Cyber Threat Brief

Cyber Threat Brief

By Carolina Clear Tech, LLCTechnologyTech News
Download on the App Store

Cyber Threat Brief episodes

  • 2026-11-14: SCKit is abusing ScreenConnect access to compromise MSP-managed endpoints and target technician
    Show Notes - 2026-11-14
    Stories Covered
    • Today:
    • CISA adds exploited UnrealIRCd and Check Point flaws to KEV (CVE-2026-114713, CVE-2026-123039) [Critical Alerts]
    • SCKit abuses ScreenConnect to compromise endpoints and technician sessions [Critical Alerts]
    • Actively exploited flaws threaten Dixell and Copeland refrigeration controllers [Critical Alerts]
    • Operation Endgame disrupts Gootloader, CastleRAT and StealC infrastructure [Ransomware & Extortion]
    • ARTEX moves from authorized testing into criminal and espionage operations [Business & Infrastructure Threats]
    • AI-agent containment requires workflow, identity and network controls [Business & Infrastructure Threats]
    • SignDrop disclosure describes local elevation to SYSTEM through CLFS [Windows / AD Security]
    • Turla's Cereal framework targets Exchange email collection [Windows / AD Security]
    • UK healthcare leaders face November 27 safeguard-response deadline [General Security News]
    • Trezor confirms recovery-phrase implants in reseller-supplied wallets [General Security News]
    • Project Zero shortens vulnerability-disclosure timelines [General Security News]
    • PostgreSQL fixes 52 flaws, including authenticated code execution (CVE-2026-6460, CVE-2026-116322) [Vulnerability Disclosures]
      • CVEs Referenced

      CVE-2026-114713, CVE-2026-116322, CVE-2026-123039, CVE-2026-6460

      Read the full brief

      14 min
    • 2026-11-13: N-central exploitation is reaching servers running Hotfix 2
      Show Notes - 2026-11-13
      Stories Covered
      • Today:
      • N-central exploited despite Hotfix 2 (CVE-2026-90436) [Critical Alerts]
      • SCKit abuses ScreenConnect extensions and technician trust (CVE-2026-84869) [Critical Alerts]
      • Check Point exploitation progresses to ESXi wiping (CVE-2026-109618, CVE-2026-109619, CVE-2026-123039) [Critical Alerts]
      • BlackNevas-linked incident destroys virtualization and backups [Ransomware & Extortion]
      • Campaign indicators for immediate retrospective searches [IOCs & Detection]
      • Microsoft 365 disruption affects email and administration [Business & Infrastructure Threats]
      • SignDrop demonstrates a claimed CLFS privilege-escalation path [Windows / AD Security]
      • Exchange 2016 and 2019 no longer receive security testing [Windows / AD Security]
      • Exploited Outlook spoofing exposes authentication material (CVE-2026-124194) [Windows / AD Security]
      • Operation Endgame disrupts ransomware-enabling malware [General Security News]
      • Citrix fixes NetScaler and Secure Access Client vulnerabilities [Vulnerability Disclosures]
      • PTC patches critical deserialization RCE (CVE-2026-126325) [Vulnerability Disclosures]
      • Siemens advisories extend PHP2Shell and Node2Shell exposure checks [Vulnerability Disclosures]
      • GPUStack authentication bypass attracts scanning (CVE-2026-102895) [Vulnerability Disclosures]
        • CVEs Referenced

        CVE-2026-102895, CVE-2026-107412, CVE-2026-109618, CVE-2026-109619, CVE-2026-111497, CVE-2026-118207, CVE-2026-118268, CVE-2026-118269, CVE-2026-120869, CVE-2026-123039, CVE-2026-124194, CVE-2026-12569, CVE-2026-126325, CVE-2026-84869, CVE-2026-90436

        Indicators of Compromise

        Domains:

        241[.]16, 19[.]204, mo7sen[.]dev, 73[.]103, quill-kraee-um2gf[.]pro, 32[.]130, 131[.]24

        Hashes:

        8b5026d841aa93758ec3cb55c276f84d3ec1cf459810e0d9aa5624e2776f2fcd

        IP Addresses:

