Weekly Threat Landscape Digest – Week 46

November 13, 2026
Alert Advisory, CVE, Cyber Threat Intelligence, Threat Hunting Insights
  1. Adobe Multiple Products Vulnerabilities Including Code Injection and SQL Injection (Adobe Connect, AEM, After Effects, Photoshop, and More)

Overview

  • Security vulnerabilities across Adobe Connect, Experience Manager (AEM), After Effects, Photoshop, Content Credentials SDK, Audition, Premiere, Media Encoder, and Dimension.
  • Types include code injection, buffer overflow, out-of-bounds memory access, path traversal, SQL injection, XSS, authentication/authorization issues, and improper input validation.
  • Exploitation could allow arbitrary code execution, information disclosure, data modification or deletion, program installation, or creation of unauthorized user accounts. No exploitation in the wild reported.

Impact

  • Severe flaws could lead to remote code execution, privilege escalation, and data compromise depending on the user’s privileges.

Affected / Fixed Versions

  • Adobe Connect: 12.12 and earlier (Windows).
  • AEM: Cloud Service 2026.10.29023 and earlier; 6.5 SP25 and earlier; 6.5 LTS SP3 and earlier.
  • After Effects: 26.5 and earlier; 25.6.6 and earlier. Photoshop: 2026 27.11 and earlier; 2025 26.11.8 and earlier.
  • Content Credentials SDK: Rust SDK c2pa-v0.91.10 and earlier; C2PA Tool c2patool-v0.28.5 and earlier.
  • Audition: 26.5/25.6.6 and earlier. Premiere: 26.5.2/25.6.6 and earlier. Media Encoder: 26.5.2/25.6.6 and earlier. Dimension: 4.1.9 and earlier (macOS).

Recommendations

  • Apply Adobe’s latest security updates for all affected products after appropriate testing.
  • Inventory deployed Adobe versions to find vulnerable systems.
  • Prioritize patching systems exposed to untrusted files or external access.

Reference Links

  1. Fortinet Multiple Critical Vulnerabilities Including Arbitrary Code Execution and Authentication Bypass (CVE-2026-126170)

Overview

  • Fortinet released updates for FortiOS, FortiManager, FortiAnalyzer, and FortiSASE.
  • Flaws include output encoding, numeric truncation, SQL injection, authentication bypass, improper authorization, SSRF, and missing authentication in HA functionality. Some are remotely exploitable without authentication.

Impact

  • Unauthenticated arbitrary code or command execution via crafted requests.
  • Authentication and authorization bypass, privilege escalation, and unauthorized access to Virtual Domains and internal resources.
  • Forged routing updates and routing disruption; super-admin command execution under specific configurations.

Affected / Fixed Versions

  • Detailed affected and fixed versions are in Fortinet’s official advisories.

Recommendations

  • Apply Fortinet-provided mitigations or workarounds immediately.
  • Review and monitor network configurations for exploitation signs; share threat intelligence with partners and subsidiaries.

Reference Links

  1. Progress WS_FTP Server Multiple Vulnerabilities (CVE-2026-115338, CVE-2026-115341)

Overview

  • High-severity issues: improper protection of XFT communications, insufficient access restrictions in Thin Client Web Transfer, improper resource management causing crashes, and credential exposure via temporary files.
  • An OpenSSL component is vulnerable to crafted client certificates causing excessive heap memory use during TLS handshakes.

Impact

  • CVE-2026-115338: network attackers can intercept or modify information over unencrypted HTTP.
  • CVE-2026-115341: authenticated FTP users may access files beyond authorized directories.
  • CVE-2026-115339, CVE-2026-35189: remote DoS via memory exhaustion or XFT service crash.
  • CVE-2026-115340: credentials and session information exposed via temporary files.

Affected / Fixed Versions

  • Affected: WS_FTP Server before 2025.0.5 (10.0.5). Fixed: 2025.0.5 (10.0.5) and later.

Recommendations

  • Update to WS_FTP Server 2025.0.5 (10.0.5) or later.

Reference Links

  1. Microsoft November 2026 Patch Tuesday: Actively Exploited Outlook Spoofing Zero-Day (CVE-2026-124194) and Critical RCEs

Overview

  • Microsoft addressed 1,252 vulnerabilities, including one actively exploited zero-day (CVE-2026-124194) in Outlook.
  • Critical flaws affect Windows core services, Active Directory Domain Services, LDAP, Exchange Server, Hyper-V, and Remote Desktop Services, enabling code execution, privilege escalation, information disclosure, and system compromise.

