7 verified findings from 1 run · 9 updates to prior coverage · the settled record for this UTC day, in the classic brief order.
Criticality
Kind
Topic
Region
TL;DR · the day in one read
01NetScaler: 28 flaws fixed, one reaches every default ADC and Gateway; update to 14.1-73.57 or 13.1-64.39. Cloud Software Group's bulletin CTX697305 of 2026-11-12 fixes 28 flaws in customer-managed NetScaler ADC and Gateway, 9 of them scored CVSS 4.0 9.0 or above; CVE-2026-120868 (9.3) needs no feature or authentication and affects every deployment in default configuration, and CVE-2026-107412 (9.5) reaches Gateway and AAA virtual servers. The fixed builds are 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS and 13.1-37.293, and bulletin CTX697320 fixes an unauthenticated NetScaler Console authentication bypass in 14.1-74.34; the bulletins describe the impact as unpredictable behaviour or denial of service, offer no workaround and state no exploitation status, while CERT-EU writes that Citrix reports none and no source reports an attack. →
02Huntress: device-code phishing posing as a Teams booking skips URL reputation checks; hunt Cmsi:Cmsi sign-ins. Huntress describes a mid-October 2026 intrusion in which a spear-phish impersonating a company executive led, through a Safe Links-wrapped Google share link that sidestepped URL reputation checks, to a fake Microsoft Teams meeting scheduler whose 'Booking Reference' is a Microsoft device code, with a phishing kit shipped as AES-256-GCM ciphertext that the browser decrypts and a fallback that restarts the device-code session when MFA is required. The account had no MFA enrolled and the captured session was replayed from a residential proxy, showing as a device-code (Cmsi:Cmsi) sign-in followed by programmatic user agents; Huntress names no victim country and no Swiss link. →
03Group-IB: DarkLunnen's FortiOS chain leaves a 'service' super_admin; Swiss FortiGates are scan targets only. Group-IB found an open directory on a Latvian server that documents more than 14 months of operations against Europe by an operator it tracks as DarkLunnen and links to no known actor: a modified public exploit for FortiOS CVE-2024-55591 that creates an administrator named service with super_admin privileges, among other tools. Group-IB recovered a list of 4,725 Swiss FortiGate scanning targets, which it says does not confirm vulnerability or exploitation, and restic commands that accessed an S3 backup repository at a Swiss domain in May and June 2025, without naming an organisation or confirming success. →
Group-IB reports that in late July 2026 it found an open directory on a Latvian server that held the operator's /root/ directory, 457 files of which 35 were recovered, and documents more than 14 months of operations against Europe by an operator it tracks as DarkLunnen; Group-IB links it to no known actor and does not establish nationality or state affiliation (Group-IB, 2026-11-11). The main campaign used a modified watchTowr proof of concept for FortiOS CVE-2024-55591, designed to create a backdoor super-admin account named service (Group-IB, 2026-11-11); the recovered results list about 600 devices in Turkey (hospitals, industry and municipalities), 16 in Ukraine, 14 in Azerbaijan and 1 in Algeria, and a stolen FortiGate configuration from a Romanian organisation carried the same account and yielded 10 cleartext VPN passwords (Group-IB, 2026-11-11).
The Swiss content is thin. Group-IB recovered a list of 4,725 FortiGate scanning targets for Switzerland and says such lists identify scanning targets but do not confirm vulnerability or successful exploitation; a table of additional operations also lists restic commands with AWS credentials accessing an S3 repository at a Swiss domain in May and June 2025, with production snapshots enumerated, and the report names no organisation and says that for several operations the evidence is limited to recorded commands (Group-IB, 2026-11-11). Fortinet's advisory FG-IR-24-535 lists FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12 and 7.0.0 through 7.0.19 as affected, fixed in 7.0.17, 7.2.13 and 7.0.20, names FortiOS 7.2, 7.4, 7.6 and 6.4 as not affected and offers disabling the HTTP/HTTPS administrative interface as the workaround (Fortinet PSIRT, 2025-01-14).
DarkLunnen used a modified proof-of-concept (PoC) exploit developed by watchTowr for FortiGate CVE-2024-55591, designed to create a backdoor super-admin account named “service”.
Additional FortiGate scanning target lists were recovered for Switzerland (4,725 targets), South Korea (5,199), and Ireland (647). These lists identify scanning targets but do not confirm vulnerability or successful exploitation.
For several of these operations, the available evidence is limited to recorded commands. Unless otherwise indicated, the findings do not independently confirm successful exploitation, unauthorized access, or data exfiltration.
In mid-October a Huntress SOC saw an employee of a construction company receive a spear-phishing email from a typosquatted domain impersonating another company's senior vice president; the link in the mail was wrapped by Microsoft Safe Links and pointed to a Google share link that redirected server-side to the lure page, so the mail body held the Google link and not the lure domain, which Huntress says sidestepped URL reputation checks for email security (Huntress, 2026-11-12). The page posed as a Microsoft Teams meeting scheduler, and behind it the backend started a Microsoft device-code sign-in; the "Booking Reference" shown to the victim is the device code, which the victim enters in a genuine Microsoft sign-in window (Huntress, 2026-11-12).
