6 verified findings from 1 run · 8 updates to prior coverage · the settled record for this UTC day, in the classic brief order.
Criticality
Kind
Topic
Region
TL;DR · the day in one read
01ScreenConnect SCKit: second wave hits on-prem; disable RMM+, update technician clients to 26.6.5+. Huntress saw an operator use access to several cloud-hosted ScreenConnect panels on 2026-11-11 to run Run Command as SYSTEM on groups of managed endpoints, installing an attacker-controlled second ScreenConnect client and the SCKit toolkit on at least 288 hosts at 48 organisations within 90 minutes; Sophos independently saw the same client deployments. Huntress later said the activity seems related to the third-party RMM+ extension, whose versions 1.0.31 and 1.0.32 accepted a blank access key; ConnectWise's CNA record CVE-2026-127063 (CVSS 4.0 9.3) says the extension uses a static API secret by default, names no fix and gives disabling as the mitigation, while a Huntress spokesperson says the panel-access vector is still unclear and Blackpoint calls the extensions' role unresolved. A second wave on 2026-11-13 hit 205 hosts at 41 organisations (Huntress) and appears to target on-premises instances with mitigations pending (Blackpoint); Microsoft describes a rogue client built to deliver a payload to the technician who connects, which ConnectWise says ScreenConnect clients 26.6.5 and later block. →
02Plone anonymous RCE chain: update or install the 20261110 hotfix, block portal_modifier, check modifier conditions. The Plone and Zope security team released fixes on 2026-11-10 for a chain of issues that together let an anonymous visitor run code on the server in Plone 6.0, 6.1 and 6.2 and, per the team, back to at least 4.3; the entry point is a CMFEditions flaw rated 9.8 with no privileges required, and its advisory says a working proof of concept exists. The team's fixes are the updated packages or the hotfix package Products.PloneHotfix20261110, a workaround that blocks URLs containing portal_modifier has applied since the 2026-11-02 pre-announcement, CVE ids are requested and no source reports exploitation. →
03Apache httpd mod_http2 RCE: update to 2.4.71 or drop h2/h2c from Protocols; Debian, Ubuntu, Alpine fixed. The Apache HTTP Server project released 2.4.71 on 2026-11-11 to fix CVE-2026-119618, a race in mod_http2 that it rates critical and says can lead to remote code execution in versions 2.4.55 through 2.4.70; Red Hat adds that it is unauthenticated, affects only servers with HTTP/2 enabled through the Protocols directive, and that public research has demonstrated a reliable exploit, while no source reports exploitation. Red Hat has fixed RHEL 9 and 10, Debian bookworm and trixie and Alpine ship 2.4.71 packages, Ubuntu has shipped backported fixes, while a researcher's public test reproduces crashes on 2.4.70 and, per Wordfence, does not show code execution. →
The Belgian Centre for Cybersecurity (CCB) warned on 2026-11-10 that a trusted partner had observed successful attacks against multiple Belgian organisations in which attackers abused Microsoft Entra ID SMS as a first factor, the sign-in mode in which a phone number and a one-time code replace the password (CCB, 2026-11-10). The warning gives no victim count, sector, actor, date range or attack chain, and it does not say how the codes were obtained; its only statement on the factor itself is that SMS and voice can be phished, intercepted or SIM-swapped (CCB, 2026-11-10). No other source reports the Belgian attacks. Microsoft describes the method as designed for frontline workers, advises enabling it only for them, and says it is different from SMS as a multifactor method, which needs a username and password (Microsoft Learn, 2026-10-30). Microsoft is disabling first-factor sign-in in tenants with no such traffic in the previous 30 days (Microsoft Learn, 2026-10-30) and retires its own SMS and voice delivery on 2027-02-01 for all users except Global Administrators and external users, who follow on 2027-07-01; a customer-configured telephony provider can keep the methods working (Microsoft Learn, 2026-09-23).
Check which users actually use SMS sign-in, give them an alternative and disable it as soon as possible
Look for successful SMS-based sign-ins, phone number or method changes, unusual locations or devices, and follow-on activity such as mailbox rules or app consents.
On 2026-11-11 Huntress observed an operator using access to several cloud-hosted ScreenConnect panels to run commands as SYSTEM on groups of managed endpoints through the Run Command feature, hitting at least 288 hosts at 48 organisations within 90 minutes (Huntress, 2026-11-11). Each host installed an attacker-controlled second client and fetched SCKit, a 16-file toolkit delivered encrypted that sets the legitimate client to manual start so the attacker's copy replaces it and runs a per-host executable from a scheduled task (Huntress, 2026-11-11). A second wave on 2026-11-13 hit 205 hosts at 41 organisations with no follow-on executions observed (Huntress, 2026-11-13), and Blackpoint says it appears to target on-premises instances where mitigations are still pending (Blackpoint, 2026-11-13).
Huntress's later update says the activity seems related to RMM+, a third-party extension that bypasses ScreenConnect's accounts, roles and MFA: versions 1.0.31 and 1.0.32 accepted a blank access key when an administrator had never set one (Huntress, 2026-11-11). ConnectWise, as CNA, published CVE-2026-127063 (CVSS 4.0 9.3) saying the extension uses a static API secret by default; it names no fixed version, removed the extension from cloud-hosted instances and tells on-premises customers to disable it and not reinstall it (ConnectWise, 2026-11-12).
