{"category":"patch","changes":[{"body":null,"category":"patch","date":"2026-11-14","incident":"php2shell-check-point-gateways-attackers-chain-php-rce-local-privesc-to-root-deploy-webshells-and-wiper-cve-2026-109618","incidentTitle":"Check Point gateways: PHP2Shell chain to root, webshells and ESXi wiper (CVE-2026-109618, CVE-2026-123039)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://securityaffairs.com/203040/hacking/u-s-cisa-adds-check-point-and-unrealircd-flaws-to-its-known-exploited-vulnerabilities-catalog.html","status":"live","title":"CISA adds Check Point flaw (CVE-2026-114713) to KEV catalog, confirming active exploitation; UnrealIRCd flaw also added","url":"https://helix.ml/threat-watch/i/php2shell-check-point-gateways-attackers-chain-php-rce-local-privesc-to-root-deploy-webshells-and-wiper-cve-2026-109618"},{"body":null,"category":"patch","date":"2026-11-14","incident":"apache-shiro-defaultldaprealm-accepts-any-password-with-auth-caching-enabled-cve-2026-129349","incidentTitle":"Apache Shiro: DefaultLdapRealm accepts any password with auth caching enabled (CVE-2026-129349)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://seclists.org/oss-sec/2026/q4/705","status":"live","title":"Apache Shiro: DefaultLdapRealm accepts any password with auth caching enabled (CVE-2026-129349)","url":"https://helix.ml/threat-watch/i/apache-shiro-defaultldaprealm-accepts-any-password-with-auth-caching-enabled-cve-2026-129349"},{"body":null,"category":"patch","date":"2026-11-13","incident":"apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al","incidentTitle":"Apache HTTP Server mod_http2 RCE and mod_vhost_alias/mod_md flaws disclosed (CVE-2026-119618 et al.)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://webflow.sysdig.com/blog/httpd-cve-2026-119618-detecting-heap-corruption-and-rce-in-apache-http-server-mod-http2","status":"live","title":"Sysdig publishes detection guidance for heap corruption and RCE in Apache HTTP Server mod_http2 (CVE-2026-119618)","url":"https://helix.ml/threat-watch/i/apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al"},{"body":null,"category":"patch","date":"2026-11-13","incident":"dropbear-permitopen-permitlisten-bypass-via-unix-socket-forwarding-docker-sock-reachable","incidentTitle":"Dropbear: per-destination forwarding limits bypassed via unix sockets, docker.sock reachable","kind":"disclosure","patchStatus":"unpatched","severity":"high","sourceUrl":"https://seclists.org/oss-sec/2026/q4/690","status":"live","title":"Dropbear permitopen/permitlisten bypass via unix-socket forwarding — docker.sock reachable","url":"https://helix.ml/threat-watch/i/dropbear-permitopen-permitlisten-bypass-via-unix-socket-forwarding-docker-sock-reachable"},{"body":null,"category":"patch","date":"2026-11-13","incident":"dixell-xweb-evo-refrigeration-controller-flaws-14-vulns-give-root-access-two-actively-exploited","incidentTitle":"Copeland Dixell XWEB EVO: 14 disclosed flaws give root on refrigeration controllers","kind":"disclosure","patchStatus":"partial","severity":"critical","sourceUrl":"https://cyberscoop.com/copeland-dixell-refrigeration-vulnerabilities/","status":"live","title":"Dixell XWEB EVO refrigeration controller flaws: 14 vulns give root access, two actively exploited","url":"https://helix.ml/threat-watch/i/dixell-xweb-evo-refrigeration-controller-flaws-14-vulns-give-root-access-two-actively-exploited"},{"body":null,"category":"patch","date":"2026-11-13","incident":"postgresql-bulk-security-update-fixes-52-cves-incl-many-rce-flaws","incidentTitle":"PostgreSQL 14-18 update: 52 CVEs fixed, many allow code execution by a database user","kind":"advisory","patchStatus":"patched","severity":"high","sourceUrl":"https://thehackernews.com/2026/11/postgresql-patches-52-flaws-including.html","status":"live","title":"PostgreSQL update highlights CVE-2026-6460, a 22-year-old type confusion authenticated RCE (CVSS 8.8) requiring C extension rebuilds for full protection","url":"https://helix.ml/threat-watch/i/postgresql-bulk-security-update-fixes-52-cves-incl-many-rce-flaws"},{"body":null,"category":"patch","date":"2026-11-13","incident":"php2shell-check-point-gateways-attackers-chain-php-rce-local-privesc-to-root-deploy-webshells-and-wiper-cve-2026-109618","incidentTitle":"Check Point gateways: PHP2Shell chain to root, webshells and ESXi wiper (CVE-2026-109618, CVE-2026-123039)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.bleepingcomputer.com/news/security/check-point-gateways-hacked-via-php2shell-to-deploy-vmware-esxi-wiper/","status":"live","title":"PHP2Shell attacks on Check Point gateways now deploy data-wiping malware on VMware ESXi hosts","url":"https://helix.ml/threat-watch/i/php2shell-check-point-gateways-attackers-chain-php-rce-local-privesc-to-root-deploy-webshells-and-wiper-cve-2026-109618"},{"body":null,"category":"patch","date":"2026-11-13","incident":"php2shell-check-point-gateways-attackers-chain-php-rce-local-privesc-to-root-deploy-webshells-and-wiper-cve-2026-109618","incidentTitle":"Check Point gateways: PHP2Shell chain to root, webshells and ESXi wiper (CVE-2026-109618, CVE-2026-123039)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://securityaffairs.com/202982/hacking/unpatched-check-point-gateways-are-being-wiped-exploiting-php2shell.html","status":"live","title":"Unpatched Check Point gateways wiped: PHP2Shell exploitation via Mobile Access portal confirmed with destructive wiper attacks since 30 October","url":"https://helix.ml/threat-watch/i/php2shell-check-point-gateways-attackers-chain-php-rce-local-privesc-to-root-deploy-webshells-and-wiper-cve-2026-109618"},{"body":null,"category":"patch","date":"2026-11-13","incident":"citrix-netscaler-november-2026-patch-batch-12-flaws-incl-auth-bypass-and-dos-cve-2026-120868-et-al","incidentTitle":"Citrix NetScaler November 2026 patches: Console auth bypass and ADC/Gateway memory flaws (CVE-2026-120869 et al.)","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.securityweek.com/citrix-patches-10-critical-netscaler-vulnerabilities/","status":"live","title":"Citrix patches 10 more critical NetScaler vulnerabilities, mostly leading to denial-of-service conditions","url":"https://helix.ml/threat-watch/i/citrix-netscaler-november-2026-patch-batch-12-flaws-incl-auth-bypass-and-dos-cve-2026-120868-et-al"},{"body":null,"category":"patch","date":"2026-11-13","incident":"apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al","incidentTitle":"Apache HTTP Server mod_http2 RCE and mod_vhost_alias/mod_md flaws disclosed (CVE-2026-119618 et al.)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.aikido.dev/blog/cve-2026-119618-apache-http-server-rce","status":"live","title":"CVE-2026-119618 (mod_http2 RCE, Apache 2.4.55–2.4.70) rated critical; fix guidance includes upgrading or disabling HTTP/2","url":"https://helix.ml/threat-watch/i/apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al"},{"body":null,"category":"patch","date":"2026-11-13","incident":"php2shell-check-point-gateways-attackers-chain-php-rce-local-privesc-to-root-deploy-webshells-and-wiper-cve-2026-109618","incidentTitle":"Check Point gateways: PHP2Shell chain to root, webshells and ESXi wiper (CVE-2026-109618, CVE-2026-123039)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/11/hackers-exploit-php2shell-flaws-in.html","status":"live","title":"Check Point details TSGA backdoor deployed via PHP2Shell chain on unpatched gateways targeting Israeli orgs since Oct 30","url":"https://helix.ml/threat-watch/i/php2shell-check-point-gateways-attackers-chain-php-rce-local-privesc-to-root-deploy-webshells-and-wiper-cve-2026-109618"},{"body":"Press coverage of Check Point Research's 12 November analysis. Wave dates and attribution caveats follow the vendor post.","category":"patch","date":"2026-11-13","incident":"php2shell-check-point-gateways-attackers-chain-php-rce-local-privesc-to-root-deploy-webshells-and-wiper-cve-2026-109618","incidentTitle":"Check Point gateways: PHP2Shell chain to root, webshells and ESXi wiper (CVE-2026-109618, CVE-2026-123039)","kind":"other","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.securityweek.com/php2shell-exploited-in-destructive-check-point-gateway-attacks/","status":"live","title":"SecurityWeek reports the Check Point gateway PHP2Shell campaign, including the wiper","url":"https://helix.ml/threat-watch/i/php2shell-check-point-gateways-attackers-chain-php-rce-local-privesc-to-root-deploy-webshells-and-wiper-cve-2026-109618"},{"body":null,"category":"patch","date":"2026-11-13","incident":"4everable2shell-agent2shell-n-able-n-central-new-root-rce-and-windows-system-exploits-work-against-patched-servers-cve-2","incidentTitle":"N-able N-central: unauthenticated root RCE and Windows SYSTEM exploits work on Hotfix 2 (CVE-2026-90436)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.securityweek.com/hackers-exploit-new-n-central-zero-day-hours-after-poc-publication/","status":"live","title":"N-central 4EverAble2Shell zero-day exploited in the wild hours after PoC publication","url":"https://helix.ml/threat-watch/i/4everable2shell-agent2shell-n-able-n-central-new-root-rce-and-windows-system-exploits-work-against-patched-servers-cve-2"},{"body":null,"category":"patch","date":"2026-11-13","incident":"4everable2shell-agent2shell-n-able-n-central-new-root-rce-and-windows-system-exploits-work-against-patched-servers-cve-2","incidentTitle":"N-able N-central: unauthenticated root RCE and Windows SYSTEM exploits work on Hotfix 2 (CVE-2026-90436)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://thehackernews.com/2026/11/hackers-exploit-n-central-flaws-to.html","status":"live","title":"Attackers