The kit is shipped as AES-256-GCM ciphertext that the browser decrypts, so that to an email scanner or crawler that does not run JavaScript the page is an encrypted blob; if Microsoft answers AADSTS50076 or interaction_required because MFA is required, the kit starts a new device-code session and restarts the flow (Huntress, 2026-11-12). After the victim finished, the attacker held a session token and the device-code login (Cmsi:Cmsi) was routed through a residential proxy; the compromised account had no MFA enrolled and was used from an unmanaged device, and Huntress contained the incident before it escalated (Huntress, 2026-11-12).
Triage: Huntress treats a device-code prompt that follows a link, a booking request or another unexpected interaction as suspicious, and the captured session shows up as a replay from another ASN and region within one session (Huntress, 2026-11-12).
This booking reference is the device code.
To an email scanner or crawler that doesn't run JavaScript, the lure page is just an encrypted blob.
The captured session was replayed from attacker infrastructure; the ASN and region changed inside the same session ID.
StepSecurity reports that from 2026-11-10 an attacker uses stolen GitHub tokens of real developer and bot accounts, as a developer would, not a bug in GitHub Actions, to push a CI secret stealer into repositories those tokens can write to (StepSecurity, 2026-11-12). It first opens a pull request titled "docs: dependency audit notes" from a branch named wfx-docs that only proves write access; StepSecurity counts more than 63,000 such probes by 2026-11-12 (StepSecurity, 2026-11-12), Aikido, which tracks the campaign as wfx-loot, counts 4,837 compromised accounts and at least 1,835 repositories where the payload ran, and Endor Labs counts 8,926 infected repositories (Aikido, 2026-11-12; Endor Labs, 2026-11-12); BleepingComputer reports that the compromised accounts included those of the US General Services Administration and the French government (BleepingComputer, 2026-11-12).
Where the token's permissions and the repository's setup let it run, the attacker pushes a script of about 1,500 lines through an edit to an existing workflow or CI shell script, a new workflow on a short-lived branch or a hidden script that an npm hook runs, and the script collects every Actions secret, the job token, the memory of the runner worker process and credential files for the major clouds and registries, then uses the job's OIDC token to open AWS, GCP and Azure sessions (StepSecurity, 2026-11-12). It plants persistence meant to outlast rotation, a rewritten AWS role trust policy with new access keys and federated identity credentials on Azure applications, sends the archive over HTTP and from 2026-11-12 through a Telegram bot, and within about a minute pushes a revert commit and deletes the workflow run, leaving a gap in the run numbers that StepSecurity calls the most reliable sign the stealer ran (StepSecurity, 2026-11-12). How the tokens were obtained is not known: some probes came through the Fly.io GitHub App, and StepSecurity has no evidence of a breach of Fly.io (StepSecurity, 2026-11-12). BleepingComputer's report of Aikido's findings gives the same probe title and start date (BleepingComputer, 2026-11-12).
Triage: a probe pull request alone shows that the account that opened it is compromised, even if nothing else happened; the payload probably ran where a commit with one of those messages is paired with a deleted run (StepSecurity, 2026-11-12).
The attacker does not exploit a bug in GitHub Actions.
The pull request does nothing by itself. It tells the attacker that the token can write to the repository. If you see one, the account that opened it is compromised, even if nothing else happened.
The gap is the most reliable sign that the stealer ran.
Cloud Software Group's bulletin CTX697305 of 2026-11-12 fixes 28 flaws in customer-managed NetScaler ADC and NetScaler Gateway (Cloud Software Group, 2026-11-12). The bulletin describes the impact as unpredictable or erroneous behaviour or denial of service, while its CVSS 4.0 vectors score confidentiality, integrity and availability impact High on ten rows, and no source says that code execution is possible (CERT-EU, 2026-11-12). The row that applies everywhere is CVE-2026-120868 (9.3), a memory overflow in packet processing with the precondition "All NetScaler ADC and NetScaler Gateway deployments (Default configuration / No additional feature required)" and no authentication or user interaction (Cloud Software Group, 2026-11-12). CVE-2026-107412 (9.5) covers several overflows on an appliance configured as a Gateway (SSL VPN, ICA Proxy, CVPN or RDP Proxy) or an AAA virtual server, which CERT-EU, citing the vendor, says can be reached without authentication (CERT-EU, 2026-11-12); further rows at 9.3 or 8.7 each depend on one configured feature, such as an SMPP, DNS-over-HTTPS or PUSH virtual server or a SAML, WebAuth, email OTP, certificate or LDAP authentication action, and CVE-2026-120863 needs only a path from an untrusted host to the management address NSIP or NSIP6 (Cloud Software Group, 2026-11-12). Bulletin CTX697320 fixes CVE-2026-120869, an unauthenticated authentication bypass on the NetScaler Console, scored 9.4 with an adjacent vector in the bulletin (Cloud Software Group, 2026-11-12) and 9.3 with a network vector in ENISA's record (ENISA EUVD, 2026-11-12).
The fixed builds are 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS and 13.1-37.293 for 13.1-FIPS and 13.1-NDcPP (Cloud Software Group, 2026-11-12), and 14.1-74.34 for the Console (Cloud Software Group, 2026-11-12); Secure Private Access Hybrid deployments must upgrade their NetScaler instances (Cloud Software Group, 2026-11-12). Neither bulletin states an exploitation status or a workaround. CERT-EU writes that Citrix reports no exploitation and no confirmed public proof of concept (CERT-EU, 2026-11-12), NCSC Switzerland lists the exploitation status as unknown (NCSC Switzerland, 2026-11-12), and none of the CVEs is in CISA's catalog. heise reports that Citrix will publish NetScaler security fixes monthly on a fixed date close to Patch Tuesday from now on, with out-of-cycle updates for urgent cases such as active exploitation (heise, 2026-11-12).
