Live threat brief
ClickTap any finding to open its full analysis: detection and triage guidance, ATT&CK mapping, changelog and every source.
Technical University of Munich: attackers captured the central-login passwords of everyone who signed in to the legacy myTUM portal, took a TUMonline system administrator's credentials and attacked the campus-management system; accounts with MFA were protected
The Technical University of Munich said on 2026-11-06 that unknown attackers attacked its myTUM portal and captured the central-login passwords of all persons who had signed in there, among them the credentials of a TUMonline system administrator, with which they attacked the campus-management system TUMonline, which TUM took off the network. TUM says accounts with multi-factor authentication were protected, reported the incident to the Bavarian data-protection commissioner and filed a criminal complaint; heise reports that the entry point was a legacy system and that about 60,000 users are concerned.
Canton Aargau adopts its information-security ordinance (InfoSiV) and sets 1 January 2027 for the information-security law and ordinance, with a specialist unit to receive directive and enforcement powers and a cyber coordination office at the cantonal police
The Aargau government council announced on 2026-11-06 that it adopted the information-security ordinance (InfoSiV) and that the information-security law (InfoSiG) and the ordinance enter into force on 1 January 2027. An information-security specialist unit is to advise cantonal bodies with directive and enforcement powers, and a cantonal cyber coordination office, headed from that date by Bernhard Droz, and a personnel-security-vetting unit sit at the cantonal police.
Oneconsult on the File System Access API: after two clicks a website holds read and write access to folders such as .vscode, .Azure, the public desktop and SMB shares in Chrome and Edge, enough for token theft and persistence without a process on the host
Oneconsult's analysis of Chromium's Windows blocklist shows that a website granted a folder through the File System Access API after two clicks keeps a handle for as long as the tab is open, and that the blocklist leaves .vscode, .Azure, C:\Users\Public, SMB shares and, after a OneDrive Known Folder Move, the Desktop reachable. The paths it demonstrates are token and .env theft, a fake VS Code extension and PowerShell profile or module backdoors that need the Bypass or Unrestricted execution policy, and a file proxy through the open tab that EDR sees only as browser file activity.
Kaspersky GERT: two ESXi and Proxmox ransomware cases in which a monitoring server's reused root password and plaintext administrator notes, not a VM escape, gave the attackers the hypervisor
Kaspersky's Global Emergency Response Team describes two ransomware cases in virtualised estates. In the BlackNevas case a PRTG Network Monitor held ESXi root access and the same root password was reused across hosts, so the attacker connected over SSH, disabled the execInstalledOnly policy with esxcli, ran the encryptor and deleted logs; in the case attributed to The Gentlemen the actor found Proxmox root credentials in plaintext notes on an administrator workstation and used the VNC web socket to encrypt the cluster. Kaspersky stresses that no VM escape was needed.
Acronis TRU on BOSSAI: one operator's mesh of 12 AI agents took patient-care records and dispatch case data from Taiwanese emergency services through a legacy open port, a public API and default root credentials, and failed wherever authentication was enforced
Acronis TRU describes BOSSAI, an agentic campaign it attributes with high confidence to one operator in Taiwan: a mesh of 12 AI agents, nine active, that over 12 observed days targeted government emergency services, banks, universities and military systems in 11 countries, with confirmed data exfiltration or system access at roughly ten targets in three countries. The confirmed emergency-services harm was patient-care records of a Taipei fire department and dispatch case records of a city 119 system; TRU says the agents failed where authentication was enforced and endpoints were filtered.
