The shape of the day
A hundred Fortinet flaws in one batch, a Check Point gateway chain that ends in wiped ESXi hosts, and an N-central campaign that went from proof of concept to cryptominers in five hours. A newly named actor was intercepting two-factor codes over the phone network’s signaling protocols. While all of that was landing, Microsoft 365 was down for most of the day, and the CEO of the world’s most valuable chip company resigned.
Four threads today: the patch pile and the ones already exploited, the phone network as the target, the supply chain that keeps paying, and the outage with the policy shelf behind it.
The patch pile, and the ones already exploited
Fortinet shipped 89 advisories in a single November batch — around 100 vulnerabilities, roughly 17 of them critical. The one with a name is Fortinet2Shell, CVE-2026-121529, CVSS 9.1: a CORS and origin-validation flaw in a FortiClient local service that lets a malicious website run code on the machine, just by being visited. The fixes are 7.4.8 and 7.2.15. There is no workaround and no virtual patch. Not known to be exploited yet.
The Check Point story was already exploited. Check Point disclosed on November 12 that an unknown actor chained PHP2Shell — CVE-2026-109618 and CVE-2026-109619 in the Mobile Access portal — with a Gaia OS privilege-escalation zero-day, CVE-2026-123039, to get root on Security Gateways. The campaign started October 30 against Israeli organizations and widened on November 2 to multiple countries and sectors. After root came PHP webshells and a persistent backdoor called TSGA, and in some victims a lateral move over SSH to VMware ESXi hosts, where a wiper called destroy_v6 overwrote files with zeros. Check Point counts a couple of dozen customers hit. The hotfixes are out; the temporary mitigation is stopping the dynamic_server process.
The N-central story moved from disclosure to exploitation in about five hours. Researcher Sean Bales published proofs of concept on November 12, and attackers had an XMRig Monero miner running on 21 N-central servers the same day. The detail that changes the remediation: 19 of those 21 servers were already running the latest hotfix, 2026.4 Hotfix 2. The chain — an Apache Axis flaw plus a privilege escalation — still worked. N-able has taken its hosted N-central offline and is telling customers to disable the Legacy API. The second flaw set, Agent2Shell, would let an attacker run commands as SYSTEM on managed Windows endpoints. No exploitation reported there yet, and no fix released for any of it as of November 13.
Apache patched a critical remote code execution flaw in mod_http2, CVE-2026-119618, CVSS 9.8. A race condition in the header handling lets an unauthenticated attacker corrupt the heap and run code. Versions 2.4.55 through 2.4.70 are affected; 2.4.71, released November 11, fixes it. No known in-the-wild exploitation yet, but public research has already demonstrated a reliable exploit, and one vendor counts vulnerable resources in 64% of cloud environments.
Citrix patched 28 vulnerabilities in NetScaler ADC and Gateway on November 12 — nine critical, plus a tenth the same day in NetScaler Console. The highest is CVE-2026-107412 at CVSS 9.5. One of them, CVE-2026-120868 at 9.3, is a memory overflow in core packet processing that hits all deployments, including the default configuration, with no workaround. The Console flaw, CVE-2026-120869, is an unauthenticated authentication bypass. No known exploitation for any of them.
On the endpoint side, Binance warned on November 10 about an iOS sandbox escape called worse_query. A malicious third-party app can read local files from other apps — crypto seed phrases, private keys, login credentials — with no jailbreak. It affects iOS 26.7.1, 27.0.1, and 27.2. A proof of concept went up on GitHub on November 8, and an app built on it already browses and edits other apps’ data. Apple shipped iOS 27.2.1 and 26.7.3 on November 9, but the researcher says worse_query is not patched in 27.2.1 or in the 27.3 beta. No confirmed theft yet.
And PostgreSQL shipped its November security update across five branches — 18.7, 17.12, 16.16, 15.20, and 14.25 — fixing 52 vulnerabilities and more than 140 other bugs. Thirty-two of the CVEs score 8.8, most letting an authenticated user run code as the database server’s operating-system user. The release that matters most is 14.25, because it’s the last one. PostgreSQL 14 is now end of life and gets no further fixes.
The phone network is the target now
Enea named a new state-level actor, SilentAir, hijacking nodes inside Asian mobile operators to launch SS7 and Diameter signaling attacks over the IPX interconnect. Attack sources sit in at least six Asian countries; Taiwan is the primary target, including political and government figures. Interception was 18.3% of the observed activity — against 2.07% for commercial surveillance firms. Two-factor codes were seen being intercepted moments after the diversion began, which reads like an attempt to break into the victims’ other accounts.