All NetScaler ADC and NetScaler Gateway deployments (Default configuration / No additional feature required)
Ten of the flaws are scored as having a high impact on confidentiality, integrity and availability. However, the vendor bulletin describes their impact only as unpredictable behaviour or denial of service
Internet-facing Gateway and AAA appliances should be upgraded first.
Cyderes Howler Cell reports that the exploit was published on 2026-11-10 under a GitHub handle, the same day as November Patch Tuesday, with no coordinated disclosure, no CVE and no patch, and that its team reproduced a SYSTEM shell from a standard user session (Cyderes, 2026-11-12). The chain is a logic bug with no memory corruption: CLFS containers are created through Object Manager symbolic links, an oplock on a bait file confirms that Microsoft Defender has engaged, a call to Defender's signature-update RPC makes clfs.sys create its .cnpf authentication-signature file as SYSTEM at an attacker-chosen path, here hid.dll in the Common Files\microsoft shared\ink directory, a file that does not ship in that directory; the content is replaced with a payload DLL and a runas request makes consent.exe load it, which starts a SYSTEM conhost.exe on the user's desktop (Cyderes, 2026-11-12). Like every release of the same cluster it needs a foothold on the host first. It applies where the CLFS authentication Mode value, under HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication, is 0 or 1 (Cyderes, 2026-11-12).
Cyderes says the feature ships enabled on current Windows versions and that the researcher tested Windows 11 26H2 and experimental builds of Windows 11 and Windows Server 2025; the researcher's estimate that 80% of Windows installations are vulnerable has no data behind it (Cyderes, 2026-11-12). The researcher adds that, because the privileged file creation appears to come from the antimalware engine's own process, the technique can be used against any antimalware engine's self-defense; that claim rests on his statement alone (BleepingComputer, 2026-11-12). No source reports exploitation, and Microsoft had not commented publicly as of 2026-11-11 (SecurityOnline, 2026-11-11).
Triage: Cyderes calls a hid.dll creation in the ink directory and a Defender signature-update RPC from outside the Defender service tree rare enough in a typical estate to alert on rather than hunt, and the first is a successful write whatever the variant (Cyderes, 2026-11-12).
The exploit was published on November 10, 2026, under the MSNightmare handle on GitHub. No coordinated disclosure, no CVE, no patch.
Alert on any creation of hid.dll in the ink directory. The file does not ship there with Windows, so any appearance indicates a successful write regardless of variant.
The researcher estimates 80% of Windows installations are vulnerable, though no data supports that figure.
VulnCheck, the assigning CNA, describes unauthenticated command injection in XWEB EVO through the password field (VulnCheck, 2026-11-12) and the username field (VulnCheck, 2026-11-12) of its login and API scripts, and through the sh parameter of the setuid xwconsole.cgi (VulnCheck, 2026-11-12), all reaching root; a hard-coded password for the built-in Administrator account that gives a full session in one request (VulnCheck, 2026-11-12); and Administrator and root passwords that can be computed offline from the device MAC address and the date (VulnCheck, 2026-11-12; VulnCheck, 2026-11-12; VulnCheck, 2026-11-12). The cluster holds 14 records, and the seven scored 9.2 or higher are the ones covered here (ENISA EUVD, 2026-11-12). The records' ranges end before 5.6.2 or 5.7.0 or run through 5.8.8, but Copeland's download pages list EVO packages only up to 5.2.3 of 2018 (Copeland, 2026-11-13), and its bulletin says software support ended on 2026-03-16 with no further firmware or security updates (Copeland, 2026-03-16), so no source shows where a fixed build can be had.
No source reports exploitation or a public proof of concept for these CVEs, and none ties them to the compromises of Danfoss, Copeland and Dixell controllers. Copeland's bulletin of 2026-10-14, carried in the Dixell France guide that CERT-FR links, acknowledges a vulnerability on an end-of-life generation of XWEB EVO controllers and tells operators to remove all XWEB EVO units from the public internet immediately (translated from French) (Dixell France, 2026-10-14); NCSC Switzerland says that guidance addresses end-of-service XWEB EVO systems and that the public information does not confirm exploitation of the Danfoss CVEs it lists (NCSC Switzerland, 2026-11-06), and BACS lists Copeland and Dixell XWEB as potentially affected (BACS, 2026-11-10). The one compromised-unit log read concerns an XWEB Pro, not an EVO (Ransom-ISAC, 2026-11-06).
PTC's CNA record, published on 2026-11-11, describes CVE-2026-126325 as a critical remote code execution flaw in PTC Windchill and PTC FlexPLM that may be exploited through the deserialization of untrusted data, scored CVSS 4.0 9.2 with high attack complexity, no privileges and no user interaction (ENISA EUVD, 2026-11-11). NCSC Switzerland says successful exploitation lets remote attackers achieve code execution and potentially full system compromise through crafted network requests carrying malicious serialized data, with network access to the exposed system as the prerequisite (NCSC Switzerland, 2026-11-12); BSI describes a remote, anonymous attacker (translated from German) (BSI CERT-Bund, 2026-11-11). The affected release lines are Windchill 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0 and 13.1.0.0 to 13.1.4.0, with ten FlexPLM releases up to 13.1.3.0 (The Hacker News, 2026-11-12).