exploited N-central flaws to infect 21 servers, 19 of them running Hotfix 2; N-able restricts features","url":"https://helix.ml/threat-watch/i/4everable2shell-agent2shell-n-able-n-central-new-root-rce-and-windows-system-exploits-work-against-patched-servers-cve-2"},{"body":null,"category":"patch","date":"2026-11-13","incident":"rucio-unauthenticated-admin-impersonation-via-ssh-challenge-tokens-accepted-as-auth-credentials-cve-2026-100397","incidentTitle":"Rucio: Unauthenticated admin impersonation via SSH challenge tokens (CVE-2026-100397)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-x585-4vv8-2mh2","status":"closed","title":"Rucio: Unauthenticated admin impersonation via SSH challenge tokens accepted as auth credentials (CVE-2026-100397)","url":"https://helix.ml/threat-watch/i/rucio-unauthenticated-admin-impersonation-via-ssh-challenge-tokens-accepted-as-auth-credentials-cve-2026-100397"},{"body":"Check Point Research publishes the full chain (PHP2Shell, CVE-2026-123039, webshells, TSGA and TSProxy, ESXi wiper), its PhiliKit and UNC5221 observations, the Dream Security brand on the wiper note, and the caveat that the operation cannot be assessed with high confidence.","category":"patch","date":"2026-11-12","incident":"php2shell-check-point-gateways-attackers-chain-php-rce-local-privesc-to-root-deploy-webshells-and-wiper-cve-2026-109618","incidentTitle":"Check Point gateways: PHP2Shell chain to root, webshells and ESXi wiper (CVE-2026-109618, CVE-2026-123039)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/","status":"live","title":"Check Point Research publishes analysis of the PHP2Shell gateway campaign and its attribution caveats","url":"https://helix.ml/threat-watch/i/php2shell-check-point-gateways-attackers-chain-php-rce-local-privesc-to-root-deploy-webshells-and-wiper-cve-2026-109618"},{"body":"NVD describes a root-owned DynamicCLI daemon listening on a world-writable local socket, through which a logged-in local user can run commands as root. Check Point is the CNA and scores it 7.8 under CVSS 3.1.","category":"patch","date":"2026-11-12","incident":"php2shell-check-point-gateways-attackers-chain-php-rce-local-privesc-to-root-deploy-webshells-and-wiper-cve-2026-109618","incidentTitle":"Check Point gateways: PHP2Shell chain to root, webshells and ESXi wiper (CVE-2026-109618, CVE-2026-123039)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-123039","status":"live","title":"NVD publishes CVE-2026-123039 (Check Point Gaia DynamicCLI local root, CVSS 3.1 7.8, awaiting analysis)","url":"https://helix.ml/threat-watch/i/php2shell-check-point-gateways-attackers-chain-php-rce-local-privesc-to-root-deploy-webshells-and-wiper-cve-2026-109618"},{"body":null,"category":"patch","date":"2026-11-12","incident":"postgresql-bulk-security-update-fixes-52-cves-incl-many-rce-flaws","incidentTitle":"PostgreSQL 14-18 update: 52 CVEs fixed, many allow code execution by a database user","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://www.helpnetsecurity.com/2026/11/13/postgresql-security-update-november-2026/","status":"live","title":"PostgreSQL November 2026 update confirmed: 52 CVEs fixed across 18.7/17.12/16.16/15.20/14.25, ending PostgreSQL 14 support","url":"https://helix.ml/threat-watch/i/postgresql-bulk-security-update-fixes-52-cves-incl-many-rce-flaws"},{"body":"Mallory's story, updated 2026-11-12, reports that Howler Cell (Cyderes) said it reproduced SignDrop and obtained a SYSTEM shell, and that 78researchlab found the exploit works but is not reliable enough for operational use, because every UAC prompt opened both a standard-user and a SYSTEM shell. We could not fetch either firm's own post. A reproduction is not Microsoft confirmation or evidence of exploitation in the wild.","category":"patch","date":"2026-11-12","incident":"signdrop-windows-clfs-authentication-mitigation-zero-day-grants-system-privileges-and-edr-tamper-protection-bypass","incidentTitle":"Windows CLFS: unpatched SignDrop zero-day grants SYSTEM and reportedly bypasses tamper protection","kind":"other","patchStatus":"unpatched","severity":"high","sourceUrl":"https://mallory.ai/stories/01a1caef-5375-76b8-af23-0e0ce6736182","status":"live","title":"Third-party reproduction of SignDrop reported (not verified by us)","url":"https://helix.ml/threat-watch/i/signdrop-windows-clfs-authentication-mitigation-zero-day-grants-system-privileges-and-edr-tamper-protection-bypass"},{"body":null,"category":"patch","date":"2026-11-12","incident":"apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al","incidentTitle":"Apache HTTP Server mod_http2 RCE and mod_vhost_alias/mod_md flaws disclosed (CVE-2026-119618 et al.)","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-119618/","status":"live","title":"CVE-2026-119618 mod_http2 race condition RCE confirmed critical, fixed in Apache HTTP Server 2.4.71","url":"https://helix.ml/threat-watch/i/apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al"},{"body":"The 14.25 release is the final PostgreSQL 14 release; it receives no further security or bug fixes.","category":"patch","date":"2026-11-12","incident":"postgresql-bulk-security-update-fixes-52-cves-incl-many-rce-flaws","incidentTitle":"PostgreSQL 14-18 update: 52 CVEs fixed, many allow code execution by a database user","kind":"status","patchStatus":"patched","severity":"high","sourceUrl":"https://www.postgresql.org/about/news/postgresql-187-1712-1616-1520-1425-and-19-rc-2-released-3442/","status":"live","title":"PostgreSQL 14 reaches end of life with 14.25","url":"https://helix.ml/threat-watch/i/postgresql-bulk-security-update-fixes-52-cves-incl-many-rce-flaws"},{"body":null,"category":"patch","date":"2026-11-12","incident":"4everable2shell-agent2shell-n-able-n-central-new-root-rce-and-windows-system-exploits-work-against-patched-servers-cve-2","incidentTitle":"N-able N-central: unauthenticated root RCE and Windows SYSTEM exploits work on Hotfix 2 (CVE-2026-90436)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.bleepingcomputer.com/news/security/new-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released/","status":"live","title":"N-able '4EverAble2Shell' zero-day now actively exploited hours after PoC release — 21 servers compromised, mostly patched, to deploy cryptominers","url":"https://helix.ml/threat-watch/i/4everable2shell-agent2shell-n-able-n-central-new-root-rce-and-windows-system-exploits-work-against-patched-servers-cve-2"},{"body":null,"category":"patch","date":"2026-11-12","incident":"apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al","incidentTitle":"Apache HTTP Server mod_http2 RCE and mod_vhost_alias/mod_md flaws disclosed (CVE-2026-119618 et al.)","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.bleepingcomputer.com/news/security/apache-http-server-patches-critical-http-2-remote-code-execution-flaw/","status":"live","title":"Apache HTTP Server patches the critical unauthenticated HTTP/2 RCE flaw","url":"https://helix.ml/threat-watch/i/apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al"},{"body":null,"category":"patch","date":"2026-11-12","incident":"postgresql-bulk-security-update-fixes-52-cves-incl-many-rce-flaws","incidentTitle":"PostgreSQL 14-18 update: 52 CVEs fixed, many allow code execution by a database user","kind":"disclosure","patchStatus":"patched","severity":"high","sourceUrl":"https://seclists.org/oss-sec/2026/q4/682","status":"live","title":"PostgreSQL bulk security update fixes 52 CVEs incl. many RCE flaws","url":"https://helix.ml/threat-watch/i/postgresql-bulk-security-update-fixes-52-cves-incl-many-rce-flaws"},{"body":null,"category":"patch","date":"2026-11-12","incident":"red-hat-quay-key-server-flaw-lets-attackers-forge-registry-tokens-and-steal-private-container-images-cve-2026-123710","incidentTitle":"Red Hat Quay: unauthenticated service-key takeover forges registry tokens (CVE-2026-123710)","kind":"advisory","patchStatus":"partial","severity":"critical","sourceUrl":"https://thehackernews.com/2026/11/critical-red-hat-quay-flaw-lets.html","status":"live","title":"Red Hat Quay critical flaw also lets attackers read and overwrite all private container images, exploitable anonymously when anonymous access is enabled","url":"https://helix.ml/threat-watch/i/red-hat-quay-key-server-flaw-lets-attackers-forge-registry-tokens-and-steal-private-container-images-cve-2026-123710"},{"body":null,"category":"patch","date":"2026-11-12","incident":"citrix-netscaler-november-2026-patch-batch-12-flaws-incl-auth-bypass-and-dos-cve-2026-120868-et-al","incidentTitle":"Citrix NetScaler November 2026 patches: Console auth bypass and ADC/Gateway memory flaws (CVE-2026-120869 et al.)