Daily Security Intelligence Briefing — November 14, 2026
Tier 1 — Priority Targets (Must-Read)
1. FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’
Source & Article Link: The Record from Recorded Future News
Technical Severity / Domain: AI & Offensive Cyber / CRITICAL (Ecosystem-Wide)
Why You Must Read This: The FBI, Cisco Talos, AWS, and Cloudflare warn that open-source agentic AI penetration testing frameworks—led by ARTEX and expanding to over 50 distinct framework families—are automating full attack chains in the wild. These autonomous agents chain reconnaissance, vulnerability exploitation, and lateral movement, compressing intrusion timelines from initial targeting to privileged access to under three hours. Cloudflare observed over 50 framework families scanning global customer infrastructure within a three-day window, fundamentally shifting the speed and scale of automated threat operations.
Recommended Immediate Action: Update WAF and bot-detection rulesets to identify high-velocity agentic scanning patterns, enforce strict API rate limiting, and audit identity and privilege boundaries to contain rapid lateral movement.
2. New Mior and Skyfall Attacks Let Rogue Cloud Hosts Steal Secrets From AMD SEV-SNP VMs
Source & Article Link: The Hacker News
Technical Severity / Domain: Cloud & Hypervisor / HIGH (Architectural Break)
Why You Must Read This: Researchers from ETH Zurich and Google disclosed two attacks, Mior and Skyfall, that break the core isolation guarantees of AMD SEV-SNP confidential virtual machines. Mior allows a rogue hypervisor and BIOS to read and write encrypted VM memory and forge cryptographic attestation reports, while Skyfall uses timing side channels to recover register values and disk-encryption keys. Because both attacks operate within AMD's defined threat model for confidential computing, they undermine hardware-enforced cloud tenant isolation across major cloud providers.
Recommended Immediate Action: Apply latest AMD firmware and microcode updates across host fleets, verify hardware root-of-trust attestation chains, and evaluate secondary encryption layers for highly sensitive workloads in multi-tenant cloud environments.
Tier 2 — Essential Intelligence (Summaries & Analysis)
1. Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper
Domain: Network & Hypervisor Security
Subject / Topic Summary: Threat actors are exploiting Check Point Security Gateways via PHP2Shell (CVE-2026-109618, CVE-2026-109619) and a newly added CISA KEV privilege escalation flaw (CVE-2026-123039, CVSS 7.8) to plant web shells and gain root access. Initially targeting Israeli organizations, attackers pivot from compromised perimeter gateways to deploy data-wiping malware directly onto internal VMware ESXi hypervisors.
Key Technical & Strategic Takeaways: Apply emergency Check Point hotfixes for CVE-2026-123039 before the November 16 CISA KEV deadline and ensure PHP packages are updated to remediate PHP2Shell.; Isolate ESXi management interfaces from perimeter gateway subnets and audit Check Point appliances for unauthorized PHP web shells planted since October 30.
Essential Direct Quote: Vulnerable Check Point Security Gateway instances have been targeted in PHP2Shell attacks that deployed data-wiping malware on VMware ESXi hosts.
Source: BleepingComputer
2. SCKit abuses ScreenConnect to deploy remote access and target technician sessions
Domain: Endpoint & MSP Security
Subject / Topic Summary: Microsoft and ConnectWise warned of an active campaign starting November 11 where attackers exploit a critical flaw (CVE-2026-84869) in cloud-hosted ConnectWise ScreenConnect instances belonging to MSPs. The threat actors deploy SCKit malware to hijack active technician support sessions and establish persistent remote access across downstream customer environments.
Key Technical & Strategic Takeaways: Verify cloud-hosted and on-premises ScreenConnect instances are patched against CVE-2026-84869 immediately.; Audit MSP technician session logs for anomalous remote execution and hunt for SCKit indicators of compromise.
Essential Direct Quote: Beginning on November 11, 2026, ConnectWise reported an active campaign of a threat actor gaining unauthorized access to cloud-hosted ConnectWise ScreenConnect instances belonging to managed service providers.
Source: Microsoft Security Blog
3. PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE
Domain: Database Security
Subject / Topic Summary: PostgreSQL released versions 17.6, 16.10, and 15.14 to patch 52 vulnerabilities, headlined by CVE-2026-6460 (CVSS 8.8), a 22-year-old type confusion bug. The flaw allows any authenticated database user with CREATE privileges to execute arbitrary code under the operating system account running the PostgreSQL server.