Microsoft describes the technician stage: RelayTrap, a replacement client compiled on the endpoint with the .NET C# compiler and designed to deliver a payload to the technician who connects, and browser-access code that searches Chrome, Edge and Opera profiles for cookies named .ASPXAUTH, with a component designed to queue payloads through the console's Shared Toolbox (Microsoft, 2026-11-13). ConnectWise says clients 26.6.5 and later block the transfer, and Microsoft adds that a cloud-console update does not update technician clients (Microsoft, 2026-11-13); Huntress and Blackpoint saw no successful technician compromise (Huntress, 2026-11-11; Blackpoint, 2026-11-13).
On November 11, 2026, Huntress observed an operator using access to multiple cloud-hosted ScreenConnect panels to push commands to groups of managed endpoints.
The legitimate installation of ScreenConnect is then stopped, set to manual start, and the attacker controlled copy of ScreenConnect positioned to replace it.
Disabling these 3rd party extensions is a precautionary containment measure. It does not establish that unauthorized software, persistence mechanisms, or access already present on affected devices has been removed
BleepingComputer (quoting the ConnectWise advisory)
versions 1.0.31 and 1.0.32 contained a serious authentication flaw
ConnectWise, as CNA, published CVE-2026-127063 (CVSS 4.0 9.3) on 2026-11-12: the third-party RMM+ extension "uses a static API secret by default", no fixed version has been announced, disabling is the mitigation, and ConnectWise has removed the extension from cloud-hosted instances while on-premises customers must disable it and not reinstall it (ConnectWise, 2026-11-12). This differs from Huntress's account of a blank key in versions 1.0.31 and 1.0.32, and a Huntress spokesperson told The Record that it has seen no evidence of a new vulnerability and that how the attacker got panel access is still unclear, while ConnectWise says the extension's API is protected by a passphrase the partner sets (The Record, 2026-11-12). Blackpoint reverse engineered the toolkit, saw unauthorised deployments through legitimate cloud-hosted instances but no successful propagation to a technician workstation, and calls the extensions' role in the first panel access unresolved (Blackpoint, 2026-11-12).
Microsoft published on 2026-11-13 its analysis of SCKit, which includes RelayTrap, a malicious replacement for the ScreenConnect client on an affected customer endpoint that is designed to deliver a payload to a technician's workstation when they connect for support (Microsoft, 2026-11-13). A watcher on the endpoint enumerates the ScreenConnect client services and builds RelayTrap for each with the .NET C# compiler, and the toolkit's browser code searches Chrome, Edge, Opera and Opera GX profiles for cookies named .ASPXAUTH; a console-distribution component is designed to combine the cookie with the anti-forgery and access tokens, upload a payload, queue it through the Shared Toolbox and remove the uploaded item afterwards (Microsoft, 2026-11-13). Microsoft relays ConnectWise's statement that clients 26.6.5 and later block the transfer; in its own words the fix for CVE-2026-84869 was released on 2026-09-08 and a cloud-console update does not automatically update technician clients, and it advises live response or another out-of-band method instead of ScreenConnect on a suspected device, with connecting technician workstations in scope, invalidation of ScreenConnect web and identity-provider sessions, and no use of a cleanup script recovered from the kit (Microsoft, 2026-11-13). Blackpoint's own test found that a current Host client did not fetch or run the queued transfer, and it found no technical link between the extensions and RelayTrap or the browser routines (Blackpoint, 2026-11-13).
Huntress's update of 2026-11-13 reports a second spike at 16:12 UTC that hit 205 hosts at 41 organisations with no follow-on executions observed, one incident at an organisation running a self-hosted RMM+, a rogue client persisting as a service called Windows Update Agent, and ConnectWise's updated advisory urging partners to verify that every technician client runs 26.6.5 or later (Huntress, 2026-11-13). Blackpoint's update says the second wave appears to target on-premises instances where mitigations remain pending (Blackpoint, 2026-11-13).
Microsoft observed several unrelated threat actors deploy GSocket, an open-source remote access tool, on Linux servers after exploiting an internet-facing web application, and says it kept access after the exploited vulnerabilities were remediated (Microsoft, 2026-11-11). The chain starts with command execution as a child of the web server or application runtime, where curl fetches an installation script that bash runs; the script profiles the host, picks a client matching the architecture, stages it as a hidden, executable file in a writable or memory-backed path such as /dev/shm and opens encrypted outbound command and control through the Global Socket Relay Network (Microsoft, 2026-11-11). The client is then disguised with kernel-thread-like process names (bash exec -a), persisted through cron, systemd units, shell profiles, watchdogs and redundant copies, and the staging files are removed (Microsoft, 2026-11-11). In a few incidents the actors afterwards attempted the Linux kernel flaw CVE-2026-43284, known as Dirty Frag, to reach root; Microsoft gives no success statement and no affected or fixed versions (Microsoft, 2026-11-11).
Both the compromised host and the operator connect outbound to the public relay, so the host needs no inbound listener, inbound firewall rules do not see the traffic and a shared secret, not an address, pairs the endpoints, which lets the operator reconnect later from any compatible client; Microsoft therefore says that blocking an address or domain is unlikely to cut off access, while egress filtering and outbound monitoring can see it (Microsoft, 2026-11-11). Microsoft's telemetry is concentrated on web applications and hosting; education and research and technology and telecommunications were the largest shares of affected organisations, which Microsoft says reflect exposure more likely than deliberate sector selection (Microsoft, 2026-11-11).
Triage: Microsoft notes that the same relay model also serves legitimate remote administration, and says a match must be judged on process ancestry, execution context, persistence changes and related network activity; a client started from a web-service process tree, from a writable or memory-backed path and under a kernel-thread-like name is the pattern it describes (Microsoft, 2026-11-11).
Threat actors used Gsocket to maintain access even after the vulnerabilities used for initial compromise were remediated.