CVE-2026-111497, Brotli decoder flaw in Siemens Desigo CC and Industrial Edge, Mitel MiVoice Business and OpenScape, with Cisco listing Duo Network Gateway and RoomOS in its combined advisory: Desigo CC takes the .NET updates, while Mitel updates and the Industrial Edge Common Configurator fix are still pending
Between 2026-10-27 and 2026-11-06 Siemens, Mitel and Cisco listed affected products in advisories that cover the Brotli decoder flaw CVE-2026-111497: Siemens names Desigo CC V8 and V9 (remedy: the latest .NET security updates) and Industrial Edge, where Common Configurator has no fix; Mitel names MiVoice Business and five OpenScape products with updates planned and workaround articles for three; Cisco's combined advisory lists Duo Network Gateway (3.4.2) and RoomOS among its products with fixes, a longer list of which is dated up to 2027, without saying which of its CVEs each fix addresses. Cisco says it is not aware of malicious use against any Cisco product, and CISA lists the flaw as exploited.
CVE-2026-19868, SonicWall SonicOS SSLVPN: valid credentials for an alternate authentication method bypass SAML and the MFA it enforces; SonicWall investigated a report of exploitation and CISA lists it as exploited (CVSS 3.1 7.1)
SonicWall's advisory SNWLID-2026-0014 of 2026-11-06 fixes CVE-2026-19868, an SSLVPN authentication enforcement flaw (CVSS 3.1 7.1) that lets a user with valid credentials for an alternate authentication method bypass SAML, MFA enforced through SAML included, on Gen7 firewalls up to 7.3.3-7015 and Gen8 up to 8.2.2-8015 when SAML is enabled for SSLVPN logins. SonicWall says it investigated a report indicating potential exploitation and CISA lists the flaw as exploited; there is no workaround, and 7.3.4-7013 and 8.2.3-8015 fix it.
Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controllers compromised, with forced defrost at hundreds of French supermarkets, refrigeration failures at more than 115 shops in at least six more countries and first cases in Germany, and on 2026-11-02 altered settings in the cold rooms of the French blood service through a refrigeration supplier, and on 2026-11-05 the first publicly known cases in Switzerland; responsibility not established; ENISA and Europol call for immediate action
Update · NCSC Switzerland updated its advisory on 2026-11-06 with the Swiss incidents, Copeland and Dixell XWEB and healthcare, a four-point checklist for refrigeration management systems across all relevant operations, supplier-managed equipment included, and the statement that the public information does not establish a common attack method or confirm exploitation of the Danfoss CVEs it lists. Ransom-ISAC published the event log of one internet-reachable Copeland XWEB Pro compromise (743 parameter writes in two administrator sessions, default credentials claimed without published evidence), and Unit 42 counts over 5,000 exposed devices across countries on 5 and 6 November and a falling count in France since October.
CVE-2026-123158, OpenSSH Portable before 10.6p2 (*sshole): on Linux with musl libc and no PAM, a password of 257 to 1,024 bytes logs in to accounts whose password field is *; NCSC Switzerland issued an advisory (CVSS 3.1 8.1)
Update · Previdian's page, as read on 2026-11-07, reports 15 exploitation attempts against CVE-2026-123158 from 10 addresses in 8 countries since 2026-11-06, and The Hacker News reports, quoting Previdian's chief executive, a successful root login on an Alpine Linux honeypot followed by reconnaissance commands; CISA does not list the flaw and no authority source reports attacks on production systems.
WordPress core 4.7 to 7.1.3: an unauthenticated race in the core update process can lead to remote code execution, fixed in 7.1.4 and backported to every supported branch, listed by CISA as exploited; Wordfence assigned CVE-2026-119977
Update · The discoverer, Umut Bayram of Picus Security, shows that the update installing WordPress 7.1.4 still unpacks with the site's old code, so the staging folder under wp-content/upgrade can be reachable at a predictable path during that update, while a partial package exposes the installer only if it contains the installer files; he advises denying web access to the folder and confirming it answers 403 before updating.
