Security News
Apache patches critical HTTP/2 RCE (CVE-2026-119618) — Unauthenticated remote code execution in Apache HTTP Server 2.4.55–2.4.70, discovered by Anthropic and Google. Patch immediately if HTTP/2 is enabled.
N-able N-central 33 zero-days — "4EverAble2Shell" actively exploited — Researcher disclosed 33 vulns; one was weaponised within hours, deploying cryptominers on 21+ systems. N-able took N-central offline and issued a hotfix.
ScreenConnect SCKit worm hits ~50 MSPs across 488 machines — ConnectWise confirmed a third-party extension breach. SCKit spreads from customer devices to MSP technicians' machines and pivots to additional managed networks.
GitHub wfx-loot campaign: 4,837 accounts, 61,764 repos targeted — Compromised CI/CD pipelines; 1,800+ repos actively backdoored with credential-stealing malware.
Jensen Huang resigns as Nvidia CEO after 33 years — CFO Colette Kress takes over as interim CEO. Singapore also named Megaspeed (linked to Huang associate Alice Huang) in an ongoing national security inquiry.
Maersk confirms WhiteArmor ransomware stole 100GB, $5M ransom demand — Legacy system acquired through acquisition. Same incident flagged earlier this week.
Windows SignDrop zero-day grants SYSTEM privileges — no patch yet — Released by researcher Nightmare Eclipse. No Microsoft patch issued as of this briefing.
Europol dismantles Gootloader, CastleRAT, and StealC infrastructure — Nine-country operation, hundreds of servers seized. StealC traced to Virtualine bulletproof hosting (FBI, Oct 2026).
Unit 42: Cairn AI agent framework weaponised against semiconductor and defence targets — Autonomous scanning, exploitation, and lateral movement with minimal human involvement.
Exchange Server 2016/2019 declared permanently unpatched — Microsoft will only patch Exchange Subscription Edition going forward. Migration window is closed.
November Patch Tuesday: 1,095 CVEs, 64 critical, one exploited at release — Largest single Patch Tuesday on record.
CISA Known Exploited Vulnerabilities
No new CISA KEV entries were added in the past 48 hours. See the full catalogue for the current list.
Have I Been Pwned — New Breaches
YouHack (Russian hacking forum) — 7,160,000 accounts added
SberSpasibo (Sberbank loyalty programme) — 3,290,000 accounts added
CastleRAT (malware victim infrastructure, taken down by Europol) — 179,745 records
Ransomware Activity — 58 Victims, 18 Groups
The Gentlemen — 22 victims
🇸🇦 United Pharmacy (Healthcare ⚠️) · 🇸🇪 Orennia (Energy) · 🇨🇦 City of Humboldt (Government) · 🇺🇸 Clancy Systems International (Government) · plus 18 further victims across Japan, Mexico, Germany, South Africa, France, Argentina, and more
Curious Worm — 10 victims
🇺🇸 Benchmark Senior Living (Healthcare ⚠️) · 🇬🇧 Baron & Budd (Legal) · 4 additional healthcare victims ⚠️ · 4 others
Qilin — 3 victims
🇺🇸 Oral Roberts University (Education) · 🇺🇸 University of Texas at Arlington (Education) · 🇨🇦 York University (Education)
IncRansom — 5 victims
🇺🇸 Raymond James (Financial Services) · 4 others
Akira — 3 victims
Manufacturing sector — 3 victims
Aoqin — 2 victims
🇵🇰 Airblue (Aviation ⚠️) · 🇺🇸 Tyfone
Panzer — 1 victim
🇲🇾 Ministry of Health Malaysia (Government/Healthcare ⚠️)
Osiris — 1 victim
🇺🇸 Herald Christian Health Center (Healthcare ⚠️)
Remaining 10 groups — 11 victims
BlackSuit, Medusa, RansomHub, DragonForce, Rhysida, Nitrogen, Abyss, BrainCipher, KillSec, and Interlock — one or two victims each across various sectors and countries.