The DOJ announced on November 12 that the FBI disrupted the infrastructure behind FaceStealer, a North Korean scheme tied to more than $400 million in crypto theft over 18 months. Agents seized more than 900 victim webcam videos under a federal warrant. The scheme works like this: an invitation arrives from an account stolen from an earlier victim, the target joins a fake video meeting and sees prerecorded webcam clips of people they know — plus AI deepfakes of prominent crypto figures — and gets talked into installing malware or draining a wallet. FaceStealer is now also targeting open-source maintainers.
Unit 42 published Cairn — an open-source AI pentesting framework, run by Chinese-speaking attackers with Chinese models, to carry out 25 largely autonomous operations against at least 19 organizations in August and September. Ten of them ended in unauthorized access or data retrieval. The operators supplied a target and a goal. Cairn planned, executed, and recorded on its own, working from a shared blackboard of facts and intents. The models were Zhipu’s GLM 5.2 and DeepSeek’s V4. The targets: semiconductor supply chain, defense policy, civil society. One organization lost more than a million personal records.
Brazil’s largest port, Santos, has been running on manual procedures for five days after a cyberattack crippled its IT network. It began with a power outage after attackers reached equipment left exposed online. The same port authority was hit by the n0n data-extortion group in October and refused a $26 million ransom demand. A port running on paper is the picture of what a cyberattack does to a physical place. The ships don’t stop. The systems that schedule them do.
And Symantec detailed an attack on an unnamed US retailer in September. Hand-typed commands were blocked repeatedly for about two hours. Then the attacker switched to what looks like AI-generated PowerShell — long, error-free scripts with labeled output sections and comments that read like model reasoning — and broke through. Credentials came out of SolarWinds Orion config files, and the attacker laterally moved to a second server about ten minutes after querying Orion. The defender blocked the human for two hours. The model got through in ten minutes.
The supply chain keeps paying
Europol and Eurojust announced the latest Operation Endgame action on November 12: law enforcement from nine countries seized 235 servers and 257 domains and identified 6.4 million victim credential datasets. The targets were Gootloader, CastleRAT, and StealC. Gootloader alone had infected at least 25,000 computers since 2018, with about $28.8 million in losses counted by the US DOJ. No arrests announced. The victim data goes to HaveIBeenPwned and the other notification services. The takedown is the headline; the notification is the part that reaches the people.
Doctor Web found fake GitHub repositories posing as security utilities — scanners, security-testing tools, log analyzers — infecting more than 2,000 Windows machines. The code hides in Visual Studio, Python, and Go files through whitespace obfuscation, and a pre-build PowerShell routine fetches an encrypted link and downloads an Electron loader named Microsoft.exe. The payloads: AsyncRAT, a crypto-wallet clipboard clipper, and an infostealer that exfiltrates through a Telegram bot.
SANS wrote up a ClickFix sample on November 13: a fake CAPTCHA page tells the user to paste a command into Terminal, which pulls down a Go infostealer for macOS. The researchers call it DownTheDRAIN, after the function that finds crypto wallet addresses and redirects their contents to attacker wallets — Bitcoin, Litecoin, Dogecoin, Ethereum, XRP. It also harvests Keychain data, browser passwords, and cached cookies, phones home on port 8133, and hides in the Library/Caches folder. The platform caught this one in testing. The paste-into-Terminal instruction is still the vulnerability.
FortiGuard published a campaign from early October: an open-source scanner hunts for SQL Server on TCP 1433, then a brute-forcer tries the sa and admin accounts against more than 2,700 passwords. On success it runs T-SQL and drops an XMRig Monero miner disguised as MicrosoftEdgeUpdate.exe — plus a Gh0st RAT variant as winlogon.exe. No CVE. This is a configuration problem, not a software bug. The miner is the noise. The RAT is the reason to worry.
Arkham tracked 1,052.34 bitcoin — about $78.61 million — leaving wallets labeled as belonging to the Bitget hacker between November 6 and 11. Of that, 847.26 bitcoin, about $63.43 million, went into 66 CoinJoin transactions, starting the morning of November 6. This is movement of stolen funds, not a new breach. The original breach was September 24, first valued at $351.6 million and later revised to $387.5 million.