ARTEX: Microsoft reports Storm-0940, a China-state aligned actor, running an open-source multi-agent LLM penetration-testing framework against hundreds of organizations, with privileged cloud access in under three hours in some cases, and Expel sees the same infrastructure abuse Okta self-service registration
Update · Microsoft reports that Storm-3358, a Cambodia-based, financially motivated cluster, has used ARTEX since October 2026 against financial organisations, pairing it with conventional scanners and installing the open-source remote access tools WISP, vshell and AdaptixC2; Check Point Research reads ten exposed operator consoles showing campaigns that run almost autonomously once a goal is set, and Microsoft says honeypots, decoys, tarpits and fake wins helped reduce the attack traffic reaching real assets.
CVE-2026-76461: Cisco Secure Email Gateway unauthenticated SQL injection in email parsing reaches root command execution, exploited before disclosure (CVSS 9.8)
Update · Rapid7's Metasploit framework now carries public modules for two unauthenticated SQL injections on Cisco Secure Email Gateway that end in root command execution: one merged on 2026-11-05 for the injection its author matches, at medium confidence, to the exploited CVE-2026-76461 and which needs URL Filtering and URL Retrospective Service enabled, and one for the non-default S/MIME public-key harvesting feature that Rapid7 believes is CVE-2026-76443. A clean mail_logs check does not rule out the S/MIME injection, and Cisco's hardening advisory names no fixed 16.0 build.
CVE-2026-58115, Siemens SIMATIC IoT2050 Advanced, Basic, M.2 and SM ship a Node-RED interface with no authentication, so one unauthenticated HTTP request runs code with maximum privileges on an OT edge gateway (CVSS 10.0); VulnCheck's canary caught exploitation
Update · Siemens revised its advisory SSA-834709 to V1.1 on 2026-11-04 and now lists the SIMATIC IoT2050 Advanced, Basic, M.2 and SM variants as affected, all versions below V4.3.4-1 with Node-RED installed; the fix and interim mitigations are unchanged, so owners of the three further variants are in scope as well.
Action items (15)
Do-now tasks recorded on the findings in this window. Each one links the finding it comes from.
- Find every Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controller, and any other refrigeration controller with a remote management interface because not every second-wave site's vendor is confirmed, in facilities you own or that a contractor manages for you and take its management interface off the internet now, restoring access only through a secure VPN or protected network (filtering to the contractor's source addresses is an emergency stop-gap, and CERT-FR asks you to check your insurance conditions before cutting the contractor's data uplink); an end-of-life unit that gets no fixes needs replacing, because a factory reset leaves it vulnerable and probably compromised again.FindingRefrigeration attacks reach Switzerland, a Köniz…
- On every such controller that was reachable from the internet, check the whole configuration, defrost ranges, alarm thresholds and notification recipients included, against the intended one, verify the actual temperatures and test that alarms reach staff; for a Danfoss unit that may have been taken over, restart it or otherwise factory-reset it, restore access only through a secure VPN or protected network and reconfigure it for service, then update its firmware, set the security level to Strict and replace the default and any weak passwords, and on every Copeland or Dixell XWEB unit confirm the factory Admin password was changed and give each contractor a named account with an expiry date.FindingRefrigeration attacks reach Switzerland, a Köniz…
- Update every SIMATIC IoT2050 (Advanced, Basic, M.2 and SM) to V4.3.4-1 or later now; where that cannot happen at once, uninstall Node-RED on units that do not use it, since Siemens names uninstalling or hardening Node-RED as its interim mitigations and exploitation takes a single unauthenticated request.FindingCVE-2026-58115
- On every Node-RED instance that was reachable from an untrusted network, review the deployed flows for exec nodes and http-in endpoints that nobody built, and the access logs for POST requests to /flows from non-engineering addresses.FindingCVE-2026-58115
