Briefing — 14 November 2026

Security News

Nightmare Eclipse drops Windows zero-day 'SignDrop' — no patch, SYSTEM rights

The researcher behind a string of unpatched Windows disclosures has dropped SignDrop, a zero-day that abuses the Common Log File System driver and Windows Defender to trigger arbitrary file creation and escalate to full System privileges. No patch has been issued. Local privilege escalation to System is immediately useful post-compromise. (SecurityWeek)

FAA nationwide ground stop — cyberattack not ruled out

The FAA issued a third-ever nationwide ground stop on Friday due to what it described as "extraordinary circumstances" — a communications failure across air traffic control centres. By Friday evening, nearly 5,000 flights were cancelled and 10,000 delayed. Federal officials have not confirmed the cause, and a cyberattack has not been ruled out. The FAA's AI-powered traffic management system SMART had recently been expanded across all 22 US control centres. (Ars Technica, SecurityWeek)

FBI flash alert: Artex AI attack tool reducing intrusions to under three hours

The FBI issued a flash alert on Artex, an open-source AI-powered penetration testing tool being weaponised by criminal actors. The bureau says Artex "significantly reduces the time required to chain attack techniques," with some intrusions progressing from initial targeting to privileged access in under three hours. Cisco Talos and Unit 42 published complementary research on the same day — a coordinated industry response. (The Record, Talos, Unit 42)

Check Point zero-day CVE-2026-123039 exploited — ESXi wipers deployed

Check Point patched an actively exploited zero-day in Security Gateway. Vulnerable instances have been targeted in PHP2Shell attacks deploying VMware ESXi wipers — destructive malware designed to destroy virtualised infrastructure. Emergency hotfixes are available. If you're running Check Point gateways, treat this as urgent. (BleepingComputer, SecurityWeek)

Trezor confirms hardware supply chain attack — implants in three Safe 5 wallets

Trezor confirmed that three Safe 5 cryptocurrency wallets sold by a Southeast Asian reseller, CryptoBilis, contained malicious hardware implants designed to steal wallet recovery phrases and transmit them over cellular networks. Physical supply chain compromise — the implants were baked into the devices before sale. Trezor has released a firmware fix but the implants themselves are hardware. (BleepingComputer)

CVE count for 2026 passes 100,000 — double 2025 total

The CVE count for 2026 passed one hundred thousand on Friday — more than double the total for all of 2025. Analysts attribute the surge primarily to AI-assisted vulnerability discovery tools. Volume at this scale makes comprehensive patch management functionally impossible. (The Register)

City of Osaka data breach — approximately 1 million residents affected

Japan's third-largest city (population 2.8 million) confirmed a breach affecting approximately 1 million residents. Residents were warned about suspicious emails purporting to come from local government. Japan has seen dozens of cyber incidents in recent weeks. (The Record)

Brazil's Caixa insurer breach exposes names and tax IDs of all 7.6 million customers

Brazil's Caixa insurance company confirmed a breach exposing the names and tax identification numbers of all 7.6 million customers. Full customer population affected.

Quantum Systems — German military drone operations disrupted by cyberattack

German defence technology company Quantum Systems confirmed a late-October cyberattack disrupted military drone operations. Drones are now back in the air following incident response, but few technical details have been disclosed. (The Register)

SilentAir — SS7-style telecom intercept from inside mobile networks, Taiwan targeted

SilentAir, a threat actor tracked by Enea, was found to have hijacked mobile network nodes to intercept calls and messages from inside telecom infrastructure. Taiwanese subscribers were the primary targets — not an external intrusion but a compromise of the network fabric itself. (SecurityWeek)

Gootloader takedown — 235 servers, 257 domains, 6.4 million credentials seized

The DOJ released details alongside the Europol Gootloader takedown: the malware was used in at least 44 ransomware attacks since 2018, costing victims $29 million. Europol and partners seized 235 servers, 257 domains, and 6.4 million victim credentials in Operation Endgame. (SecurityWeek, The Record)

TSMC confirms employee data exposed via cloud service provider

TSMC confirmed employee data was exposed through a compromised cloud service provider. No TSMC systems were directly breached, and no customer or operational data was involved. (The Record)

Citrix patches 10 critical NetScaler vulnerabilities

Citrix released patches for ten critical vulnerabilities in NetScaler. Prioritise patching if NetScaler is in your environment. (SecurityWeek)

UK ICO reports record cyber incidents — driven by data extortion and AI-assisted attacks

The UK Information Commissioner's Office reported a record number of cyber incidents from British organisations this year, driven by data extortion campaigns and AI-assisted attacks. The ICO also issued formal warnings to healthcare executives following over 300 reports of staff inappropriately accessing patient medical records. (The Record)

CISA Known Exploited Vulnerabilities

No new additions to the Known Exploited Vulnerabilities catalogue in the past 48 hours.

Ransomware Activity — 14 victims · 11 groups

No UK victims recorded in this period.

HaveIBeenPwned

No new breach additions in the past 48 hours.

NCSC

No new advisories issued in the past 48 hours.