PTC's Trust Center says a patch has been available since 2026-11-11, that a Windchill administrator applies it, that PTC-hosted environments were patched on the customer's behalf, and that self-hosted customers are urged to apply it as soon as possible (PTC Trust Center, 2026-11-11). The vendor advisory sits behind a customer login, so no fixed release is public (NCSC Switzerland, 2026-11-12). NCSC Switzerland lists the exploitation status as unknown (NCSC Switzerland, 2026-11-12), and PTC's change log records no attack on this flaw (PTC Trust Center, 2026-11-11). The product has a history: CISA listed the earlier Windchill and FlexPLM flaw CVE-2026-12569 as exploited in June (The Hacker News, 2026-06-26), and Ransom-ISAC, eCrime.ch and DEFUSED reported Cl0p-linked attackers chaining a FlexPLM information disclosure with a Windchill login-servlet flaw to drop JSP web shells (The Hacker News, 2026-07-25).
If your Windchill or FlexPLM environment is hosted by PTC, the patches have been applied on their behalf. No action is required on your part.
Successful exploitation allows remote attackers to achieve remote code execution and potentially full system compromise via crafted network requests containing malicious serialized data.
ANSSI's second REACTIV report of 2026-11-12 counts 64 further breaches, five at ministries, says all exploit the weaknesses already listed and names the reuse of stolen secrets as the technique, with new cases of an SMS second factor validated by the attacker and IDOR flaws combined with infostealer credentials.
ANSSI's second REACTIV situation report, published on 2026-11-12, counts 64 new data breaches brought to its attention since the first report of 2026-09-30, five of them at ministries or bodies under their supervision, with a significant fall in breaches detected or claimed at ministry level; it says all of them exploit weaknesses already named in September and gives the reuse of stolen secrets to reach ministry applications as the technique, which lets attackers extract the data legitimately (translated from French) (ANSSI, 2026-11-12). The new cases it describes: stolen technical accounts reused against a foreign-ministry library portal after a server compromise; an IDOR flaw in the payment API of a public registration portal for the hunting-licence exam, exposing more than a thousand people; an agent's France Travail account compromised with the SMS second factor validated, with the data of more than 60,000 agents and professionals claimed on a forum; and partner-account credentials from infostealers without two-factor authentication, combined with an IDOR flaw on a URL exposing file identifiers, which let attackers extract close to 1.2 million files from the CAF's VACAF service in three days. Education nationale is now put at 25 of 30 académies, with lateral movement over the interministerial network (ANSSI, 2026-11-12). ANSSI's recommendations are renewing compromised or suspect secrets first, systematic strong authentication, strict control of privileged accounts and tighter filtering to prevent exfiltration (ANSSI, 2026-11-12).
ConnectWise's CNA record CVE-2026-127063 (CVSS 4.0 9.3) says the RMM+ extension uses a static API secret by default, names no fix and gives disabling as the mitigation; Huntress's spokesperson and Blackpoint leave the panel-access vector unresolved, so the explanations differ and the action now names RMM+ specifically.
ConnectWise, as CNA, published CVE-2026-127063 (CVSS 4.0 9.3) on 2026-11-12: the third-party RMM+ extension "uses a static API secret by default", no fixed version has been announced, disabling is the mitigation, and ConnectWise has removed the extension from cloud-hosted instances while on-premises customers must disable it and not reinstall it (ConnectWise, 2026-11-12). This differs from Huntress's account of a blank key in versions 1.0.31 and 1.0.32, and a Huntress spokesperson told The Record that it has seen no evidence of a new vulnerability and that how the attacker got panel access is still unclear, while ConnectWise says the extension's API is protected by a passphrase the partner sets (The Record, 2026-11-12). Blackpoint reverse engineered the toolkit, saw unauthorised deployments through legitimate cloud-hosted instances but no successful propagation to a technician workstation, and calls the extensions' role in the first panel access unresolved (Blackpoint, 2026-11-12).
Check Point Research confirms exploitation of unpatched Check Point gateways from 2026-10-30 (PHP2Shell, then the root escalation CVE-2026-123039, exploited against a couple of dozen customers, with a persistent backdoor and an ESXi wiper); the Jumbo takes now carry both fixes.
Check Point Research reports that exploitation of unpatched Check Point gateways began on 2026-10-30 and says it escalated to root with a second flaw, CVE-2026-123039, which Check Point rates CVSS 7.8 and says it saw exploited against a couple of dozen customers (Check Point Research, 2026-11-12; Check Point, 2026-11-12). The attacker left PHP web shells and a root-run backdoor with backup and snapshot persistence, and in the first wave moved by SSH from the gateway to a VMware ESXi host and deleted files there (Check Point Research, 2026-11-12); sk1000302 itself still carries no exploitation statement (Check Point, 2026-11-12). The fix for both flaws is in Jumbo Hotfix Accumulator R82.20 take 14, R82.10 take 52, R82 take 132 and R81.20 take 174 or later (Check Point, 2026-11-12; Check Point, 2026-11-12), none is listed for R81.10 or R81 (Check Point, 2026-11-12), and the Spark fixes are now stated as builds from B998002843 and B996005005 (Check Point, 2026-11-12). Check Point Research describes the TSGA backdoor and its embedded TSProxy library as modified variants of PhiliKit, a framework ESET associated with the China-nexus cluster UNC5221, and says the evidence does not allow a high-confidence assessment of who ran the operation: a single actor, an initial access broker or a false-flag operation all remain plausible (Check Point Research, 2026-11-12).