- Upgrade every Cisco Secure Email Gateway appliance (physical and virtual) to AsyncOS 15.5.5-014 as re-released on 2026-10-31 (on an appliance that took the earlier build, confirm with retroscannerstatus that Retro Remediation Engine runs 4.0.2 or later), 16.0.4-302, or 16.5.0-780 (Cisco's recommended target) now; 16.0.4-302 closes CVE-2026-76461 only, because the hardening advisory names no fixed 16.0 release, so move a 16.0 appliance to 16.5.0-780 to close the five hardening-release CVEs (CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, CVE-2026-76443, CVE-2026-76442) as well, one of which, CVE-2026-76443, has a public Metasploit module according to its author.FindingCVE-2026-76461 +5
- Grep every appliance's mail_logs (and, if clustered, every cluster member's logs) for the pattern "COPY.*TO PROGRAM" and cross-check firewall/network logs external to the appliance for unexpected outbound connections; a successful exploit grants root, so an attacker may have removed local log evidence of their own access; a clean result does not rule out the S/MIME injection, which did not leave that pattern in the module author's reproduction.FindingCVE-2026-76461 +5
- Secure Email Cloud customers should confirm directly with Cisco whether their instance is among those where indicators of compromise were identified; Cisco states it has already proactively contacted affected Cloud customers and upgraded all Cloud instances.FindingCVE-2026-76461 +5
- Upgrade every SonicWall Gen7 firewall and NSv that serves SAML SSLVPN logins to SonicOS 7.3.4-7013 or later and every Gen8 firewall and NSv to 8.2.3-8015 or later now, because SonicWall lists no workaround and CISA lists the flaw as exploited.FindingCVE-2026-19868 +3
- On every WordPress site your organisation, its web agencies or its hosting suppliers run, deny web access to wp-content/upgrade/ in the web server configuration (not with an .htaccess file inside that folder) and confirm it answers 403 before installing 7.1.4 or the fixed release of its branch, because the update itself still unpacks with the old code and a firewall that WordPress itself loads does not run for that request; then confirm in Dashboard > Updates that each site is on 7.1.4 or the fixed release of its branch.FindingCVE-2026-119977
- List every monitoring server, script, scheduled task and connection manager that stores an ESXi, vCenter or Proxmox root password, replace each with a least-privilege monitoring account, and rotate the root passwords that were stored or reused across hosts.FindingKaspersky: ESXi and Proxmox ransomware ran on a…
- Install the latest .NET security updates through Windows Update on every Siemens Desigo CC V8 and V9 host.FindingCVE-2026-111497
- On every Industrial Edge Management instance running Common Configurator, uninstall all Management Applications and put the instance behind a firewall or WAF, and stop Common Configurator on Edge devices, until Siemens ships a fix, because Siemens lists no fix for it.FindingCVE-2026-111497
- Apply Mitel's workaround articles KB000129034 (OpenScape SESAP), KB000129100 (OpenScape SBC) and KB000129114 (OpenScape Contact Center) on the OpenScape SESAP, SBC and Contact Center systems in use, because Mitel has released no update for them.FindingCVE-2026-111497
- On every musl-based Linux host that runs sshd (Alpine, OpenWrt, Buildroot, Yocto), install OpenSSH 10.6p2 or the distribution's fixed openssh package and restart sshd, because updating the package does not replace the running server, and rebuild container and cloud images from a fixed base; until then set PasswordAuthentication no in sshd_config and restart sshd.FindingCVE-2026-123158
- In every Okta org that allows self-service registration, review the accounts created since 2026-10-13 and every Okta Verify enrollment on them, and remove self-created accounts that nobody provisioned.FindingMicrosoft: Storm-0940 runs ARTEX at machine speed…
Explore the knowledge base
Machine-readable: actions.json · briefbook.json · search.json · RSS feeds · STIX 2.1 · llms.txt · every entry's raw source at entries/<date>/<slug>/index.md
Read the signal, not the noise.
CTIPilot is continuous cyber threat intelligence for Swiss government entities: national, cantonal and communal administrations, emergency services, police and armed forces. Published the hour it is verified; source-linked, IOC-free, autonomously generated by an LLM.
Everything verified or updated in the last 24 hours, held to a constant relevance bar. An update or correction to an earlier finding floats it back to the top under the run that made it. How this works →