Because GSocket runs independently of the exploited application, patching the vulnerability does not remove the relay client or its persistence.
Unit 42 describes Falcon C2, also called XG and not the CrowdStrike Falcon sensor, a NodeJS command-and-control framework whose operator-controlled JavaScript implant runs inside the victim's browser, so the endpoint holds no file for it (Unit 42, 2026-11-11). A script tag placed in a trusted site makes each visit request the implant from the Falcon server, which returns a script obfuscated per browser session, and the implant then holds a TLS WebSocket to the server while the tab is open and runs operator JavaScript through eval (Unit 42, 2026-11-11). Unit 42 identified compromised government entities in one Middle Eastern and four Southeast Asian countries between March and May 2026, among them ministries and law enforcement agencies, and names no actor (Unit 42, 2026-11-11).
In April 2026 a script tag inserted into the Roundcube webmail portal of a Middle Eastern ministry of foreign affairs let the operator intercept credentials as users signed in and monitor sessions (39 Roundcube instances in that country, none observed elsewhere; how the tag got in is not stated) (Unit 42, 2026-11-11). In May 2026 a module in a Southeast Asian police web application harvested usernames and then showed a fake Adobe Flash Player update prompt to chosen users, which served the Antino implant that uses Microsoft OneDrive for command and control (Unit 42, 2026-11-11). Against a justice-department entity in another country, a Chrome extension named PDF Viewer, sideloaded in developer mode, checked in every 3 to 4 minutes for over three weeks and exfiltrated plaintext credentials for an internal correspondence system and a screenshot of a document the victim was viewing (Unit 42, 2026-11-11). The Jewelbug campaign also used an extension named PDF Viewer (Symantec, 2026-08-13); Unit 42 lists it only as a further resource.
Unit 42 assesses with high confidence that Falcon and PeckBirdy (Trend's JScript framework used by China-aligned actors since 2023) are variants of one core framework; that is code lineage, not who operates Falcon (Unit 42, 2026-11-11; Trend Micro, 2026-01-26).
Triage: Unit 42's basis for the cookie check is that Baidu Analytics cookies are normal on sites that use that service and anomalous on internal government web applications where it has no reason to appear (Unit 42, 2026-11-11).
We are currently unaware of how an operator is deploying these browser extensions.
We observed a total of 39 Roundcube instances being affected within the target country.
Based on these extensive technical overlaps, we assess with high confidence that Falcon and PeckBirdy represent variants of the same core framework.
The Plone and Zope security team says the fixes it released on 2026-11-10 close a chain of several issues that together let an anonymous visitor run code on the server, in all supported Plone versions (6.0, 6.1 and 6.2) and in older ones back to at least 4.3 (Plone Security Team, 2026-11-10). The anonymous entry point is Products.CMFEditions: the conditional modifiers in portal_modifier had no security declarations, so an anonymous visitor could change a modifier's TALES condition and then run it, and the condition is also evaluated when an editor saves versioned content (Plone Security Team, 2026-11-10). Products.CMFPlone, Products.MimetypesRegistry and plone.batching opened whole modules to restricted code, which let TALES expressions and Python scripts escape the sandbox and reach modules such as os, and plone.restapi opened the json module (Plone Security Team, 2026-11-10). The CMFEditions advisory rates its flaw 9.8 with no privileges required and states that a working proof of concept exists; the team says details are public and that with current AI tools it may not take long to turn them into a working exploit, and no source reports exploitation (Plone, 2026-11-10; Plone Security Team, 2026-11-10).
The fixed packages are CMFPlone 6.2.3, 6.1.6 and 6.0.16 with the helper package versions the announcement lists, or the hotfix Products.PloneHotfix20261110, which covers Plone 4.3 to 6.2, and all Zope instances must be restarted afterwards (Plone Security Team, 2026-11-10). The team's pre-announcement of 2026-11-02 already gave the workaround, to block any URL containing portal_modifier at the web server at any path depth, which only helps if Zope's own port cannot be reached directly; the team advises keeping it after updating (Plone Security Team, 2026-11-02). After the fix, restricted code can import only the names Plone itself needs from the closed modules, so custom scripts that import others now get an Unauthorized error (Plone Security Team, 2026-11-10).
It is a chain of several issues, which together let an anonymous visitor run code on the server.
Apache HTTP Server 2.4.71, released on 2026-11-11, fixes CVE-2026-119618, a race in mod_http2's assign_headers() that the project rates critical and says can lead to remote code execution, in versions 2.4.55 through 2.4.70 (Apache HTTP Server project, 2026-11-11). The project publishes no CVSS score; Red Hat scores it CVSS 3.1 9.8 and says it allows unauthenticated remote code execution, with a worker thread writing into memory owned by the connection thread through a shared lock-free allocator (Red Hat Product Security, 2026-11-11). Red Hat states that only servers with HTTP/2 (h2 or h2c) enabled through the Protocols directive are affected and that HTTP/1.1-only servers are not (Red Hat Product Security, 2026-11-11); the project's own page is silent on that prerequisite (Apache HTTP Server project, 2026-11-11).
On exploitation the sources differ. Wiz wrote at its publication that no exploit was available and no exploitation in the wild was reported (Wiz, 2026-11-11), while Red Hat says public research has demonstrated a reliable exploit against a default-configured server with mod_http2 enabled, without linking it (Red Hat Product Security, 2026-11-11). A researcher has since posted a test setup that reports memory corruption and Apache child-process crashes on 2.4.70, and Wordfence says it does not demonstrate remote command execution (Wordfence, 2026-11-12). No source reports attacks, and the project's advisory carries no exploitation or workaround statement (Apache HTTP Server project, 2026-11-11). Wiz advises disabling HTTP/2 temporarily as the interim measure (Wiz, 2026-11-11).