Apple fixed the Brotli decoder flaw on 2026-11-09 in iOS and iPadOS 27.2.1 and 26.7.3, macOS Golden Gate 27.2.1, Tahoe 26.7.3 and Sequoia 15.8.3, watchOS 27.2.1 and visionOS 27.2.1, and in HomeView Software 27.2 on 2026-11-12; Cisco's advisory, now at version 1.12, lists ISE as not impacted; Apple's pages state no exploitation, so the exploited status rests on CISA's listing.
Apple fixed CVE-2026-111497 on 2026-11-09: its security notes list a Brotli component entry, "An out-of-bounds write issue was addressed with improved input validation", with the impact "Processing maliciously crafted input may lead to memory corruption", in iOS and iPadOS 27.2.1 (Apple, 2026-11-09) and 26.7.3 (Apple, 2026-11-09), macOS Golden Gate 27.2.1 (Apple, 2026-11-09), macOS Tahoe 26.7.3 (Apple, 2026-11-09), macOS Sequoia 15.8.3 (Apple, 2026-11-09), watchOS 27.2.1 (Apple, 2026-11-09) and visionOS 27.2.1 (Apple, 2026-11-09); HomeView Software 27.2, released on 2026-11-12, carries the same fix (Apple, 2026-11-12). The Apple pages read carry no statement about exploitation of this flaw, so exploitation still rests on CISA's listing, and the iOS 18.7.12 (Apple, 2026-11-09) and watchOS 26.6.1 (Apple, 2026-11-10) releases list no Brotli entry, which does not by itself show that those branches are unaffected. Cisco's advisory is now at version 1.12 of 2026-11-12 and lists Identity Services Engine as not impacted (Cisco PSIRT, 2026-10-27).
Microsoft's record, revised on 2026-11-12, lists Windows 10, Windows 11 and Windows Server 2019 to 2025 as affected, with the November 2026 cumulative updates (KB per branch) as the fix, so the Windows update joins the .NET runtime update on the patch list.
Microsoft's record for CVE-2026-111497, revised on 2026-11-12, now lists Windows as affected: the revision note says it updated the Security Updates table to include affected Windows versions and the applicable November 2026 security updates (Microsoft Security Response Center, 2026-11-12). The fixes are the November 2026 cumulative updates, KB5131096 for Windows 10 21H2 and 22H2, KB5131085 for Windows 10 1809 and Server 2019, KB5131090 for Server 2022, KB5131080, or the earlier KB5131077, for Server 2025, KB5131087 for Windows 11 23H2, KB5132061, or the earlier KB5132043, for Windows 11 24H2, 25H2 and 26H2 and KB5132059 for Windows 11 26H1, and the record still marks the flaw not exploited although CISA lists it (Microsoft Security Response Center, 2026-11-12). The record names no Windows component, and it also lists PowerShell 7.4 to 7.6 and Visual Studio 2017 to 2026 as affected (Microsoft Security Response Center, 2026-11-12).
The same flaw, CVE-2026-90436, is exploited against N-able N-central servers that embed Apache Axis (Huntback, Previdian); no source reports exploitation of Confluence, and Apache does not expect to release an Axis 1.x fix, so the Remote API setting stays the lever.
The same flaw, CVE-2026-90436, is now exploited against another product: it is the first stage of the 4EverAble2Shell chain on N-able N-central servers, followed by a separate root escalation (BleepingComputer, 2026-11-12). Huntback counts at least 21 production N-central servers running a cryptominer after a crafted SOAP fault sent to the Apache Axis endpoint (Huntback, 2026-11-12), and Previdian's honeypot recorded attempts at the chain (Previdian, 2026-11-12). No source reports exploitation of Confluence. The Apache Axis project says it does not expect to release an Axis 1.x fix (Apache Axis project, 2026-11-06), so a Confluence instance with the Remote API ticked relies on Atlassian's 9.2.28 or on switching the setting off.
The researcher's second exploit set, 4EverAble2Shell, chains Apache Axis CVE-2026-90436 with a root escalation, works against Hotfix 2 when the Legacy API is on and is exploited on at least 21 production servers per Huntback, with attempts recorded on Previdian's honeypot; N-able has no fix yet and says it has seen no signs of compromise.
The researcher's second exploit set, 4EverAble2Shell, published on 2026-11-12, works against Hotfix 2 builds when the Legacy API is turned on and reachable, and no fix exists. It pairs CVE-2026-90436 in the Apache Axis 1.x SOAP engine (Apache Axis project, 2026-11-06) with a separate root escalation (Huntback, 2026-11-12; BleepingComputer, 2026-11-12). Huntback counts at least 21 production servers, 19 of them on Hotfix 2, mining for one operator (Huntback, 2026-11-12), Previdian's honeypot recorded attempts at the chain (Previdian, 2026-11-12), and BleepingComputer relays both (BleepingComputer, 2026-11-12). N-able said on 2026-11-12 that it had seen no signs of compromise, had no fix for the new claims and planned a follow-up hotfix (Tenable, 2026-11-12); Huntress says a Hotfix 2 server with the Legacy API disabled is not exposed to this chain (Huntress, 2026-11-12).
Debian bookworm and trixie and Alpine now ship 2.4.71 packages, Ubuntu ships backported fixes, and a researcher's public test reproduces crashes on 2.4.70 without, per Wordfence, showing code execution.