Impact

  • Active exploitation of the Outlook spoofing flaw.
  • Critical RCEs (CVSS up to 9.8) in Windows Xbox Live Networking Service, Windows Search, LDAP, Exchange Server, SMB Server, Print Spooler, and Office components.
  • Elevation of privilege in Remote Desktop Services and Microsoft Entra Device Registration; potential widespread network compromise.

Affected / Fixed Versions

  • Multiple Microsoft products and components; specific versions not detailed.

Recommendations

  • Immediately apply November 2026 security updates; prioritize Outlook for CVE-2026-124194.
  • Secure internet-facing systems, domain controllers, Exchange servers, and Office applications.

Reference Links

  1. SAP NetWeaver Authentication Bypass and Memory Corruption Including CVE-2026-120017 (CVSS 10.0)

Overview

  • November 2026 SAP Security Patch Day fixes 38 vulnerabilities, including 9 critical, across NetWeaver, Web Dispatcher, Gateway, ICM, CRM components, and BusinessObjects.
  • Four score CVSS 10.0, enabling authentication bypass, code execution, memory corruption, and unauthorized access.

Impact

  • CVE-2026-120017: SAML2 service provider flaw in NetWeaver AS ABAP lets unauthenticated attackers bypass authentication and impersonate users.
  • CVE-2026-89126: heap overflow in Web Dispatcher enabling RCE. CVE-2026-76964: memory corruption in ICM enabling code execution.
  • CVE-2026-89103: Gateway default ACL with excessive privileges allows server impersonation.
  • Also code injection in Knowledge Management and CRM, OS command injection in ABAP, CSRF in Web Dispatcher/ICM, and XXE in BusinessObjects Web Intelligence.

Affected / Fixed Versions

  • NetWeaver AS ABAP/ABAP Platform SAP_BASIS 702–920 (SAML2); Web Dispatcher 7.53, 7.54, 7.77, 7.93, 9.16–9.20; ICM kernel releases; Gateway kernel 7.22–9.21.
  • NetWeaver Knowledge Management (XML Forms), CRM components (S4CRM, S4CEXT, BBPCRM), BusinessObjects BI Platform Web Intelligence.

Recommendations

  • Apply November 2026 SAP patches immediately, prioritizing critical issues and internet-facing NetWeaver, Gateway, Web Dispatcher, and ICM.
  • Review SAML2 authentication configurations to ensure proper assertion validation.

Reference Links

  1. Apple Multiple Vulnerabilities Including Actively Exploited Brotli Out-of-Bounds Write (CVE-2026-111497)

Overview

  • Apple updates for iOS, iPadOS, macOS, watchOS, and visionOS address memory corruption, unauthorized access, information disclosure, and restriction bypass.
  • CVE-2026-111497: out-of-bounds write in Brotli compression, potentially allowing arbitrary code execution, actively exploited in the wild.
  • Other issues affect Bluetooth pairing, AirPlay pairing, App Intents authorization, and iMessage group chat access.

Impact

  • Memory corruption and code execution; unauthorized Bluetooth pairing without interaction; AirPlay pairing bypass, including from the lock screen; apps gaining unauthorized access to user data; remote attackers joining iMessage group chats and reading past messages.

Affected / Fixed Versions

  • iOS/iPadOS 27.2.1 (iPhone 11 and later, supported iPads); iOS/iPadOS 26.7.3 for earlier models; iOS/iPadOS 18.7.12 for iPhone XS/XS Max/XR and iPad 7th gen.
  • macOS Golden Gate 27.2.1, Tahoe 26.7.3, Sequoia 15.8.3. watchOS 27.2.1 (Series 9+); watchOS 26.6.1 (Series 6–8, SE 2nd gen, Ultra). visionOS 27.2.1.

Recommendations

  • Install the latest Apple updates immediately.