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/11/citrix-patches-12-netscaler-and-secure.html","status":"live","title":"Citrix NetScaler November 2026 patches: Console auth bypass and ADC/Gateway memory flaws (CVE-2026-120869 et al.)","url":"https://helix.ml/threat-watch/i/citrix-netscaler-november-2026-patch-batch-12-flaws-incl-auth-bypass-and-dos-cve-2026-120868-et-al"},{"body":"StepSecurity describes the mechanism (a zero-length typed-array view is dropped while its header stays on the wire, so the parser resynchronises at an attacker-controlled offset and resolves a planted module row), and suggests detection at proxies and CDNs. It does not mention in-the-wild exploitation or a public PoC; it describes a lab reproduction built for the analysis.","category":"patch","date":"2026-11-12","incident":"next-js-unauthenticated-rce-in-use-cache-functions-returning-typed-arrays-ghsa-673q-mjm6-r5xr","incidentTitle":"React Server Components / Next.js: unauthenticated RCE via typed-array payloads (GHSA-xqc2-xf4c-x3h3, GHSA-673q-mjm6-r5xr)","kind":"other","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.stepsecurity.io/blog/cve-2026-126187-react-flight-rce","status":"closed","title":"StepSecurity writeup: smuggled Flight rows mechanism and detection","url":"https://helix.ml/threat-watch/i/next-js-unauthenticated-rce-in-use-cache-functions-returning-typed-arrays-ghsa-673q-mjm6-r5xr"},{"body":null,"category":"patch","date":"2026-11-12","incident":"signdrop-windows-clfs-authentication-mitigation-zero-day-grants-system-privileges-and-edr-tamper-protection-bypass","incidentTitle":"Windows CLFS: unpatched SignDrop zero-day grants SYSTEM and reportedly bypasses tamper protection","kind":"disclosure","patchStatus":"unpatched","severity":"high","sourceUrl":"https://www.bleepingcomputer.com/news/security/new-windows-signdrop-zero-day-gives-hackers-system-privileges/","status":"live","title":"SignDrop: Windows CLFS authentication mitigation — zero-day grants SYSTEM privileges and EDR tamper-protection bypass","url":"https://helix.ml/threat-watch/i/signdrop-windows-clfs-authentication-mitigation-zero-day-grants-system-privileges-and-edr-tamper-protection-bypass"},{"body":null,"category":"patch","date":"2026-11-12","incident":"apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al","incidentTitle":"Apache HTTP Server mod_http2 RCE and mod_vhost_alias/mod_md flaws disclosed (CVE-2026-119618 et al.)","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.securityweek.com/apache-patches-critical-http-server-rce-found-by-anthropic-google/","status":"live","title":"Apache patches critical mod_http2 race-condition RCE (CVE-2026-119618), found by Anthropic and Google","url":"https://helix.ml/threat-watch/i/apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al"},{"body":null,"category":"patch","date":"2026-11-12","incident":"apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al","incidentTitle":"Apache HTTP Server mod_http2 RCE and mod_vhost_alias/mod_md flaws disclosed (CVE-2026-119618 et al.)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.wordfence.com/blog/2026/11/cve-2026-119618-apache-http2/","status":"live","title":"WordPress-focused PSA urges site owners to verify hosts patched Apache mod_http2 RCE (CVE-2026-119618)","url":"https://helix.ml/threat-watch/i/apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al"},{"body":null,"category":"patch","date":"2026-11-12","incident":"sansar-linux-cryptomining-orchestrator-with-kernel-rootkit-tor-c2-and-ethereum-based-backdoor","incidentTitle":"SANSAR: Linux cryptomining orchestrator with kernel rootkit, Tor C2 and Ethereum-based backdoor","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware","status":"live","title":"SANSAR: Linux cryptomining orchestrator with kernel rootkit, Tor C2 and Ethereum-based backdoor","url":"https://helix.ml/threat-watch/i/sansar-linux-cryptomining-orchestrator-with-kernel-rootkit-tor-c2-and-ethereum-based-backdoor"},{"body":"Previdian reports that the observed chain tried CVE-2026-90436 for initial code execution, then a root step using 4EverAble2Shell, then a curl download and run of a shell script from the same IP. watchTowr reports probes against builds with the Legacy API enabled. No successful exploitation was reported as of the article. The attempts were not confirmed against customer systems.","category":"patch","date":"2026-11-12","incident":"4everable2shell-agent2shell-n-able-n-central-new-root-rce-and-windows-system-exploits-work-against-patched-servers-cve-2","incidentTitle":"N-able N-central: unauthenticated root RCE and Windows SYSTEM exploits work on Hotfix 2 (CVE-2026-90436)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","status":"live","title":"Previdian reports 4EverAble2Shell probing from 157.20.241[.]16 within hours of PoC release","url":"https://helix.ml/threat-watch/i/4everable2shell-agent2shell-n-able-n-central-new-root-rce-and-windows-system-exploits-work-against-patched-servers-cve-2"},{"body":"N-able says the server issue depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet. It says the Legacy API is off by default and not recommended, and that hosted environments are not affected. Per the Hacker News report, N-able is investigating; no hotfix date was given in the reporting reviewed.","category":"patch","date":"2026-11-12","incident":"4everable2shell-agent2shell-n-able-n-central-new-root-rce-and-windows-system-exploits-work-against-patched-servers-cve-2","incidentTitle":"N-able N-central: unauthenticated root RCE and Windows SYSTEM exploits work on Hotfix 2 (CVE-2026-90436)","kind":"advisory","patchStatus":"partial","severity":"critical","sourceUrl":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","status":"live","title":"N-able investigating new N-central flaws and urges Legacy API to be disabled","url":"https://helix.ml/threat-watch/i/4everable2shell-agent2shell-n-able-n-central-new-root-rce-and-windows-system-exploits-work-against-patched-servers-cve-2"},{"body":"The researcher's N-central folder holds three directories: 4EverAble2Shell, Able2Shell and Agent2Shell. The new flaws sit apart from the 33 Able2Shell flaws. The folder listing was read through the GitHub API; the contents were not read or run. The date is the Hacker News report date; the commit date was not checked.","category":"patch","date":"2026-11-12","incident":"4everable2shell-agent2shell-n-able-n-central-new-root-rce-and-windows-system-exploits-work-against-patched-servers-cve-2","incidentTitle":"N-able N-central: unauthenticated root RCE and Windows SYSTEM exploits work on Hotfix 2 (CVE-2026-90436)","kind":"disclosure","patchStatus":"partial","severity":"critical","sourceUrl":"https://github.com/Oracle-Security/CVEs/tree/main/0-Days/N-Central%20N-Able","status":"live","title":"Researcher's repo has separate 4EverAble2Shell and Agent2Shell folders, apart from Able2Shell","url":"https://helix.ml/threat-watch/i/4everable2shell-agent2shell-n-able-n-central-new-root-rce-and-windows-system-exploits-work-against-patched-servers-cve-2"},{"body":null,"category":"patch","date":"2026-11-12","incident":"asus-router-firmware-flaws-zoom-workplace-for-windows-privilege-escalation-cve-2026-108186","incidentTitle":"Zoom Workplace for Windows: unauthenticated privilege escalation (CVE-2026-108186, CVE-2026-108187)","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"https://securityaffairs.com/202911/security/zoom-fixes-critical-windows-vulnerability-allowing-privilege-escalation.html","status":"live","title":"Zoom releases patches for the two Zoom Workplace for Windows privilege escalation flaws (CVE-2026-108186/108187)","url":"https://helix.ml/threat-watch/i/asus-router-firmware-flaws-zoom-workplace-for-windows-privilege-escalation-cve-2026-108186"},{"body":"The Hacker News reports that the researcher's new PoCs, 4EverAble2Shell and Agent2Shell, work against N-central 2026.4 Hotfix 2 (2026.4.1.26). N-able is investigating and says the server issue needs the Legacy API turned on and exposed.","category":"patch","date":"2026-11-12","incident":"4everable2shell-agent2shell-n-able-n-central-new-root-rce-and-windows-system-exploits-work-against-patched-servers-cve-2","incidentTitle":"N-able N-central: unauthenticated root RCE and Windows SYSTEM exploits work on Hotfix 2 (CVE-2026-90436)","kind":"disclosure","patchStatus":"partial","severity":"critical","sourceUrl":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","status":"live","title":"Researcher publishes 4EverAble2Shell and Agent2Shell PoCs for N-central","url":"https://helix.ml/threat-watch/i/4everable2shell-agent2shell-n-able-n-central-new-root-rce-and-windows-system-exploits-work-against-patched-servers-cve-2"},{"body":null,"category":"patch","date":"2026-11-12","incident":"windows-10-kb5131096-esu-november-2026-patch-tuesday-fixes-incl-actively-exploited-outlook-zero-day","incidentTitle":"Windows 10 KB5131096 ESU: November 2026 security fixes, plus PowerShell and NTLM signing changes","kind":"other","patchStatus":"patched","severity":"high","sourceUrl":"https://www.bleepingcomputer.com/news/microsoft/microsoft-confirms-kb5132061-installation-issues-0x80070306-0x800f0989-0x800f0993-errors/","status":"live","title":"Microsoft confirms November 2026 security updates fail to install on Windows 11 systems with the October preview update","url":"https://helix.ml/threat-watch/i/windows-10-kb5131096-esu-november-2026-patch-tuesday-fixes-incl-actively-exploited-outlook-zero-day"},{"body":"Sean Bales says he did not disclose responsibly because N-able had not patched two flaws he had earlier reported in another product. N-able says he did not use its established reporting channels, and CEO John Pagliuca said publishing exploit code before customers can act does not make anyone safer. Reported by SecurityWeek on 2026-11-12.","category":"patch","date":"2026-11-12","incident":"able2shell-n-able-n-central-30-zero-days-published-hosted-environments-taken-offline","incidentTitle":"N-able N-central: 33 flaws with public PoCs, unauthenticated XXE-to-RCE; 7 of 33 fixed in Hotfix 2","kind":"other","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.securityweek.com/hackers-target-n-central-zero-days-as-n-able-rushes-patches/","status":"live","title":"Researcher and N-able dispute the disclosure path","url":"https://helix.ml/threat-watch/i/able2shell-n-able-n-central-30-zero-days-published-hosted-environments-taken-offline"},{"body":null,"category":"patch","date":"2026-11-12","incident":"cve-2026-118383-mongodb-server-unauthenticated-use-after-free-in-replica-set-primary-catch-up-can-crash-or-execute-code","incidentTitle":"MongoDB Server: unauthenticated use-after-free in replica set catch-up, crash or code exec (CVE-2026-118383)","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html","status":"live","title":"MongoDB CVE-2026-118383: unauthenticated attacker can crash lagging servers chosen as new primary during failover; fixed versions released","url":"https://helix.ml/threat-watch/i/cve-2026-118383-mongodb-server-unauthenticated-use-after-free-in-replica-set-primary-catch-up-can-crash-or-execute-code"},{"body":"RHEL 9 and 10 mod_http2 builds give each stream its own allocator, which makes exploitation harder. Red Hat says public research has shown a reliable exploit against a default-configured server with mod_http2 enabled.","category":"patch","date":"2026-11-12","incident":"apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al","incidentTitle":"Apache HTTP Server mod_http2 RCE and mod_vhost_alias/mod_md flaws disclosed (CVE-2026-119618 et al.)