Debian's tracker now lists apache2 2.4.71-1~deb12u1 for bookworm (DLA-4902-1) and 2.4.71-1~deb13u1 for trixie (DSA-6620-1) as fixed, with forky still vulnerable (Debian Security Tracker, 2026-11-13); Ubuntu's USN-9090-1 fixes 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10, and 20.04 LTS through ESM (Ubuntu, 2026-11-12) and Alpine 3.21 to 3.24 ship 2.4.71-r0 (Alpine Linux, 2026-11-13), while SUSE lists the issue as pending (SUSE, 2026-11-13). A researcher's public test setup reports memory corruption and Apache child-process crashes on 2.4.70 and a clean run on 2.4.71 (researcher repository, 2026-11-12), and Wordfence says it does not demonstrate remote command execution (Wordfence, 2026-11-12); the researcher's results table records crashes inside the allocator and the HTTP/2 stream code in an instrumented build (researcher repository, 2026-11-12), and the same repository lists mod_h2 2.0.43 as the fixed standalone release.
Trend Micro's advisory of 2026-11-12 now names the Apex Central (CP B7351) and Apex One server (CP B20113) patches and moves the Deep Discovery Analyzer patch to 2026-11-18.
Trend Micro's advisory KA-0024802, updated 2026-11-12, now names the Apex Central patch as CP B7351 and the Apex One server patch as CP B20113 (Trend Micro, 2026-11-12), so it no longer lags the Download Center for those two products. It moves the Deep Discovery Analyzer patch from 12 November to 18 November and keeps the Mobile Security for Enterprise patch at 17 November (Trend Micro, 2026-11-12); the Download Center pages of both products still list no 2026-11 patch (Trend Micro Download Center, 2026-11-12; Trend Micro Download Center, 2026-11-12).
On every FortiGate on FortiOS 7.0 below 7.0.17 (and FortiProxy 7.2 below 7.2.13 or 7.0 below 7.0.20) take the HTTP/HTTPS administrative interface off internet-facing interfaces, and on any unit whose interface was ever reachable list the administrators for an account named service or any unexplained super_admin account and review jsconsole logins; where one is found rotate every secret stored in the configuration, because a patch does not remove an account that already exists.
Upgrade every customer-managed NetScaler ADC and Gateway to 14.1-73.57, 13.1-64.39 (14.1-73.58 FIPS; 13.1-37.293 for 13.1-FIPS and 13.1-NDcPP) and the NetScaler Console to 14.1-74.34, internet-facing Gateway and AAA appliances first, because CVE-2026-120868 affects every unpatched appliance in default configuration and neither bulletin offers a workaround; keep the management address (NSIP) and the Console IP off networks that untrusted hosts can reach.
On every ScreenConnect instance your organisation or its IT providers run, disable the RMM+ extension immediately, verify it stays disabled and do not re-enable or reinstall it (on-premises instances by hand; ConnectWise removed it from cloud-hosted ones), review Run Command and Toolbox history and the instance audit logs for executions nobody started, including before 2026-11-11, and check managed endpoints for a second ScreenConnect client service; open no interactive session to a suspect host, use EDR live response or WinRM, because a session can trigger the toolkit to spread to the technician's workstation; update every technician host client to ScreenConnect 26.6.5 or later, because a cloud-console update does not update them.
Confirm on every on-premises N-central server, yours or your IT provider's, that the Legacy API is disabled and not reachable from the internet, and keep Hotfix 2 (build 2026.4.1.26) and the Agent and Probe upgrades in place; on any server that had the Legacy API on, check the web logs for POST requests to the Axis endpoint /dms/services/ServerUI carrying a SOAP fault and the host for a symlink at the N-central flag file path, and treat a hit as a full compromise, because Hotfix 2 does not fix the chain and 19 of the 21 compromised servers Huntback found already ran it.
Install a Jumbo Hotfix Accumulator at or above R81.20 take 174, R82 take 132, R82.10 take 52 or R82.20 take 14 on every Check Point gateway, management server, log server, Multi-Domain server and Maestro, because it carries both the PHP2Shell fix and the fix for CVE-2026-123039, and until it is in apply the cp-httpd.conf mitigation and stop the dynamic_server process; replace R81.10 and R81 systems, for which no fix for CVE-2026-123039 is listed.
On every gateway that ran Mobile Access, SSL Network Extender, SAML-realm VPN, the captive portal, UserCheck or Zero Phishing before the hotfix, search /var/log/dynamicCli.log for commands that do not use the legitimate Clish wrapper and the Mobile Access login-template directory for PHP files nobody deployed, and treat a hit as a compromise, because the implant has backup and snapshot persistence and one attacker moved from a gateway to an ESXi host.
In every GitHub organisation you or your suppliers administer, search for pull requests titled "docs: dependency audit notes" and for commits titled "ci: refresh build cache", "ci: restore", "ci: cleanup", "chore: add ci helper" or "chore: add dependency audit workflow"; for each account that pushed one, revoke its tokens, rotate every secret its workflows could read and remove the AWS trust-policy changes, access keys and Azure federated credentials the stealer created, because the persistence is designed to outlast rotation.
Apply the patch PTC announced on 2026-11-11 (article CS483249 in PTC's support portal, login required) to every self-hosted Windchill and FlexPLM, internet-reachable servers first, and keep them off networks that untrusted hosts can reach until it is in, because the flaw needs no authentication and PTC names no workaround.
