Cybersecurity briefing, 2026-11-09

These cold-chain attacks never break the controller.

• SAP NetWeaver flaw fuels webshell planting and searches
• Plex2Shell puts QNAP NAS storage at risk
• France adds sanctions push to supermarket attack response
• PHP2Shell chain leaves Check Point gateways with root footholds
• GPT-6 Cyber’s exploit gains test its guardrails
• AhsayCBS attackers query Veeam credentials after compromise
• Ethersphere’s trusted releases delivered the SleepyDuck loader
• Claude Code approvals leave secrets in public GitHub repos
• CISA widens the SSHole story to four exploited flaws
• SonicWall SSL-VPN bypass now faces reported active exploitation
• WordPress upgrade window opens a path to server code
• N-able N-central returns online with remote control paused
• Qubole breach reached customer secrets beyond stale AWS roles
• NoName057(16) offers crypto for officials’ family details
• Trojanized CWP server spreads a Linux backdoor
• Bitter's PapRAT campaign spans three routes and two variants
• DeepSeek agent adapted as telecom defenses blocked attacks
• Outlook.com rejects legitimate mail over authentication checks
• DigiCert archive access exposed customer records and IDs

Recent editions

• Sunday, November 8, 2026: CISA widens the SSHole story to four exploited flaws · 3 stories
• Saturday, November 7, 2026: GPT-6 Cyber’s exploit gains test its guardrails · 13 stories
• Friday, November 6, 2026: CISA widens the SSHole story to four exploited flaws · 19 stories
• Thursday, November 5, 2026: APT29's Plerdy tracker compromise reached hundreds of sites · 20 stories
• Wednesday, November 4, 2026: WordPress upgrade window opens a path to server code · 19 stories
• Tuesday, November 3, 2026: Node-RED attacks add persistent command backdoors · 18 stories
• Monday, November 2, 2026: Ivanti's second patch closes the chain, not prior exposure · 20 stories