        127.0.0.1, 26.11.1.6

        Read the full brief

        16 min
      • 2026-11-12: Prioritize the exploited Outlook NTLM credential-disclosure flaw, exposed N-central servers
        Show Notes - 2026-11-12
        Stories Covered
        • Today:
        • N-central Able2Shell flaws expose privileged management infrastructure [Critical Alerts]
        • Exploited Outlook credential disclosure, critical Exchange and LDAP RCE [Critical Alerts]
        • ScreenConnect abuse reaches 288 endpoints across 48 organizations [Critical Alerts]
        • 9 claims tracked across 1 group [Ransomware Claims (Last 48h)]
        • Maersk confirms data extraction; WhiteArmor's sensitive-data claims remain unverified [Ransomware & Extortion]
        • Qlik Sense intrusion attempts overlap with historical CACTUS activity [Ransomware & Extortion]
        • SCKit and Qlik-associated reverse-shell indicators [IOCs & Detection]
        • GSocket persistence survives application patching [Business & Infrastructure Threats]
        • Hijacked GitHub accounts plant CI secret stealers [Business & Infrastructure Threats]
        • Windows KB5132061 installation failures need deployment verification [Windows / AD Security]
        • Grok-built apps expose business data through public access settings [General Security News]
        • Apache HTTP/2 unauthenticated RCE (CVE-2026-119618) [Vulnerability Disclosures]
        • Ivanti management-plane flaws permit unauthenticated attacks [Vulnerability Disclosures]
        • Zoom Workplace remote privilege escalation [Vulnerability Disclosures]
          • CVEs Referenced

          CVE-2023-41265, CVE-2023-41266, CVE-2023-46604, CVE-2023-48365, CVE-2024-40711, CVE-2026-105425, CVE-2026-108186, CVE-2026-108187, CVE-2026-116928, CVE-2026-119618, CVE-2026-119958, CVE-2026-121653, CVE-2026-121683, CVE-2026-124194, CVE-2026-125882, CVE-2026-125883

          Indicators of Compromise

          Domains:

          255[.]28, 150[.]39, ns[.]mo7sen, sc[.]payproofkit, cdn007-digitaldownloads[.]com, newnewnew[.]gotdns, Soxnewwork[.]homedns, 26[.]23

          IP Addresses:

          5.0.8.1

          Read the full brief

          15 min
        • 2026-11-11: Patch actively exploited Outlook and Chrome flaws, and check Xen Orchestra and AhsayCBS for
          Show Notes - 2026-11-11
          Stories Covered
          • Today:
          • Microsoft Patch Tuesday: exploited Outlook credential disclosure and critical server flaws [Critical Alerts]
          • Chrome XML use-after-free under active exploitation (CVE-2026-125350) [Critical Alerts]
          • Barracuda vulnerabilities enter KEV with November 13 dates [Critical Alerts]
          • BroadWorks and Openwave flaws actively exploited (CVE-2026-20320, CVE-2026-111793) [Critical Alerts]
          • Xen Orchestra authentication bypass enables infrastructure takeover [Critical Alerts]
          • 12 tracker posts dated November 10 across two groups. [Ransomware Claims (Last 48h)]
          • Citrus uses contractor credentials and targets certificate services [Ransomware & Extortion]
          • Vanderbilt restores services after incident claimed by BYOD [Ransomware & Extortion]
          • GhostFrame turns compromised ESXi hosts into post-exploitation platforms [Ransomware & Extortion]
          • Campaign indicators for targeted hunting [IOCs & Detection]
          • AhsayCBS exploitation deploys Python implant (CVE-2026-105133, CVE-2026-105134) [Business & Infrastructure Threats]
          • AD CS certificate validation bypass (CVE-2026-105590) [Windows / AD Security]
          • Industrial products require product-specific mitigations [Vulnerability Disclosures]
            • CVEs Referenced

            CVE-2026-105133, CVE-2026-105134, CVE-2026-105590, CVE-2026-110043, CVE-2026-110068, CVE-2026-111560, CVE-2026-111793, CVE-2026-116606, CVE-2026-116928, CVE-2026-118146, CVE-2026-118148, CVE-2026-118207, CVE-2026-119958, CVE-2026-120002, CVE-2026-124194, CVE-2026-125346, CVE-2026-125350, CVE-2026-20320, CVE-2026-54121

            Indicators of Compromise

            Domains:

