{"meta":{"aiCadenceHours":6,"liveCadenceMinutes":15,"liveUpdatedAt":"2026-11-12T13:30:34.217Z","aiUpdatedAt":"2026-11-12T12:01:14.948Z","xHandles":["CISAgov","NSACyber","FBI","NCSC","MsftSecIntel","Unit42_Intel","TalosSecurity","CrowdStrike","Mandiant","ESETresearch","kaspersky","SentinelOne","rapid7","HuntressLabs","watchtowrcyber","threatintel","RecordedFuture","vxunderground","malwrhunterteam","BleepinComputer","TheRecord_Media","briankrebs","campuscodi","cyb3rops","GossiTheDog","_JohnHammond","Cyber_O51NT","ransomwaremap"],"xHandlesDarknet":["DarkWebInformer","FalconFeedsio","H4ckManac","DailyDarkWeb","DarkTracer_int","AlvieriD","BrettCallow","Cyberknow20","MonThreat","socradar","AuCyble","ransomwaremap","vxunderground"],"xHandlesUsed":["CISAgov","MsftSecIntel","Mandiant","vxunderground","DarkWebInformer","BleepinComputer","AuCyble","NSACyber","FBI","NCSC"],"mode":"live","askEnabled":false,"askSiteKey":"","dossierRefresh":false,"riskNarrative":false,"turnstileSiteKey":"","level":"High","levelScore":6.5,"servedAt":"2026-11-12T13:34:57.840Z"},"live":{"updatedAt":"2026-11-12T13:30:34.217Z","stats":{"kev24h":0,"kev7d":11,"kevTotal":1779,"cve24h":550,"cveHigh24h":96,"iocs24h":0,"families24h":0,"actorsTracked":23,"attackTrafficDelta7d":null},"series":{"days":["Nov 6","Nov 7","Nov 8","Nov 9","Nov 10","Nov 11","Nov 12"],"kevDaily":[1,0,0,4,6,0,0],"cveHighDaily":[126,121,136,105,113,151,96],"iocDaily":[0,0,0,0,0,0,0],"attackTraffic":[]},"kev":[{"cveId":"CVE-2026-124194","vendor":"Microsoft","product":"Office","name":"Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability","dateAdded":"2026-11-10","dueDate":"2026-11-24","ransomwareUse":"Known","cvss":6.5,"epss":null,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-124194"},{"cveId":"CVE-2026-111793","vendor":"Openwave Messaging Limited","product":"Webtop Media Transcoder","name":"Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability","dateAdded":"2026-11-10","dueDate":"2026-11-24","ransomwareUse":"Known","cvss":4.3,"epss":0.003,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-111793"},{"cveId":"CVE-2026-20320","vendor":"Cisco","product":"BroadWorks","name":"Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability","dateAdded":"2026-11-10","dueDate":"2026-11-24","ransomwareUse":"Known","cvss":7.5,"epss":0.004,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20320"},{"cveId":"CVE-2026-111560","vendor":"Barracuda Networks","product":"Multiple Products","name":"Barracuda Networks Multiple Products OS Command Injection Vulnerability","dateAdded":"2026-11-10","dueDate":"2026-11-13","ransomwareUse":"Known","cvss":8.6,"epss":0.011,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-111560"},{"cveId":"CVE-2026-116606","vendor":"Barracuda Networks","product":"Barracuda Email Security Gateway (ESG)","name":"Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability","dateAdded":"2026-11-10","dueDate":"2026-11-13","ransomwareUse":"Known","cvss":9.3,"epss":0.016,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-116606"},{"cveId":"CVE-2026-125350","vendor":"Google","product":"Chromium","name":"Google Chromium Use-After-Free Vulnerability","dateAdded":"2026-11-10","dueDate":"2026-11-24","ransomwareUse":"Known","cvss":8.8,"epss":null,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-125350"},{"cveId":"CVE-2026-102895","vendor":"GPUStack","product":"GPUStack","name":"GPUStack Improper Authentication Vulnerability","dateAdded":"2026-11-09","dueDate":"2026-11-12","ransomwareUse":"Known","cvss":9.8,"epss":0.006,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102895"},{"cveId":"CVE-2026-123158","vendor":"OpenBSD","product":"OpenSSH","name":"OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability","dateAdded":"2026-11-09","dueDate":"2026-11-12","ransomwareUse":"Known","cvss":8.1,"epss":0.165,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-123158"},{"cveId":"CVE-2026-116779","vendor":"SignalWire","product":"FreeSwitch","name":"SignalWire FreeSwitch Code Injection Vulnerability","dateAdded":"2026-11-09","dueDate":"2026-11-12","ransomwareUse":"Known","cvss":9.8,"epss":0.022,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-116779"},{"cveId":"CVE-2026-123218","vendor":"IBM","product":"Aspera Faspex","name":"IBM Aspera Faspex Incorrect Authorization Vulnerability","dateAdded":"2026-11-09","dueDate":"2026-11-12","ransomwareUse":"Known","cvss":9.8,"epss":0.007,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-123218"},{"cveId":"CVE-2026-19868","vendor":"SonicWall","product":"SonicOS SSLVPN","name":"SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability","dateAdded":"2026-11-06","dueDate":"2026-11-20","ransomwareUse":"Known","cvss":7.5,"epss":0.005,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-19868"},{"cveId":"CVE-2024-27834","vendor":"Apple","product":"Multiple Products","name":"Apple Multiple Products Improper Authentication Vulnerability","dateAdded":"2026-11-04","dueDate":"2026-11-18","ransomwareUse":"Known","cvss":5.5,"epss":0.015,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27834"},{"cveId":"CVE-2026-119977","vendor":"WordPress","product":"WordPress Core","name":"WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability","dateAdded":"2026-11-03","dueDate":"2026-11-06","ransomwareUse":"Known","cvss":8.1,"epss":0.012,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-119977"},{"cveId":"CVE-2026-118527","vendor":"Ivanti","product":"Connect Secure","name":"Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability","dateAdded":"2026-10-30","dueDate":"2026-11-13","ransomwareUse":"Known","cvss":4.3,"epss":0.008,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-118527"},{"cveId":"CVE-2026-111357","vendor":"Ivanti","product":"Connect Secure","name":"Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability","dateAdded":"2026-10-30","dueDate":"2026-11-02","ransomwareUse":"Known","cvss":7,"epss":0.005,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-111357"},{"cveId":"CVE-2026-97229","vendor":"GitLab","product":"Community Edition and Enterprise Edition","name":"GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability","dateAdded":"2026-10-29","dueDate":"2026-11-01","ransomwareUse":"Known","cvss":10,"epss":0.652,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-97229"},{"cveId":"CVE-2026-76418","vendor":"Cisco","product":"Secure Firewall ASA Software and Cisco Secure FTD Software","name":"Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability","dateAdded":"2026-10-29","dueDate":"2026-11-01","ransomwareUse":"Known","cvss":8.6,"epss":0.008,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76418"},{"cveId":"CVE-2026-41709","vendor":"Broadcom","product":"VMware ESX","name":"Broadcom VMWare ESX Insufficient Logging Vulnerability","dateAdded":"2026-10-28","dueDate":"2026-11-11","ransomwareUse":"Known","cvss":2.7,"epss":0.007,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-41709"},{"cveId":"CVE-2026-46300","vendor":"Linux","product":"Kernel","name":"Linux Kernel Missing Initialization of a Variable Vulnerability","dateAdded":"2026-10-28","dueDate":"2026-10-31","ransomwareUse":"Known","cvss":7.8,"epss":0.161,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-46300"},{"cveId":"CVE-2026-48356","vendor":"Adobe","product":"Commerce and Magento","name":"Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability","dateAdded":"2026-10-27","dueDate":"2026-11-10","ransomwareUse":"Known","cvss":9.3,"epss":0.475,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48356"},{"cveId":"CVE-2026-111497","vendor":"Google","product":"Brotli","name":"Google Brotli Unchecked Return Value Vulnerability","dateAdded":"2026-10-27","dueDate":"2026-11-10","ransomwareUse":"Known","cvss":9.2,"epss":0.826,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-111497"},{"cveId":"CVE-2026-109618","vendor":"PHP Group","product":"PHP","name":"PHP Memory Corruption Vulnerability","dateAdded":"2026-10-26","dueDate":"2026-10-29","ransomwareUse":"Known","cvss":9.2,"epss":1,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-109618"},{"cveId":"CVE-2026-109619","vendor":"PHP Group","product":"PHP","name":"PHP Stale Internal Request-State Vulnerability","dateAdded":"2026-10-26","dueDate":"2026-10-29","ransomwareUse":"Known","cvss":9.2,"epss":1,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-109619"},{"cveId":"CVE-2026-114625","vendor":"Arista","product":"VeloCloud Orchestrator","name":"Arista VeloCloud Orchestrator SQL Injection Vulnerability","dateAdded":"2026-10-23","dueDate":"2026-10-26","ransomwareUse":"Known","cvss":9.4,"epss":0.01,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-114625"},{"cveId":"CVE-2026-110447","vendor":"Collabora","product":"Collabora Online – Built-in CODE Server","name":"Collabora Online – Built-in CODE Server OS Command Injection Vulnerability","dateAdded":"2026-10-23","dueDate":"2026-10-26","ransomwareUse":"Known","cvss":9.2,"epss":0.733,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-110447"}],"cves":[{"cveId":"CVE-2026-110697","published":"2026-11-11","cvss":9.9,"severity":"Critical","vendor":"","description":"A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110697"},{"cveId":"CVE-2026-123710","published":"2026-11-11","cvss":9.8,"severity":"Critical","vendor":"","description":"A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123710"},{"cveId":"CVE-2026-65840","published":"2026-11-11","cvss":9.6,"severity":"Critical","vendor":"Fider","description":"Fider is a feedback portal for feature requests and suggestions. Prior to version 0.36.0, in multi-tenant mode (HOST_MODE=multi), an attacker can use an email verification key issued by Tenant A to authenticate as the same email address on Tenant B. This…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65840"},{"cveId":"CVE-2026-126768","published":"2026-11-11","cvss":9.3,"severity":"Critical","vendor":"OpsTree REMS","description":"OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field. Attackers can send a POST /api/v1/user/login/ request for the admin…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126768"},{"cveId":"CVE-2026-126797","published":"2026-11-11","cvss":9.3,"severity":"Critical","vendor":"NextScan","description":"NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126797"},{"cveId":"CVE-2026-126800","published":"2026-11-11","cvss":9.3,"severity":"Critical","vendor":"Hydro","description":"Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered users to inject script by placing double quotes in language- class tokens within markdown-it-xss.ts. Attackers can store a payload in their…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126800"},{"cveId":"CVE-2026-126806","published":"2026-11-11","cvss":9.3,"severity":"Critical","vendor":"WWBN AVideo","description":"WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDownloadedLink value stored unescaped through objects/aVideoEncoder.json.php. Attackers can embed event-handler payloads…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126806"},{"cveId":"CVE-2026-126812","published":"2026-11-11","cvss":9.3,"severity":"Critical","vendor":"","description":"blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126812"},{"cveId":"CVE-2026-126325","published":"2026-11-11","cvss":9.2,"severity":"Critical","vendor":"","description":"A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126325"},{"cveId":"CVE-2026-85632","published":"2026-11-11","cvss":9.1,"severity":"Critical","vendor":"Missing","description":"Missing authentication for critical function and Improper validation of integrity check value vulnerability in Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module allows Authentication Bypass and Application API Message…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85632"},{"cveId":"CVE-2026-126777","published":"2026-11-11","cvss":9.1,"severity":"Critical","vendor":"Traccar","description":"Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126777"},{"cveId":"CVE-2026-91880","published":"2026-11-11","cvss":8.9,"severity":"High","vendor":"Dell Terraform","description":"Dell Terraform Provider for PowerFlex, versions 1.5.0 through 1.8.0, contains an Improper Certificate Validation vulnerability in the SSH client component.Terraform PowerFlex provider uses