The upstream fix is 2.4.71. The project lists standalone mod_h2 releases from GitHub, 2.0.8 through 2.0.42, as affected and names no fixed standalone release (Apache HTTP Server project, 2026-11-11). Red Hat shipped mod_http2 errata for RHEL 9 (mod_http2-2.0.26-7.el9_9.1) and RHEL 10 (mod_http2-2.0.29-5.el10_3.1) on 2026-11-11, rates them Important (Red Hat, 2026-11-11; Red Hat, 2026-11-11), says the packages allocate each HTTP/2 stream from a separate allocator, which makes exploitation substantially more complex, and lists RHEL 8 and earlier as not affected (Red Hat Product Security, 2026-11-11); Debian's tracker lists apache2 2.4.71-1~deb12u1 for bookworm (DLA-4902-1) and 2.4.71-1~deb13u1 for trixie (DSA-6620-1) as fixed while forky is still vulnerable (Debian Security Tracker, 2026-11-13), Ubuntu's USN-9090-1 fixes 22.04 LTS to 26.10, and 20.04 LTS through ESM (Ubuntu, 2026-11-12), Alpine 3.21 to 3.24 ship 2.4.71-r0 (Alpine Linux, 2026-11-13) and SUSE lists the issue as pending (SUSE, 2026-11-13).
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.
Only servers that have HTTP/2 enabled are affected; servers configured to serve only HTTP/1.1 are not vulnerable.
It allows unauthenticated remote code execution, and public research has demonstrated a reliable exploit against a default-configured server with the mod_http2 module enabled.
Debian's tracker now lists apache2 2.4.71-1~deb12u1 for bookworm (DLA-4902-1) and 2.4.71-1~deb13u1 for trixie (DSA-6620-1) as fixed, with forky still vulnerable (Debian Security Tracker, 2026-11-13); Ubuntu's USN-9090-1 fixes 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10, and 20.04 LTS through ESM (Ubuntu, 2026-11-12) and Alpine 3.21 to 3.24 ship 2.4.71-r0 (Alpine Linux, 2026-11-13), while SUSE lists the issue as pending (SUSE, 2026-11-13). A researcher's public test setup reports memory corruption and Apache child-process crashes on 2.4.70 and a clean run on 2.4.71 (researcher repository, 2026-11-12), and Wordfence says it does not demonstrate remote command execution (Wordfence, 2026-11-12); the researcher's results table records crashes inside the allocator and the HTTP/2 stream code in an instrumented build (researcher repository, 2026-11-12), and the same repository lists mod_h2 2.0.43 as the fixed standalone release.
Publica's own page of 2026-11-10 says the supplier received general extortion letters immediately after the attack, never made concrete with an amount or payment deadline, while PK Softech's page names no letter; watson.ch reports that PK Softech ignores the negotiation-chat prompt Akira left in its network, and SRF's report of a concrete demand with a threat to publish remains unconfirmed by the supplier, Publica and the federal bodies.
Publica's own page, in a correction headed "Stand: 10.11.2026", says that according to current knowledge the affected software supplier received general extortion letters immediately after the attack, which have not since been made concrete with an amount or a payment deadline; that the federal bodies involved know of no concrete ransom demand; that Publica received no demand itself and is in no contact with the attacker group; and that it knows of no case of persons demonstrably contacted or harmed and has no indication of publication on the darkweb (Publica, 2026-11-10). PK Softech's own page of 2026-11-10 mentions no extortion letter and does not name the attackers (PK Softech, 2026-11-10). watson.ch reports that PK Softech confirmed on enquiry that it ignores the prompt Akira left in its network to contact it through an anonymous chat and does not want to negotiate a ransom; watson's reading that the denials mean only that nobody opened the link, and that the firm and the Confederation knew early that Akira was behind the attack, is its own inference (watson.ch, 2026-11-11). SRF reported on 2026-11-10, citing several sources, that the perpetrators demanded ransom and threatened to publish or resell the data, while PK Softech and Publica told SRF that no ransom demand reached them (SRF, 2026-11-10).
eMudhra's full incident report of 2026-11-10 says eight RSA-4096 issuers (G2B and G2C) were revoked on 2026-11-07 with the reason cessationOfOperation because their keys were handled in the memory of a Python script, so eMudhra cannot show compliance with its policy; it had said on 2026-10-19 that they were not impacted, no source says the keys leaked, and the G2C issuers had issued end-entity certificates.
eMudhra posted its full incident report in the Mozilla bug on 2026-11-10 (eMudhra, Mozilla bug 2083449, 2026-11-10). For the eight RSA-4096 issuers (G2B and G2C) it says the key integrity is intact, all signatures verifying, but that during re-import the private-key material was handled in the volatile memory of a Python process on the ceremony host, which is not consistent with its certification practice statement, so the RSA issuers are treated as not meeting it; it adds that logs cannot reliably establish or exclude how that material was handled (eMudhra, Mozilla bug 2083449, 2026-11-10). It identified this in early November after a root-program discussion, revoked the eight issuers on 2026-11-07 with the reason cessationOfOperation, not the compromise reason used for the ECDSA set, and had written on 2026-10-19 that the RSA issuers were not impacted (eMudhra, Mozilla bug 2083449, 2026-11-10; eMudhra, Mozilla bug 2083449, 2026-10-19). The G2C issuers were put into production in May 2026 and issued end-entity certificates, the last on 2026-11-03, after which issuance from them stopped; BleepingComputer reports that eMudhra says the affected customer certificates were replaced or migrated, and that the company has not detected malicious use of the keys (eMudhra, Mozilla bug 2083449, 2026-11-10; BleepingComputer, 2026-11-11). eMudhra also decided to exit public TLS, with all issuance from its emSign Root CA - G1 hierarchy to stop before 2026-11-16 and an independent review due 2026-12-04 (eMudhra, Mozilla bug 2083449, 2026-11-10). No page read from Google, Microsoft, Apple, Mozilla or the incident tracker names the G2B or G2C issuers or says a vendor blocked them.