Reference Links

  1. Contact Form 7 Critical Unauthenticated Arbitrary File Upload (CVE-2026-114432, CVSS 9.8)

Overview

  • Unauthenticated arbitrary file upload in Contact Form 7 versions 6.2 through 6.2.3, from insufficient file type validation and improper temporary-file cleanup on upload fields.
  • Under certain Apache configurations it may lead to RCE; otherwise attackers can upload malicious HTML and SVG files to the uploads directory.

Impact

  • Remote attackers can upload arbitrary files without authentication, potentially causing RCE or website compromise.

Affected / Fixed Versions

  • Affected: 6.2 through 6.2.3. Fixed: 6.2.4 and later.

Recommendations

  • Upgrade Contact Form 7 to 6.2.4 or later immediately.
  • Identify and assess all WordPress installations running affected versions for compromise.

Reference Links

  1. Google Chrome Memory Corruption Vulnerabilities Including Actively Exploited Use-After-Free (CVE-2026-125350)

Overview

  • Updates for Chrome Stable and Extended Stable on Windows, macOS, Linux, and Android address buffer overflow, use-after-free, type confusion, out-of-bounds write, incorrect authorization, and uninitialized resource issues.
  • CVE-2026-125350 (use-after-free in XML) is confirmed actively exploited.

Impact

  • Arbitrary code execution, security restriction bypass, or denial of service; risk to confidentiality, integrity, and availability, heightened by active exploitation.

Affected / Fixed Versions

  • Stable: Chrome 157.0.8103.50/.51 (Windows, macOS); 157.0.8103.50 (Linux, Android).
  • Extended Stable: Chrome 156.0.8078.96 (Windows, macOS).

Recommendations

  • Update Google Chrome to the latest version promptly.

Reference Links

  1. Plex Media Server Plex2Shell Arbitrary Code Execution Actively Exploited on QNAP NAS

Overview

  • Four Plex Media Server vulnerabilities (Plex2Shell) affect versions 1.43.2 and earlier on QNAP NAS: SSRF, improper URI scheme neutralization, administrative token disclosure, and arbitrary file write.
  • They can be chained for unauthenticated RCE with Plex process privileges. Exploitation is active and widespread, with a public PoC; compromised servers are used for cryptomining and proxy deployment.

Impact

  • Full server compromise, unauthorized access to privileged functions, cryptominer and proxy malware deployment, and access via disclosed admin tokens.

Affected / Fixed Versions

  • Affected: Plex Media Server 1.43.2 and earlier on QNAP NAS. Fixed: 1.43.3.10861 or later.
  • QNAP OS (QTS, QuTS hero) and NAS devices without Plex are not affected.

Recommendations

  • Immediately update Plex Media Server to 1.43.3.10861 or later.
  • If internet-accessible while vulnerable, assess for compromise; consider a clean reinstall; preserve logs; remove suspicious codec files; do not restore compromised content.
  • Reset Plex and NAS credentials, enable 2FA, rotate exposed keys, disable Plex Remote Access and port 32400 forwarding, and use VPNs.
  • Monitor processes, network, logs, and CPU; keep QNAP OS, Malware Remover, and QuFirewall updated.

Reference Links

  1. React Server Components Remote Code Execution (GHSA-xqc2-xf4c-x3h3, CVSS 9.5)

Overview

  • Critical RCE in react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. Unauthenticated attackers can execute arbitrary code via crafted payloads.
  • Exploitation needs specific, uncommon conditions; client-only React apps and those not using frameworks/bundlers supporting React Server Components are not affected.

Impact

  • Code execution compromising confidentiality, integrity, and availability. No privileges or user interaction needed; low complexity, network vector.

Affected / Fixed Versions

  • Affected: 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, and 19.3.0. Fixed: 19.0.9, 19.1.10, 19.2.9, 19.3.1.

Recommendations

  • Immediately upgrade the three packages to the fixed versions.

Reference Links

  1. JetBrains Multiple Products Critical and High-Severity Vulnerabilities (CVE-2026-123294, CVSS 9.6)

Overview

  • Updates fix arbitrary code execution, privilege escalation, authentication bypass, XSS, session forgery, and improper access controls.
  • CVE-2026-123294: JetBrains Hub email login verification manipulation grants administrative privileges. CVE-2026-123279: Datalore lets view-only users execute arbitrary code in notebook tasks.
  • High-severity: unauthorized REST requests in YouTrack, XSS in IntelliJ IDEA, 2FA bypass in Hub, session forgery in Ktor, GDB profile flaws in CLion.