ssh.InsecureIgnoreHostKey() as the default SSH host key callback. An…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91880"},{"cveId":"CVE-2026-125838","published":"2026-11-11","cvss":8.8,"severity":"High","vendor":"Cross-Site Request","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti Quality quality allows Cross Site Request Forgery.This issue affects Quality: from n/a through 3.3.","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125838"},{"cveId":"CVE-2026-125839","published":"2026-11-11","cvss":8.8,"severity":"High","vendor":"Cross-Site Request","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti ElitePress elitepress allows Cross Site Request Forgery.This issue affects ElitePress: from n/a through 3.2.1.","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125839"},{"cveId":"CVE-2026-125840","published":"2026-11-11","cvss":8.8,"severity":"High","vendor":"Cross-Site Request","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti Rambo rambo allows Cross Site Request Forgery.This issue affects Rambo: from n/a through 3.0.","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125840"},{"cveId":"CVE-2026-125841","published":"2026-11-11","cvss":8.8,"severity":"High","vendor":"Cross-Site Request","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti Heroic heroic allows Cross Site Request Forgery.This issue affects Heroic: from n/a through 1.4.2.","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125841"},{"cveId":"CVE-2026-125842","published":"2026-11-11","cvss":8.8,"severity":"High","vendor":"Cross-Site Request","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti Wallstreet Agency wallstreet-agency allows Cross Site Request Forgery.This issue affects Wallstreet Agency: from n/a through 1.3.4.","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125842"},{"cveId":"CVE-2026-125843","published":"2026-11-11","cvss":8.8,"severity":"High","vendor":"Cross-Site Request","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti Spasalon spasalon allows Cross Site Request Forgery.This issue affects Spasalon: from n/a through 3.0.","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125843"},{"cveId":"CVE-2026-125844","published":"2026-11-11","cvss":8.8,"severity":"High","vendor":"Cross-Site Request","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti vice vice allows Cross Site Request Forgery.This issue affects vice: from n/a through 1.4.","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125844"},{"cveId":"CVE-2026-125845","published":"2026-11-11","cvss":8.8,"severity":"High","vendor":"Cross-Site Request","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti vdequator vdequator allows Cross Site Request Forgery.This issue affects vdequator: from n/a through 1.2.7.","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125845"},{"cveId":"CVE-2026-125846","published":"2026-11-11","cvss":8.8,"severity":"High","vendor":"Cross-Site Request","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti Mazino mazino allows Cross Site Request Forgery.This issue affects Mazino: from n/a through 1.1.","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125846"},{"cveId":"CVE-2026-125847","published":"2026-11-11","cvss":8.8,"severity":"High","vendor":"Cross-Site Request","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti vdperanto vdperanto allows Cross Site Request Forgery.This issue affects vdperanto: from n/a through 2.2.","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125847"},{"cveId":"CVE-2026-125848","published":"2026-11-11","cvss":8.8,"severity":"High","vendor":"Cross-Site Request","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti Leo leo allows Cross Site Request Forgery.This issue affects Leo: from n/a through 1.7.4.","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125848"},{"cveId":"CVE-2026-125849","published":"2026-11-11","cvss":8.8,"severity":"High","vendor":"Cross-Site Request","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti Shk Corporate shk-corporate allows Cross Site Request Forgery.This issue affects Shk Corporate: from n/a through 2.4.3.","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125849"},{"cveId":"CVE-2026-125850","published":"2026-11-11","cvss":8.8,"severity":"High","vendor":"Cross-Site Request","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti Appointment Dark appointment-dark allows Cross Site Request Forgery.This issue affects Appointment Dark: from n/a through 1.3.4.","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125850"},{"cveId":"CVE-2026-106152","published":"2026-11-11","cvss":8.8,"severity":"High","vendor":"In Progress","description":"In Progress® Telerik® Report Server prior to version 12.3.26.1110, an external control of a system configuration setting vulnerability allows an unauthenticated remote attacker to influence the server address used by Report Server when generating links and…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106152"},{"cveId":"CVE-2026-107662","published":"2026-11-11","cvss":8.8,"severity":"High","vendor":"Blind SQL","description":"Blind SQL injection in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to extract arbitrary database values through the banner-zone.php and campaign-zone.php administration pages. Permission checks and database…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107662"},{"cveId":"CVE-2026-61619","published":"2026-11-11","cvss":8.8,"severity":"High","vendor":"The OWASP","description":"The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, regular-expression denial of service (ReDoS) affects a shared regex-assembly include…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61619"},{"cveId":"CVE-2026-91879","published":"2026-11-11","cvss":8.8,"severity":"High","vendor":"Dell Terraform","description":"Dell Terraform for ObjectScale and Powerstore, versions prior to 1.1.1 (ObjectScale) and versions 1.2.1 through 1.3.0 (PowerStore) contains an insertion of sensitive information into Log File vulnerability in the client initialization component.  A low…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91879"},{"cveId":"CVE-2026-126774","published":"2026-11-11","cvss":8.8,"severity":"High","vendor":"","description":"@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126774"},{"cveId":"CVE-2026-126802","published":"2026-11-11","cvss":8.8,"severity":"High","vendor":"NextScan","description":"NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126802"},{"cveId":"CVE-2026-126144","published":"2026-11-11","cvss":8.8,"severity":"High","vendor":"","description":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2 all versions, FortiRecorder…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126144"},{"cveId":"CVE-2026-65820","published":"2026-11-11","cvss":8.7,"severity":"High","vendor":"","description":"aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pull_request_target for pre-commit checks on pull requests from forks. In this configuration, fork-controlled code could be…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65820"},{"cveId":"CVE-2026-91890","published":"2026-11-11","cvss":8.7,"severity":"High","vendor":"Dell Ansible","description":"Dell Ansible Storage for Unity , versions prior to 1.2.13 contains an Improper Certificate Validation vulnerability in the UnityRESTConnector component. An unauthenticated attacker with remote access could potentially exploit this vulnerability,leading to…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91890"},{"cveId":"CVE-2026-126769","published":"2026-11-11","cvss":8.7,"severity":"High","vendor":"OpsTree REMS","description":"OpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access Governance API endpoints, including /api/v1/databases. Attackers can send requests without an Authorization header, or with…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126769"},{"cveId":"CVE-2026-126779","published":"2026-11-11","cvss":8.7,"severity":"High","vendor":"Spatie Browsershot","description":"Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml(). Attackers can embed iframe, img, link or script elements referencing…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126779"},{"cveId":"CVE-2026-65843","published":"2026-11-11","cvss":8.7,"severity":"High","vendor":"","description":"sync-rpc runs asynchronous commands synchronously by putting them in a separate proces. Prior to version 1.3.7, if an attacker could guess the correct port and it was not blocked via a firewall, it was possible to load and execute arbitrary JavaScript files…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65843"},{"cveId":"CVE-2026-91873","published":"2026-11-11","cvss":8.7,"severity":"High","vendor":"Dell OpenManage","description":"Dell OpenManage Ansible Modules, versions 2.1.2 through 10.0.3, contains an Improper Certificate Validation vulnerability in the iDRACRedfishAPI component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91873"},{"cveId":"CVE-2026-91874","published":"2026-11-11","cvss":8.7,"severity":"High","vendor":"Dell OpenManage","description":"Dell OpenManage Ansible Modules, versions 5.0.0 through 10.0.3, contains an Improper Certificate Validation vulnerability in the iDRACConnection component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91874"},{"cveId":"CVE-2026-91875","published":"2026-11-11","cvss":8.7,"severity":"High","vendor":"Dell OpenManage","description":"Dell OpenManage Ansible Modules, versions 9.2.0 through 10.0.3, contains an Improper Certificate Validation vulnerability in the SessionAPI component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91875"}],"malware":[],"iocs":[],"ticker":[{"ts":"2026-11-12T13:30:34.217Z","kind":"advisory","severity":"High","title":"Leak sites: 27 new ransomware victims posted in 24 hours; most active this week n0n 25, curious worm 9, interlock 9","source":"ransomware.live","url":"https://www.ransomware.live/"},{"ts":"2026-11-12T13:00:00.000Z","kind":"news","severity":"Medium","title":"The Record: Kazakhstan-linked hackers used AI agent to spy on Central Asian governments","source":"The Record","url":"https://therecord.media/kazakhstan-hackers-central-asia"},{"ts":"2026-11-11T23:00:53.000Z","kind":"news","severity":"Medium","title":"Unit 42: ARTEX and AI-Powered Red Teaming Tools: What Defenders Need to Know","source":"Unit 42","url":"https://unit42.paloaltonetworks.com/artex-and-ai-powered-red-teaming-tools/"},{"ts":"2026-11-11T21:04:56.000Z","kind":"advisory","severity":"High","title":"AWS Security Bulletins: CVE-2026-125926 - Server-side request forgery in the server registration and update API in mcp-gateway-registry","source":"AWS Security Bulletins","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-180-aws/"},{"ts":"2026-11-11T19:49:57.000Z","kind":"news","severity":"Medium","title":"Microsoft Security: The global socket: how threat actors are weaponizing GSocket for stealthy C2","source":"Microsoft Security","url":"https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/"},{"ts":"2026-11-11T19:49:10.000Z","kind":"news","severity":"Medium","title":"Wiz Research: Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know","source":"Wiz Research","url":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability"},{"ts":"2026-11-11T18:06:01.000Z","kind":"news","severity":"Medium","title":"Krebs on Security: Who Runs the Ransomware Group Qilin?","source":"Krebs on Security","url":"https://krebsonsecurity.com/2026/11/who-runs-the-ransomware-group-qilin/"},{"ts":"2026-11-11T17:00:00.000Z","kind":"advisory","severity":"High","title":"Palo Alto Networks PSIRT: CVE-2026-0330 PAN-OS: Authenticated Remote Code Execution (RCE) in Panorama (Severity: MEDIUM)","source":"Palo Alto Networks PSIRT","url":"https://security.paloaltonetworks.com/CVE-2026-0330"},{"ts":"2026-11-11T17:00:00.000Z","kind":"advisory","severity":"High","title":"Palo Alto Networks PSIRT: CVE-2026-0329 PAN-OS: Buffer Overflow Vulnerability (Severity: MEDIUM)","source":"Palo Alto Networks PSIRT","url":"https://security.paloaltonetworks.com/CVE-2026-0329"},{"ts":"2026-11-11T17:00:00.000Z","kind":"advisory","severity":"High","title":"Palo Alto Networks PSIRT: CVE-2026-0324 GlobalProtect App: Incorrect Privilege Management Vulnerability in OPSWAT MetaDefender Endpoint Security SDK on Windows (Severity: MEDIUM)","source":"Palo Alto Networks PSIRT","url":"https://security.paloaltonetworks.com/CVE-2026-0324"},{"ts":"2026-11-11T17:00:00.000Z","kind":"advisory","severity":"High","title":"Palo Alto Networks PSIRT: CVE-2026-0326 PAN-OS: Buffer Overflow Vulnerability in Protocol and Service Processing (Severity: LOW)","source":"Palo Alto Networks PSIRT","url":"https://security.paloaltonetworks.com/CVE-2026-0326"},{"ts":"2026-11-11T12:00:00Z","kind":"cve","severity":"Critical","title":"NVD: CVE-2026-126797 scored 9.3 — NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows…","source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126797"},{"ts":"2026-11-11T12:00:00Z","kind":"cve","severity":"Critical","title":"NVD: CVE-2026-126768 scored 9.3 — OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated…","source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126768"},{"ts":"2026-11-11T12:00:00Z","kind":"cve","severity":"Critical","title":"NVD: CVE-2026-65840 scored 9.6 — Fider is a feedback portal for feature requests and suggestions. Prior to version 0.36.0, in multi-tenant…","source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65840"},{"ts":"2026-11-11T12:00:00Z","kind":"cve","severity":"Critical","title":"NVD: CVE-2026-123710 scored 9.8 — A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an…","source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123710"},{"ts":"2026-11-11T12:00:00Z","kind":"cve","severity":"Critical","title":"NVD: CVE-2026-110697 scored 9.9 — A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from…","source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110697"},{"ts":"2026-11-10T12:00:00Z","kind":"kev","severity":"Critical","title":"CISA KEV: CVE-2026-125350 Google Chromium google chromium use-after-free vulnerability added, ransomware use known","source":"CISA","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-125350"},{"ts":"2026-11-10T12:00:00Z","kind":"kev","severity":"Critical","title":"CISA KEV: CVE-2026-116606 Barracuda Networks Barracuda Email Security Gateway (ESG) barracuda networks email security gateway (esg) authentication bypass using an alternate path or channel vulnerability added, ransomware use known","source":"CISA","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-116606"},{"ts":"2026-11-10T12:00:00Z","kind":"kev","severity":"Critical","title":"CISA KEV: CVE-2026-111560 Barracuda Networks Multiple Products barracuda networks multiple products os command injection vulnerability added, ransomware use known","source":"CISA","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-111560"},{"ts":"2026-11-10T12:00:00Z","kind":"kev","severity":"Critical","title":"CISA KEV: CVE-2026-20320 Cisco BroadWorks cisco broadworks improper restriction of xml external entity reference vulnerability added, ransomware use known","source":"CISA","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20320"},{"ts":"2026-11-10T12:00:00Z","kind":"kev","severity":"Critical","title":"CISA KEV: CVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder openwave messaging limited webtop media transcoder incorrect resource transfer between spheres vulnerability added, ransomware use known","source":"CISA","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-111793"},{"ts":"2026-11-10T12:00:00Z","kind":"kev","severity":"Critical","title":"CISA KEV: CVE-2026-124194 Microsoft Office microsoft office outlook missing user interaction for potentially unsafe action vulnerability added, ransomware use known","source":"CISA","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-124194"},{"ts":"2026-11-10T09:00:00Z","kind":"cve","severity":"Critical","title":"GitHub Advisory: GHSA-8vv3-6qpc-gpw6 / CVE-2026-107846 in npm bitcoinjs-lib — bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list","source":"GitHub Security Advisories","url":"https://github.com/advisories/GHSA-8vv3-6qpc-gpw6"},{"ts":"2026-11-10T09:00:00Z","kind":"cve","severity":"Critical","title":"GitHub Advisory: GHSA-pcrw-h46h-c93h / CVE-2026-125120 in npm mongoose — Mongoose: sanitizeFilter not applied on countDocuments","source":"GitHub Security Advisories","url":"https://github.com/advisories/GHSA-pcrw-h46h-c93h"},{"ts":"2026-11-10T09:00:00Z","kind":"cve","severity":"Critical","title":"GitHub Advisory: GHSA-xqc2-xf4c-x3h3 / CVE-2026-126187 in npm react-server-dom-parcel — React: Unauthenticated Remote Code Execution in React Server Components","source":"GitHub Security Advisories","url":"https://github.com/advisories/GHSA-xqc2-xf4c-x3h3"},{"ts":"2026-11-09T12:00:00Z","kind":"kev","severity":"Critical","title":"CISA KEV: CVE-2026-123158 OpenBSD OpenSSH openbsd openssh unexpected status code or return value vulnerability added, ransomware use known","source":"CISA","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-123158"},{"ts":"2026-11-09T12:00:00Z","kind":"kev","severity":"Critical","title":"CISA KEV: CVE-2026-102895 GPUStack GPUStack gpustack improper authentication vulnerability added, ransomware use known","source":"CISA","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102895"}],"advisories":[{"title":"Kazakhstan-linked hackers used AI agent to spy on Central Asian governments","source":"The Record","kind":"news","published":"2026-11-12T13:00:00.000Z","url":"https://therecord.media/kazakhstan-hackers-central-asia","summary":"Suspected Kazakhstan-linked hackers used an artificial intelligence agent to help spy on Central Asian governments, steal sensitive documents and infiltrate critical infrastructure networks, according to new research."},{"title":"ARTEX and AI-Powered Red Teaming Tools: What Defenders Need to Know","source":"Unit 42","kind":"partner","published":"2026-11-11T23:00:53.000Z","url":"https://unit42.paloaltonetworks.com/artex-and-ai-powered-red-teaming-tools/","summary":"Learn what Unit 42 discovered about attacker use of AI-powered red team tools, and how to mitigate these attacks. The post ARTEX and AI-Powered Red Teaming Tools: What Defenders Need to Know appeared first on Unit 42 ."},{"title":"CVE-2026-125926 - Server-side request forgery in the server registration and update API in mcp-gateway-registry","source":"AWS Security Bulletins","kind":"psirt","published":"2026-11-11T21:04:56.000Z","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-180-aws/","summary":"Bulletin ID: 2026-180-AWS Publication Date: 11/11/2026 13:00 PM PST Description: MServer-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated…"},{"title":"The global socket: how threat actors are weaponizing GSocket for stealthy C2","source":"Microsoft Security","kind":"partner","published":"2026-11-11T19:49:57.000Z","url":"https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/","summary":"Threat actors are deploying GSocket on compromised Linux servers to keep encrypted remote access after the original vulnerability is patched. Learn how to detect, investigate, and remediate this activity. The post The global socket: how…"},{"title":"Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know","source":"Wiz Research","kind":"partner","published":"2026-11-11T19:49:10.000Z","url":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability","summary":"Detect and mitigate CVE-2026-119618, a critical RCE vulnerability in Apache HTTP Server. According to Wiz data, 64% of cloud environments have resources vulnerable to CVE-2026-119618. Immediate patching is advised."},{"title":"Who Runs the Ransomware Group Qilin?","source":"Krebs on Security","kind":"news","published":"2026-11-11T18:06:01.000Z","url":"https://krebsonsecurity.com/2026/11/who-runs-the-ransomware-group-qilin/","summary":"The cybercrime group Qilin has emerged as the world's most active ransomware affiliate program, claiming at least 365 victim organizations in the past three months alone. But even top Russian hackers make operational security mistakes,…"},{"title":"CVE-2026-0326 PAN-OS: Buffer Overflow Vulnerability in Protocol and Service Processing (Severity: LOW)","source":"Palo Alto Networks PSIRT","kind":"psirt","published":"2026-11-11T17:00:00.000Z","url":"https://security.paloaltonetworks.com/CVE-2026-0326","summary":""},{"title":"CVE-2026-0324 GlobalProtect App: Incorrect Privilege Management Vulnerability in OPSWAT MetaDefender Endpoint Security SDK on Windows (Severity: MEDIUM)","source":"Palo Alto Networks PSIRT","kind":"psirt","published":"2026-11-11T17:00:00.000Z","url":"https://security.paloaltonetworks.com/CVE-2026-0324","summary":""},{"title":"CVE-2026-0329 PAN-OS: Buffer Overflow Vulnerability (Severity: MEDIUM)","source":"Palo Alto Networks PSIRT","kind":"psirt","published":"2026-11-11T17:00:00.000Z","url":"https://security.paloaltonetworks.com/CVE-2026-0329","summary":""},{"title":"CVE-2026-0330 PAN-OS: Authenticated Remote Code Execution (RCE) in Panorama (Severity: MEDIUM)","source":"Palo Alto Networks PSIRT","kind":"psirt","published":"2026-11-11T17:00:00.000Z","url":"https://security.paloaltonetworks.com/CVE-2026-0330","summary":""},{"title":"CVE-2026-0323 Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability (Severity: LOW)","source":"Palo Alto Networks PSIRT","kind":"psirt","published":"2026-11-11T17:00:00.000Z","url":"https://security.paloaltonetworks.com/CVE-2026-0323","summary":""},{"title":"CVE-2026-0328 PAN-OS: User Impersonation through GlobalProtect Portal (Severity: LOW)","source":"Palo Alto Networks PSIRT","kind":"psirt","published":"2026-11-11T17:00:00.000Z","url":"https://security.paloaltonetworks.com/CVE-2026-0328","summary":""},{"title":"PAN-SA-2026-0014 Chromium: Monthly Vulnerability Update (November 2026) (Severity: HIGH)","source":"Palo Alto Networks PSIRT","kind":"psirt","published":"2026-11-11T17:00:00.000Z","url":"https://security.paloaltonetworks.com/PAN-SA-2026-0014","summary":""},{"title":"CVE-2026-0331 PAN-OS: Sensitive Information Disclosure Vulnerability (Severity: MEDIUM)","source":"Palo Alto Networks PSIRT","kind":"psirt","published":"2026-11-11T17:00:00.000Z","url":"https://security.paloaltonetworks.com/CVE-2026-0331","summary":""},{"title":"CVE-2026-0327 PAN-OS: Privilege Escalation Vulnerability in GlobalProtect (Severity: LOW)","source":"Palo Alto Networks PSIRT","kind":"psirt","published":"2026-11-11T17:00:00.000Z","url":"https://security.paloaltonetworks.com/CVE-2026-0327","summary":""},{"title":"CVE-2026-0325 PAN-OS: GlobalProtect Authorization Bypass Vulnerability (Severity: LOW)","source":"Palo Alto Networks PSIRT","kind":"psirt","published":"2026-11-11T17:00:00.000Z","url":"https://security.paloaltonetworks.com/CVE-2026-0325","summary":""},{"title":"Iran-backed network directed London attacks over FaceTime, US prosecutors say","source":"The Record","kind":"news","published":"2026-11-11T16:57:00.000Z","url":"https://therecord.media/iran-backed-network-directed-london-attacks-over-facetime","summary":"An indictment unsealed Tuesday says the broader campaign, targeting Jewish and American sites, included attacks on synagogues in Belgium, the Netherlands and London, and U.S. bank buildings in Amsterdam and Paris."},{"title":"Lessons from 59 Linux Kernel Bug Reports","source":"Microsoft Security","kind":"partner","published":"2026-11-11T16:55:00.000Z","url":"https://www.microsoft.com/en-us/security/blog/2026/11/11/lessons-from-59-linux-kernel-bug-reports/","summary":"Microsoft FORGE Lab researchers used codename MDASH to investigate Linux kernel vulnerabilities, resulting in 59 upstream bug reports, 33 assigned CVEs, and 38 merged fixes. The research includes eight demonstrated local root…"},{"title":"The XG Files: Falcon C2 Flying Under The (Browser) Radar","source":"Unit 42","kind":"partner","published":"2026-11-11T15:00:23.000Z","url":"https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/","summary":"We uncover Falcon C2, a browser-based threat framework targeting governments via malicious scripts, extensions, and the Antino implant. The post The XG Files: Falcon C2 Flying Under The (Browser) Radar appeared first on Unit 42 ."},{"title":"Poland shuts down government services platform ePUAP following cyberattack","source":"The Record","kind":"news","published":"2026-11-11T13:18:00.000Z","url":"https://therecord.media/poland-shuts-down-government-services-platform-cyberattack","summary":"The attack targeted a nationwide system that allows users to submit official documents, communicate with government agencies and complete administrative procedures online."