Siemens revised SSA-834709 to V1.2 on 2026-11-10 and added a second affected configuration for each of the four IoT2050 variants, all versions running Example Image versions with Node-RED installed, for which no fix is available; the V4.3.4-1 fix and the interim mitigations apply only as stated for Industrial OS and Node-RED.
Siemens revised SSA-834709 to V1.2 on 2026-11-10, describing the change as "Added additional affected configuration for SIMATIC IoT2050 family" (Siemens ProductCERT, 2026-08-11). For each of the four variants the advisory now lists a second affected configuration, "All versions running Example Image versions with Node-RED installed", for which "Currently no fix is available"; the fix, update to V4.3.4-1 or later, applies only to the Industrial OS configurations, and the two mitigations, hardening Node-RED and uninstalling it, apply to all eight (Siemens ProductCERT, 2026-08-11). The advisory's title and summary still say "with Industrial OS", Siemens does not define Example Image, and the advisory makes no statement on exploitation; VulnCheck remains the only exploitation source (VulnCheck, 2026-11-01).
Siemens' advisories SSA-242944 and SSA-678870 of 2026-11-10 extend the exploited Brotli flaw to 15 industrial and 28 software products, among them SIMATIC WinCC, the User Management Component, TIA Administrator, Teamcenter and the Opcenter family; only WinCC OA V3.20 and BRAUMAT and SISTAR have a fix, and the mitigations differ by product, with none listed for some.
Siemens published SSA-242944 and SSA-678870 on 2026-11-10, each still interim, extending CVE-2026-111497 to 15 industrial and 28 software products (Siemens ProductCERT, 2026-11-10; Siemens ProductCERT, 2026-11-10). Fixes exist only for SIMATIC WinCC OA V3.20 below V3.20 P17.1 (update to V3.20 P17.1) and for BRAUMAT and SISTAR V8.2 Update 1 to below Update 5 (update to V8.2 Update 5); Siemens plans no fix for the SIMATIC Profiling Tool and lists none available for SIMATIC WinCC V7/V8, WinCC Unified, WinCC Runtime Professional, WinCC Companion, WinCC OA V3.21, TIA Administrator, the User Management Component, COMOS Walkinside, the Project Server Web Administration Tool or, in the software advisory, any of the 28 products, among them Teamcenter V2412 to V2606, the Opcenter family, PADS and Xpedition (Siemens ProductCERT, 2026-11-10; Siemens ProductCERT, 2026-11-10). For the industrial products the mitigation is to disable Brotli compression and decompression at the application or proxy layer where it is not required, and the User Management Component and, when UMC authentication is enabled, TIA Administrator also get an IIS request-filtering rule that denies the value br in the Content-Encoding header (Siemens ProductCERT, 2026-11-10). For the software products Siemens points Teamcenter, the Opcenter family and Process Preparation X to knowledge-base articles that need a Siemens login and were not readable without one, tells HyperLynx, PADS and Xpedition to disable Brotli compression and block it at the network firewall, and lists no mitigation for Innexis Architecture Native Acceleration, Insights Hub, PAVE360 Automotive and Simcenter Executable Digital Twin and Studio (Siemens ProductCERT, 2026-11-10). Polarion, Solid Edge, Calibre, Capital and four other software products are listed as not affected because Node.js is not present or predates Brotli (Siemens ProductCERT, 2026-11-10). Neither advisory says anything about exploitation; the exploited status rests on CISA's listing.
Fortinet's advisories of 2026-11-10 carry ten more critical rows than the nine first listed across FortiAnalyzer, FortiManager, FortiOS, FortiMail and FortiClient, and the October builds do not fix every row: FortiAnalyzer and FortiManager 8.0 have no fixed build for CVE-2026-126170 until 8.0.3, FortiMail 7.2 awaits 7.2.10 for CVE-2026-126150, and FortiOS 7.0 and FortiAnalyzer and FortiManager 7.2 and 7.0 must migrate.
The advisory pages carry ten more critical rows (CVSS 9.0 or higher), shown above, and the October builds do not fix every row: FortiAnalyzer and FortiManager 8.0.0 through 8.0.2 have no fixed build for CVE-2026-126170 until the upcoming 8.0.3 (Fortinet PSIRT, 2026-11-10), FortiMail 7.2 awaits 7.2.10 for CVE-2026-126150 (Fortinet PSIRT, 2026-11-10), FortiAnalyzer and FortiManager 7.2 and 7.0 must migrate for CVE-2026-126229 (Fortinet PSIRT, 2026-11-10), and FortiOS 7.0 must migrate for CVE-2026-126253 and CVE-2026-126259 (Fortinet PSIRT, 2026-11-10) (Fortinet PSIRT, 2026-11-10).
Trend Micro released critical patches for Apex Central (build 7351, whose readme names PHP2Shell) and Apex One Service Pack 1 (build 20113, whose readme names no flaw) on 2026-11-11, both upgrading PHP to 8.2.35, while its advisory, last updated 2026-11-04, still shows both as awaiting patches; Mobile Security for Enterprise and Deep Discovery Analyzer remain pending.