Key Technical & Strategic Takeaways: Upgrade PostgreSQL instances to 17.6, 16.10, or 15.14 and rebuild all installed C-language extensions to achieve full remediation.; Restrict object creation privileges (CREATE) to trusted administrative roles until patching and extension recompilation are complete.
Essential Direct Quote: Full protection from this flaw also requires rebuilding any C-language extensions installed on the server.
Source: The Hacker News
4. Windows 0-day dropped by disgruntled researcher hands hackers System rights
Domain: Endpoint & OS Security
Subject / Topic Summary: A researcher operating under the pseudonym Nightmare Eclipse publicly disclosed 'SignDrop,' an unpatched Windows zero-day vulnerability in the Common Log File System (CLFS). The flaw allows local attackers to escalate privileges and obtain full SYSTEM rights on affected Windows installations.
Key Technical & Strategic Takeaways: Monitor endpoint detection telemetry for abnormal process interactions with the Windows Common Log File System (CLFS).; Enforce strict least-privilege access controls to limit local foothold opportunities while awaiting an official Microsoft patch.
Essential Direct Quote: On Tuesday, Nightmare Eclipse disclosed SignDrop, a vulnerability that gives local users full System rights on some versions of Windows.
Source: Ars Technica - All content
5. Thousands of GitHub repos hit with secret-stealing malware
Domain: Supply Chain & DevSecOps
Subject / Topic Summary: Aikido Security uncovered a massive campaign utilizing 4,837 hijacked GitHub accounts to open malicious probe pull requests across 61,764 repositories. The secret-stealing payload successfully executed in at least 1,806 repositories, exfiltrating CI/CD secrets and cloud credentials.
Key Technical & Strategic Takeaways: Disable automatic execution of GitHub Actions workflows triggered by pull requests from external forks.; Rotate CI/CD tokens and cloud credentials immediately if repositories processed unauthorized pull requests recently.
Essential Direct Quote: The payload executed in at least 1,806 repos, exfiltrating CI/CD secrets and cloud credentials.
Source: CSO Online
6. Adapting to AI penetration testing orchestrators: The Modern Security Model
Domain: Application & Cloud Security
Subject / Topic Summary: Cloudflare details the rapid proliferation of LLM-driven penetration testing orchestrators, noting a surge from a single framework (ARTEX) to over 50 distinct framework families scanning customer assets within days. The analysis outlines architectural defenses needed to counter machine-speed reconnaissance and automated exploit chaining.
Key Technical & Strategic Takeaways: Shift defensive posture from static signature matching to behavioral analysis capable of spotting automated multi-step probing.; Deploy deception mechanisms and strict egress/ingress controls to disrupt autonomous agent feedback loops.
Essential Direct Quote: In just the last three days, we have seen over 50 framework families attempt to scan Cloudflare customers globally.
Source: The Cloudflare Blog
7. Amazon Threat Intelligence observes threat actors running cybercrime campaigns with ARTEX AI agents
Domain: Threat Intelligence
Subject / Topic Summary: Between October 3 and November 5, 2026, Amazon's MadPot decoy sensors captured requests from threat actors operating the open-source ARTEX AI framework. Because MadPot sensors emulated popular LLM inference endpoints, Amazon was able to intercept the agents' operating memory and analyze live offensive campaign workflows.
Key Technical & Strategic Takeaways: Monitor network traffic for unauthorized outbound connections to external or unverified LLM inference APIs.; Review Amazon Threat Intelligence indicators to detect ARTEX agent reconnaissance and exploitation patterns.
Essential Direct Quote: From Oct. 3 to Nov. 5, 2026, Amazon’s MadPot, a globally distributed network of decoy threat sensors, captured requests from AI agents that included operating memory from offensive campaigns that threat actors ran on ARTEX.
Source: AWS Security Blog
8. ARTEX and beyond: AI-enabled penetration testing platforms
Domain: Threat Intelligence
Subject / Topic Summary: Cisco Talos reports growing in-the-wild abuse of AI-enabled red team frameworks that automate reconnaissance, vulnerability testing, and post-exploitation. These tools significantly lower the technical barrier for threat actors while accelerating the end-to-end intrusion lifecycle.