},{"title":"Britain, France set out first guidelines for commercial hacking firms","source":"The Record","kind":"news","published":"2026-11-11T13:11:00.000Z","url":"https://therecord.media/britain-france-set-out-guidelines-for-commercial-hacking-firms","summary":"The guidelines call on businesses that develop, sell or finance CCICs to vet their customers, establish technical safeguards against misuse and to maintain systems for monitoring and reporting abuses."},{"title":"Microsoft Patch Tuesday for November 2026 — Snort rules and prominent vulnerabilities","source":"Cisco Talos","kind":"research","published":"2026-11-11T01:41:17.000Z","url":"https://blog.talosintelligence.com/microsoft-patch-tuesday-for-november-2026/","summary":"Microsoft has released its monthly security update for November 2026, which includes 1328 vulnerabilities affecting a range of products, including 60 that Microsoft marked as \"critical.\" Out of 60 \"critical\" vulnerabilities, 45 are remote…"},{"title":"Detecting sleeper agents hiding in AI model neurons","source":"Microsoft Security","kind":"partner","published":"2026-11-10T23:00:00.000Z","url":"https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/","summary":"Microsoft Research has released new threat research detailing how a capable agent model could be turned into a sleeper agent by editing fewer than ten neurons to inject a short payload; Microsoft Research has also found that this threat…"},{"title":"Cisco Identity Services Engine Authorization Bypass Vulnerabilities","source":"Cisco PSIRT","kind":"psirt","published":"2026-11-10T22:37:41.000Z","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-1-MxcTNgwx?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Identity%20Services%20Engine%20Authorization%20Bypass%20Vulnerabilities%26vs_k=1","summary":"Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to modify parts of the configuration…"},{"title":"Patch Tuesday - November 2026","source":"Rapid7","kind":"research","published":"2026-11-10T21:55:37.000Z","url":"https://www.rapid7.com/blog/post/em-patch-tuesday-november-2026","summary":"Microsoft is publishing 1,092 own-product vulnerabilities on November 2026 Patch Tuesday, including 1,102 vulnerabilities in Windows. Until a few months ago, these volumes would have been unimaginable, but if anything, this month feels…"},{"title":"Microsoft Fixes Nearly 1,100 Security Vulnerabilities","source":"Krebs on Security","kind":"news","published":"2026-11-10T21:55:03.000Z","url":"https://krebsonsecurity.com/2026/11/microsoft-fixes-nearly-1100-security-vulnerabilities/","summary":"Microsoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software. This month's Patch Tuesday addresses 63 critical flaws -- including…"},{"title":"Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities","source":"Cisco PSIRT","kind":"psirt","published":"2026-11-10T21:50:24.000Z","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-emudhra-info-ScS22A1r?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Informational%20for%20Emergency%20Distrust%20of%20eMudhra%20Root%20and%20Intermediate%20Certificate%20Authorities%26vs_k=1","summary":"Between October 17 and October 20, 2026, a critical security compromise involving Certificate Authorities that are managed by eMudhra was uncovered. A security researcher demonstrated that the private keys for eight eMudhra intermediate…"},{"title":"US Army member arrested in UK over allegations of spying for Russia","source":"The Record","kind":"news","published":"2026-11-10T21:13:00.000Z","url":"https://therecord.media/us-army-member-arrested-in-uk-spying-for-russia","summary":"The unnamed soldier was arrested by British counterterrorism police “working closely” with U.S. authorities, including the FBI and the military, the Metropolitan Police said in a statement."},{"title":"Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026","source":"Cisco PSIRT","kind":"psirt","published":"2026-11-10T21:02:32.000Z","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20Node.js%20and%20Brotli%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1","summary":"On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations such as the Brotli decoder,…"},{"title":"How to Evaluate AI Agent Cybersecurity Capabilities","source":"Wiz Research","kind":"partner","published":"2026-11-10T16:03:25.000Z","url":"https://www.wiz.io/blog/cyber-model-arena-ai-benchmark","summary":"A tutorial for building a benchmark for offensive agents, based on how we built the Wiz Cyber Model Arena"},{"title":"Critical vulnerabilities in N-able N-central prompt hosted shutdown","source":"Rapid7","kind":"research","published":"2026-11-10T14:20:34.000Z","url":"https://www.rapid7.com/blog/post/etr-critical-vulnerabilities-in-n-able-n-central-prompt-hosted-shutdown","summary":"Overview On November 9, 2026, N-able announced that it was responding to the public disclosure of critical vulnerabilities affecting N-central , its remote monitoring and management (RMM) platform. In a public disclosure titled…"},{"title":"Five Signs Your MDR is All Alert, No Action","source":"Rapid7","kind":"research","published":"2026-11-10T14:04:31.000Z","url":"https://www.rapid7.com/blog/post/five-signs-your-mdr-is-all-alert-no-action","summary":"Your managed detection and response (MDR) provider flags suspicious activity, and your analyst spends the next hour finding the account, checking logs, and deciding whether anything needs to happen. By the time the investigation is…"},{"title":"Wiz and ISMAP: Building the Foundation for Japan's Public Sector","source":"Wiz Research","kind":"partner","published":"2026-11-10T13:48:36.000Z","url":"https://www.wiz.io/blog/wiz-and-ismap-for-japan-public-sector","summary":"A transparent look at our gap assessment, our ISO alignment, and our plan to earn a spot on Japan's government cloud service list"},{"title":"CISA Adds Six Known Exploited Vulnerabilities to Catalog","source":"CISA","kind":"gov","published":"2026-11-10T12:00:00.000Z","url":"https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog","summary":"CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability…"},{"title":"Broken Access Control in Two-Factor-Authentication","source":"Fortinet PSIRT","kind":"psirt","published":"2026-11-10T08:00:00.000Z","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-195","summary":"CVSSv3 Score: 5.9 An Improper Authentication vulnerability [CWE-287] in the FortiOS Remote Radius Type Admin Two-Factor (TFA) Authentication may allow a remote authenticated attacker with at least read-only permission to log in to the…"},{"title":"Authorization bypass through user-controlled key in dmserver","source":"Fortinet PSIRT","kind":"psirt","published":"2026-11-10T08:00:00.000Z","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-244","summary":"CVSSv3 Score: 9.1 An Authorization Bypass Through User-Controlled Key [CWE-639] in FortiManager, FortiAnalyzer, FortiManager Cloud and FortiAnalyzer Cloud could allow an authenticated administrator to access to other VDOMs via specially…"},{"title":"Authorization bypass through user-controlled key in GUI","source":"Fortinet PSIRT","kind":"psirt","published":"2026-11-10T08:00:00.000Z","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-228","summary":"CVSSv3 Score: 8.7 An Authorization Bypass Through User-Controlled Key vulnerability [cwe-639] in FortiManager, FortiManager Cloud and FortiSase-Sovereign GUI may allow an authenticated attacker to execute commands outside of the expected…"},{"title":"Authorization bypass through user-controlled key","source":"Fortinet PSIRT","kind":"psirt","published":"2026-11-10T08:00:00.000Z","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-211","summary":"CVSSv3 Score: 7.5 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiMail may allow an unauthenticated attacker to release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine…"},{"title":"Authorization bypass through user-controlled key","source":"Fortinet PSIRT","kind":"psirt","published":"2026-11-10T08:00:00.000Z","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-204","summary":"CVSSv3 Score: 8.1 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiMail may allow an authenticated remote attacker to delete arbitrary directories as root, or to access or delete other users' calendar…"},{"title":"Authorization bypass through user-controlled key","source":"Fortinet PSIRT","kind":"psirt","published":"2026-11-10T08:00:00.000Z","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-235","summary":"CVSSv3 Score: 8.2 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiManager may allow a remote authenticated attacker with admin permission to elevate their privileges to root via crafted HTTP requests.…"},{"title":"Authorization bypass through user-controlled key","source":"Fortinet PSIRT","kind":"psirt","published":"2026-11-10T08:00:00.000Z","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-208","summary":"CVSSv3 Score: 9.1 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiMail may allow an unauthenticated remote attacker to take over an arbitrary IBE recipient account via crafted HTTP requests. Revised on…"},{"title":"Authentication bypass by spoofing","source":"Fortinet PSIRT","kind":"psirt","published":"2026-11-10T08:00:00.000Z","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-229","summary":"CVSSv3 Score: 8.2 An authentication bypass by spoofing vulnerability (CWE-290) in FortiAnalyzer, FortiAnalyzer Cloud, FortiAnalyzer-BigData, FortiManager, FortiManager Cloud, FortiSASE-Sovereign fortilogd may allow an attacker to disrupt…"},{"title":"Authentication bypass by primary weakness","source":"Fortinet PSIRT","kind":"psirt","published":"2026-11-10T08:00:00.000Z","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-267","summary":"CVSSv3 Score: 9.3 An Authentication Bypass by Primary Weakness vulnerability [cwe-305] in FortiOS and FortiSASE ospf daemon may allow an unauthenticated attacker to broadcast LSA via specially crafted request Revised on 2026-11-10 00:00:00"},{"title":"Authentication bypass","source":"Fortinet PSIRT","kind":"psirt","published":"2026-11-10T08:00:00.000Z","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-271","summary":"CVSSv3 Score: 9.0 A Use of Hard-coded Password [CWE-259] vulnerability in FortiAuthenticator may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and gain…"},{"title":"Arbitrary file write and delete in JSON API","source":"Fortinet PSIRT","kind":"psirt","published":"2026-11-10T08:00:00.000Z","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-190","summary":"CVSSv3 Score: 7.3 An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiManager and FortiAnalyzer API may allow an authenticated attacker whose profile only has read permission to…"},{"title":"Allocation of resources without limits or throttling in fastapi","source":"Fortinet PSIRT","kind":"psirt","published":"2026-11-10T08:00:00.000Z","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-258","summary":"CVSSv3 Score: 7.5 An Allocation of Resources Without Limits or Throttling vulnerability [CWE-770] in FortiAuthenticator may allow an unauthenticated attacker to exhaust system resources, potentially resulting in a denial of service (DoS).