Impact

  • Arbitrary code execution, privilege escalation, authentication bypass, information disclosure, and unauthorized actions.

Affected / Fixed Versions

  • Hub 2026.2.52556; Datalore 2026.4+; YouTrack 2026.2.19728; Ktor 3.6.1; IntelliJ IDEA, WebStorm, CLion 2026.3 or applicable 2026.2.4.1 updates; Junie CLI 26.8.24; Toolbox App 3.9.

Recommendations

  • Update all affected JetBrains products to the fixed or later versions immediately.

Reference Links

  1. IBM API Connect and Aspera Faspex Critical Vulnerabilities (CVE-2026-17402)

Overview

  • IBM API Connect: OS command injection, LDAP injection, improper access controls, authentication bypass, hard-coded credentials, and path traversal.
  • IBM Aspera Faspex: improper authorization allowing privilege escalation.

Impact

  • Remote code execution, authentication bypass, administrative access to other tenants or full admin privileges, and potential compromise of tenant data and gateway configurations.

Affected / Fixed Versions

  • API Connect 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2; fixed in 10.0.8.13 and 12.1.1.3.
  • Aspera Faspex 5.0.0–5.0.19; fixed in 5.0.19 PL1 (Linux).

Recommendations

  • Update to the fixed versions or later; apply patches promptly and monitor for suspicious activity.

Reference Links

  1. HPE Morpheus Software VM Essentials RCE and Certificate Exposure (CVE-2026-95778, CVE-2026-95779, CVSS 8.8)

Overview

  • Two high-severity flaws in HPE Morpheus Software used in VM Essentials allow RCE and exposure of confidential certificate information. Both require network access and low-level privileges.

Impact

  • CVE-2026-95778: authenticated low-privileged attackers can execute arbitrary code remotely. CVE-2026-95779: exposure of appliance certificate information.

Affected / Fixed Versions

  • Affected: Morpheus VM Essentials, Advanced, Enterprise, and HPE VME 9.0 up to before 9.0.2. Fixed: 9.0.2-3 and 9.1.0-2.

Recommendations

  • Upgrade all affected deployments to 9.0.2-3 or later.

Reference Links

  1. USN-9090-1: Apache HTTP Server Vulnerabilities

Overview

  • Vulnerabilities in mod_dav, mod_vhost_alias, mod_md, mod_http2, and CGI internal redirect handling: incorrect memory size calculation, one-byte stack buffer overflow, NULL pointer dereference, heap corruption, and improper redirect handling.

Impact

  • Denial of service via crashes and, in several cases, remote arbitrary code execution.

Affected / Fixed Versions

  • Ubuntu 20.04, 22.04, 24.04, 26.04 LTS and 26.10; some issues affect only 26.04 LTS and 26.10.

Recommendations

  • Apply Ubuntu security updates; monitor Apache deployments for suspicious activity.

Reference Links

  1. USN-9068-1: Debian-LAN Vulnerability

Overview

  • Debian-LAN’s Kerberos admin server has overly permissive ACLs (discovered by Wolfgang Schweer).

Impact

  • An authenticated user could change other users’ credentials, leading to privilege escalation.

Recommendations

  • Review and tighten ACL configurations on the Kerberos admin server.

Reference Links

  1. Rogue Remote-Access Campaign Spread Through ScreenConnect Add-on

Overview

  • Attackers accessed multiple cloud-hosted ScreenConnect panels to push commands to managed endpoints; at least 288 computers across 48 organizations were infected with attacker-controlled ScreenConnect clients.
  • They abused the third-party RMM+ extension, which bypasses ScreenConnect accounts, roles, and MFA using a shared access key; versions 1.0.31 and 1.0.32 had a default blank key, allowing unauthenticated access.
  • Malware replaced legitimate clients to avoid detection and attempted session cookie theft for lateral movement (unsuccessful).

Impact

  • Rapid compromise across organizations, persistence and evasion via legitimate remote tools, and abuse of extension flaws rather than ScreenConnect platform flaws.

Recommendations

  • Disable or carefully audit third-party ScreenConnect extensions, especially RMM+.
  • Apply updates and monitor for suspicious remote management activity or unexpected client installations.