Kaspersky reported on 2026-11-11 that the Citrus ransomware group attempted Certighost in intrusions that began with stolen contractor VPN and RDP credentials, leaving machine accounts named GHOST plus eight random letters; it does not say an attempt succeeded and Microsoft's record still lists no confirmed exploitation.
Kaspersky's Citrus report of 2026-11-11 says the group attempted to exploit Certighost with an exploit published on GitHub, requesting a Machine-template certificate on behalf of a newly created account with the cdc attribute pointing the CA at a system it controlled, and that the group later deploys its Go ransomware domain-wide through a malicious Group Policy Object (Kaspersky, 2026-11-11). Kaspersky says that if exploitation succeeds the CA issues the certificate and the domain controller name in it lets the attackers authenticate as the domain controller account, and it never says an attempt succeeded (Kaspersky, 2026-11-11); Microsoft's record has not been revised since 2026-07-14 (Microsoft MSRC, 2026-07-14).
Microsoft's Edge notes now list the exploited-flaw fix in Edge for Android 157.0.4341.53 while no Edge desktop release names it, Extended Stable 156.0.8078.96 of 2026-11-09 already carried the fix, and Stable 157.0.8103.78/.79 and Extended Stable 156.0.8078.100 of 2026-11-11 replace the first fixed builds as the update target; Google's Stable page files a second XML bug under the exploited CVE while its Extended Stable page lists it under its own id.
Google released Stable 157.0.8103.78/.79 on 2026-11-11 with 83 security fixes, five of them Critical use-after-free bugs (Google, 2026-11-11), and Extended Stable 156.0.8078.100 the same day with 72 fixes, four of them Critical (Google, 2026-11-11); neither post lists the XML use-after-free again, and both builds are later than the fixed ones. Microsoft's Edge release notes of the same day list Edge for Android 157.0.4341.53 as containing the fix, while the newest Edge desktop release on the page is 157.0.4341.42 of 2026-11-05 and names no CVE (Microsoft, 2026-11-11). Google's Stable page for 157.0.8103.50 files Chromium bug 572578603 inside the row for the exploited flaw (Google, 2026-11-09). Its Extended Stable page of the same day lists the same bug as a separate High row under its own CVE id (Google, 2026-11-09); both pages list it as fixed and differ only on its CVE id.
Update every SIMATIC IoT2050 running Industrial OS (Advanced, Basic, M.2 and SM) to V4.3.4-1 or later now; on units running Example Image versions, for which Siemens has no fix, and wherever the update cannot happen at once, uninstall Node-RED if it is unused or harden it as Siemens' Node-RED User Guide describes and take its HTTP interface off networks that untrusted hosts can reach, since exploitation takes a single unauthenticated request.
On every Node-RED instance that was reachable from an untrusted network, review the deployed flows for exec nodes and http-in endpoints that nobody built, and the access logs for POST requests to /flows from non-engineering addresses.
In every Microsoft Entra tenant you run or manage for others, open the Authentication methods policy for SMS, list who is enabled and who actually signs in with SMS using the Authentication methods activity report, and turn off 'Use for sign-in' (labelled 'Enable first factor sign-in' in Microsoft's how-to) for everyone who has an alternative; where it must stay for frontline workers, restrict it to that group and monitor it, because the CCB reports successful attacks against it.
On every ScreenConnect instance your organisation or its IT providers run, disable the RMM+ extension immediately, verify it stays disabled and do not re-enable or reinstall it (on-premises instances by hand; ConnectWise removed it from cloud-hosted ones), review Run Command and Toolbox history and the instance audit logs for executions nobody started, including before 2026-11-11, and check managed endpoints for a second ScreenConnect client service; open no interactive session to a suspect host, use EDR live response or WinRM, because a session can trigger the toolkit to spread to the technician's workstation; update every technician host client to ScreenConnect 26.6.5 or later, because a cloud-console update does not update them.
Update Chrome to the current Stable build, 157.0.8103.78 or later (157.0.8103.50 is the first fixed build), and Extended Stable to 156.0.8078.100 or later on every managed endpoint, force the browser relaunch now, update Edge for Android to 157.0.4341.53, and install the Edge desktop and other Chromium-browser updates as soon as each vendor lists CVE-2026-125350 as fixed.
Upgrade every FortiMail to 8.0.2, 7.6.7 or 7.4.9 (a 7.2 unit moves to a fixed release; 7.2.10 for CVE-2026-126150 is not released), every FortiAuthenticator to 8.0.4 or 6.6.11, every FortiOS to 8.0.2, 7.6.8, 7.4.13 or 7.2.14 (a 7.0 unit migrates), and every FortiManager and FortiAnalyzer on 7.6 or 7.4 to 7.6.8 or 7.4.12 (7.2 and 7.0 migrate), internet-facing units and FortiMail first, because the advisories describe unauthenticated code execution and account takeover and Fortinet warns that patch differences show attackers where the weakness sits; keep the FGFM and oftp ports and every administrative interface off untrusted networks.
On every FortiAnalyzer and FortiManager (Cloud variants included) on 8.0.0 through 8.0.2, set rpc-permit none on every administrator profile that has the JSON API enabled until Fortinet releases 8.0.3, because no 8.0 build fixes the unauthenticated 9.8 flaw CVE-2026-126170 and 8.0.2 is affected.
Confirm the July 2026 cumulative update (2026-07-14) is applied to every Enterprise CA; on any CA where it is not, clear the chase-fallback flag with certutil -setreg policy\\EditFlags -EDITF_ENABLECHASECLIENTDC and restart the service with Restart-Service CertSvc -Force, after testing in staging because legitimate workflows that rely on the chase fallback will break.