…"},{"title":"CVE-2026-0250 GlobalProtect App: Buffer Overflow Vulnerability during connection to Portal or Gateway (Severity: MEDIUM)","source":"Palo Alto Networks PSIRT","kind":"psirt","published":"2026-11-10T07:15:00.000Z","url":"https://security.paloaltonetworks.com/CVE-2026-0250","summary":""},{"title":"November 2026 Patch Tuesday: 1,252 CVEs Include One Zero-Day and 68 Critical Vulnerabilities","source":"CrowdStrike","kind":"partner","published":"2026-11-10T06:00:00.000Z","url":"https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-november-2026/","summary":""},{"title":"CVE-2026-124034, CVE-2026-124035: Issues with Amazon Braket SDK","source":"AWS Security Bulletins","kind":"psirt","published":"2026-11-09T22:42:12.000Z","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-175-aws/","summary":"Bulletin ID: 2026-175-AWS Publication Date: 11/09/2026 14:15 PM PST Description: Amazon Braket SDK is an open source Python library that customers use to run quantum tasks and hybrid jobs on Amazon Braket. We identified CVE-2026-124034,…"},{"title":"CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)","source":"Palo Alto Networks PSIRT","kind":"psirt","published":"2026-11-09T21:00:00.000Z","url":"https://security.paloaltonetworks.com/CVE-2026-111497","summary":""},{"title":"FORGE Lab uses agentic tools to identify memory safety issues in Rust","source":"Microsoft Security","kind":"partner","published":"2026-11-09T20:17:31.000Z","url":"https://www.microsoft.com/en-us/security/blog/2026/11/09/forge-lab-uses-agentic-tools-to-identify-memory-safety-issues-in-rust/","summary":"Microsoft FORGE Lab researchers found memory-safety bugs in Rust's core and std libraries, including cases where safe Rust code can trigger undefined behavior. Using Hyenas, FORGE's frontier research version of codename MDASH, the team…"},{"title":"Cisco Meraki Security Hardening Release: October 2026","source":"Cisco PSIRT","kind":"psirt","published":"2026-11-09T17:55:54.000Z","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Meraki%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally…"},{"title":"VU#188754: FrodoBots EarthRover Mini+ firmware contains multiple vulnerabilities","source":"CERT/CC","kind":"gov","published":"2026-11-09T16:21:18.111Z","url":"https://kb.cert.org/vuls/id/188754","summary":"Overview Multiple vulnerabilities in the FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) may allow remote code execution, unauthorized access to onboard sensors, disclosure of sensitive information, and full compromise…"},{"title":"Trusted by Default: Qubole Cross-Account Access Abused in the Wild","source":"Wiz Research","kind":"partner","published":"2026-11-09T14:56:32.000Z","url":"https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild","summary":"A threat actor used IAM credentials from Qubole's AWS account to assume integration roles in customer AWS environments. Here's what we observed and how to hunt for it."},{"title":"VU#385711: PrestaShop debug mode configuration allows PHP code injection","source":"CERT/CC","kind":"gov","published":"2026-11-09T14:53:28.663Z","url":"https://kb.cert.org/vuls/id/385711","summary":"Overview PrestaShop's back-office Performance > Debug mode functionality contains a PHP code injection vulnerability. An authenticated attacker with permission to modify debug-mode configuration can submit crafted cookie configuration…"},{"title":"CISA Adds Four Known Exploited Vulnerabilities to Catalog","source":"CISA","kind":"gov","published":"2026-11-09T12:00:00.000Z","url":"https://www.cisa.gov/news-events/alerts/2026/11/09/cisa-adds-four-known-exploited-vulnerabilities-catalog","summary":"CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-102895 GPUStack Improper Authentication Vulnerability CVE-2026-116779 SignalWire FreeSwitch…"},{"title":"ARTEX abuse expands as cybercriminals target financial sector","source":"Microsoft Security","kind":"partner","published":"2026-11-07T02:44:34.000Z","url":"https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/","summary":"In October 2026, the financially motivated threat actor Storm-3358 began targeting organizations in the financial sector using the agentic AI offensive framework ARTEX. The post ARTEX abuse expands as cybercriminals target financial…"},{"title":"Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration Systems","source":"Unit 42","kind":"partner","published":"2026-11-06T21:15:09.000Z","url":"https://unit42.paloaltonetworks.com/europes-refrigeration-systems-attacks/","summary":"Unit 42 examines recent cyberattacks targeting European refrigeration systems and outlines defense and mitigation strategies. The post Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration Systems appeared first on Unit 42 ."},{"title":"CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL","source":"AWS Security Bulletins","kind":"psirt","published":"2026-11-06T19:03:08.000Z","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-166-aws/","summary":"Read this article"},{"title":"Vulnerabilities in PHP Affecting Cisco Products: October 2026","source":"Cisco PSIRT","kind":"psirt","published":"2026-11-06T14:21:13.000Z","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20PHP%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1","summary":"On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global state For information…"}],"ghsa":[{"ghsaId":"GHSA-xqc2-xf4c-x3h3","cveId":"CVE-2026-126187","summary":"React: Unauthenticated Remote Code Execution in React Server Components","severity":"Critical","cvss":null,"ecosystem":"npm","pkg":"react-server-dom-parcel","published":"2026-11-10","url":"https://github.com/advisories/GHSA-xqc2-xf4c-x3h3"},{"ghsaId":"GHSA-pcrw-h46h-c93h","cveId":"CVE-2026-125120","summary":"Mongoose: sanitizeFilter not applied on countDocuments","severity":"Critical","cvss":9.8,"ecosystem":"npm","pkg":"mongoose","published":"2026-11-10","url":"https://github.com/advisories/GHSA-pcrw-h46h-c93h"},{"ghsaId":"GHSA-8vv3-6qpc-gpw6","cveId":"CVE-2026-107846","summary":"bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list","severity":"Critical","cvss":null,"ecosystem":"npm","pkg":"bitcoinjs-lib","published":"2026-11-10","url":"https://github.com/advisories/GHSA-8vv3-6qpc-gpw6"},{"ghsaId":"GHSA-62m9-f875-rqw6","cveId":"CVE-2026-102894","summary":"GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover","severity":"Critical","cvss":9.1,"ecosystem":"pip","pkg":"gpustack","published":"2026-11-10","url":"https://github.com/advisories/GHSA-62m9-f875-rqw6"},{"ghsaId":"GHSA-xggf-m53x-jc3f","cveId":"CVE-2026-95860","summary":"node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions","severity":"Critical","cvss":9.1,"ecosystem":"npm","pkg":"node-opcua","published":"2026-11-10","url":"https://github.com/advisories/GHSA-xggf-m53x-jc3f"},{"ghsaId":"GHSA-rjr3-43j3-4q8g","cveId":"CVE-2026-77596","summary":"Kubeflow Pipelines API server lacks authorization for shared pipeline uploads","severity":"Critical","cvss":9.6,"ecosystem":"go","pkg":"github.com/kubeflow/pipelines","published":"2026-11-09","url":"https://github.com/advisories/GHSA-rjr3-43j3-4q8g"},{"ghsaId":"GHSA-gj9m-f8ph-pmhr","cveId":"CVE-2026-102895","summary":"GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin","severity":"Critical","cvss":9.8,"ecosystem":"pip","pkg":"gpustack","published":"2026-11-09","url":"https://github.com/advisories/GHSA-gj9m-f8ph-pmhr"},{"ghsaId":"GHSA-rm8c-2cv8-jwf6","cveId":"CVE-2026-115770","summary":"Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing","severity":"Critical","cvss":9.6,"ecosystem":"go","pkg":"github.com/pocket-id/pocket-id/backend","published":"2026-11-09","url":"https://github.com/advisories/GHSA-rm8c-2cv8-jwf6"},{"ghsaId":"GHSA-p2mm-64f6-gmpp","cveId":"CVE-2026-63471","summary":"fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator","severity":"Critical","cvss":null,"ecosystem":"pip","pkg":"fastapi-code-generator","published":"2026-11-09","url":"https://github.com/advisories/GHSA-p2mm-64f6-gmpp"},{"ghsaId":"GHSA-6xmv-cjr5-w3q8","cveId":"CVE-2026-63469","summary":"fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict","severity":"Critical","cvss":null,"ecosystem":"pip","pkg":"fastapi-code-generator","published":"2026-11-09","url":"https://github.com/advisories/GHSA-6xmv-cjr5-w3q8"},{"ghsaId":"GHSA-h667-4jj2-cgv4","cveId":"CVE-2026-63470","summary":"fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring","severity":"Critical","cvss":null,"ecosystem":"pip","pkg":"fastapi-code-generator","published":"2026-11-09","url":"https://github.com/advisories/GHSA-h667-4jj2-cgv4"},{"ghsaId":"GHSA-47w9-6r3f-938g","cveId":null,"summary":"LXD has restricted project bypass leading to arbitrary command execution","severity":"Critical","cvss":9.9,"ecosystem":"go","pkg":"github.com/canonical/lxd","published":"2026-11-06","url":"https://github.com/advisories/GHSA-47w9-6r3f-938g"},{"ghsaId":"GHSA-pjff-c2wc-f6jm","cveId":null,"summary":"LXD has arbitrary file write on client due to trusted image hash","severity":"Critical","cvss":9.9,"ecosystem":"go","pkg":"github.com/canonical/lxd","published":"2026-11-06","url":"https://github.com/advisories/GHSA-pjff-c2wc-f6jm"},{"ghsaId":"GHSA-fmc8-p6q7-75cc","cveId":null,"summary":"LXD has argument injection in backup compression algorithm leading to AFW and ACE","severity":"Critical","cvss":9.9,"ecosystem":"go","pkg":"github.com/canonical/lxd","published":"2026-11-06","url":"https://github.com/advisories/GHSA-fmc8-p6q7-75cc"},{"ghsaId":"GHSA-vghh-5rfx-xhq8","cveId":null,"summary":"LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image","severity":"Critical","cvss":9.9,"ecosystem":"go","pkg":"github.com/canonical/lxd","published":"2026-11-06","url":"https://github.com/advisories/GHSA-vghh-5rfx-xhq8"},{"ghsaId":"GHSA-jpf8-86f3-wp38","cveId":null,"summary":"LXD has arbitrary file read+write on host via templates/ symlink in malicious image","severity":"Critical","cvss":9.9,"ecosystem":"go","pkg":"github.com/canonical/lxd","published":"2026-11-06","url":"https://github.com/advisories/GHSA-jpf8-86f3-wp38"},{"ghsaId":"GHSA-9j25-mm2h-2f76","cveId":null,"summary":"LXD has arbitrary file write on host via `exec-output` symlink in crafted image","severity":"Critical","cvss":9.9,"ecosystem":"go","pkg":"github.com/canonical/lxd","published":"2026-11-06","url":"https://github.com/advisories/GHSA-9j25-mm2h-2f76"},{"ghsaId":"GHSA-5q7h-w9jf-cx97","cveId":"CVE-2026-105769","summary":"kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts","severity":"Critical","cvss":9.3,"ecosystem":"go","pkg":"github.com/chainguard-dev/kaniko","published":"2026-11-05","url":"https://github.com/advisories/GHSA-5q7h-w9jf-cx97"},{"ghsaId":"GHSA-33r5-xmm8-v6x5","cveId":"CVE-2026-44267","summary":"Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access","severity":"Critical","cvss":9.8,"ecosystem":"npm","pkg":"@enspirit/elo","published":"2026-11-03","url":"https://github.com/advisories/GHSA-33r5-xmm8-v6x5"},{"ghsaId":"GHSA-7w38-ggh5-v542","cveId":"CVE-2026-44266","summary":"Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels","severity":"Critical","cvss":9.8,"ecosystem":"npm","pkg":"@enspirit/elo","published":"2026-11-03","url":"https://github.com/advisories/GHSA-7w38-ggh5-v542"},{"ghsaId":"GHSA-4xm8-rg9h-jhq2","cveId":"CVE-2026-123807","summary":"Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution","severity":"Critical","cvss":9.8,"ecosystem":"npm","pkg":"signalk-server","published":"2026-10-30","url":"https://github.com/advisories/GHSA-4xm8-rg9h-jhq2"},{"ghsaId":"GHSA-hff9-5pqw-6w9f","cveId":null,"summary":"imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution","severity":"Critical","cvss":9.8,"ecosystem":"go","pkg":"github.com/imgproxy/imgproxy/v3","published":"2026-10-30","url":"https://github.com/advisories/GHSA-hff9-5pqw-6w9f"},{"ghsaId":"GHSA-5xjx-3w67-w9x9","cveId":null,"summary":"pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI","severity":"Critical","cvss":null,"ecosystem":"actions","pkg":"pypa/gh-action-pypi-publish","published":"2026-10-30","url":"https://github.com/advisories/GHSA-5xjx-3w67-w9x9"},{"ghsaId":"GHSA-6jp4-8v48-cc5v","cveId":"CVE-2026-117601","summary":"Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it","severity":"Critical","cvss":7.5,"ecosystem":"pip","pkg":"electrum","published":"2026-10-28","url":"https://github.com/advisories/GHSA-6jp4-8v48-cc5v"},{"ghsaId":"GHSA-mghf-wjfp-p5xm","cveId":"CVE-2026-115893","summary":"Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction","severity":"Critical","cvss":9.9,"ecosystem":"rust","pkg":"wasmtime","published":"2026-10-28","url":"https://github.com/advisories/GHSA-mghf-wjfp-p5xm"}],"ransomware":{"victims24h":27,"victims7d":100,"series7d":[0,0,0,37,36,24,3],"groups":[{"group":"n0n","url":"https://www.ransomware.live/group/n0n","victims24h":2,"victims7d":25,"series7d":[0,0,0,23,0,2,0],"sectors":[]},{"group":"curious worm","url":"https://www.ransomware.live/group/curious%20worm","victims24h":9,"victims7d":9,"series7d":[0,0,0,0,0,9,0],"sectors":["Healthcare","Professional