Key Technical & Strategic Takeaways: Reduce patch remediation windows, as AI agents can rapidly identify and exploit unpatched perimeter flaws within hours.; Implement network segmentation to prevent automated post-exploitation scripts from moving laterally.
Essential Direct Quote: Talos has seen full automation of the attack chain by these frameworks.
Source: Cisco Talos Blog
9. Citrix Patches Critical NetScaler Flaws Allowing Authentication Bypass and Denial of Service
Domain: Network Security
Subject / Topic Summary: Citrix released security updates addressing 31 vulnerabilities across NetScaler ADC, NetScaler Gateway, and NetScaler Console. The patches fix a critical unauthenticated authentication bypass and multiple memory corruption flaws that could lead to unauthorized access or denial of service.
Key Technical & Strategic Takeaways: Prioritize patching internet-facing NetScaler ADC and Gateway appliances to block unauthenticated authentication bypass.; Audit active sessions and configuration files on NetScaler devices for signs of pre-patch compromise.
Essential Direct Quote: Citrix patched 31 vulnerabilities across NetScaler ADC, Gateway, and Console, including a critical authentication bypass and multiple memory corruption flaws.
Source: #infosec
10. Siemens Patches Critical Desigo and Gridscale Flaws Following CISA Exploitation Warning
Domain: OT & ICS Security
Subject / Topic Summary: Siemens addressed an actively exploited CVSS 9.8 vulnerability in Desigo CC and Gridscale X products triggered by crafted Brotli-compressed data, alongside critical PHP2Shell RCE flaws (CVE-2026-109618, CVE-2026-109619) affecting Energy Engage and Spectrum Power. Unauthenticated remote attackers can exploit these flaws to execute arbitrary code across building automation and energy management systems.
Key Technical & Strategic Takeaways: Update Siemens Desigo CC, Gridscale X, Energy Engage, and Spectrum Power deployments to the latest patched releases immediately.; Restrict network access to OT/ICS management interfaces and monitor for anomalous Brotli-compressed payloads.
Essential Direct Quote: Siemens patched a critical CVSS 9.8 vulnerability in its Desigo CC and Gridscale X products that is currently being exploited in the wild.
Source: #infosec
11. Trezor confirms crypto-stealing implants in three wallets, releases fix
Domain: Hardware & Supply Chain Security
Subject / Topic Summary: Hardware wallet manufacturer Trezor confirmed that three Safe 5 devices purchased through Southeast Asian reseller CryptoBilis contained malicious hardware implants. The extra circuit board reads recovery phrases directly off the device screen and exfiltrates them over cellular networks to attacker-controlled servers.
Key Technical & Strategic Takeaways: Procure cryptographic hardware and security keys exclusively from original manufacturers rather than third-party resellers.; Apply Trezor's latest firmware update and migrate funds to a new seed phrase if a device was sourced from unverified channels.
Essential Direct Quote: Trezor has confirmed that three Safe 5 devices sold by Southeast Asian reseller CryptoBilis contained malicious hardware implants designed to steal wallet recovery phrases and send them to attackers over cellular networks.
Source: BleepingComputer
12. Now exploited in the wild: CVE-2026-75650 Adobe Commerce / Magento Open Source
Domain: Application Security
Subject / Topic Summary: CISA added two actively exploited vulnerabilities in Adobe Commerce and Magento Open Source to its KEV catalog: CVE-2026-75650 (template-engine injection leading to RCE) and CVE-2026-71362 (incorrect authorization leading to privilege escalation). CISA also added active exploitation warnings for UnrealIRCd (CVE-2026-114713) and Roundcube Webmail (CVE-2025-68461).
Key Technical & Strategic Takeaways: Apply Adobe security patches APSB26-146 and APSB26-92 to all Magento and Adobe Commerce installations immediately.; Update exposed UnrealIRCd servers and Roundcube Webmail instances to mitigate active in-the-wild exploitation.
Essential Direct Quote: Now exploited in the wild: CVE-2026-75650 Adobe Commerce / Magento Open Source: Template-engine injection leading to code execution (APSB26-146).
