT, and Gootloader infrastructure.; German and Dutch authorities traced rebuilt StealC servers to the previously seized Virtualine bulletproof host.; Operation TorNado targeted users of offline dark web markets including Archetyp, Bohemia, Nemesis, Kingdom, and Tor2Door.
Essential Direct Quote: Investigators seized 235 servers and 257 domains, along with 6.4 million victim credentials as part of Operation Endgame.
Source: SecurityWeek
13. US seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance
Domain: Nation-State & Cybercrime
Subject / Topic Summary: The U.S. Department of Justice and FBI announced the court-authorized seizure of $1.2 billion in cryptocurrency stolen from Binance by North Korean state hackers. Additionally, authorities disrupted 'FaceStealer', a DPRK social engineering campaign that stole $400 million over 18 months by luring crypto workers into fake Zoom and Teams calls populated with 900+ stolen webcam recordings of prior victims.
Key Technical & Strategic Takeaways: FaceStealer uses real webcam footage of compromised victims to make fraudulent video calls appear legitimate before deploying malware.; Material Security separately reported tracking 27 suspected DPRK fake IT worker personas that successfully reached corporate onboarding over the past year.; Crypto, Web3, and open-source maintainers should verify video call invites out-of-band and tighten HR identity verification during remote onboarding.
Essential Direct Quote: North Korean state hackers have stolen more than $400 million in cryptocurrency over the past 18 months by pulling targets into fake Zoom and Teams calls filled with webcam footage of earlier victims.
Source: CyberScoop
14. Massive Microsoft 365 outage disrupts Outlook, Teams, Copilot worldwide
Domain: Cloud Resilience & Operations
Subject / Topic Summary: A widespread Microsoft 365 outage lasting over five hours disrupted Exchange Online, Outlook, Teams, Copilot, and Defender portals globally on Thursday. Microsoft attributed the incident to servers failing health checks and becoming unresponsive under traffic load, while security teams warn of opportunistic phishing and the end-of-support 'permanently vulnerable' status for on-prem Exchange 2016 and 2019.
Key Technical & Strategic Takeaways: Microsoft paused all global deployments and configuration changes while investigating why healthy servers collapsed upon receiving traffic.; Microsoft also confirmed that November Patch Tuesday updates are causing Windows activation failures (error 0x80041008) and SQL Server performance issues.; Exchange Server 2016 and 2019 received no November patches as Microsoft warns they are now 'permanently vulnerable' compared to Subscription Edition.
Essential Direct Quote: While the servers we've returned to service initially remain healthy, we've observed that they can become unresponsive again once they begin receiving traffic.
Source: BleepingComputer
15. Critical Enterprise Patch Roundup: MongoDB, ManageEngine, Red Hat, Mitel, and Gradle
Domain: Vulnerability Management
Subject / Topic Summary: Multiple enterprise vendors released critical security patches over the last 24 hours addressing pre-authentication RCE, sandbox escapes, and authentication bypasses. Key disclosures include a pre-auth use-after-free in MongoDB replication (CVE-2026-118383, CVSS 9.5) and a critical flaw in ManageEngine M365 Manager Plus (CVE-2026-12591, CVSS 9.9).
Key Technical & Strategic Takeaways: MongoDB CVE-2026-118383 allows unauthenticated node crashes or RCE in replica sets and shards; fixed in 6.0.30, 7.0.48, and 8.0.37.; Red Hat patched a CVSS 9.6 sandbox bypass in Satellite (CVE-2026-107360), while Mitel fixed a CVSS 9.4 auth bypass in MiVoice MX-ONE (8.2 SP1 HF2).; Gradle 9.9.1 and 8.14.7 remediate a CVSS 9.3 version catalog code injection flaw that executes during builds and IDE syncs.
Essential Direct Quote: CVE-2026-118383 (CVSS 9.5): pre-auth use-after-free in MongoDB replication. Unauthenticated requests crash a node when a newly elected primary completes catch-up; RCE possible in some cases.
Source: #cve
16. Apple details Secure Exclaves, isolated runtimes for camera and microphone data
Domain: Mobile & Endpoint Architecture
Subject / Topic Summary: Apple published architectural details on 'Secure Exclaves', hardware-isolated execution environments designed to process sensitive camera and microphone data in the background without exposing it to the main OS, apps, or Apple. Alongside this, Google and Mozilla patched over 180 vulnerabilities in Chrome 157 and Firefox 160, and Apple patched iMessage, Bluetooth, and Brotli flaws in iOS 27.2.1.
Key Technical & Strategic Takeaways: Secure Exclaves isolate background data processing for features like HomeView person recognition, Siri Recap, and Live Rewind.; Apple released iOS 27.2.1 patching CVE-2026-113961 and CVE-2026-111497 in iMessage, Bluetooth, and Brotli.; Chrome 157 (83 fixes) and Firefox 160 (99 fixes) should be deployed across enterprise endpoints.
Essential Direct Quote: Apple says data processed and analyzed within Secure Exclaves cannot be accessed by the main operating system, apps, or the company itself.
Source: Help Net Security