Services","Manufacturing"]},{"group":"interlock","url":"https://www.ransomware.live/group/interlock","victims24h":1,"victims7d":9,"series7d":[0,0,0,0,8,1,0],"sectors":["Education","Healthcare","Retail & E-Commerce"]},{"group":"booba project","url":"https://www.ransomware.live/group/booba%20project","victims24h":0,"victims7d":6,"series7d":[0,0,0,0,6,0,0],"sectors":["Healthcare","Professional Services","Technology"]},{"group":"play","url":"https://www.ransomware.live/group/play","victims24h":1,"victims7d":4,"series7d":[0,0,0,0,3,1,0],"sectors":["Hospitality","Retail & E-Commerce","Transportation"]},{"group":"silentransomgroup","url":"https://www.ransomware.live/group/silentransomgroup","victims24h":0,"victims7d":4,"series7d":[0,0,0,2,2,0,0],"sectors":["Professional Services"]},{"group":"qilin","url":"https://www.ransomware.live/group/qilin","victims24h":3,"victims7d":3,"series7d":[0,0,0,0,0,1,2],"sectors":["Education"]},{"group":"aoqin","url":"https://www.ransomware.live/group/aoqin","victims24h":1,"victims7d":3,"series7d":[0,0,0,2,0,1,0],"sectors":["Technology","Retail & E-Commerce"]},{"group":"akira","url":"https://www.ransomware.live/group/akira","victims24h":3,"victims7d":3,"series7d":[0,0,0,0,0,3,0],"sectors":["Manufacturing","Transportation"]},{"group":"vortex","url":"https://www.ransomware.live/group/vortex","victims24h":0,"victims7d":3,"series7d":[0,0,0,0,3,0,0],"sectors":["Healthcare","Professional Services"]},{"group":"byod","url":"https://www.ransomware.live/group/byod","victims24h":0,"victims7d":3,"series7d":[0,0,0,1,2,0,0],"sectors":["Healthcare","Manufacturing","Education"]},{"group":"climax inc","url":"https://www.ransomware.live/group/climax%20inc","victims24h":0,"victims7d":3,"series7d":[0,0,0,0,3,0,0],"sectors":["Energy & Utilities","Retail & E-Commerce"]},{"group":"medusalocker","url":"https://www.ransomware.live/group/medusalocker","victims24h":1,"victims7d":2,"series7d":[0,0,0,0,1,1,0],"sectors":[]},{"group":"everstake","url":"https://www.ransomware.live/group/everstake","victims24h":1,"victims7d":2,"series7d":[0,0,0,1,0,1,0],"sectors":["Retail & E-Commerce"]},{"group":"osiris","url":"https://www.ransomware.live/group/osiris","victims24h":2,"victims7d":2,"series7d":[0,0,0,0,0,2,0],"sectors":["Professional Services","Healthcare"]}],"sectors":[{"sector":"Healthcare","count":18},{"sector":"Professional Services","count":9},{"sector":"Retail & E-Commerce","count":8},{"sector":"Technology","count":7},{"sector":"Education","count":7},{"sector":"Manufacturing","count":7},{"sector":"Other","count":3},{"sector":"Hospitality","count":2}],"countries":[{"country":"US","count":52},{"country":"CA","count":6},{"country":"GB","count":4},{"country":"ES","count":3},{"country":"QA","count":1},{"country":"ET","count":1},{"country":"IE","count":1},{"country":"SA","count":1},{"country":"DE","count":1},{"country":"AE","count":1},{"country":"AU","count":1},{"country":"MX","count":1},{"country":"JP","count":1},{"country":"IN","count":1},{"country":"NP","count":1},{"country":"BR","count":1},{"country":"ZA","count":1},{"country":"TH","count":1},{"country":"CM","count":1},{"country":"NL","count":1},{"country":"IT","count":1},{"country":"CO","count":1},{"country":"KR","count":1}],"recent":[{"group":"qilin","sector":"Education","country":"CA","discovered":"2026-11-12"},{"group":"qilin","sector":"Education","country":"US","discovered":"2026-11-12"},{"group":"barracuda","sector":"Technology","country":"US","discovered":"2026-11-12"},{"group":"osiris","sector":"Healthcare","country":"US","discovered":"2026-11-11"},{"group":"panzer","sector":"Retail & E-Commerce","country":"ES","discovered":"2026-11-11"},{"group":"osiris","sector":"Professional Services","country":"US","discovered":"2026-11-11"},{"group":"qilin","sector":"Education","country":"US","discovered":"2026-11-11"},{"group":"akira","sector":"Transportation","country":"—","discovered":"2026-11-11"},{"group":"akira","sector":"Manufacturing","country":"—","discovered":"2026-11-11"},{"group":"akira","sector":"Manufacturing","country":"US","discovered":"2026-11-11"},{"group":"interlock","sector":"Education","country":"CA","discovered":"2026-11-11"},{"group":"aoqin","sector":"Technology","country":"US","discovered":"2026-11-11"},{"group":"curious worm","sector":"Technology","country":"—","discovered":"2026-11-11"},{"group":"curious worm","sector":"Professional Services","country":"US","discovered":"2026-11-11"},{"group":"curious worm","sector":"Healthcare","country":"SA","discovered":"2026-11-11"},{"group":"curious worm","sector":"Healthcare","country":"US","discovered":"2026-11-11"},{"group":"everstake","sector":"Not Found","country":"—","discovered":"2026-11-11"},{"group":"curious worm","sector":"Healthcare","country":"US","discovered":"2026-11-11"},{"group":"curious worm","sector":"Professional Services","country":"GB","discovered":"2026-11-11"},{"group":"curious worm","sector":"Healthcare","country":"IE","discovered":"2026-11-11"}],"source":"ransomware.live","sourceUrl":"https://www.ransomware.live/"},"sourceStatus":{"kev":"ok","nvd":"ok","epss":"ok","threatfox":"skipped","rss:CISA":"ok","rss:NCSC UK":"ok","rss:CERT/CC":"ok","rss:Cisco PSIRT":"ok","rss:Palo Alto Networks PSIRT":"ok","rss:Fortinet PSIRT":"ok","rss:Microsoft MSRC":"ok","rss:AWS Security Bulletins":"ok","rss:Google Threat Intelligence":"ok","rss:Microsoft Security":"ok","rss:CrowdStrike":"ok","rss:Unit 42":"ok","rss:Wiz Research":"ok","rss:Cisco Talos":"ok","rss:SentinelLabs":"ok","rss:Rapid7":"ok","rss:BleepingComputer":"error","rss:The Record":"ok","rss:Krebs on Security":"ok","ghsa":"ok","ransomware":"ok","radar":"skipped"},"sourceKinds":{"CISA":"gov","NCSC UK":"gov","CERT/CC":"gov","Cisco PSIRT":"psirt","Palo Alto Networks PSIRT":"psirt","Fortinet PSIRT":"psirt","Microsoft MSRC":"psirt","AWS Security Bulletins":"psirt","Google Threat Intelligence":"partner","Microsoft Security":"partner","CrowdStrike":"partner","Unit 42":"partner","Wiz Research":"partner","Cisco Talos":"research","SentinelLabs":"research","Rapid7":"research","BleepingComputer":"news","The Record":"news","Krebs on Security":"news"},"sourceUrls":{"kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","nvd":"https://nvd.nist.gov/vuln/search","epss":"https://www.first.org/epss/","threatfox":"https://threatfox.abuse.ch/browse/","ghsa":"https://github.com/advisories?query=severity%3Acritical+type%3Areviewed","ransomware":"https://www.ransomware.live/","radar":"https://radar.cloudflare.com/security","CISA":"https://www.cisa.gov/cybersecurity-advisories/all.xml","NCSC UK":"https://www.ncsc.gov.uk/api/1/services/v1/report-rss-feed.xml","CERT/CC":"https://kb.cert.org/vuls/atomfeed/","Cisco PSIRT":"https://sec.cloudapps.cisco.com/security/center/psirtrss20/CiscoSecurityAdvisory.xml","Palo Alto Networks PSIRT":"https://security.paloaltonetworks.com/rss.xml","Fortinet PSIRT":"https://filestore.fortinet.com/fortiguard/rss/ir.xml","Microsoft MSRC":"https://msrc.microsoft.com/blog/feed","AWS Security Bulletins":"https://aws.amazon.com/security/security-bulletins/rss/feed/","Google Threat Intelligence":"https://cloud.google.com/blog/topics/threat-intelligence/rss/","Microsoft Security":"https://www.microsoft.com/en-us/security/blog/feed/","CrowdStrike":"https://www.crowdstrike.com/blog/feed/","Unit 42":"https://unit42.paloaltonetworks.com/feed/","Wiz Research":"https://www.wiz.io/feed/rss.xml","Cisco Talos":"https://blog.talosintelligence.com/rss/","SentinelLabs":"https://www.sentinelone.com/labs/feed/","Rapid7":"https://www.rapid7.com/blog/rss/","BleepingComputer":"https://www.bleepingcomputer.com/feed/","The Record":"https://therecord.media/feed","Krebs on Security":"https://krebsonsecurity.com/feed/"}},"brief":{"generatedAt":"2026-11-12T12:01:14.948Z","runId":"ai-20261112120028-81c00a94","model":"grok-4.3","window":"6h","headline":"Ransomware operators list dozens of new victims; eBPF rootkit code circulates underground.","items":[{"id":"1a0a87936f6fcdebb2d166e32995f4283f1a467498f5d9e007dac97f23005798","title":"eBPF rootkit code and tutorials shared on underground forums","summary":"Actors discuss eBPF techniques for hiding Linux processes and activating backdoors via crafted packets. BleepingComputer reports on the emerging threat with analysis from Flare Systems.","severity":"High","type":"campaign","confidence":"Reported","cves":[],"actors":[],"sectors":[],"recommends":"Hunt for eBPF programs in production Linux environments and monitor underground forums for new tooling.","sources":[{"title":"BleepingComputer post on eBPF rootkits","url":"https://www.bleepingcomputer.com/news/security/ebpf-rootkits-why-underground-actors-are-taking-notice/","kind":"web"}]},{"id":"0ac7e5321cb020ef2498eebe0da5aaa89724091889c7673152c89da4ace79140","title":"AntiFox AI platform used to steal AWS production secrets","summary":"Arctic Wolf researchers detail attacks hosting AntiFox on Alibaba Cloud to deploy webshells, extract database credentials, and abuse AWS identities. Hundreds of API requests observed in single incidents.","severity":"High","type":"campaign","confidence":"Reported","cves":[],"actors":[],"sectors":["Technology"],"recommends":"Monitor for unusual AWS API activity and restrict AI tool deployments on cloud infrastructure.","sources":[{"title":"Dark Web Informer on AntiFox attacks","url":"https://x.com/DarkWebInformer/status/2120598265322148274","kind":"x"}]},{"id":"b64944d4dfe195714143ca4164ee4cb02310929080a4b6e9b3ffeffbe8c987a7","title":"35 ransomware victims listed on leak sites in 24 hours","summary":"The Gentlemen posted 22 victims, Curious Worm 9, and Akira 3. Sectors include construction and manufacturing in the United States.","severity":"High","type":"breach","confidence":"Reported","cves":[],"actors":["The Gentlemen","Curious Worm","Akira"],"sectors":["Construction","Manufacturing"],"recommends":"Review recent leak-site postings for sector exposure and verify backup integrity.","sources":[{"title":"Ransomnews daily ransomware tracker","url":"https://ransomnews.com/ransomware-attacks-today/","kind":"web"}]}],"industry":[{"id":"ad60b659bf259fd97cd0eb60f082b2c8ec2b6479739c8b5b44171bb111e8ff0a","title":"Microsoft publishes GSocket C2 and Linux kernel research","summary":"Reports detail GSocket use for persistent access on Linux servers and 59 kernel bug reports yielding multiple high-severity CVEs.","severity":"Medium","type":"vulnerability","confidence":"Likely","cves":[],"actors":[],"sectors":[],"recommends":"Deploy Microsoft hunting queries for GSocket and review Linux kernel updates.","sources":[{"title":"Microsoft Security Blog on GSocket","url":"https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/","kind":"web"}]}],"xPulse":[{"handle":"BleepinComputer","summary":"eBPF rootkit code shared underground; ScreenConnect MSP compromises reported.","url":"https://x.com/BleepinComputer/status/2120534513189273699","ts":"2026-11-11T15:10:00Z"},{"handle":"DarkWebInformer","summary":"AntiFox AI agents used for AWS credential theft in real attacks.","url":"https://x.com/DarkWebInformer/status/2120598265322148274","ts":"2026-11-11T19:23:19Z"},{"handle":"MsftSecIntel","summary":"GSocket deployed for stealthy C2 on compromised Linux servers.","url":"https://x.com/MsftSecIntel/status/2120609029001032115","ts":"2026-11-11T20:06:06Z"}],"xTrends":[{"topic":"eBPF rootkits underground","summary":"Handles discuss new Linux rootkit techniques shared on forums.","urgency":"High","handles":["BleepinComputer"],"sources":[{"title":"BleepingComputer eBPF post","url":"https://www.bleepingcomputer.com/news/security/ebpf-rootkits-why-underground-actors-are-taking-notice/","kind":"web"}]},{"topic":"AI-powered breach tools","summary":"AntiFox platform observed stealing AWS secrets in production environments.","urgency":"High","handles":["DarkWebInformer"],"sources":[{"title":"Dark Web Informer AntiFox post","url":"https://x.com/DarkWebInformer/status/2120598265322148274","kind":"x"}]}],"darknet":[{"title":"The Gentlemen lists 22 new victims on leak site","summary":"Operator posted 22 organizations in the last 24 hours, primarily US construction and manufacturing.","severity":"High","type":"darknet","confidence":"Reported","cves":[],"actors":["The Gentlemen"],"sectors":["Construction","Manufacturing"],"recommends":"Monitor leak sites for sector-specific claims and rotate credentials.","sources":[{"title":"Ransomnews