On every internet-facing Apache HTTP Server that loads mod_http2, update to 2.4.71 or to your distribution's fixed package (Debian bookworm 2.4.71-1~deb12u1 or trixie 2.4.71-1~deb13u1, Ubuntu per USN-9090-1, Alpine 2.4.71-r0, RHEL 9 mod_http2 2.0.26-7.el9_9.1, RHEL 10 mod_http2 2.0.29-5.el10_3.1) and restart it; where no fixed package exists yet, as on Debian forky and SUSE, remove h2 and h2c from the Protocols directive until one does, because Red Hat reports an unauthenticated code-execution path and a public exploit, though it rates its RHEL 9 and 10 packages Important rather than Critical for their harder exploitation.
Install Trend Micro's Apex Central Critical Patch build 7351 and Apex One Service Pack 1 Critical Patch build 20113 (both released 2026-11-11; the Apex One readme updates PHP to 8.2.35 without naming the flaw) on every server now and keep their consoles on administrator networks until done; for Mobile Security for Enterprise (patch due 2026-11-17, mitigation from Trend Micro support) and Deep Discovery Analyzer (due 2026-11-18) keep the interim mitigation until the patch ships; install the critical patches the table lists for Deep Discovery Inspector and Email Inspector.
Install KACE SMA 15.0 CU5 or 15.1 CU2 and the SDA 9.3 hotfix 9.3.313 (9.3.312 where already installed), and until then block inbound ports 80, 443 and 52230 to every appliance, as Quest advises.
Install .NET 8.0.33, 9.0.22 or 10.0.14 (11 Release Candidate 3 for the preview) on every host that runs .NET applications, including Windows hosts already updated on 2026-10-13, which still carry CVE-2026-70197; rebuild and republish self-contained applications and rebuild container images from the updated .NET images, because a runtime update on the host does not change a bundled runtime; install the November 2026 Windows cumulative update of each branch (KB5131096, KB5131085, KB5131090, KB5131080, KB5131087, KB5132061 or KB5132059) on every Windows endpoint and server, because Microsoft's record now lists Windows as affected and CISA lists the flaw as exploited.
2026-11-13T0256Z-intel· Sonnet 5.5 · window 26 h · 7 entries published
Verification & coverage notes
Window: standard 26 h (gap to the previous fire 24.0 h). KEV sweep: no catalogue additions in the window and no ransomware-flag flips on covered entries. No closed-source drops present (S5 not spawned). Seven new entries (eight composed, one dropped by verification) and nine changelog records; no deep dive and no critical: nothing met the stop-and-act bar. The will-publish set exceeded eight items, so the Phase 4 deep read of the primaries was delegated to five scoped cti-research workers (DR-A to DR-E, saved bodies under work/<run-id>/bodies/); two of them did not report call telemetry (null in the block above), and the bridge-fetch counts of DR-A and DR-B are the workers' own approximations.
Inclusions with reduced confidence or carve-outs:
Citrix NetScaler ADC/Gateway CTX697305 (high): vendor bulletin plus watchTowr credit, no exploitation reported; high because the default-configuration gateway role is the constituency's exposed edge (the verifier questioned the call because the vendor states a crash or denial-of-service impact and no source reports code execution or exploitation; kept, since an unauthenticated default-configuration flaw scored up to 9.3 on an internet-facing gateway decides a 7-day patch window, and the body states both limits). Citrix revised the bulletin on 2026-11-12 after the slice captured it, correcting seven mistyped CVE numbers (now CVE-2026-111333 to CVE-2026-111339); the verifier caught it in iteration 4 and the entry now carries all 29 records.
PTC Windchill/FlexPLM CVE-2026-126325: the vendor's Trust Center and CNA record are the primary; NCSC Switzerland, BSI, ENISA and The Hacker News restate them and the fixed releases are behind a customer login, so confidence stays medium; references the two earlier Windchill entries.
DarkLunnen (Group-IB): admitted through the rotational-lookback rule (d); cves[] left empty so the entry does not collide with the Gunra and Gentlemen entries that carry the same FortiOS ids; references the Gunra entry.
SignDrop (CLFS LPE, public PoC, no patch): reproduction and detection tables from one research source plus the PoC publication; no CVE assigned yet, cves: [].
Dixell/Copeland XWEB EVO: VulnCheck CNA cluster, seven records all no-patch; actions: [] because the earlier Danfoss entry already carries the do-now step.
Check Point PHP2Shell update: priority raised notable to high on the vendor's new SK1000302 portal and VPN-gateway scope plus CVE-2026-123039; the main analysis was rewritten and stays above 550 words only by the structured record, flagged for the audit.
N-able N-central / Confluence: the 4EverAble2Shell exploitation of CVE-2026-90436 is recorded on the N-able entry as an update and cross-referenced in prose on the Confluence entry; the Confluence exploited status is not changed (its own product is not shown exploited).