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://access.redhat.com/security/cve/cve-2026-119618","status":"live","title":"Red Hat scores CVE-2026-119618 CVSS 9.8; RHEL 9/10 rated Important, RHEL 8 not affected","url":"https://helix.ml/threat-watch/i/apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al"},{"body":"googlesky/CVE-2026-119618 documents the trigger: a body-less HTTP/2 request with Content-Type, no Content-Length, and a full request header table. It is a crash and corruption lab, not a weaponised RCE exploit. No in-the-wild exploitation has been reported.","category":"patch","date":"2026-11-12","incident":"apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al","incidentTitle":"Apache HTTP Server mod_http2 RCE and mod_vhost_alias/mod_md flaws disclosed (CVE-2026-119618 et al.)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/googlesky/CVE-2026-119618","status":"live","title":"Public reproduction lab published: heap corruption on 2.4.70 shown under ASan/TSan, 2.4.71 clean","url":"https://helix.ml/threat-watch/i/apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al"},{"body":"Dark Reading reports on the NetAskari leak.","category":"patch","date":"2026-11-12","incident":"overseas-chinese-affairs-big-data-platform-smart-eye-ccp-ai-system-scrapes-diaspora-data-to-scout-spies-in-taiwan-chip-i","incidentTitle":"'Smart Eye' Overseas Chinese Affairs platform: leaked files describe UFWD AI profiling of diaspora talent","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.darkreading.com/threat-intelligence/chinese-ai-project-scouts-spies-taiwan-chip-industry","status":"live","title":"'Smart Eye' Overseas Chinese Affairs platform: leaked files describe UFWD AI profiling of diaspora talent","url":"https://helix.ml/threat-watch/i/overseas-chinese-affairs-big-data-platform-smart-eye-ccp-ai-system-scrapes-diaspora-data-to-scout-spies-in-taiwan-chip-i"},{"body":"NVD publication for the CVE. The NVD description calls it a critical RCE in PTC Windchill and PTC FlexPLM exploitable through deserialization of untrusted data. It does not mention exploitation.","category":"patch","date":"2026-11-11","incident":"ptc-windchill-flexplm-critical-deserialization-rce-patched-cve-2026-126325","incidentTitle":"PTC Windchill/FlexPLM: critical deserialization RCE patched (CVE-2026-126325)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-126325","status":"live","title":"NVD record published for CVE-2026-126325 (CVSS 3.1 9.0, CVSS 4.0 9.2)","url":"https://helix.ml/threat-watch/i/ptc-windchill-flexplm-critical-deserialization-rce-patched-cve-2026-126325"},{"body":"PTC trust-center change log, 11/11/2026 10:30 AM ET: a new security patch for CVE-2026-126325 is available (instructions in eSupport CS483249). PTC applied it to hosted instances; self-hosted customers are asked to apply it as soon as possible.","category":"patch","date":"2026-11-11","incident":"ptc-windchill-flexplm-critical-deserialization-rce-patched-cve-2026-126325","incidentTitle":"PTC Windchill/FlexPLM: critical deserialization RCE patched (CVE-2026-126325)","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/11/ptc-patches-critical-windchill-and.html","status":"live","title":"PTC publishes patch for CVE-2026-126325 (Windchill and FlexPLM)","url":"https://helix.ml/threat-watch/i/ptc-windchill-flexplm-critical-deserialization-rce-patched-cve-2026-126325"},{"body":"Commit 094cfb024, Fix CVE-2026-110697 and CVE-2026-123710 (PR #8056), merged 2026-11-11 19:43 UTC. The latest upstream tag, v3.18.2, is dated 2026-10-20 and does not contain it, and no v3.18.3 tag existed on GitHub when checked on 2026-11-12.","category":"patch","date":"2026-11-11","incident":"red-hat-quay-key-server-flaw-lets-attackers-forge-registry-tokens-and-steal-private-container-images-cve-2026-123710","incidentTitle":"Red Hat Quay: unauthenticated service-key takeover forges registry tokens (CVE-2026-123710)","kind":"patch","patchStatus":"partial","severity":"critical","sourceUrl":"https://github.com/quay/quay/pull/8056","status":"live","title":"Upstream fix merged to quay/quay master; no tagged release contains it yet","url":"https://helix.ml/threat-watch/i/red-hat-quay-key-server-flaw-lets-attackers-forge-registry-tokens-and-steal-private-container-images-cve-2026-123710"},{"body":"NVD record published 2026-11-11 15:17 UTC, scored from Red Hat's CVSS vector. Red Hat rates it Critical and states that deployments where /keys is reachable by untrusted clients are affected.","category":"patch","date":"2026-11-11","incident":"red-hat-quay-key-server-flaw-lets-attackers-forge-registry-tokens-and-steal-private-container-images-cve-2026-123710","incidentTitle":"Red Hat Quay: unauthenticated service-key takeover forges registry tokens (CVE-2026-123710)","kind":"advisory","patchStatus":"partial","severity":"critical","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-123710","status":"live","title":"NVD publishes CVE-2026-123710 (CVSS 3.1 9.8)","url":"https://helix.ml/threat-watch/i/red-hat-quay-key-server-flaw-lets-attackers-forge-registry-tokens-and-steal-private-container-images-cve-2026-123710"},{"body":"NVD record published 2026-11-11 15:17 UTC. Red Hat's CVE page lists Quay 3 and Quay 5 as affected and names no fixed build for this CVE.","category":"patch","date":"2026-11-11","incident":"red-hat-quay-key-server-flaw-lets-attackers-forge-registry-tokens-and-steal-private-container-images-cve-2026-123710","incidentTitle":"Red Hat Quay: unauthenticated service-key takeover forges registry tokens (CVE-2026-123710)","kind":"disclosure","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.securityweek.com/critical-red-hat-quay-vulnerability-could-expose-private-container-images/","status":"live","title":"Red Hat publishes CVE-2026-123710 advisory (Critical, CVSS 3.1 9.8)","url":"https://helix.ml/threat-watch/i/red-hat-quay-key-server-flaw-lets-attackers-forge-registry-tokens-and-steal-private-container-images-cve-2026-123710"},{"body":"NetAskari published an analysis, based on internal documents it says were leaked to it, of the Overseas Chinese Affairs Big Data Platform, which it calls Smart Eye and places at Jinan University's Big Data Center. It attributes the platform to the United Front Work Department. The documents themselves are not published.","category":"patch","date":"2026-11-11","incident":"overseas-chinese-affairs-big-data-platform-smart-eye-ccp-ai-system-scrapes-diaspora-data-to-scout-spies-in-taiwan-chip-i","incidentTitle":"'Smart Eye' Overseas Chinese Affairs platform: leaked files describe UFWD AI profiling of diaspora talent","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://netaskari.substack.com/p/the-smart-eye-how-chinas-united-front","status":"live","title":"NetAskari publishes analysis of leaked 'Smart Eye' documents","url":"https://helix.ml/threat-watch/i/overseas-chinese-affairs-big-data-platform-smart-eye-ccp-ai-system-scrapes-diaspora-data-to-scout-spies-in-taiwan-chip-i"},{"body":"The GHSA references commit c65a28f, 'Reject PPD names that leave the upload directory (OCU-01-020)'. No patched release is listed. The oss-security announcement says the fix will ship in a release shortly after.","category":"patch","date":"2026-11-11","incident":"cve-2026-123747-pappl-retrofit-directory-traversal-in-add-delete-ppdfiles-actions-lets-attackers-write-delete-arbitrary","incidentTitle":"pappl-retrofit: path traversal in PPD add/delete lets attackers write or delete files (CVE-2026-123747)","kind":"patch","patchStatus":"partial","severity":"high","sourceUrl":"https://github.com/OpenPrinting/pappl-retrofit/security/advisories/GHSA-wxj6-x3wg-4vmc","status":"live","title":"Fix commit c65a28f on master; no release yet","url":"https://helix.ml/threat-watch/i/cve-2026-123747-pappl-retrofit-directory-traversal-in-add-delete-ppdfiles-actions-lets-attackers-write-delete-arbitrary"},{"body":"Datadog reproduced a segfault on 8.0.34 using two unauthenticated ping requests with readConcern.afterOpTime plus a forced failover. The same requests were rejected on 8.0.37. Datadog did not demonstrate code execution.","category":"patch","date":"2026-11-11","incident":"cve-2026-118383-mongodb-server-unauthenticated-use-after-free-in-replica-set-primary-catch-up-can-crash-or-execute-code","incidentTitle":"MongoDB Server: unauthenticated use-after-free in replica set catch-up, crash or code exec (CVE-2026-118383)","kind":"other","patchStatus":"patched","severity":"critical","sourceUrl":"https://securitylabs.datadoghq.com/articles/cve-2026-118383-mongodb-server-use-after-free/","status":"live","title":"Datadog Security Labs publishes reproduction: crash on 8.0.34, code execution not shown","url":"https://helix.ml/threat-watch/i/cve-2026-118383-mongodb-server-unauthenticated-use-after-free-in-replica-set-primary-catch-up-can-crash-or-execute-code"},{"body":null,"category":"patch","date":"2026-11-11","incident":"apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al","incidentTitle":"Apache HTTP Server mod_http2 RCE and mod_vhost_alias/mod_md flaws disclosed (CVE-2026-119618 et al.)