Reference Links

  1. USN-9084-1: Radicale Vulnerability

Overview

  • Radicale did not delay failed authentication attempts with htpasswd authentication, letting remote attackers obtain passwords via timing or brute force.

Impact

  • Unauthorized access by recovering user passwords.

Recommendations

  • Apply available Ubuntu security updates.

Reference Links

  1. N-able “4EverAble2Shell” N-central Zero-Day Exploited Hours After PoC Release

Overview

  • A critical zero-day in N-able N-central is actively exploited; at least 21 systems compromised, 19 of them fully updated. Attackers deploy cryptominers on compromised servers.

Impact

  • Unauthorized compromise of N-central servers and illicit cryptomining.

Recommendations

  • Monitor for compromise and unauthorized mining activity.
  • Apply forthcoming N-able patches or mitigations promptly.

Reference Links

  1. Cisco Informational: Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities

Overview

  • Discovered October 17–20, 2026: private keys for eight eMudhra intermediate certificates were broken by a severe error in an April 2025 Key Generation Ceremony, allowing brute-forcing within seconds.
  • Cisco’s review indicates only listed products are affected; updates will follow.

Impact

  • Potential unauthorized issuance or misuse of certificates from compromised intermediate CAs, undermining trust validation.

Recommendations

  • Review the advisory and affected product list; follow distrust and mitigation guidance.
  • Monitor for further updates from Cisco and researchers.

Reference Links

  1. Europol Takes Down 235 Servers and 257 Domains Linked to Gootloader, CastleRAT, and StealC

Overview

  • Europol and partners disrupted infrastructure for Gootloader, CastleRAT, and StealC, seizing 235 servers and 257 domains and recovering 6.4 million victim datasets.
  • Gootloader used fake legal documents and search poisoning to deliver loaders facilitating ransomware; CastleRAT offered keylogging, screen capture, and clipboard monitoring; StealC stole passwords and digital identities.

Impact

  • Disruption of ransomware and credential theft operations; recovered data will aid victim notification globally.

Recommendations

  • WordPress site owners should change credentials, enable MFA, patch, remove unknown accounts, and keep systems updated.
  • Affected users must secure exposed accounts and systems despite the takedown.

Reference Links

  1. Operation Endgame Dismantles Malware Networks and Exposes 6.4 Million Stolen Credentials

Overview

  • Police in nine countries (with Europol and Eurojust and private partners) dismantled infrastructure behind CastleRAT, Gootloader (spread via hacked WordPress sites), and StealC as part of Operation Endgame.

Impact

  • 235 servers and 257 domains seized; 6.4 million victim credentials identified.
  • Gootloader infected at least 25,000 computers and was tied to ransomware on 44 US victims causing $28.8 million in losses; 681 infected websites cleaned up.

Recommendations

  • WordPress users should update credentials, enable MFA, and patch.
  • Victim data was shared with HaveIBeenPwned, Shadowserver Foundation, and the Dutch NCSC to help affected users.

Reference Links

  1. Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass

Overview

  • Citrix patched critical flaws in NetScaler ADC, NetScaler Gateway, and NetScaler Console, including a memory overflow that can cause DoS or authentication bypass conditions.

Impact

  • DoS or authentication bypass, potentially allowing unauthorized access.

Recommendations

  • Apply the released Citrix security patches promptly.

Reference Links

  1. nDiligence Four-Year Study Identifies Critical Supply-Chain Vulnerability Across 50 Platform Types

Overview

  • A critical vulnerability in runtime client-side rendering used across 50 platform types lets attackers manipulate what users see despite passing all security checks, by exploiting code from layered suppliers.
  • It can cause false data display, stolen input, and unauthorized actions under the user’s authority, affecting browsers, mobile apps, vehicle displays, medical devices, and industrial control screens.
  • The study includes demonstrations, a whitepaper, and remediation playbooks (TLP:CLEAR). Researchers have warned since 2024 following the Polyfill.io incident; no automated detection tools exist.

Impact

  • Attackers can deceive, disrupt, degrade, deny, or destroy by controlling displayed information and input undetected, threatening trust in critical decision-making software.

Recommendations

  • Organizations building, operating, or defending critical software should understand and mitigate this vulnerability.
  • Collaborate with researchers and vendors to close the gap.