            109[.]118, 251[.]112

            Read the full brief

            16 min
          • 2026-11-10: Patch Chrome's actively exploited XML zero-day and keep on-premises N-central servers offline under
            Show Notes - 2026-11-10
            Stories Covered
            • Today:
            • Chrome XML Zero-Day Exploited in the Wild (CVE-2026-125350) [Critical Alerts]
            • N-central Taken Offline Following Able2Shell Disclosures [Critical Alerts]
            • Four Actively Exploited Flaws Added to CISA KEV [Critical Alerts]
            • Queens Public Library Ransomware Disrupts Public Services [Ransomware & Extortion]
            • CWPdoor Replaces the Control Web Panel Web Server [IOCs & Detection]
            • cPGuard Malicious Updates Executed on Customer Servers [Business & Infrastructure Threats]
            • Qubole Trusted AWS Access Used Against Customers [Business & Infrastructure Threats]
            • Refrigeration Controller Attack Causes Physical Damage [Business & Infrastructure Threats]
            • Turla Cereal Toolset Targets Microsoft Exchange [Windows / AD Security]
            • TUM Password Theft Enables Follow-on Administrative Access [Windows / AD Security]
            • Microsoft Confirms Erroneous Outlook.com Message Blocking [General Security News]
            • SAP Fixes Four Maximum-Severity Flaws [Vulnerability Disclosures]
            • SonicOS SAML Controls Bypassed With Alternative Credentials (CVE-2026-19868) [Vulnerability Disclosures]
              • CVEs Referenced

              CVE-2026-102895, CVE-2026-116779, CVE-2026-120017, CVE-2026-123158, CVE-2026-123218, CVE-2026-125350, CVE-2026-19868, CVE-2026-76964, CVE-2026-89103, CVE-2026-89126

              Indicators of Compromise

              Domains:

              141[.]71

              Read the full brief

              14 min
            • 2026-11-09: CISA added SonicOS MFA-bypass vulnerability CVE-2026-19868 to KEV
              Show Notes - 2026-11-09
              Stories Covered
              • Today:
              • SonicOS SSL-VPN Authentication Bypass Added to KEV (CVE-2026-19868) [Critical Alerts]
              • LNbits Calls for Server Shutdown Amid Wallet Attacks [Critical Alerts]
              • SANS Observes SSH Exploitation Attempts (CVE-2026-123158) [Critical Alerts]
              • Unclassified SSH Download Payload [IOCs & Detection]
              • Refrigeration Attacks Put Inventory and Equipment at Risk [Business & Infrastructure Threats]
              • Frontline Education Breach Affected More Than 3 Million People [Business & Infrastructure Threats]
              • BOSSAI Operation Used AI Agents Against Exposed Services [Business & Infrastructure Threats]
              • BluePhishing Demonstrates Entra Agent-Blueprint Consent Abuse [Windows / AD Security]
              • NoName057(16) Publishes Personal Information of European Officials [General Security News]
              • RSA-1024 Research Reduces Certain Attack Costs [General Security News]
              • Additional SonicOS Fixes and End-of-Life GMS Exposure [Vulnerability Disclosures]
                • CVEs Referenced

                CVE-2026-107154, CVE-2026-107155, CVE-2026-109593, CVE-2026-109594, CVE-2026-123158, CVE-2026-19868, CVE-2026-82308

                Indicators of Compromise

                IP Addresses:

                156.238.252.37

                Read the full brief

                14 min
              • 2026-11-08: Apiiro researchers identified 2,539 secrets in public GitHub repositories
                Show Notes - 2026-11-08
                Stories Covered
                • Today:
                • Apiiro identifies 2,539 secrets in public GitHub repositories [Business & Infrastructure Threats]
                • Hundreds of Artex penetration-testing deployments publicly exposed [Business & Infrastructure Threats]
                • Norad discloses grant-portal cyberattack [Business & Infrastructure Threats]
                • Sussex County Prosecutor's Office announces personal-information incident [Business & Infrastructure Threats]
                • British soldier's phone compromise highlights deployment-device controls [General Security News]

                  • Read the full brief

                  6 min
                • 2026-11-07: SonicWall SSL VPN authentication bypass CVE-2026-19868 is actively exploited
                  Show Notes - 2026-11-07
                  Stories Covered
                  • Today:
                  • SonicWall SSL VPN Authentication Bypass (CVE-2026-19868) [Critical Alerts]
                  • OpenSSH SSHole Exploitation Observed on Alpine Honeypot (CVE-2026-123158) [Critical Alerts]
                  • WordPress Update Can Leave One Final Exploitation Window (CVE-2026-119977) [Critical Alerts]
                  • PHP2Shell Chained With Linux Privilege Escalation (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300) [Critical Alerts]
                  • SSHole Exploitation Source [IOCs & Detection]
                  • European Refrigeration Attacks Extend Across Retail and Medical Facilities [Business & Infrastructure Threats]
                  • Claude Code Permission Files Expose Development Secrets [Business & Infrastructure Threats]
                  • Browser Extension Test Reaches Claude Desktop Through Dispatch [Business & Infrastructure Threats]
                  • Storm-3358 Uses ARTEX Against Financial Organizations [Business & Infrastructure Threats]
                  • Teams Help-Desk Impersonation Leads to AD CS Abuse [Windows / AD Security]
                  • DigiCert Archive Exposure Included Identity Documents [General Security News]
                  • Microsoft Paint Fix Requires Store Delivery (CVE-2026-83844) [Vulnerability Disclosures]
                    • CVEs Referenced