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability","status":"live","title":"Wiz reports 64% of cloud environments have resources vulnerable to the critical Apache CVE-2026-119618 RCE, urging immediate patching","url":"https://helix.ml/threat-watch/i/apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al"},{"body":"Vendor fix release. The mod_http2 fix is the one-line change in modules/http2/h2_request.c (commit 824beab). No standalone mod_h2 release fixes the issue.","category":"patch","date":"2026-11-11","incident":"apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al","incidentTitle":"Apache HTTP Server mod_http2 RCE and mod_vhost_alias/mod_md flaws disclosed (CVE-2026-119618 et al.)","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"https://downloads.apache.org/httpd/CHANGES_2.4","status":"live","title":"httpd 2.4.71 released with fixes for CVE-2026-119618, CVE-2026-106023 and CVE-2026-109163","url":"https://helix.ml/threat-watch/i/apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al"},{"body":null,"category":"patch","date":"2026-11-11","incident":"apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al","incidentTitle":"Apache HTTP Server mod_http2 RCE and mod_vhost_alias/mod_md flaws disclosed (CVE-2026-119618 et al.)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://seclists.org/oss-sec/2026/q4/662","status":"live","title":"Apache HTTP Server mod_http2 RCE and mod_vhost_alias/mod_md flaws disclosed (CVE-2026-119618 et al.)","url":"https://helix.ml/threat-watch/i/apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al"},{"body":null,"category":"patch","date":"2026-11-11","incident":"asus-router-firmware-flaws-zoom-workplace-for-windows-privilege-escalation-cve-2026-108186","incidentTitle":"Zoom Workplace for Windows: unauthenticated privilege escalation (CVE-2026-108186, CVE-2026-108187)","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/11/critical-zoom-workplace-flaw-could.html","status":"live","title":"Zoom releases patches for two Zoom Workplace for Windows flaws incl. critical unauthenticated privilege escalation (CVE-2026-108186, CVSS 9.6)","url":"https://helix.ml/threat-watch/i/asus-router-firmware-flaws-zoom-workplace-for-windows-privilege-escalation-cve-2026-108186"},{"body":null,"category":"patch","date":"2026-11-11","incident":"cve-2026-123747-pappl-retrofit-directory-traversal-in-add-delete-ppdfiles-actions-lets-attackers-write-delete-arbitrary","incidentTitle":"pappl-retrofit: path traversal in PPD add/delete lets attackers write or delete files (CVE-2026-123747)","kind":"disclosure","patchStatus":"partial","severity":"high","sourceUrl":"https://seclists.org/oss-sec/2026/q4/658","status":"live","title":"pappl-retrofit: path traversal in PPD add/delete lets attackers write or delete files (CVE-2026-123747)","url":"https://helix.ml/threat-watch/i/cve-2026-123747-pappl-retrofit-directory-traversal-in-add-delete-ppdfiles-actions-lets-attackers-write-delete-arbitrary"},{"body":null,"category":"patch","date":"2026-11-11","incident":"xen-orchestra-auth-bypass-vsa-2026-062-vates-attackers-bypass-auth-via-crafted-cookie-take-over-xcp-ng-hosts-as-root-cve","incidentTitle":"Xen Orchestra: crafted cookie logs in as a token owner with admin rights (VSA-2026-062)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.securityweek.com/critical-xen-orchestra-flaws-exploited-in-attacks/","status":"live","title":"Critical Xen Orchestra flaws now actively exploited in attacks — auth bypass enables admin code execution and XCP-ng node takeover","url":"https://helix.ml/threat-watch/i/xen-orchestra-auth-bypass-vsa-2026-062-vates-attackers-bypass-auth-via-crafted-cookie-take-over-xcp-ng-hosts-as-root-cve"},{"body":"SecurityWeek's roundup of the 2026-11-11 patch cycle covers Zoom, Asus, Cisco and SonicWall. This record now covers only the Zoom CVEs; the Asus bulletin is proposed as a separate record.","category":"patch","date":"2026-11-11","incident":"asus-router-firmware-flaws-zoom-workplace-for-windows-privilege-escalation-cve-2026-108186","incidentTitle":"Zoom Workplace for Windows: unauthenticated privilege escalation (CVE-2026-108186, CVE-2026-108187)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.securityweek.com/asus-zoom-release-security-patches/","status":"live","title":"SecurityWeek's 2026-11-11 patch roundup includes the Zoom Workplace for Windows fixes","url":"https://helix.ml/threat-watch/i/asus-router-firmware-flaws-zoom-workplace-for-windows-privilege-escalation-cve-2026-108186"},{"body":"SecurityWeek reports the November 2026 ICS advisory batch from Siemens, Schneider Electric, Phoenix Contact, Hitachi Energy and VDE CERT vendors, including Siemens advisories on Node2Shell.","category":"patch","date":"2026-11-11","incident":"node2shell-php2shell-siemens-schneider-electric-phoenix-contact-and-other-ics-vendors-november-2026-ics-patch-tuesday-ad","incidentTitle":"Node2Shell / PHP2Shell: Siemens, Schneider Electric and other ICS vendors publish RCE advisories, Nov 2026","kind":"disclosure","patchStatus":"partial","severity":"high","sourceUrl":"https://www.securityweek.com/ics-patch-tuesday-siemens-flags-high-severity-flaws-node2shell-exposure/","status":"closed","title":"Node2Shell / PHP2Shell: Siemens, Schneider Electric and other ICS vendors publish RCE advisories, Nov 2026","url":"https://helix.ml/threat-watch/i/node2shell-php2shell-siemens-schneider-electric-phoenix-contact-and-other-ics-vendors-november-2026-ics-patch-tuesday-ad"},{"body":"SecurityWeek reports Previdian saw 17 attempts targeting CVE-2026-116606 between 9 and 11 November, from 15 IP addresses in three countries. Neither Barracuda nor CISA has shared exploitation details.","category":"patch","date":"2026-11-11","incident":"barracuda-esg-and-appliance-flaws-allow-root-access-via-admin-interface-cve-2026-116606-cve-2026-111560","incidentTitle":"Barracuda appliances: auth bypass and command injection chain to root (CVE-2026-116606, CVE-2026-111560)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.securityweek.com/recently-patched-barracuda-vulnerabilities-exploited-in-attacks/","status":"live","title":"Previdian observes 17 exploitation attempts against CVE-2026-116606 from 15 IPs","url":"https://helix.ml/threat-watch/i/barracuda-esg-and-appliance-flaws-allow-root-access-via-admin-interface-cve-2026-116606-cve-2026-111560"},{"body":null,"category":"patch","date":"2026-11-11","incident":"microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20","incidentTitle":"Microsoft Outlook: NTLM hash-leak zero-day exploited in Nov 2026 Patch Tuesday (CVE-2026-124194)","kind":"advisory","patchStatus":"patched","severity":"high","sourceUrl":"https://securityaffairs.com/202839/hacking/microsoft-november-patch-tuesday-one-exploited-outlook-bug-and-30-wormable-flaws.html","status":"live","title":"Microsoft November Patch Tuesday fixes ~1,090 flaws including the exploited Outlook bug and 30 wormable issues","url":"https://helix.ml/threat-watch/i/microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20"},{"body":"SecurityWeek (11 Nov 2026) reports exploitation of the Openwave flaw. CVE-2026-20320 is a separate Cisco BroadWorks XXE flaw covered in the same article. The configuration-data wording belongs to the Cisco flaw; the Openwave flaw lets an authenticated user obtain sensitive information through a crafted upload, per JVN.","category":"patch","date":"2026-11-11","incident":"openwave-messaging-limited-webtop-media-transcoder-cve-2026-111793","incidentTitle":"Openwave Webtop Media Transcoder: authenticated users bypass file-type limits, exploited (CVE-2026-111793)","kind":"exploitation","patchStatus":"patched","severity":"medium","sourceUrl":"https://www.securityweek.com/threat-actors-exploit-openwave-cisco-broadworks-vulnerabilities/","status":"closed","title":"Threat actors exploit Openwave CVE-2026-111793 to obtain sensitive information","url":"https://helix.ml/threat-watch/i/openwave-messaging-limited-webtop-media-transcoder-cve-2026-111793"},{"body":null,"category":"patch","date":"2026-11-11","incident":"microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20","incidentTitle":"Microsoft Outlook: NTLM hash-leak zero-day exploited in Nov 2026 Patch Tuesday (CVE-2026-124194)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://thehackernews.com/2026/11/microsoft-patches-1259-flaws-including.html","status":"live","title":"Microsoft's November 2026 Patch Tuesday total revised to 1,259 flaws, including the exploited Outlook NTLMv2 hash-leak zero-day","url":"https://helix.ml/threat-watch/i/microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20"},{"body":"The announcement says the full Plone releases were announced on 2026-11-10, and Docker images were available by 2026-11-11 at 01:21 (time as stated in the post). Products.PloneHotfix20261110 is the alternative for Plone 4.3 through 6.2 that cannot upgrade the listed packages.","category":"patch","date":"2026-11-11","incident":"plone-rce-chain-via-cmfeditions-modifier-and-allow-module-sandbox-escapes-anonymous-attackers-can-run-code-on-server","incidentTitle":"Plone: anonymous visitor can run code on the server via CMFEditions modifier and sandbox