daily tracker","url":"https://ransomnews.com/ransomware-attacks-today/","kind":"web"}],"category":"leak-claim"}],"usage":{"inputTokens":23101,"outputTokens":3095,"searches":1,"costUsd":0.0995,"xHandlesUsed":["CISAgov","MsftSecIntel","Mandiant","vxunderground","DarkWebInformer","BleepinComputer","AuCyble","NSACyber","FBI","NCSC"],"xDisabled":false}},"actors":[{"id":"curious-worm","name":"Curious Worm","aliases":[],"originReported":"","motivation":"Financial","sectors":[],"regions":[],"lastSeen":"2026-11-12","activity7d":[0,0,0,0,0,0,3],"ttps":[],"tools":[],"summary":"New ransomware actor announced with onion site.","confidence":"Reported","sources":[{"title":"Dark Web Informer post","url":"https://x.com/DarkWebInformer/status/2120571059963666879","kind":"x"}]},{"id":"whitearmor","name":"WhiteArmor","aliases":[],"originReported":"","motivation":"Financial","sectors":["Logistics","Transportation"],"regions":["Denmark"],"lastSeen":"2026-11-12","activity7d":[0,0,0,0,0,3,2],"ttps":[],"tools":[],"summary":"Claims Maersk legacy system access; $5M demand.","confidence":"Likely","sources":[{"title":"Dark Web Informer post","url":"https://x.com/DarkWebInformer/status/2120586639110013353","kind":"x"},{"title":"Maersk confirms data breach","url":"https://www.bleepingcomputer.com/news/security/maersk-confirms-data-breach-as-whitearmor-ransomware-demands-5-million/","kind":"web"}]},{"id":"play","name":"PLAY","aliases":[],"originReported":"","motivation":"Financial","sectors":["Sports"],"regions":["US"],"lastSeen":"2026-11-12","activity7d":[0,0,0,0,0,0,2],"ttps":[],"tools":[],"summary":"Claims MiLB data with 15 Nov publication date.","confidence":"Reported","sources":[{"title":"Dark Web Informer post","url":"https://x.com/DarkWebInformer/status/2120628384745287867","kind":"x"}]},{"id":"akira","name":"Akira","aliases":["Storm-1567","Howling Scorpius"],"originReported":"Criminal, possible Conti lineage","motivation":"Financial","sectors":["Education","Manufacturing","Finance","Small and medium business"],"regions":["North America","Europe"],"lastSeen":"2026-11-12","activity7d":[1,0,0,0,0,0,1],"ttps":[{"id":"T1133","name":"External Remote Services"},{"id":"T1078","name":"Valid Accounts"},{"id":"T1486","name":"Data Encrypted for Impact"}],"tools":["VPN credential abuse","Megazord"],"summary":"Initial access through VPN appliances without MFA; dual-extortion with a Linux ESXi variant.","confidence":"Confirmed","sources":[{"title":"CISA AA24-109A","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a","kind":"web"}]},{"id":"n0n","name":"n0n","aliases":[],"originReported":"","motivation":"Financial","sectors":["Transportation","Professional Services","Manufacturing","Healthcare","Technology","Retail & E-Commerce"],"regions":["Global","US","United States","Europe"],"lastSeen":"2026-11-11","activity7d":[2,2,1,5,3,3,0],"ttps":[],"tools":[],"summary":"Posted 41 victims in 24-hour window, leading all groups.","confidence":"Likely","sources":[{"title":"Leak sites activity summary","url":"https://www.outpostdaily.com/cves/","kind":"web"},{"title":"Ransomware attacks today","url":"https://ransomnews.com/ransomware-attacks-today/","kind":"web"},{"title":"Global Ransomware Report: Syndicates Claim 1,026 Victims as n0n Surges 372%","url":"https://www.ransom-db.com/blog/global-ransomware-threat-landscape-november-2026","kind":"web"},{"title":"Ransomware news | Cyber Security Journal","url":"https://cybersecurityjournal.us/topics/ransomware","kind":"web"},{"title":"Dark Web Informer post","url":"https://x.com/DarkWebInformer/status/2111596850625036585","kind":"x"},{"title":"SOCRadar n0n report","url":"https://socradar.io/blog/n0n-group-global-ports-shipping-leak/","kind":"web"}]},{"id":"qilin","name":"Qilin","aliases":["Agenda","Spikey Scorpius"],"originReported":"Russian-speaking criminal","motivation":"Financial","sectors":["Healthcare","Manufacturing","Professional services","Professional Services","Multiple","Government","Education","Technology"],"regions":["Global","North America","US","Australia"],"lastSeen":"2026-11-11","activity7d":[2,0,2,2,2,1,0],"ttps":[{"id":"T1078","name":"Valid Accounts"},{"id":"T1555.003","name":"Credentials from Web Browsers"},{"id":"T1486","name":"Data Encrypted for Impact"}],"tools":["Chrome credential harvesting","Rust and Go lockers"],"summary":"Confirmed exploitation of Palo Alto GlobalProtect CVE-2026-0257 for initial access.","confidence":"Likely","sources":[{"title":"Ransomware groups expand targeting","url":"https://www.cybersecuritydive.com/news/ransomware-targeting-palo-alto-networks-vulnerability/833474/","kind":"web"},{"title":"Patch Critical Check Point VPN Vulnerability (CVE-2026-50751)","url":"https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/","kind":"web"},{"title":"Ransomnews tracker","url":"https://ransomnews.com/","kind":"web"},{"title":"Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June","url":"https://www.helpnetsecurity.com/2026/10/21/ransomware-groups-exploit-palo-alto-globalprotect-cve-2026-0257/","kind":"web"},{"title":"Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw","url":"https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html","kind":"web"},{"title":"Unit 42 PAN-OS brief","url":"https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/","kind":"web"}]},{"id":"climax-inc","name":"Climax Inc.","aliases":[],"originReported":"","motivation":"Financial","sectors":["Healthcare","Manufacturing"],"regions":[],"lastSeen":"2026-11-10","activity7d":[0,0,0,0,3,0,0],"ttps":[],"tools":[],"summary":"New ransomware operator emerged posting 14 victims in a single day.","confidence":"Reported","sources":[{"title":"Dark Web Informer Climax post","url":"https://x.com/DarkWebInformer/status/2120196505210593652","kind":"x"}]},{"id":"gentlemen","name":"Gentlemen","aliases":[],"originReported":"Qilin affiliate (reported)","motivation":"Financial","sectors":["Food Services","Professional Services","Financial Services"],"regions":["Global"],"lastSeen":"2026-11-09","activity7d":[0,0,0,1,0,0,0],"ttps":[],"tools":[],"summary":"Posted KFC, Deloitte and MoneyGram on leak site without samples.","confidence":"Reported","sources":[{"title":"National Technology Gentlemen report","url":"https://nationaltechnology.co.uk/KFC_Deloitte_MoneyGram_Named_In_Ransomware_Gangs_Data_Leak_Claims.php","kind":"web"}]},{"id":"hawkmoth","name":"Hawkmoth","aliases":["Anubis Operators"],"originReported":"","motivation":"Financial","sectors":["Technology"],"regions":["United States"],"lastSeen":"2026-11-05","activity7d":[0,0,0,0,0,0,0],"ttps":[],"tools":["Lindnor backdoor","BYOVD drivers","AnyDesk"],"summary":"Added custom backdoor and heavy BYOVD tooling to Anubis RaaS playbook in October 2026 U.S. intrusion.","confidence":"Likely","sources":[{"title":"New Lindnor Backdoor and Glut of Security Killers Used in Ransomware Attack on U.S. Org","url":"https://www.security.com/threat-intelligence/lindnor-new-backdoor-anubis-ransomware","kind":"web"}]},{"id":"safepay","name":"SafePay","aliases":[],"originReported":"","motivation":"Financial","sectors":["Critical Infrastructure"],"regions":["North America","Europe","Australia"],"lastSeen":"2026-11-05","activity7d":[0,0,0,0,0,0,0],"ttps":[],"tools":[],"summary":"Joint advisory confirms 600+ victims since 2024; uses credential access and legacy VPN/backup exploits.","confidence":"Likely","sources":[{"title":"FBI/CISA #StopRansomware advisory","url":"https://therecord.media/fbi-says-safepay-ransomware-gang-among-most-active-600-victims","kind":"web"}]},{"id":"k0t","name":"k0t","aliases":["Cryptofeel","MEMBER19","Qazwsxshop"],"originReported":"","motivation":"Financial","sectors":["Technology","Government","Education","Industrial","Healthcare"],"regions":["Global"],"lastSeen":"2026-10-30","activity7d":[0,0,0,0,0,0,0],"ttps":[],"tools":["Phantom"],"summary":"Linked to INC and Gentlemen initial-access operations using AI framework.","confidence":"Likely","sources":[{"title":"The Hacker News: ransomware coverage","url":"https://thehackernews.com/search/label/ransomware","kind":"web"},{"title":"Check Point Research","url":"https://research.checkpoint.com/2026/26th-october-threat-intelligence-report/","kind":"web"},{"title":"The Hacker News","url":"https://thehackernews.com/search/label/Cyber%20Attack","kind":"web"},{"title":"The Hacker News","url":"https://thehackernews.com/","kind":"web"}]},{"id":"shinysp1d3r","name":"ShinySp1d3r","aliases":[],"originReported":"","motivation":"Financial","sectors":["Technology"],"regions":["Global"],"lastSeen":"2026-10-30","activity7d":[0,0,0,0,0,0,0],"ttps":[],"tools":[],"summary":"Ex-Lapsus$ operators re-emerge with RaaS recruitment and development push.","confidence":"Reported","sources":[{"title":"Ransomware Archives - GBHackers Security","url":"https://gbhackers.com/category/ransome/page/18/","kind":"web"}]},{"id":"armory-castle","name":"Armory Castle","aliases":["UNC5221"],"originReported":"PRC state-sponsored (reported)","motivation":"Espionage","sectors":["Technology","Government","Legal"],"regions":["Global"],"lastSeen":"2026-10-19","activity7d":[0,0,0,0,0,0,0],"ttps":[],"tools":["Sawfly PHP webshell","Sawfly webshell"],"summary":"Armory Castle exploited BeyondTrust Remote Support zero-day in August; overlaps noted with recent NetScaler and Ivanti activity.","confidence":"Likely","sources":[{"title":"BeyondTrust zero-day exploited by China-linked group Armory Castle","url":"https://www.scworld.com/news/beyondtrust-zero-day-exploited-by-china-linked-group-armory-castle","kind":"web"},{"title":"Mandiant analysis","url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust","kind":"web"},{"title":"Mandiant post","url":"https://x.com/Mandiant/status/2111226746548306402","kind":"x"}]},{"id":"datasuckers","name":"DataSuckers","aliases":[],"originReported":"","motivation":"","sectors":[],"regions":["Russia","Ukraine"],"lastSeen":"2026-10-19","activity7d":[0,0,0,0,0,0,0],"ttps":[],"tools":[],"summary":"Suspects detained by Moscow police for breaches in Ukraine and Russia.","confidence":"Likely","sources":[{"title":"The Record: Moscow police detain suspected DataSuckers hackers linked to breaches in Ukraine and Russia","url":"https://therecord.media/russia-datasuckers-hackers-arrested","kind":"web"}]},{"id":"uta0576","name":"UTA0576","aliases":[],"originReported":"","motivation":"Unknown","sectors":["Technology","Enterprise"],"regions":[],"lastSeen":"2026-10-15","activity7d":[0,0,0,0,0,0,0],"ttps":[],"tools":[],"summary":"Chained three zero-days in Ivanti Connect Secure for root access and data theft in early October.","confidence":"Likely","sources":[{"title":"CISA warns of new Ivanti bug being exploited","url":"https://therecord.media/new-ivanti-microsoft-bugs-exploitation","kind":"web"},{"title":"Volexity Volexity blog","url":"https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/","kind":"web"}]},{"id":"black-basta","name":"Black Basta","aliases":["Cardinal","Storm-0506"],"originReported":"Russian-speaking criminal","motivation":"Financial","sectors":["Healthcare","Manufacturing","Construction"],"regions":["North America","Europe","Australia"],"lastSeen":"2026-10-12","activity7d":[0,0,0,0,0,0,0],"ttps":[{"id":"T1566","name":"Phishing"},{"id":"T1219","name":"Remote Access Software"},{"id":"T1486","name":"Data Encrypted for Impact"}],"tools":["Qakbot","Quick Assist abuse","SystemBC"],"summary":"Email bombing followed by help-desk impersonation over Teams and remote-assist tooling to deploy ransomware.","confidence":"Confirmed","sources":[{"title":"CISA AA24-131A","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a","kind":"web"}]},{"id":"lazarus-group","name":"Lazarus Group","aliases":["APT38","Hidden Cobra","Tradertraitor","Diamond Sleet"],"originReported":"DPRK state-sponsored (reported)","motivation":"Financial, espionage","sectors":["Cryptocurrency","Finance","Defense","Software supply chain"],"regions":["Global"],"lastSeen":"2026-10-12","activity7d":[0,0,0,0,0,0,0],"ttps":[{"id":"T1195.002","name":"Compromise Software Supply Chain"},{"id":"T1566.003","name":"Spearphishing via Service"},{"id":"T1204.002","name":"Malicious File"}],"tools":["Trojanized npm packages","Fake job lures"],"summary":"Revenue-generation operations against crypto exchanges and developers through