On every Plone site, update to CMFPlone 6.2.3, 6.1.6 or 6.0.16 with the helper packages the Plone team lists, or install Products.PloneHotfix20261110 on any version from 4.3 to 6.2, restart all Zope instances, keep blocking URLs that contain portal_modifier at the front web server, and then check the modifier conditions with @@check-modifier-conditions or the hotfix's startup warning, because an anonymous request can already have stored a malicious condition that survives the fix.
On every internet-facing Apache HTTP Server that loads mod_http2, update to 2.4.71 or to your distribution's fixed package (Debian bookworm 2.4.71-1~deb12u1 or trixie 2.4.71-1~deb13u1, Ubuntu per USN-9090-1, Alpine 2.4.71-r0, RHEL 9 mod_http2 2.0.26-7.el9_9.1, RHEL 10 mod_http2 2.0.29-5.el10_3.1) and restart it; where no fixed package exists yet, as on Debian forky and SUSE, remove h2 and h2c from the Protocols directive until one does, because Red Hat reports an unauthenticated code-execution path and a public exploit, though it rates its RHEL 9 and 10 packages Important rather than Critical for their harder exploitation.
Install the latest .NET security updates through Windows Update on every Siemens Desigo CC V8 and V9 host, update Siemens Gridscale X DSA V5.3 to V5.4 and Gridscale X PSS®E to V36.8.0, and update WinCC OA V3.20 to V3.20 P17.1 and BRAUMAT and SISTAR to V8.2 Update 5.
On the SSA-242944 products Siemens lists with no fix or no planned fix (SIMATIC WinCC V7/V8, WinCC Unified, WinCC OA V3.21, WinCC Runtime Professional, WinCC Companion, the Profiling Tool, User Management Component, TIA Administrator, COMOS Walkinside and the Project Server Web Administration Tool), disable Brotli compression and decompression at the application or proxy layer where it is not required and add the IIS request-filtering rule that denies br in the Content-Encoding header on UMC (on TIA Administrator when UMC authentication is enabled), and on every Industrial Edge Management instance running Common Configurator uninstall all Management Applications and put it behind a firewall or WAF.
Apply Mitel's workaround articles KB000129034 (OpenScape SESAP), KB000129100 (OpenScape SBC) and KB000129114 (OpenScape Contact Center) on the OpenScape SESAP, SBC and Contact Center systems in use, because Mitel has released no update for them.
Install Trend Micro's Apex Central Critical Patch build 7351 and Apex One Service Pack 1 Critical Patch build 20113 (both released 2026-11-11; the Apex One readme updates PHP to 8.2.35 without naming the flaw) on every server now and keep their consoles on administrator networks until done; for Mobile Security for Enterprise (patch due 2026-11-17, mitigation from Trend Micro support) and Deep Discovery Analyzer (due 2026-11-18) keep the interim mitigation until the patch ships; install the critical patches the table lists for Deep Discovery Inspector and Email Inspector.
Install KACE SMA 15.0 CU5 or 15.1 CU2 and the SDA 9.3 hotfix 9.3.313 (9.3.312 where already installed), and until then block inbound ports 80, 443 and 52230 to every appliance, as Quest advises.
Update every non-browser TLS client that keeps its own CA bundle or does not check revocation to a fixed version: standalone Java runtimes, including those already updated on 2026-10-21, to the update of Oracle's Security Alert CVE-2026-114820 or OpenJDK (Oracle Database Server, Autonomous Health Framework and OPatch installations too), Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 or 3.11.18 together with pip 26.2.2 or later, Go 1.27.3 or 1.26.10, self-managed GitLab to a fixed patch release together with GitLab Runner 19.5.1, and SonicWall Gen7 firewalls with Client DPI-SSL enabled to SonicOS 7.3.4-7015 or later and Gen8 to 8.2.3-8015 or later; then confirm with curl against the incident tracker's test host that the client rejects the certificate; on managed Macs update to macOS 27.2.1, 26.7.3 or 15.8.3, or where that is not possible remove emSign ECC Root CA - G3 from /etc/ssl/cert.pem as Apple describes (AAA Certificate Services is optional and can stop tools that read only that file from verifying some unaffected sites).
Replace, by hand where the ACME client does not support ACME Renewal Information, every TLS certificate your organisation holds that chains to emSign ECC Root CA - G3 or to another of the seven certificates Microsoft removed from the Windows and Edge trust lists, or that was issued by one of the eight RSA G2B and G2C issuing CAs eMudhra revoked on 2026-11-07, because Chrome's removal of the G3 root was due on 2026-10-27 and the Windows change takes effect when the trust-list update reaches a device; deliver the updated Disallowed Certificate Trust List and the trust-list changes Microsoft describes, including its out-of-band update of 2026-10-26, to Windows devices that do not receive automatic certificate-trust updates; do not renew or reissue under emSign Root CA - G1 after 2026-11-16, because Chrome 153 and higher will not trust by default a certificate under it whose earliest SCT is later, and Windows, Edge and WebView2 stop trusting the remaining eMudhra roots on 2026-11-16 as Microsoft's update of 2026-11-10 describes.
Apply Cisco's remediation now for the products its eMudhra advisory (version 1.9) lists with a fix or a procedure available: the CA-trust distrust guide for IOS XE and the guidance for Secure Firewall ASA, FTD and FMC, Secure Email Gateway and Secure Email and Web Manager (run the updatenow command where updates are manual), Duo Access Gateway 3.2.0, Duo Network Gateway 3.4.1, Duo Agentic Authorization Connector 1.0.1 and ThousandEyes Enterprise Agent (Application-hosting Agent 5.2.2).