escapes","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"https://community.plone.org/t/plone-security-hotfix-20261110/23313","status":"live","title":"Full Plone releases and Docker images available for the fixed lines","url":"https://helix.ml/threat-watch/i/plone-rce-chain-via-cmfeditions-modifier-and-allow-module-sandbox-escapes-anonymous-attackers-can-run-code-on-server"},{"body":"Posted 2026-11-10, two days before the news coverage, per ThreatDefence and Mallory. Not Microsoft confirmation and not exploitation in the wild.","category":"patch","date":"2026-11-10","incident":"signdrop-windows-clfs-authentication-mitigation-zero-day-grants-system-privileges-and-edr-tamper-protection-bypass","incidentTitle":"Windows CLFS: unpatched SignDrop zero-day grants SYSTEM and reportedly bypasses tamper protection","kind":"disclosure","patchStatus":"unpatched","severity":"high","sourceUrl":"https://thehackernews.com/2026/11/new-signdrop-zero-day-exploit-turns.html","status":"live","title":"SignDrop PoC and write-up posted to GitHub by the researcher","url":"https://helix.ml/threat-watch/i/signdrop-windows-clfs-authentication-mitigation-zero-day-grants-system-privileges-and-edr-tamper-protection-bypass"},{"body":"GitHub advisory GHSA-xqc2-xf4c-x3h3 was published 2026-11-10 (GitHub API published_at 2026-11-10T22:44:12Z) and NVD published CVE-2026-126187 the same day (2026-11-10T23:17:20). GitHub rates it CVSS 4.0 9.5 (CWE-502). Finder credited: evolutionstorm. The advisory says it only affects 'extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value'.","category":"patch","date":"2026-11-10","incident":"next-js-unauthenticated-rce-in-use-cache-functions-returning-typed-arrays-ghsa-673q-mjm6-r5xr","incidentTitle":"React Server Components / Next.js: unauthenticated RCE via typed-array payloads (GHSA-xqc2-xf4c-x3h3, GHSA-673q-mjm6-r5xr)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-xqc2-xf4c-x3h3","status":"closed","title":"GHSA-xqc2-xf4c-x3h3 published with CVE-2026-126187 (CVSS 4.0 9.5)","url":"https://helix.ml/threat-watch/i/next-js-unauthenticated-rce-in-use-cache-functions-returning-typed-arrays-ghsa-673q-mjm6-r5xr"},{"body":"The Apache TomEE project published 38 security advisories on 10 November 2026 to its users list. Fixes for 26 issues ship in 10.3.0 and 11.0.0-M2; 12 issues affect optional modules that are removed in both releases with no fix. The project consolidated the list on oss-security on 12 November.","category":"patch","date":"2026-11-10","incident":"apache-tomee-38-cves-fixed-in-10-3-0-11-0-0-m2-incl-ejb-auth-bypass-on-jdk-21-cve-2026-86336","incidentTitle":"Apache TomEE: 38 CVEs fixed in 10.3.0/11.0.0-M2 incl. EJB auth bypass on JDK 21+ (CVE-2026-86336)","kind":"disclosure","patchStatus":"patched","severity":"high","sourceUrl":"https://seclists.org/oss-sec/2026/q4/681","status":"live","title":"Apache TomEE publishes 38 security advisories; fixes in 10.3.0 and 11.0.0-M2","url":"https://helix.ml/threat-watch/i/apache-tomee-38-cves-fixed-in-10-3-0-11-0-0-m2-incl-ejb-auth-bypass-on-jdk-21-cve-2026-86336"},{"body":"MongoDB 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35 and 4.4.32 list the CVE in their security fixes. Later patch releases 8.0.38 and 9.0.8 are also dated 2026-11-10 in the release notes.","category":"patch","date":"2026-11-10","incident":"cve-2026-118383-mongodb-server-unauthenticated-use-after-free-in-replica-set-primary-catch-up-can-crash-or-execute-code","incidentTitle":"MongoDB Server: unauthenticated use-after-free in replica set catch-up, crash or code exec (CVE-2026-118383)","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.mongodb.com/docs/manual/release-notes/8.0/","status":"live","title":"Fixed releases on 4.4 to 9.0 branches list CVE-2026-118383","url":"https://helix.ml/threat-watch/i/cve-2026-118383-mongodb-server-unauthenticated-use-after-free-in-replica-set-primary-catch-up-can-crash-or-execute-code"},{"body":"MongoDB's CNA record (CVSS v4.0 9.5) and the NVD entry were published on 2026-11-10. The two linked tickets are SERVER-138119, which restricts readConcern.afterOpTime to system users, and SERVER-138175, which fixes the double cleanup in CatchupState::abort(). Both were closed on 2026-11-10.","category":"patch","date":"2026-11-10","incident":"cve-2026-118383-mongodb-server-unauthenticated-use-after-free-in-replica-set-primary-catch-up-can-crash-or-execute-code","incidentTitle":"MongoDB Server: unauthenticated use-after-free in replica set catch-up, crash or code exec (CVE-2026-118383)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://jira.mongodb.org/browse/SERVER-138119","status":"live","title":"MongoDB publishes CVE-2026-118383 with two Jira tickets","url":"https://helix.ml/threat-watch/i/cve-2026-118383-mongodb-server-unauthenticated-use-after-free-in-replica-set-primary-catch-up-can-crash-or-execute-code"},{"body":"watchTowr reported exploitation attempts against N-central honeypots overnight, and Previdian reported attempts against an N-central decoy environment, including XXE and sensitive-file access. Beazley Security Labs and Tenable both state that no confirmed compromise of a customer server has been reported. N-able says it has no evidence of customer exploitation and that its status page is tracking scanning tied to the published proof-of-concept code.","category":"patch","date":"2026-11-10","incident":"able2shell-n-able-n-central-30-zero-days-published-hosted-environments-taken-offline","incidentTitle":"N-able N-central: 33 flaws with public PoCs, unauthenticated XXE-to-RCE; 7 of 33 fixed in Hotfix 2","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.tenable.com/blog/able2shell-frequently-asked-questions-for-reported-n-able-n-central-zero-day-vulnerabilities","status":"live","title":"Exploitation attempts reported against N-central honeypots and a decoy; no confirmed customer compromise","url":"https://helix.ml/threat-watch/i/able2shell-n-able-n-central-30-zero-days-published-hosted-environments-taken-offline"},{"body":"N-able said on 10 November that every hosted N-central server, in all regions, had been upgraded to the Hotfix 2 release and returned to service. Hosted customers still upgrade their own agents and probes. The earlier 9 November offline step was precautionary.","category":"patch","date":"2026-11-10","incident":"able2shell-n-able-n-central-30-zero-days-published-hosted-environments-taken-offline","incidentTitle":"N-able N-central: 33 flaws with public PoCs, unauthenticated XXE-to-RCE; 7 of 33 fixed in Hotfix 2","kind":"status","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","status":"live","title":"N-able says all hosted N-central servers are upgraded and back in service","url":"https://helix.ml/threat-watch/i/able2shell-n-able-n-central-30-zero-days-published-hosted-environments-taken-offline"},{"body":"Zoom's two bulletins, both dated 2026-11-10, cover Zoom Workplace for Windows. ZSB-26023 covers CVE-2026-108186 (CVSS 9.6) for versions 7.1.0 up to before 7.1.8. ZSB-26024 covers CVE-2026-108187 (CVSS 8.1) for versions before 7.1.5. SecurityWeek reports that 7.1.8 and later contain patches for both.","category":"patch","date":"2026-11-10","incident":"asus-router-firmware-flaws-zoom-workplace-for-windows-privilege-escalation-cve-2026-108186","incidentTitle":"Zoom Workplace for Windows: unauthenticated privilege escalation (CVE-2026-108186, CVE-2026-108187)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.zoom.com/en/trust/security-bulletin/zsb-26023/","status":"live","title":"Zoom publishes bulletins for CVE-2026-108186 and CVE-2026-108187","url":"https://helix.ml/threat-watch/i/asus-router-firmware-flaws-zoom-workplace-for-windows-privilege-escalation-cve-2026-108186"},{"body":"Ivanti and Citrix published patches for 19 vulnerabilities on Tuesday 2026-11-10 (SecurityWeek reported it on 2026-11-11). NVD published CVE-2026-121683, CVE-2026-121653 and CVE-2026-105425 on 2026-11-10.","category":"patch","date":"2026-11-10","incident":"citrix-ivanti-patch-tuesday-19-flaws-incl-critical-csa-auth-bypass-cve-2026-121683-and-epm-sqli-rce-cve-2026-121653","incidentTitle":"Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA auth bypass (CVE-2026-121683) in a 19-flaw Patch Tuesday","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.securityweek.com/citrix-ivanti-patch-critical-and-high-severity-vulnerabilities/","status":"live","title":"Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA auth bypass (CVE-2026-121683) in a 19-flaw Patch Tuesday","url":"https://helix.ml/threat-watch/i/citrix-ivanti-patch-tuesday-19-flaws-incl-critical-csa-auth-bypass-cve-2026-121683-and-epm-sqli-rce-cve-2026-121653"},{"body":"N-able released N-central 2026.4 Hotfix 2, build 2026.4.1.26, which fixes seven CVEs. The other flaws in the disclosure are not mapped to a fix, and a follow-up hotfix is promised with no date. The entry is dated to the release, 10 November; the press article that reported it is dated 11 November.","category":"patch","date":"2026-11-10","incident":"able2shell-n-able-n-central-30-zero-days-published-hosted-environments-taken-offline","incidentTitle":"N-able N-central: 33 flaws with public PoCs, unauthenticated XXE-to-RCE; 7 of 33 fixed in Hotfix 2","kind":"patch","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.bleepingcomputer.com/news/security/n-able-releases-security-hotfixes-for-zero-day-vulnerabilities/","status":"live","title":"N-able releases N-central 2026.4 Hotfix 2 (build 2026.4.1.26) fixing seven of the 33 flaws","url":"https://helix.ml/threat-watch/i/able2shell-n-able-n-central-30-zero-days-published-hosted-environments-taken-offline"},{"body":"Fortinet published 89 PSIRT advisories