Reference Links

  1. Critical Red Hat Quay Vulnerability Lets Unauthenticated Attackers Hijack Container Registries (CVE-2026-123710, CVSS 9.8)

Overview

  • The key server’s rotation endpoint does not verify the token is intended for key rotation, relying only on JWT signature, audience, and issuer validation.
  • Attackers can use anonymous tokens to register their own keys with infinite approval, then sign registry tokens for any repository with full read/write access to private images and the ability to swap tags.

Impact

  • Compromise of private images and exposed secrets; replaced tags can lead to poisoned image deployment; broad impact on delivery pipelines. Similar flaws have affected other registries such as Gitea.

Affected / Fixed Versions

  • Red Hat Quay 3 and 5; only deployments exposing /keys to untrusted clients are vulnerable. No fix released yet.

Recommendations

  • Restrict /keys via proxies or load balancers to trusted internal components.
  • Audit logs for service_key_rotate and service_key_delete events with null expirations; remove unauthorized service keys.
  • Maintain access controls until a patch is available and monitor Red Hat advisories.

Reference Links

  1. PHP2Shell Exploitation on Check Point Gateways

Overview

  • In late October 2026, attackers exploited unpatched Check Point Security Gateways via Mobile Access portals using PHP2Shell (CVE-2026-109618, CVE-2026-109619), then escalated via a DynamicCLI local privilege-escalation flaw (CVE-2026-123039), deployed PHP webshells, and persisted with TSGA and TSProxy backdoors.
  • Two waves: a destructive wave targeting Israeli organizations, then a broader non-destructive wave across multiple countries. Attackers moved laterally to VMware ESXi hosts via SSH and deployed the destroy_v6 wiper with politically themed notes.

Impact

  • Unauthorized access and privilege escalation on gateways, persistent backdoors, lateral movement to ESXi, wiper deployment, data theft, configuration tampering, and service disruption.

Affected / Fixed Versions

  • Exploited shortly after fixes were released; specific versions not provided.

Recommendations

  • Promptly patch Check Point Mobile Access portals and the DynamicCLI interface.
  • Monitor for PHP session artifacts and unusual segfaults in Apache/PHP workers; remove webshells and TSGA/TSProxy implants.
  • Audit for lateral movement, especially toward ESXi, and prepare for destructive malware.

Reference Links

  1. Cisco BroadWorks Out-of-Band Blind XML External Entity Injection

Overview

  • The OCI XML parser in Cisco BroadWorks has external entity resolution enabled by default; unauthenticated remote attackers can send a crafted XML message to the OCI-P service.

Impact

  • Attackers can read sensitive files with the privileges of the BroadWorks user.

Affected / Fixed Versions

  • Cisco has released software updates.

Recommendations

  • Apply the software updates promptly. No workarounds available.

Reference Links

  1. New N-central Exploits Work Against Patched Servers, Enabling Root RCE and Windows SYSTEM Access

Overview

  • N-able is investigating exploits targeting on-premise N-central 2026.4.1 HF2. The vulnerabilities depend on a non-default configuration with the Legacy API enabled and exposed to the internet.

Impact

  • Root RCE and Windows SYSTEM-level access on affected servers.

Recommendations

  • Disable the Legacy API if not required and restrict its internet exposure.
  • Apply N-able patches or mitigations as advisory updates are published.

Reference Links

  1. Hackers Plant GSocket on Linux Servers for Persistent Access

Overview

  • Multiple threat actors abuse GSocket, a legitimate open-source remote access tool, to keep persistent access to compromised Linux servers even after the entry vulnerabilities are patched.

Impact

  • Persistent control and continued unauthorized access despite remediation.

Recommendations

  • Investigate unusual use of legitimate remote access tools like GSocket.
  • Use comprehensive EDR to detect persistence and audit servers for unauthorized backdoors.

Reference Links

  1. The Global Socket: How Threat Actors Weaponize GSocket for Stealthy C2

Overview

  • Microsoft observed multiple incidents of GSocket on compromised Linux servers, relaying traffic through the public Global Socket Relay Network (GSRN); both host and operator connect outbound, avoiding blockable attacker-owned IPs or domains.
  • GSocket disguises its process, persists across reboots, and stages files in memory-backed directories. Chains usually start with web application RCE; privilege escalation attempts using Linux kernel flaw CVE-2026-43284 (Dirty Frag) were observed.
  • Clients reconnect using a shared secret rather than IPs or hostnames.