2026-11-12T0255Z-intel· Sonnet 5.5 · window 26 h · 6 entries published
Verification & coverage notes
Window: standard 26 h (gap to the previous fire 24.0 h). KEV sweep: no catalogue additions in the window and no ransomware-flag flips on covered entries. Held backlog row left untouched: zohe-hainaut-est (no source found, expiry 2026-11-17).
borderline-drop: Node.js 2026-11-11 security releases (seven high CVEs), scheduled release, no exploitation or PoC, regular patch cycle (PD-11 b)
borderline-drop: Arista EOS BGP stack overflow CVE-2026-121289, needs a BGP peer, no exploitation
borderline-drop: PTC Windchill CVE-2026-126325, CNA record only, no fix or technical detail readable
borderline-drop: Xen XSA-529/530, timing inference of the XAPI pool secret, no exploitation, primary 7 h before window
borderline-drop: Red Hat Quay CVE-2026-123710, scores preliminary, no fixed build named, no exploitation
borderline-drop: React Server Components CVE-2026-126187, vendor advisories of 14/22 Oct, narrow condition, no confirmed exploitation
borderline-drop: PAN-OS November batch, Checkmk, Rails 8.0.5.2/8.1.4.1, git v2.56.1, Firefox 160/ESR, Zoom ZSB-26023, routine monthly releases or authenticated/user-interaction flaws, no exploitation
borderline-drop: Ubuntu tracker status for CVE-2026-98432; Ivanti CVE-2026-121683 contradictory CNA record, incremental, no decision changes
borderline-drop: France summons Iran's ambassador / Iran rejects Danfoss attribution, diplomatic track, no technical delta (would re-float a high entry)
borderline-drop: ARTEX successor frameworks (Unit 42/Sophos/Arctic Wolf AntiFox), marginal delta on an entry already past its word bound
borderline-drop: SpecterOps multi-tenant Entra app explainer, no new incident fact, audit step already in the ConnectWise and exposed-credentials entries
borderline-drop: Poland ePUAP offline, vector and actor undisclosed, no Swiss link (incident floor)
borderline-drop: MongoDB CVE-2026-118383, replica-set peer path, crash only reproduced, no exploitation
borderline-drop: Report URI scan data on the APT29 watering hole, marginal delta
borderline-drop: Kaspersky IT threat evolution Q3 2026, detection counts, no defender takeaway
borderline-drop: PowerFolder cloud breach and /wopi/ server flaw, no CVE, no technical detail, no constituency deployment shown
borderline-drop: CNIL ten sanctions on French territorial authorities, generic hardening failings, no Swiss obligation change
borderline-drop: University of Tuebingen, Gleis D Chur (Cloak), INCERT eTourismus (Zermatt Tourismus), Maileva, Notion/Fireworks AI, Maersk, private or foreign victims without a stated transferable technique or vector (incident floor)
Verification: four iterations. Iteration 1 found 29 findings (16 truth, 6 editorial, 7 advisory), iteration 2 found 19, iteration 3 found 9 (one new upstream fact: Huntress updated its ScreenConnect post with the RMM+ blank-access-key finding), and iteration 4 returned NEEDS_FIXES with truth 2 and editorial 0 and no F1 or F4, so decision rule 5 applied: the five findings were remediated, the gate re-run clean (58 pass, 0 warn, 0 fail), and the fire published on that early exit without a fifth pass. No double-CLEAN was reached; the two residual truth findings are fixed but unverified by a further cold pass, and the audit should give the ScreenConnect and Fortinet entries an independent read.
Operational notes: the jina reader pool is dead (every key HTTP 402), so pages that only the reader could serve were read by WebFetch or reported as unconfirmed. Research workers FU2 left six stray stub files at the filesystem root (/A_chrome_android.md, /A_chrome_android.err, /A_chrome_extended_156.md, /A_chrome_extended_156.err, /A_edge_security.md, /A_edge_security.err); the sandbox safety check denied deleting them and the run did not work around it, so the operator may remove them. They hold fetch scratch output only and are not part of the repo.
Gate note for the audit: check_run.pycitation-cve matches an id against a skeleton that joins the id to the digits of the next bug number on Chrome Releases rows, so a clause naming CVE-2026-125346 on the Extended Stable page reads as a miss although the id is on the page; the Chrome entry avoids naming the id there. The three KEV additions the verifier listed for 2026-11-09 and 2026-11-10 without entries (CVE-2026-20320 Cisco BroadWorks, CVE-2026-102895 GPUStack, CVE-2026-111793 Openwave Webtop) were dispositioned as borderline-drops by the 2026-11-10 and 2026-11-11 fires and are left for the audit sweep. The main analyses of the Publica (1100 words) and eMudhra (895) entries stay above the 550-word bound as before this fire, for the audit to restructure.
Source health: seven records stay UNSOLVED. Fixed this run: ico-uk, safeonweb-be, netzwoche (recipes in sources_changed). Left for a refilled reader pool or a changed host: schneier (blog and atom feed 403 on every free transport), belden-psirt (403 direct), ahnlab-asec (WebFetch reads it; bridge and extract do not), mozilla-ca-compliance-bugzilla (the REST recipe reads, its rows carry no security vocabulary the health check recognises).
Essential-coverage: every essential record was attempted. Coverage gaps: connectwise-trust-center (403 on every transport), sygnia (403), Siemens knowledge-base articles (login-gated), news-admin-ch, srf-news and swissinfo-ger (shallow reach through the listing recipes), the NCSC.ch BACS card recipe, ictjournal-ch, and rapid7's RSS (malformed).