on Tuesday 2026-11-10 (SecurityWeek reported it on 2026-11-11). The FortiClient Fortinet2Shell bug was disclosed by researcher Kevin Joensen of Baldur Security; it is exploitable only with FortiPAM enabled.","category":"patch","date":"2026-11-10","incident":"fortinet2shell-fortinet-patch-tuesday-fortinet-89-advisories-fix-100-flaws-incl-critical-rce-and-auth-bypass-across-fort","incidentTitle":"Fortinet Patch Tuesday: 89 advisories, ~17 critical, incl. FortiClient Fortinet2Shell code execution via CORS","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.securityweek.com/fortinet-patches-nearly-100-vulnerabilities/","status":"live","title":"Fortinet Patch Tuesday: 89 advisories, ~17 critical, incl. FortiClient Fortinet2Shell code execution via CORS","url":"https://helix.ml/threat-watch/i/fortinet2shell-fortinet-patch-tuesday-fortinet-89-advisories-fix-100-flaws-incl-critical-rce-and-auth-bypass-across-fort"},{"body":"CISA's KEV catalog lists both CVEs with a date added of 2026-11-10 and a due date of 2026-11-13, a three-day remediation window under BOD 26-04. Ransomware use is listed as unknown.","category":"patch","date":"2026-11-10","incident":"barracuda-esg-and-appliance-flaws-allow-root-access-via-admin-interface-cve-2026-116606-cve-2026-111560","incidentTitle":"Barracuda appliances: auth bypass and command injection chain to root (CVE-2026-116606, CVE-2026-111560)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.securityweek.com/recently-patched-barracuda-vulnerabilities-exploited-in-attacks/","status":"live","title":"CISA adds CVE-2026-116606 and CVE-2026-111560 to the KEV catalog; federal deadline 13 Nov","url":"https://helix.ml/threat-watch/i/barracuda-esg-and-appliance-flaws-allow-root-access-via-admin-interface-cve-2026-116606-cve-2026-111560"},{"body":"The announcement says the details are public from 2026-11-10 and that, with current AI tools, a working exploit may not take long to build. Andreas Jung later the same day said the issues are fully disclosed. No in-the-wild exploitation is reported. CVE numbers are requested but not yet assigned.","category":"patch","date":"2026-11-10","incident":"plone-rce-chain-via-cmfeditions-modifier-and-allow-module-sandbox-escapes-anonymous-attackers-can-run-code-on-server","incidentTitle":"Plone: anonymous visitor can run code on the server via CMFEditions modifier and sandbox escapes","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://community.plone.org/t/plone-security-hotfix-20261110/23313","status":"live","title":"Plone/Zope Security Team: full details public, working exploit may not take long","url":"https://helix.ml/threat-watch/i/plone-rce-chain-via-cmfeditions-modifier-and-allow-module-sandbox-escapes-anonymous-attackers-can-run-code-on-server"},{"body":"The five FortiGuard PSIRT advisories give CVE IDs for the batch (CVE-2026-126253, -126257, -126251, -126244 and -126214 to -126217), per-branch fixed builds (FortiOS 8.0.2/7.6.8/7.4.13/7.2.14; FortiAuthenticator 8.0.4/6.6.11; FortiAnalyzer and FortiManager 8.0.2/7.6.8/7.4.12/7.2.13; FortiSASE 26.3.2 for 26.3.1), and no exploitation statement. The older cvrf-format pages for the same advisories show no fixed versions; the /psirt/ pages are the current view.","category":"patch","date":"2026-11-10","incident":"fortinet-patch-batch-fortios-ospf-auth-bypass-fortiauthenticator-hard-coded-password-auth-flaws","incidentTitle":"Fortinet patch batch: FortiOS OSPF auth bypass, FortiAuthenticator hard-coded password \u0026 auth flaws","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://fortiguard.fortinet.com/psirt/FG-IR-26-267","status":"live","title":"Fortinet publishes CVEs and per-branch fixed builds for the 2026-10-22 hardening releases","url":"https://helix.ml/threat-watch/i/fortinet-patch-batch-fortios-ospf-auth-bypass-fortiauthenticator-hard-coded-password-auth-flaws"},{"body":"Microsoft's KB5131096 is the Windows 10 22H2 ESU and LTSC 2021 cumulative update for November 2026. It raises builds to 19045.7846 and 19044.7846 and carries the November security fixes for these builds.","category":"patch","date":"2026-11-10","incident":"windows-10-kb5131096-esu-november-2026-patch-tuesday-fixes-incl-actively-exploited-outlook-zero-day","incidentTitle":"Windows 10 KB5131096 ESU: November 2026 security fixes, plus PowerShell and NTLM signing changes","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-windows-10-kb5131096-extended-security-update/","status":"live","title":"Microsoft releases Windows 10 KB5131096 (builds 19045.7846 and 19044.7846) for ESU and LTSC 2021","url":"https://helix.ml/threat-watch/i/windows-10-kb5131096-esu-november-2026-patch-tuesday-fixes-incl-actively-exploited-outlook-zero-day"},{"body":null,"category":"patch","date":"2026-11-10","incident":"microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20","incidentTitle":"Microsoft Outlook: NTLM hash-leak zero-day exploited in Nov 2026 Patch Tuesday (CVE-2026-124194)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://cyberscoop.com/microsoft-patch-tuesday-november-2026/","status":"live","title":"Microsoft November Patch Tuesday formally lists ~1,093–1,094 CVEs, second consecutive month over 1,000, Outlook zero-day in focus","url":"https://helix.ml/threat-watch/i/microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20"},{"body":"Five GitHub security advisories were published on 2026-11-10 between 13:27 and 13:30 UTC, with fixed releases and the Products.PloneHotfix20261110 alternative. The advisories say CVE ids are requested but not yet assigned, and that the details are fully public.","category":"patch","date":"2026-11-10","incident":"plone-rce-chain-via-cmfeditions-modifier-and-allow-module-sandbox-escapes-anonymous-attackers-can-run-code-on-server","incidentTitle":"Plone: anonymous visitor can run code on the server via CMFEditions modifier and sandbox escapes","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://seclists.org/oss-sec/2026/q4/650","status":"live","title":"Plone security fix 20261110 published: five GHSA advisories and fixed releases (CMFPlone, CMFEditions, MimetypesRegistry, plone.batching, plone.restapi)","url":"https://helix.ml/threat-watch/i/plone-rce-chain-via-cmfeditions-modifier-and-allow-module-sandbox-escapes-anonymous-attackers-can-run-code-on-server"},{"body":null,"category":"patch","date":"2026-11-10","incident":"fortinet-patch-batch-fortios-ospf-auth-bypass-fortiauthenticator-hard-coded-password-auth-flaws","incidentTitle":"Fortinet patch batch: FortiOS OSPF auth bypass, FortiAuthenticator hard-coded password \u0026 auth flaws","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://fortiguard.fortinet.com/psirt/cvrf/FG-IR-26-267","status":"live","title":"Fortinet patch batch: FortiOS OSPF auth bypass, FortiAuthenticator hard-coded password \u0026 auth flaws","url":"https://helix.ml/threat-watch/i/fortinet-patch-batch-fortios-ospf-auth-bypass-fortiauthenticator-hard-coded-password-auth-flaws"},{"body":null,"category":"patch","date":"2026-11-10","incident":"fortimail-critical-flaws-unauth-command-injection-sql-injection-ibe-session-hijack-fortios-sshd-auth-bypass","incidentTitle":"FortiMail critical flaws: unauth command injection, SQL injection, IBE session hijack; FortiOS sshd auth bypass","kind":"advisory","patchStatus":"unknown","severity":"critical","sourceUrl":"https://fortiguard.fortinet.com/psirt/cvrf/FG-IR-26-211","status":"live","title":"Additional FortiMail advisories: unauth quarantine release/delete bypass and IBE recipient account takeover via user-controlled key (CWE-639)","url":"https://helix.ml/threat-watch/i/fortimail-critical-flaws-unauth-command-injection-sql-injection-ibe-session-hijack-fortios-sshd-auth-bypass"},{"body":null,"category":"patch","date":"2026-11-10","incident":"fortimail-critical-flaws-unauth-command-injection-sql-injection-ibe-session-hijack-fortios-sshd-auth-bypass","incidentTitle":"FortiMail critical flaws: unauth command injection, SQL injection, IBE session hijack; FortiOS sshd auth bypass","kind":"disclosure","patchStatus":"unknown","severity":"critical","sourceUrl":"https://fortiguard.fortinet.com/psirt/cvrf/FG-IR-26-207","status":"live","title":"FortiMail critical flaws: unauth command injection, SQL injection, IBE session hijack; FortiOS sshd auth bypass","url":"https://helix.ml/threat-watch/i/fortimail-critical-flaws-unauth-command-injection-sql-injection-ibe-session-hijack-fortios-sshd-auth-bypass"},{"body":null,"category":"patch","date":"2026-11-10","incident":"microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20","incidentTitle":"Microsoft Outlook: NTLM hash-leak zero-day exploited in Nov 2026 Patch Tuesday (CVE-2026-124194)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108409","status":"live","title":"November 2026 Patch Tuesday details: 1,000+ fixes incl. Windows DWM/Wireless/SCSI EoP, HEIF RCE, AD CS cert-validation bypass, and Windows Overlay Filter info disclosure","url":"https://helix.ml/threat-watch/i/microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20"},{"body":null,"category":"patch","date":"2026-11-10","incident":"microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20","incidentTitle":"Microsoft Outlook: NTLM hash-leak zero-day exploited in Nov 2026 Patch Tuesday (CVE-2026-124194)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102224","status":"live","title":"November 2026 Patch Tuesday also fixes Azure CycleCloud EoP (CVE-2026-102224), Windows DNS RCE (CVE-2026-109463), Azure DevOps RCE (CVE-2026-109467), codec/Raw Image RCEs, VS Code UI-layer bypass, and other Windows/.NET/Office