poisoned packages and recruiter lures.","confidence":"Confirmed","sources":[{"title":"CISA TraderTraitor advisory","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a","kind":"web"}]},{"id":"apt29","name":"APT29","aliases":["Midnight Blizzard","Cozy Bear","Nobelium","The Dukes"],"originReported":"Russian SVR (reported)","motivation":"Espionage","sectors":["Government","Diplomacy","Technology","Think tanks"],"regions":["North America","Europe"],"lastSeen":"2026-10-12","activity7d":[0,0,0,0,0,0,0],"ttps":[{"id":"T1566.002","name":"Spearphishing Link"},{"id":"T1528","name":"Steal Application Access Token"},{"id":"T1110.003","name":"Password Spraying"},{"id":"T1098.005","name":"Device Registration"}],"tools":["Cloud OAuth abuse","Residential proxies"],"summary":"Cloud-focused espionage: password spraying of legacy tenants, OAuth application abuse and device-code phishing.","confidence":"Confirmed","sources":[{"title":"NCSC and partners advisory on SVR cloud tactics","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-057a","kind":"web"}]},{"id":"alphv","name":"ALPHV","aliases":["Blackcat","Noberus"],"originReported":"Russian-speaking criminal","motivation":"Financial","sectors":["Healthcare","Finance","Energy"],"regions":["Global"],"lastSeen":"2026-10-12","activity7d":[0,0,0,0,0,0,0],"ttps":[{"id":"T1486","name":"Data Encrypted for Impact"},{"id":"T1078","name":"Valid Accounts"},{"id":"T1048","name":"Exfiltration Over Alternative Protocol"}],"tools":["ExMatter","Cobalt Strike"],"summary":"Rust-based ransomware brand associated with large healthcare disruptions; affiliates migrated to other programs after its exit scam.","confidence":"Likely","sources":[{"title":"CISA AA23-353A","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a","kind":"web"}]},{"id":"lockbit","name":"LockBit","aliases":["Lockbit 3.0","Lockbit Black","Bitwise Spider"],"originReported":"Russian-speaking criminal","motivation":"Financial","sectors":["Manufacturing","Healthcare","Professional services","Education"],"regions":["Global"],"lastSeen":"2026-10-12","activity7d":[0,0,0,0,0,0,0],"ttps":[{"id":"T1486","name":"Data Encrypted for Impact"},{"id":"T1567","name":"Exfiltration Over Web Service"},{"id":"T1021.001","name":"Remote Desktop Protocol"},{"id":"T1562.001","name":"Disable or Modify Tools"}],"tools":["StealBit","Mimikatz","PsExec"],"summary":"Ransomware-as-a-service affiliate program; resurfaced after law-enforcement disruption with rebuilt infrastructure.","confidence":"Confirmed","sources":[{"title":"CISA AA23-165A","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a","kind":"web"}]},{"id":"salt-typhoon","name":"Salt Typhoon","aliases":["Earth Estries","Ghostemperor","Famoussparrow","UNC2286"],"originReported":"PRC state-sponsored (reported)","motivation":"Espionage","sectors":["Telecommunications","Government","Internet service providers"],"regions":["United States","Global"],"lastSeen":"2026-10-12","activity7d":[0,0,0,0,0,0,0],"ttps":[{"id":"T1190","name":"Exploit Public-Facing Application"},{"id":"T1040","name":"Network Sniffing"},{"id":"T1133","name":"External Remote Services"}],"tools":["Custom backdoors","Network device implants"],"summary":"Long-term access to carrier networks and lawful-intercept systems via unpatched edge devices.","confidence":"Confirmed","sources":[{"title":"CISA guidance on telecom intrusions","url":"https://www.cisa.gov/resources-tools/resources/enhanced-visibility-and-hardening-guidance-communications-infrastructure","kind":"web"}]},{"id":"volt-typhoon","name":"Volt Typhoon","aliases":["Bronze Silhouette","Vanguard Panda","Voltzite","Insidious Taurus"],"originReported":"PRC state-sponsored (reported)","motivation":"Espionage, pre-positioning","sectors":["Energy","Water","Telecommunications","Transportation"],"regions":["United States","Guam"],"lastSeen":"2026-10-12","activity7d":[0,0,0,0,0,0,0],"ttps":[{"id":"T1190","name":"Exploit Public-Facing Application"},{"id":"T1078","name":"Valid Accounts"},{"id":"T1090.003","name":"Multi-hop Proxy"},{"id":"T1003.003","name":"NTDS Credential Dumping"}],"tools":["Living-off-the-land binaries","KV Botnet"],"summary":"Quiet persistence in critical infrastructure using built-in tools and compromised SOHO routers as proxies.","confidence":"Confirmed","sources":[{"title":"CISA AA24-038A","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a","kind":"web"}]},{"id":"scattered-spider","name":"Scattered Spider","aliases":["UNC3944","Octo Tempest","0ktapus","Muddled Libra"],"originReported":"English-speaking, dispersed","motivation":"Financial","sectors":["Retail","Hospitality","Insurance","Technology","Telecommunications"],"regions":["North America","United Kingdom"],"lastSeen":"2026-10-12","activity7d":[0,0,0,0,0,0,0],"ttps":[{"id":"T1566.004","name":"Spearphishing Voice"},{"id":"T1621","name":"MFA Request Generation"},{"id":"T1078","name":"Valid Accounts"},{"id":"T1486","name":"Data Encrypted for Impact"}],"tools":["Remote monitoring tools","DragonForce","BlackCat"],"summary":"Help-desk impersonation, SIM swapping and MFA fatigue leading to SSO takeover and ransomware deployment.","confidence":"Confirmed","sources":[{"title":"CISA AA23-320A","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a","kind":"web"}]}],"trends":{"generatedAt":"2026-11-12T13:30:35.397Z","days":["2026-08-15","2026-08-16","2026-08-17","2026-08-18","2026-08-19","2026-08-20","2026-08-21","2026-08-22","2026-08-23","2026-08-24","2026-08-25","2026-08-26","2026-08-27","2026-08-28","2026-08-29","2026-08-30","2026-08-31","2026-09-01","2026-09-02","2026-09-03","2026-09-04","2026-09-05","2026-09-06","2026-09-07","2026-09-08","2026-09-09","2026-09-10","2026-09-11","2026-09-12","2026-09-13","2026-09-14","2026-09-15","2026-09-16","2026-09-17","2026-09-18","2026-09-19","2026-09-20","2026-09-21","2026-09-22","2026-09-23","2026-09-24","2026-09-25","2026-09-26","2026-09-27","2026-09-28","2026-09-29","2026-09-30","2026-10-01","2026-10-02","2026-10-03","2026-10-04","2026-10-05","2026-10-06","2026-10-07","2026-10-08","2026-10-09","2026-10-10","2026-10-11","2026-10-12","2026-10-13","2026-10-14","2026-10-15","2026-10-16","2026-10-17","2026-10-18","2026-10-19","2026-10-20","2026-10-21","2026-10-22","2026-10-23","2026-10-24","2026-10-25","2026-10-26","2026-10-27","2026-10-28","2026-10-29","2026-10-30","2026-10-31","2026-11-01","2026-11-02","2026-11-03","2026-11-04","2026-11-05","2026-11-06","2026-11-07","2026-11-08","2026-11-09","2026-11-10","2026-11-11","2026-11-12"],"kev":[0,0,1,4,1,2,1,0,0,1,1,6,3,0,0,0,2,0,7,0,1,0,0,0,4,4,2,4,0,0,1,0,3,0,3,0,0,1,4,0,2,3,0,2,0,1,1,1,2,0,1,0,0,0,5,0,0,0,0,2,4,1,2,0,0,0,6,0,0,2,0,0,2,2,2,2,2,0,0,0,1,1,0,1,0,0,4,6,0,0],"cveHigh":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,80,116,155,174,121,102,55,41,85,88,99,122,84,37,65,91,102,94,118,108,53,73,102,101,111,126,121,136,105,113,151,96],"iocs":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"victims":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,84,100,63,55,99,57,42,46,50,47,65,64,42,43,50,69,57,41,50,71,47,33,47,72,85,42,54,54,100,100,58,27],"weekly":{"kev":{"this":11,"prev":4},"cveHigh":{"this":848,"prev":666},"victims":{"this":435,"prev":405}},"vendors30d":[{"vendor":"Plex","kev":4,"ransomware":4,"latest":"2026-10-20"},{"vendor":"Cisco","kev":3,"ransomware":3,"latest":"2026-11-10"},{"vendor":"Ivanti","kev":3,"ransomware":3,"latest":"2026-10-30"},{"vendor":"Ahsay","kev":2,"ransomware":2,"latest":"2026-10-14"},{"vendor":"Barracuda Networks","kev":2,"ransomware":2,"latest":"2026-11-10"},{"vendor":"Google","kev":2,"ransomware":2,"latest":"2026-11-10"},{"vendor":"Microsoft","kev":2,"ransomware":2,"latest":"2026-11-10"},{"vendor":"PHP Group","kev":2,"ransomware":2,"latest":"2026-10-26"},{"vendor":"Adobe","kev":1,"ransomware":1,"latest":"2026-10-27"},{"vendor":"Apple","kev":1,"ransomware":1,"latest":"2026-11-04"},{"vendor":"Arista","kev":1,"ransomware":1,"latest":"2026-10-23"},{"vendor":"Atlassian","kev":1,"ransomware":1,"latest":"2026-10-15"},{"vendor":"BeyondTrust","kev":1,"ransomware":1,"latest":"2026-10-16"},{"vendor":"Broadcom","kev":1,"ransomware":1,"latest":"2026-10-28"}],"timeToKev":{"medianDays":1.5,"sample":16},"kevAdded90d":114},"sources":[{"host":"x.com","cited":168,"corroborated":12,"rate":7,"lastSeen":"2026-11-12T12:01:16.520Z"},{"host":"bleepingcomputer.com","cited":66,"corroborated":21,"rate":32,"lastSeen":"2026-11-12T12:01:16.520Z"},{"host":"therecord.media","cited":50,"corroborated":3,"rate":6,"lastSeen":"2026-11-08T06:01:01.891Z"},{"host":"ransomnews.com","cited":44,"corroborated":2,"rate":5,"lastSeen":"2026-11-12T12:01:16.520Z"},{"host":"whatgotpwned.com","cited":25,"corroborated":0,"rate":0,"lastSeen":"2026-11-10T12:02:02.384Z"},{"host":"cisa.gov","cited":20,"corroborated":2,"rate":10,"lastSeen":"2026-11-07T18:01:03.252Z"},{"host":"thehackernews.com","cited":15,"corroborated":5,"rate":33,"lastSeen":"2026-10-31T18:00:59.751Z"},{"host":"gbhackers.com","cited":12,"corroborated":4,"rate":33,"lastSeen":"2026-11-09T06:01:59.961Z"},{"host":"cybersecuritydive.com","cited":8,"corroborated":1,"rate":13,"lastSeen":"2026-11-11T00:01:36.662Z"},{"host":"agentbeam.com","cited":7,"corroborated":1,"rate":14,"lastSeen":"2026-10-31T12:00:47.425Z"},{"host":"dailysecurityreview.com","cited":7,"corroborated":3,"rate":43,"lastSeen":"2026-11-08T06:01:01.891Z"},{"host":"helpnetsecurity.com","cited":7,"corroborated":4,"rate":57,"lastSeen":"2026-11-09T06:01:59.961Z"},{"host":"ctxsec.com","cited":6,"corroborated":2,"rate":33,"lastSeen":"2026-11-03T18:01:28.461Z"},{"host":"microsoft.com","cited":6,"corroborated":1,"rate":17,"lastSeen":"2026-11-12T12:01:16.520Z"},{"host":"rapid7.com","cited":6,"corroborated":4,"rate":67,"lastSeen":"2026-11-07T06:01:30.721Z"},{"host":"sec.cloudapps.cisco.com","cited":6,"corroborated":1,"rate":17,"lastSeen":"2026-11-09T18:01:11.904Z"},{"host":"securityweek.com","cited":6,"corroborated":4,"rate":67,"lastSeen":"2026-11-10T06:00:57.003Z"},{"host":"cybersecurity.watch","cited":4,"corroborated":3,"rate":75,"lastSeen":"2026-10-29T06:01:34.606Z"},{"host":"outpostdaily.com","cited":4,"corroborated":1,"rate":25,"lastSeen":"2026-11-11T18:01:16.753Z"},{"host":"ransom-db.com","cited":4,"corroborated":0,"rate":0,"lastSeen":"2026-11-07T18:01:03.252Z"},{"host":"cyware.com","cited":3,"corroborated":1,"rate":33,"lastSeen":"2026-11-05T18:01:16.395Z"},{"host":"esecurityplanet.com","cited":3,"corroborated":0,"rate":0,"lastSeen":"2026-11-07T12:01:08.633Z"},{"host":"github.com","cited":3,"corroborated":1,"rate":33,"lastSeen":"2026-11-07T06:01:30.721Z"},{"host":"research.checkpoint.com","cited":3,"corroborated":1,"rate":33,"lastSeen":"2026-10-27T00:02:08.652Z"},{"host":"aws.amazon.com","cited":2,"corroborated":0,"rate":0,"lastSeen":"2026-11-07T06:01:30.721Z"},{"host":"cyberexperts.com","cited":2,"corroborated":2,"rate":100,"lastSeen":"2026-10-28T00:01:59.533Z"},{"host":"cyberpress.org","cited":2,"corroborated":1,"rate":50,"lastSeen":"2026-11-06T12:00:56.912Z"},{"host":"cybersecuritynews.com","cited":2,"corroborated":1,"rate":50,"lastSeen":"2026-10-18T06:02:17.323Z"},{"host":"cypro.co.uk","cited":2,"corroborated":1,"rate":50,"lastSeen":"2026-11-11T00:01:36.662Z"},{"host":"infosecurity-magazine.com","cited":2,"corroborated":1,"rate":50,"lastSeen":"2026-10-23T00:01:22.384Z"},{"host":"nationaltechnology.co.uk","cited":2,"corroborated":0,"rate":0,"lastSeen":"2026-10-14T12:02:47.642Z"},{"host":"nidsark.example","cited":2,"corroborated":0,"rate":0,"lastSeen":"2026-11-05T06:01:19.748Z"},{"host":"nvd.nist.gov","cited":2,"corroborated":1,"rate":50,"lastSeen":"2026-11-06T00:02:21.029Z"},{"host":"radar.offseq.com","cited":2,"corroborated":1,"rate":50,"lastSeen":"2026-11-12T00:01:59.018Z"},{"host":"scworld.com","cited":2,"corroborated":1,"rate":50,"lastSeen":"2026-10-28T18:01:13.260Z"},{"host":"t.co","cited":2,"corroborated":1,"rate":50,"lastSeen":"2026-10-22T18:01:19.630Z"},{"host":"telefonicatech.com","cited":2,"corroborated":2,"rate":100,"lastSeen":"2026-10-30T12:01:14.395Z"},{"host":"tie.shahar.io","cited":2,"corroborated":0,"rate":0,"lastSeen":"2026-10-14T06:01:49.127Z"},{"host":"unit42.paloaltonetworks.com","cited":2,"corroborated":0,"rate":0,"lastSeen":"2026-10-20T12:01:58.547Z"},{"host":"wiz.io","cited":2,"corroborated":0,"rate":0,"lastSeen":"2026-11-09T18:01:11.904Z"}]}