Impact

  • Persistent access beyond patching, difficult C2 detection and blocking, and a 350%+ rise in GSocket detections from March to August 2026, affecting education, research, technology, and telecommunications.

Recommendations

  • Patch and harden internet-facing applications, CMS platforms, and plugins; remove unused components and restrict upload and admin endpoints.
  • Remove GSocket clients, persistence, and staged files; apply deny-by-default outbound policies to block relay communications.
  • Do not treat patching the initial web vulnerability as complete remediation.

Reference Links

  1. CVE-2026-0329 PAN-OS: Buffer Overflow (Medium)

Overview

  • A medium-severity buffer overflow vulnerability in PAN-OS.

Impact

  • Buffer overflows can potentially allow arbitrary code execution or denial of service.

Recommendations

  • Review the advisory and apply relevant patches or updates.

Reference Links

  1. CVE-2026-0331 PAN-OS: Sensitive Information Disclosure (Medium)

Overview

  • A medium-severity PAN-OS vulnerability resulting in sensitive information disclosure.

Impact

  • Exposure of sensitive information under certain conditions.

Recommendations

  • Review and apply vendor advisories and patches.

Reference Links

  1. CVE-2026-0323 Checkov by Prisma Cloud: Server-Side Request Forgery (Low)

Overview

  • A low-severity SSRF vulnerability in Checkov by Prisma Cloud.

Impact

  • Could allow an attacker to induce the server to make unauthorized requests.

Recommendations

  • Apply available patches or mitigations and follow Prisma Cloud advisories.

Reference Links

  1. Cisco Identity Services Engine Authorization Bypass Vulnerabilities

Overview

  • Multiple flaws in the ISE and ISE-PIC web management interface stem from missing server-side validation of Administrator permissions. Remote authenticated attackers can submit crafted HTTP requests to modify parts of the configuration, such as file descriptions.

Impact

  • Attackers with administrator access can alter configurations, affecting management integrity. Medium security impact.

Affected / Fixed Versions

  • Cisco has released software updates.

Recommendations

  • Apply the updates promptly. No effective workarounds exist.

Reference Links

  1. Critical Vulnerabilities in N-able N-central Prompt Hosted Shutdown

Overview

  • N-able responded to public disclosure of 33 critical N-central vulnerabilities: unauthenticated RCE, privilege escalation, credential disclosure, and unauthorized account creation, built from XXE flaws, session-handling weaknesses, and patch metadata manipulation.
  • Public PoC code was published; scanning was detected but no confirmed successful exploitation in customer environments. N-central is widely used by MSPs and enterprise IT.

Impact

  • Remote attackers can execute code as the nable service account or gain root, risking downstream managed environments.
  • Seven CVEs for critical issues were patched in an emergency hotfix; hosted servers in all regions were upgraded.

Affected / Fixed Versions

  • Vulnerable version tested: N-central Appliance 2026.4.0.31. Fixed: N-central 2026.4 Hotfix 2 (build 2026.4.1.26), covering seven CVEs.

Recommendations

  • Upgrade on-premises servers immediately and keep them offline until patched.
  • Hosted customers must still update Agents and Probes; follow compatibility guidance for Patch Management Engine components.
  • Monitor for compromise, engage incident response if suspicious, and use detection rules and checks from Rapid7 and others.

Reference Links

  1. U.S. Urges Critical Infrastructure to Secure Refrigeration Systems After EU Supermarket and Blood Bank Attacks

Overview

  • Attacks on French blood banks and European supermarkets exploited industrial refrigeration and cold-chain controllers via unpatched flaws, misconfigurations, and weak or hard-coded passwords to remotely manipulate temperature.
  • CISA, FBI, and other agencies issued a joint advisory urging immediate action. Targeted devices include Danfoss AK-SM and AK-SC, Copeland, and Dixell XWEB controllers. France attributed the attacks to Iran, which denies it.

Impact

  • Spoilage of blood, food, and medicines; public health hazards and supply chain disruption; temperature manipulation can also cause fire hazards.

Recommendations

  • Use strong authentication, change default passwords, patch promptly, and replace end-of-life devices.
  • Remove unnecessary internet-accessible and remote access points; isolate OT from business networks.
  • Maintain offsite backups; improve asset visibility to prevent lateral movement in converged IT/OT environments.