flaws","url":"https://helix.ml/threat-watch/i/microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20"},{"body":null,"category":"patch","date":"2026-11-10","incident":"microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20","incidentTitle":"Microsoft Outlook: NTLM hash-leak zero-day exploited in Nov 2026 Patch Tuesday (CVE-2026-124194)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109456","status":"live","title":"November 2026 Patch Tuesday batch expands: SharePoint XSS/spoofing and info-disclosure, SQL Server and WDAC OLE DB RCE/EoP, .NET/ASP.NET DoS and info-disclosure, Windows LSASS/NTFS/PFS EoP, RDP client info-disclosure, iSCSI over-read, and Azure firmware bypass CVEs","url":"https://helix.ml/threat-watch/i/microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20"},{"body":null,"category":"patch","date":"2026-11-10","incident":"microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20","incidentTitle":"Microsoft Outlook: NTLM hash-leak zero-day exploited in Nov 2026 Patch Tuesday (CVE-2026-124194)","kind":"advisory","patchStatus":"patched","severity":"high","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85862","status":"live","title":"Additional November 2026 Patch Tuesday CVEs detailed: Windows DNS/RDP/WER, SQL Server, Office (Word/PowerPoint/SharePoint), ASP.NET Core, Azure CLI, MCP Gateway, Entra Connector and 365 Agents SDK fixes","url":"https://helix.ml/threat-watch/i/microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20"},{"body":null,"category":"patch","date":"2026-11-10","incident":"microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20","incidentTitle":"Microsoft Outlook: NTLM hash-leak zero-day exploited in Nov 2026 Patch Tuesday (CVE-2026-124194)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-94515","status":"live","title":"November 2026 Patch Tuesday also fixes Windows RCE flaws (DNS, NFS, LLTD, DHCP), LSASS EoP bugs, QUIC DoS and other component vulnerabilities","url":"https://helix.ml/threat-watch/i/microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20"},{"body":null,"category":"patch","date":"2026-11-10","incident":"microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20","incidentTitle":"Microsoft Outlook: NTLM hash-leak zero-day exploited in Nov 2026 Patch Tuesday (CVE-2026-124194)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96077","status":"live","title":"November 2026 Patch Tuesday adds Windows fixes: TCP/IP DoS (CVE-2026-96077), DNS Server RCE (CVE-2026-96064), LSASS and multiple Installer/Kernel EoP flaws","url":"https://helix.ml/threat-watch/i/microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20"},{"body":null,"category":"patch","date":"2026-11-10","incident":"microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20","incidentTitle":"Microsoft Outlook: NTLM hash-leak zero-day exploited in Nov 2026 Patch Tuesday (CVE-2026-124194)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96164","status":"live","title":"November 2026 Patch Tuesday also fixes 20 Windows/Office component CVEs incl. pre-auth RCE in Windows Imaging Component, Rich Text Edit Control and Color Management (CVE-2026-96164, CVE-2026-96081, CVE-2026-96078)","url":"https://helix.ml/threat-watch/i/microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20"},{"body":null,"category":"patch","date":"2026-11-10","incident":"microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20","incidentTitle":"Microsoft Outlook: NTLM hash-leak zero-day exploited in Nov 2026 Patch Tuesday (CVE-2026-124194)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96986","status":"live","title":"November 2026 Patch Tuesday also fixes Windows DNS RCE/info-disclosure flaws, SQL Server heap-overflow RCE, BitLocker bypass, Hyper-V DoS and multiple Windows EoP bugs","url":"https://helix.ml/threat-watch/i/microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20"},{"body":null,"category":"patch","date":"2026-11-10","incident":"microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20","incidentTitle":"Microsoft Outlook: NTLM hash-leak zero-day exploited in Nov 2026 Patch Tuesday (CVE-2026-124194)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88237","status":"live","title":"MSRC Nov 2026 Patch Tuesday details: Windows iSCSI/DHCP/Media Player RCE, WSL/WFP/AppX EoP, SQL Server heap overflows, VS Code untrusted search path, Azure DevOps auth bypass, GitHub Copilot info disclosure","url":"https://helix.ml/threat-watch/i/microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20"},{"body":null,"category":"patch","date":"2026-11-10","incident":"microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20","incidentTitle":"Microsoft Outlook: NTLM hash-leak zero-day exploited in Nov 2026 Patch Tuesday (CVE-2026-124194)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95991","status":"live","title":"Nov 2026 Patch Tuesday also fixes 20 more Windows flaws incl. VFP pre-auth RCE (CVE-2026-95962) and eSCL Scanner RCE (CVE-2026-95956)","url":"https://helix.ml/threat-watch/i/microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20"},{"body":null,"category":"patch","date":"2026-11-10","incident":"microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20","incidentTitle":"Microsoft Outlook: NTLM hash-leak zero-day exploited in Nov 2026 Patch Tuesday (CVE-2026-124194)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96086","status":"live","title":"MSRC Nov 2026 release adds Windows WLAN DoS, DIAL/Feedback Hub/AppX/Installer/USB Driver EoP, and Microsoft Color Management RCE CVEs (CVE-2026-96086, 96076, 96075, 96074, 96073, 96067, 96061, 96060, 96057, 96055, 96051)","url":"https://helix.ml/threat-watch/i/microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20"},{"body":null,"category":"patch","date":"2026-11-10","incident":"microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20","incidentTitle":"Microsoft Outlook: NTLM hash-leak zero-day exploited in Nov 2026 Patch Tuesday (CVE-2026-124194)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96979","status":"live","title":"November 2026 Patch Tuesday also fixes Windows EoP/info-disclosure flaws (HID Parser, Winsock, USM, Secondary Logon, DWM) and SQL Server RCE/EoP/info-disclosure bugs","url":"https://helix.ml/threat-watch/i/microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20"},{"body":null,"category":"patch","date":"2026-11-10","incident":"microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20","incidentTitle":"Microsoft Outlook: NTLM hash-leak zero-day exploited in Nov 2026 Patch Tuesday (CVE-2026-124194)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112755","status":"live","title":"November 2026 Patch Tuesday also fixes Windows DNS, TCP/IP, RNDIS, Print Spooler, Word RCE and Azure CycleCloud flaws (CVE-2026-112755, CVE-2026-113759, CVE-2026-113822/113823 and others)","url":"https://helix.ml/threat-watch/i/microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20"},{"body":null,"category":"patch","date":"2026-11-10","incident":"microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20","incidentTitle":"Microsoft Outlook: NTLM hash-leak zero-day exploited in Nov 2026 Patch Tuesday (CVE-2026-124194)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112796","status":"live","title":"November 2026 Patch Tuesday also fixes 20 Windows component EoP/DoS/info-disclosure flaws (Print Spooler, Kernel, Event Collector, Smart Card, Task Scheduler, WFP, exFAT, etc.)","url":"https://helix.ml/threat-watch/i/microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20"},{"body":null,"category":"patch","date":"2026-11-10","incident":"microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20","incidentTitle":"Microsoft Outlook: NTLM hash-leak zero-day exploited in Nov 2026 Patch Tuesday (CVE-2026-124194)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112966","status":"live","title":"November 2026 Patch Tuesday also fixes 20 Windows flaws incl. Print Spooler, Kernel and LSASS EoP/DoS issues (CVE-2026-112966 through CVE-2026-112797)","url":"https://helix.ml/threat-watch/i/microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20"},{"body":null,"category":"patch","date":"2026-11-10","incident":"microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20","incidentTitle":"Microsoft Outlook: NTLM hash-leak zero-day exploited in Nov 2026 Patch Tuesday (CVE-2026-124194)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112988","status":"live","title":"November 2026 Patch Tuesday also fixes Windows EoP/RCE flaws incl. SMBv3 server RCE, Print Spooler UAFs, DWM and JScript issues (CVE-2026-112968–112988)","url":"https://helix.ml/threat-watch/i/microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20"},{"body":null,"category":"patch","date":"2026-11-10","incident":"microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20","incidentTitle":"Microsoft Outlook: NTLM hash-leak zero-day exploited in Nov 2026 Patch Tuesday (CVE-2026-124194)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-113766","status":"live","title":"November 2026 Patch Tuesday also fixes 20 Windows component CVEs (EoP, RCE, info disclosure) incl. Print Spooler adjacent-network RCE and Codecs Library network RCE","url":"https://helix.ml/threat-watch/i/microsoft-november-2026-patch-tuesday-fixes-record-1-235-flaws-actively-exploited-outlook-ntlm-hash-leak-zero-day-cve-20"}],"feeds":{"changes":"https://helix.ml/threat-watch/c/patch/changes.json","json":"https://helix.ml/threat-watch/c/patch/feed.json","llms":"https://helix.ml/threat-watch/c/patch/llms.txt","page":"https://helix.ml/threat-watch?c=patch","rss":"https://helix.ml/threat-watch/c/patch/feed.xml"},"generatedAt":"2026-11-15T04:20:31Z","site":"https://helix.ml/threat-watch"}