LEGO’s BrickLink marketplace is back online after going dark on November 5–6, when LEGO spotted unusual activity. LEGO now confirms that some members’ usernames and IP addresses — and a very small number of email addresses — were accessed. Passwords and payment information were not. Affected members are being emailed, and seller fees are waived for November and December. LEGO hasn’t confirmed whether it was a cyberattack or how the data was accessed.
TSMC confirmed on November 12 that about 46,000 current and former employee records — 6.9GB — leaked after a hack of an external cloud service provider. The hacker wants 3 bitcoin, roughly $200,000, and threatens a public release within a week if no buyer emerges. A 499-person sample was posted to prove the claim: names, national IDs, home addresses, phone numbers, emails, bank details, job titles, emergency contacts. TSMC says there’s no evidence its own systems were compromised and that production and customer data are untouched.
The Czech web automation platform Apify — around 80,000 customers, including Microsoft, Samsung, Siemens, and the European Commission — said an unauthorized party used a compromised credential to get into parts of its internal systems on November 9 and 10. Detected November 11 at 12:13 UTC. The attacker obtained additional account credentials and accessed related customer accounts. Apify has rotated customer API tokens and proxy passwords, reset all active sessions, and revoked OAuth connections to external services including GitHub. Affected customers are being told to reset two-factor authentication, because 2FA codes may have been exposed.
When the platform goes down, and the policy shelf
Microsoft 365 went down on November 12, starting at 16:17 UTC with Exchange Online mailbox access failing in the Americas and widening within two hours to any region. More than 130,000 Outlook problem reports hit Downdetector at peak. Thirteen hours later, on Friday morning, it still wasn’t fully restored. Outlook, Teams, SharePoint, Copilot, Intune, Purview, Power BI — all degraded. The security tooling was hit too: Defender XDR portals, and Defender for Office 365 Safe Links, which may not have been able to verify URLs. That’s the phishing-risk angle during recovery. Microsoft says servers became unexpectedly unavailable and a process for establishing secure connections got overwhelmed. Not traffic-driven, no malicious activity, no breach. No final root-cause report yet.
Japan’s prime minister announced a ¥10 billion emergency package — about $63 million — on November 6, from fiscal 2026 reserves. Roughly ¥2 billion goes to AI-assisted vulnerability scanning of government systems, ¥4.1 billion to police cyber investigations, ¥3.8 billion to securing the Digital Agency’s systems. A trade-ministry AI “top gun” expert team arrives by the end of November, and a public-private cyber rescue team will act as first responder to attacks. The package also expands active cyber-defense powers — pre-emptive access to attackers’ servers — under a law partly in effect since October 1.
Jensen Huang stepped down as NVIDIA CEO on Thursday, November 12, days after reports of an affair with Alice Huang, an executive at Singapore-based Megaspeed — an NVIDIA partner and customer whom US authorities suspect of spying for Beijing and smuggling advanced chips to China. Finance chief Colette Kress is interim CEO. House Speaker Mike Johnson said Thursday there’s growing consensus in Congress for limiting chip exports to China. The bills in play: the AI Overwatch Act, the Chip Security Act, the Match Act, and the Remote Access Security Act — several may ride the annual defense authorization bill. Senate Banking chair Tim Scott has asked Huang and Commerce Secretary Howard Lutnick to testify on December 3.
The UK’s NCSC launched its Cyber Adversary Simulation scheme on November 11 — an assurance scheme that vets providers of adversary simulation services, so the country’s most critical organizations can find trusted suppliers to test their defenses. It’s built for critical national infrastructure, government, and essential services: reconnaissance, then realistic, customer-specific attack plans. Capability-led red teaming, not checkbox pen-testing. The CTO’s line: “You cannot improve what you do not know.”
And the Senate Homeland Security Committee has set a hearing for Thursday, November 19, at 9:30 AM in Dirksen 342, to consider Michael LoSapio’s nomination as CISA director. He’s Palantir’s CISO; the nomination reached the Senate on November 10. CISA has had no Senate-confirmed director since Jen Easterly stepped down in January 2025. If LoSapio isn’t confirmed before the term ends, the nomination goes back to an incoming Democratic Senate majority in January.
The close
The day’s pattern is hard to miss. The exploitation window after a public disclosure is now measured in hours, not weeks — five hours for N-central, and the hotfix didn’t stop it. The AI is doing the operation now, not just assisting it — Cairn ran 25 of them, and a model got through a retailer’s defenses in ten minutes after a human was blocked for two. The patching is still on us. The finding, increasingly, is not.
Leave a Reply