The box you bought to hold the perimeter is now the way in, and this time the attacker didn't want your data

Vulnerabilities

Three more KEV entries, and one of them is an IRC daemon, because the internet never actually deletes anything

Alongside Check Point, CISA added CVE-2026-114713 in UnrealIRCd — an improper neutralisation of delimiters that lets any user on a network with two or more linked servers inject server-to-server commands executed with server authority — and then, this morning, CVE-2026-5430 in WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway (path traversal to unrestricted file upload to remote code execution) and CVE-2026-71362 in Adobe Commerce and Magento (incorrect authorisation, elevated access to sensitive resources, no user interaction). Meanwhile the ISC reports live exploit attempts against CVE-2026-102895, a trivial authentication bypass in GPUStack affecting all versions before 2.2.0, which was released at the end of June. GPUStack manages clusters of GPUs, which run AI workloads, which is where the money currently lives.

Threat actors

N-able pulls N-central offline after 33 flaws, and the hotfix turns out to be a lovely thing to have been running while you were compromised

N-able took the N-central platform offline after the discovery of 33 flaws and shipped a hotfix as recommended mitigation; attacks began shortly after a researcher dropped over 30 zero-days, and N-able patched the unauthenticated ones. Then the arithmetic arrived: attackers infected 21 servers, 19 of them running Hotfix 2, with the new flaw set tracked as 4EverAble2Shell and Agent2Shell, and N-able is now restricting certain N-central features and integrations. In the next lane over, ConnectWise confirmed that abuse of an independent third-party extension let attackers bypass ScreenConnect authentication, with researchers spotting intrusions at nearly 50 organisations; ThreatFox is carrying a ScreenConnect.ClientSetup.msi hosted on a Cloudflare R2 bucket, which is not shown to be the same campaign but is the same idea wearing the same coat.

Why it mattersRemote management tooling is the fastest route from one compromise to all of your customers, and 'we applied the hotfix' is no longer a sentence that closes a ticket.

Ransomware

Yesterday's leak-site 'surge' was mostly a posting schedule, and the deadlines are Monday and Tuesday

Pixelleaks put up 14 entries on 13 November against a median of one on other days — a Hong Kong green-building body, a Chinese oncology genomics outfit, Canadian and US financial advisory firms, a welding school — with full-leak timestamps stamped for 2026-11-16 11:45 UTC and 2026-11-17 01:36 UTC. n0n posted 10 at once, including claims against DraftKings, LiveRamp and LEO Pharma that nobody has verified; Play posted nine, Akira six, Qilin five, and The Gentlemen's Atlas escalations all carry one identical 17:50 timestamp. Qilin's five include the University of Texas at Arlington, which has separately warned that personal information was stolen in a cyberattack, so at least one line in the batch has a named human cost behind it. A Darkfeed tally for 2026 puts Qilin on 1171, The Gentleman on 1026 and Akira on 441.

Why it mattersCount victims, not posts: a 14-item day on one leak site is a publishing decision, and the only hard thing in it is the 16-17 November deadline.

AI & security

The FBI's complaint about Artex is not that it is clever, it is that it is quick

An FBI flash alert says the open-source hacking tool Artex "significantly reduces the time required to chain attack techniques, with some intrusions progressing from initial targeting to privileged access in under three hours". Dark Reading has a companion case: an attacker whose hand-typed commands failed against a US retailer switched to AI-generated scripts and achieved lateral movement in minutes. On our side of the table, OpenAI unveiled Daybreak Red Team, which pentests web applications with AI agents, and Defense Factory, which investigates findings and prepares patches; Apache's critical mod_http2 race condition CVE-2026-119618 was found by Anthropic and Google. And The Hacker News raises the question nobody's runbook answers: shutting down a rogue agent may not stop it, because queued tasks, active sessions and valid credentials carry on without the model.

Why it mattersIf initial targeting to privileged access can be under three hours, your detection budget is measured in minutes and your approval workflow is measured in days.

Malware & IOCs

Someone opened three Trezors, added a circuit board, and sold them anyway

Trezor has confirmed that three Safe 5 wallets sold by the Southeast Asian reseller CryptoBilis contained hidden hardware implants: an extra circuit board that reads the recovery phrase off the device's screen and sends it over the mobile network. A firmware fix is out; it does not undo earlier exposure. The same day, the FBI attributed more than $400 million in cryptocurrency theft over 18 months to a North Korean social engineering operation called FaceStealer, built on fake video calls, deepfakes and stolen webcam clips from over 900 victims, and said it has seized the attack infrastructure — while US authorities separately seized $1.2 billion in cryptocurrency stolen from Binance.

Why it mattersSupply chain assurance for hardware means the chain of custody from factory to hand, not a hologram sticker and a reseller's good word.

Policy

Operation Endgame takes 235 servers and 6.4 million stolen logins, and 354 people get a visit

Investigators seized 235 servers and 257 domains behind Gootloader, CastleRAT and StealC, along with about 6.4 million victim credentials, as part of Operation Endgame. In a separate joint international operation, 354 suspects were arrested — vendors and buyers across the Archetyp, Nemesis, Tor2Door, Bohemia and Kingdom dark web marketplaces. German authorities also took down rebuilt SteaIC malware servers for the second time this year, tracing the network to the Virtualine bulletproof hosting provider seized by the FBI in October, with Frankfurt police and the Dutch National High Tech Crime Unit. And the Bundestag passed the biggest overhaul of Germany's spy laws of the postwar era, granting hacking and sabotage powers, by 308 votes to 190 with 71 abstentions.

Why it matters6.4 million credentials recovered means a lot of them are yours, and the takedown does not rotate them for you.

Vulnerabilities

PostgreSQL fixes a 22-year-old bug, and the patch is only half the job

PostgreSQL shipped fixes for 52 security flaws, among them CVE-2026-6460 (CVSS 8.8), a type confusion bug 22 years old that lets an authenticated user with object-creation privileges run code on the database server — and full protection also requires rebuilding any C-language extensions installed on the server, which is the part that will be skipped. Elsewhere in the pile: Citrix patched 10 critical NetScaler vulnerabilities, Google fixed 83 flaws in Chrome 157 and Mozilla 99 in Firefox 160, and a critical Red Hat Quay flaw could expose private container images. Microsoft, for its part, confirmed that November's updates are causing Windows activation failures with 0x80041008 errors and may break printing for documents with complex formatting.

Why it matters'Patched' and 'rebuilt the extensions' are different states, and only one of them is actually fixed.

Oddities

On Friday the 13th, email went down, air traffic comms rebooted, and the benefits portal chose that evening to be unavailable

The FAA issued a ground stop citing "extraordinary circumstances", with federal officials not saying what caused the communications disruption or whether a cyberattack was being investigated; reporting circulating among responders attributes it to an update to the private communications network connecting air traffic control, operated by L3Harris, which caused a reboot and then a crash. Microsoft, meanwhile, spent two days trying to restore Outlook, Exchange Online and Teams after failed server health checks, with no evidence of a cyberattack disclosed. And somewhere in the middle of all that, one person on infosec.exchange tried to finalise their 2027 benefits at 11pm on the deadline and found Workday down; service was not restored before midnight.

Why it mattersMost of your worst days are change management, not adversaries, and your incident process should be able to tell the difference before the board does.