Borderline drops (PD-11 and the incident floor):
borderline-drop: Siemens SSA-166980 PHP2Shell energy and building products: control-centre products, no Swiss public-body link, exploitation needs a reachable PHP portal
borderline-drop: Azul Payara CVE-2026-110003 and CVE-2026-90908: admin interface not normally reachable, no exploitation
borderline-drop: PwnEscape CVE-2026-99999: local guest-to-host vector, lab-only bundle, not on KEV, prior reopen conditions unmet
borderline-drop: Ivanti CSA 5.0.8.1: relay-only and contradicted by its own table, Ivanti pages unreadable on every transport
borderline-drop: Microsoft 365 outage MO1550821: outage, not an attack
borderline-drop: Poland ePUAP: attack repelled per the ministry, no vector or actor
borderline-drop: Mittwald MCP breach: out-of-nexus hosting provider, cause is the vendor claim alone
borderline-drop: Operation Endgame Gootloader, CastleRAT and StealC takedown: commodity loaders, no Swiss defender step named
borderline-drop: Symantec AI-assisted retailer intrusion, Unit 42 CL-STA-1238 Cairn AI framework: out of nexus or already saturated in the store
borderline-drop: Elastic SANSAR Ray GPU cryptomining, Akamai StrikeStub: niche hosts or a single sample, no defender decision (StrikeStub delivers a ClickFix lure from a compromised Swiss site that Akamai does not name, and ClickFix delivery is already covered, so there is no named Swiss victim to act on)
borderline-drop: React Flight CVE-2026-126187: application-code preconditions, no exploitation or PoC, advisory date discrepancy (2026-10-14 vs 2026-11-10)
borderline-drop: Fireworks AI and Notion AI, FBI/DOJ FaceStealer: supplier read-across or a single secondary source with no constituency link
borderline-drop: CNIL ten sanctions on French authorities: swept by the 2026-11-10 fire, outside the window, generic failings
borderline-drop: Liechtenstein VwbP audit tender, Bitdefender Threat Debrief November 2026: governance-only delta or periodic statistics
borderline-drop: Patch Tuesday uncovered 9.8 rows (Xbox Live, Media Foundation, Color Management, DirectMusic, VFP): client-side, exploitation unlikely, fixed by the same cumulative update
Contradictions and source conflicts: the ScreenConnect SCKit entry keeps the Huntress and Blackpoint explanations of the delivery path attributed to each source rather than merged; the CNA record CVE-2026-127063 was added as a structured field. The Citrix CVE-id collision above is the only structural data defect found.
Dropped by verification: the Saxony emergency pager entry (heise and Spiegel, one informant for the message content, no access vector or actor) fell below the incident floor and was removed before publish; it carried no CVEs, so no state needed unwinding.
Dedup: the four entity-overlap WARNs are deliberate decisions, not deltas: SignDrop shares the Windows entity with the Mark-of-the-Web zero-day and eMudhra entries, DarkLunnen the FortiOS entity with the October hardening-release entry, and the Huntress kit the Microsoft 365 entity with the Q3 email-landscape entry; each is a distinct finding on a ubiquitous platform.
Verification: six iterations, no double-CLEAN. Iteration 1 found 27 truth and editorial findings (18 truth, 9 editorial; the Saxony pager entry was dropped for falling below the incident floor), iteration 2 found 7, iteration 3 found 3, iteration 4 found 10 (the main one a Citrix bulletin revision that corrected seven CVE numbers, so the entry now carries 29 records), iteration 5 found 4, and iteration 6 returned NEEDS_FIXES with truth 1 (a citation split on the Check Point update section), editorial 0 and advisory 4, no F1 or F4, so decision rule 5 applied: the finding was fixed, the gate re-run clean (59 pass, 0 fail) and the fire published on that early exit without a seventh pass. The one residual truth finding is fixed but unverified by a further cold pass, as are two last advisory edits (the Citrix body wording and a BleepingComputer government-accounts clause on the WFX Phantom entry); the audit should give the Citrix, Check Point and WFX Phantom entries an independent read. Declined with rationale: the Citrix priority (kept high), the Cisco BroadWorks KEV item, the StrikeStub drop, the Copeland download-page citation date and the .NET Exposure Windows clause.
Operational notes: the jina reader pool is dead (every key HTTP 402, the anonymous tier 401), so pages that only the reader could serve were read by WebFetch or left unconfirmed. Research worker S1 left 18 stray scratch files at the filesystem root (/atlassian.*, /depthfirst.*, /nextjs.*, /picus.*, /qnap.*, /qnap_news.*, /ruby.*, /yeswehack.*, /znuny.*, each a .err plus a .txt, .json or .html); the sandbox safety check denied deleting them and the run did not work around it, so the operator may remove them. They hold fetch scratch output only and are not part of the repo.
Source health: all 314 records read clean after the sweep (UNSOLVED list cleared in the same run). Fixed: ahnlab-asec (WebFetch reads it, every in-container transport is refused with a bare 403; tools/source_health.py now classes a webfetch record whose direct transport is refused with 401/403/429/451 as webfetch-only, with a test in tools/test_source_health.py), schneier (health recipe now reads the home page through extract, the atom-feed titles alone carried too little vocabulary) and mozilla-ca-compliance-bugzilla (content_scope: general-news, the REST rows are CA incident titles). Recipe notes recorded for kaspersky-securelist, rapid7-research, huntress, checkpoint-support, citrix-netscaler-security-bulletins, picus-security-blog and connectwise-trust-center (working fetch target: the ConnectWise CNA disclosure repository on GitHub). Candidate sources added: cyderes-howler-cell, huntback, blackpoint-cyber (each with its reason in sources.json); arctic-wolf-labs, maire-info and dysruptionhub were proposed by the slices and left for a later run.
Essential-coverage: every essential record was attempted. Coverage gaps: connectwise-trust-center (403 on every transport; GitHub disclosure repository substitutes), sygnia (403 on every transport), databreaches.net article pages (Cloudflare interstitial; feed pages only), Ivanti pages (unreadable on every transport), Atlassian bulletin index (stale extract), europol-newsroom (JS application, headline only).