Cybersecurity briefing, 2026-11-14

Attackers compromised Check Point Security Gateways using PHP2Shell and a Gaia privilege-escalation flaw.

• Check Point gateway attacks reached ESXi and wiped files
• ScreenConnect malware spreads through hijacked technician sessions
• Trezor implants leave old recovery phrases exposed
• FaceStealer seizure shows how Sapphire Sleet reuses victims
• SilentAir hijacks Asian carriers to intercept calls and texts
• ARTEX testing agent escaped isolation into WorkOS data
• Microsoft 365 outage hit email and security visibility
• GitHub account hijacks put CI secrets at risk
• XWEB EVO configuration flaw exploited within 100 minutes
• Cairn scales tailored intrusions across 19 organizations
• AI attack frameworks leave scope to prompts, not code
• Zoom Workplace flaws could grant Windows host privileges
• PostgreSQL fix needs extension rebuild to close code-execution flaw
• Operation Endgame seized infrastructure, not stolen logins
• N-able N-central returns online with remote control paused
• Fake GTA VI installer steals browser and crypto data
• Citrix NetScaler patch set adds a Console access bypass
• SignDrop turns Defender’s CLFS hardening into SYSTEM access

Recent editions

• Friday, November 13, 2026: Trezor implants leave old recovery phrases exposed · 20 stories
• Thursday, November 12, 2026: GPUStack's localhost spoofing skips authentication on exposed managers · 20 stories
• Wednesday, November 11, 2026: Apple patches pairing flaws, but Brotli remains elsewhere · 20 stories
• Tuesday, November 10, 2026: N-able N-central returns online with remote control paused · 20 stories
• Monday, November 9, 2026: SAP NetWeaver flaw fuels webshell planting and searches · 19 stories
• Sunday, November 8, 2026: CISA widens the SSHole story to four exploited flaws · 3 stories
• Saturday, November 7, 2026: GPT-6 Cyber’s exploit gains test its guardrails · 13 stories