Source: #infosec
13. CVE-2026-119618: Critical Apache HTTP/2 Flaw Could Let Attackers Take Over Web Servers
Domain: Web & Infrastructure Security
Subject / Topic Summary: Apache released a patch for CVE-2026-119618, a critical vulnerability in Apache HTTP Server affecting deployments with the HTTP/2 protocol enabled. The flaw allows unauthenticated remote attackers to take control of vulnerable web servers.
Key Technical & Strategic Takeaways: Upgrade Apache HTTP Server to the latest patched version released on November 11.; If immediate patching is not feasible, temporarily disable the HTTP/2 module on exposed Apache servers as a workaround.
Essential Direct Quote: A critical flaw in Apache HTTP Server, one of the most widely used pieces of web server software in the world, could let an attacker on the internet take control of a company's web server without logging in.
Source: #infosec
14. SAP patched four CVSS 10.0 vulnerabilities in November 2026
Domain: Enterprise Application Security
Subject / Topic Summary: SAP's November 2026 security patch day addressed four maximum-severity (CVSS 10.0) vulnerabilities, including CVE-2026-120017 impacting SAP NetWeaver and SAP Web Dispatcher. Unpatched instances face complete system compromise without authentication.
Key Technical & Strategic Takeaways: Deploy SAP's November 2026 security notes across all NetWeaver and Web Dispatcher environments immediately.; Ensure SAP management ports and Web Dispatcher administrative interfaces are not unnecessarily exposed to the public internet.
Essential Direct Quote: SAP patched four CVSS 10.0 vulnerabilities in November 2026.
Source: #cve
15. FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls
Domain: Threat Intelligence & Fraud
Subject / Topic Summary: The FBI revealed that DPRK threat actors stole over $400 million in cryptocurrency over the past 18 months through a social engineering campaign codenamed FaceStealer. Attackers use real-time deepfake video calls to impersonate trusted contacts or executives during technical meetings, tricking targets into executing malicious payloads.
Key Technical & Strategic Takeaways: Establish out-of-band verification protocols for high-value financial transactions and software installations requested during video calls.; Train engineering and finance teams to recognize deepfake artifacts and social engineering pretexts involving urgent meeting troubleshooting.
Essential Direct Quote: The U.S. Federal Bureau of Investigation (FBI) has established that threat actors tied to the Democratic People's Republic of Korea (DPRK aka North Korea) have stolen more than $400 million worth of cryptocurrency as part of a social engineering scheme codenamed FaceStealer.
Source: The Hacker News
16. How one AI agent exposed five critical enterprise security gaps
Domain: AI Security & Governance
Subject / Topic Summary: Token Security demonstrated how an enterprise AI agent designed for automated invoice processing can be hijacked via indirect prompt injection in a malicious email to alter vendor bank details without triggering legacy security alerts. Meanwhile, Microsoft researchers detailed 'Trained to Betray' post-training supply chain attacks that embed backdoors into coding agents.
Key Technical & Strategic Takeaways: Enforce human-in-the-loop approval for high-risk AI agent actions such as modifying payment routing or executing privileged code.; Treat external inputs processed by AI agents as untrusted data and audit model weights and fine-tuning pipelines for supply chain tampering.
Essential Direct Quote: An AI agent built to automate invoice processing could be manipulated into changing vendor bank details through a malicious email, without triggering traditional security alerts.
Source: BleepingComputer
17. Researchers continue to find serious vulnerabilities in internet connected refrigerators
Domain: IoT & OT Security
Subject / Topic Summary: Following recent hacking incidents targeting commercial refrigeration units in the US and Europe, VulnCheck disclosed 14 serious vulnerabilities in Copeland Dixell XWEB EVO controllers, including unauthenticated root access. Simultaneously, researchers observed GeoVision camera software (GeoStartupAgentService.exe) being abused with SYSTEM privileges to deploy XMRig cryptominers across 13 organizations.
Key Technical & Strategic Takeaways: Disconnect commercial refrigeration controllers and IP camera management systems from the public internet immediately.; Audit endpoints running GeoVision software for unauthorized SYSTEM-level execution of GeoStartupAgentService.exe.
Essential Direct Quote: On Friday, cybersecurity firm VulnCheck published details on 14 serious security vulnerabilities in popular products, while others continue to track intense interest from potential threat actors in similar internet-connected devices.
Source: CyberScoop