                    CVE-2026-109618, CVE-2026-109619, CVE-2026-119977, CVE-2026-123158, CVE-2026-19868, CVE-2026-46300, CVE-2026-83844

                    Indicators of Compromise

                    Domains:

                    89[.]18

                    Read the full brief

                    14 min
                  • 2026-11-06: Patch exposed musl-based OpenSSH servers or disable password authentication
                    Show Notes - 2026-11-06
                    Stories Covered
                    • Today:
                    • OpenSSH authentication bypass affects musl-based Linux systems [Critical Alerts]
                    • CISA adds Apple improper authentication vulnerability to KEV (CVE-2024-27834) [Critical Alerts]
                    • cPanel exploitation illustrates shrinking response windows (CVE-2026-41940) [Critical Alerts]
                    • Reused monitoring credentials enable ESXi ransomware access [Ransomware & Extortion]
                    • Queens Public Library ransomware disrupts public services [Ransomware & Extortion]
                    • cwpdoor backdoor indicators [IOCs & Detection]
                    • Agentic secret-abuse campaign network indicators [IOCs & Detection]
                    • Government agencies warn of refrigeration controller attacks [Business & Infrastructure Threats]
                    • Chainalysis discloses credential and token exposure [Business & Infrastructure Threats]
                    • CRAFTY FALCON retargets fintech victims after incomplete remediation [Business & Infrastructure Threats]
                    • Exposed application secrets enable cross-tenant Entra abuse [Windows / AD Security]
                    • Email security exceptions undermine detected phishing protections [Windows / AD Security]
                    • ChatGPT HTML preview bypass was fixed September 18 [Vulnerability Disclosures]
                      • CVEs Referenced

                      CVE-2024-27834, CVE-2026-41940

                      Indicators of Compromise

                      Domains:

                      141[.]71, 77[.]84, 223[.]26, 126[.]128

                      Read the full brief

                      15 min
                    • 2026-11-05: Zyxel GS1900 switches need 2.90 Patch 3, because Binarly found that Patch 2 does not stop the
                      Show Notes - 2026-11-05
                      Stories Covered
                      • Today:
                      • Zyxel GS1900 fix fails to stop exploited command-execution chain (CVE-2026-107441, CVE-2026-7273) [Critical Alerts]
                      • Fileless SharePoint access linked to Storm-2603 tactics (CVE-2025-53770, CVE-2025-53771) [Critical Alerts]
                      • Apple authentication bypass added to KEV amid browser exploitation (CVE-2024-27834) [Critical Alerts]
                      • Bristol school files published following shared-platform attack [Ransomware & Extortion]
                      • DarkVigil delivery infrastructure associated with Sogou DNS hijacking [IOCs & Detection]
                      • Unsupported SonicWall GMS exposes internal files (CVE-2026-109593) [Business & Infrastructure Threats]
                      • Sogou HTTP configuration delivery abused to install DarkVigil (CVE-2026-120422) [Business & Infrastructure Threats]
                      • Beget cloud attack destroys data and disrupts websites [Business & Infrastructure Threats]
                      • Breach datasets expose organizations beyond the primary victim [General Security News]
                      • Rails Active Storage image processing permits arbitrary file access [Vulnerability Disclosures]
                      • Xen flaws cross guest and management-domain boundaries [Vulnerability Disclosures]
                      • APT download-retry flaw permits root-level package substitution [Vulnerability Disclosures]
                        • CVEs Referenced

                        CVE-2024-27834, CVE-2025-53770, CVE-2025-53771, CVE-2026-107441, CVE-2026-109593, CVE-2026-120422, CVE-2026-7273

                        Indicators of Compromise

                        Domains:

                        250[.]102, 122[.]175, sogou-cdn[.]com, soft-png-cdn[.]com

                        IP Addresses:

                        8.1.4.1, 8.0.5.2

                        Read the full brief

                        13 min

                      About Cyber Threat Brief

                      From the publisher's feed

                      Your daily cybersecurity briefing. Vulnerabilities, ransomware, threat actors, and patches that matter, explained for IT professionals and business leaders protecting small and mid-sized…