Reference Links

  1. Microsoft Fixes RCE Bug in Windows Paint After Weeks of Confusion

Overview

  • Microsoft disclosed an RCE vulnerability in Microsoft Paint; initial communications about the patch and mitigation were unclear.

Impact

  • Potential for attackers to run arbitrary code on affected systems.

Recommendations

  • Apply the official Microsoft security updates for Paint once clearly released.
  • Follow patch management best practices and monitor vendor communications.

Reference Links

AI SOC

  1. Lessons from 59 Linux Kernel Bug Reports: Scaling Vulnerability Discovery with AI at Microsoft FORGE Lab

Overview

  • Microsoft’s FORGE Lab ran an AI-assisted Linux kernel vulnerability research project across networking, filesystems, and security modules, using custom tooling (codename MDASH) combining Sonnet 4.6 and GPT-5.x models.
  • 26,502 raw findings were filtered to 621 with PoC reproductions, producing 59 public upstream reports, 33 CVEs, and 38 patches merged into mainline.
  • AI agents handled scanning, screening, and PoC generation; humans handled validation, root cause analysis, and patch review. Bugs were deeply latent, averaging over 8 years old, some over two decades.

Impact

  • Confirmed working local root privilege-escalation exploits for eight CVEs.
  • AI-enabled scanning and triage improved scale and efficiency, showing practical AI-human collaboration for critical open-source software.

Recommendations

  • Combine AI-driven scanning and PoC generation with expert review.
  • Keep improving models and validation pipelines for filtering and exploit confirmation.
  • Collaborate with upstream maintainers to land fixes and remediate legacy vulnerabilities.

Reference Links

AI Threat Landscape

  1. Trained to Betray: How Post-Training Supply Chain Attacks Hijack Coding Agents

Overview

  • Two Microsoft studies show post-training supply chain attacks on AI coding and terminal agents: dataset poisoning and model poisoning.
  • Dataset poisoning injects crafted fine-tuning examples teaching unsafe conditional behaviors, so agents misuse command-execution tools on benign-seeming triggers. Model poisoning implants reliable backdoors using supervised fine-tuning plus reinforcement learning.
  • Backdoored agents can trigger unsafe tool calls affecting code, files, data, credentials, or network resources while returning benign text. Triggers can be ordinary requests or content like filenames and code comments, evading prompt-injection defenses.
  • Dataset poisoning succeeded about 78% on known harnesses with some transferability; model poisoning succeeded 84.1%–94.8% on unseen repositories.

Impact

  • Compromised agents can silently run malicious commands under normal-looking queries, enabling code execution, file changes, and access to sensitive data and credentials.
  • Degrades trust in AI-assisted development tooling and amplifies supply chain risk.

Recommendations

  • Validate and secure training data pipelines to detect poisoned inputs.
  • Enforce provenance checks and deployment-specific evaluations of model checkpoints.
  • Strictly limit agent tool permissions and add independent observability and control beyond model-level assurances.

Reference Links

  1. 9th November Threat Intelligence Report

Overview

  • Queens Public Library (ransomware) and Russian hosting provider Beget (destructive attack) were targeted. OPSSHIELD suffered a supply-chain attack pushing malicious updates to nearly 3,000 servers.
  • Ukraine’s Air Alert app was compromised to send false alerts; Russia’s emergency app was also affected with core systems intact.
  • AI-powered threats: ARTEX, an autonomous exploit framework active on 1,600+ systems harvesting iOS certificates and gaming credentials; the Haiou jailbreak bundle weakening OpenAI Codex safeguards; India’s CERT identified Crafty Falcon using AI-assisted tools against financial and crypto sectors.

Impact

  • Disruption of public and cloud services, credential and data theft.
  • Active exploitation enabling MFA bypass and command injection in enterprise environments; AI-enhanced automation and tailored exploit generation raising sophistication.

Recommendations

  • Patch SonicWall SSL VPN services, Android 14–17, Barracuda Email Security Gateway appliances, and OpenSSH musl implementations.
  • Monitor for suspicious credential use, malicious updates, and anomalous alert notifications.
  • Strengthen network and endpoint defenses against AI-driven autonomous exploitation and intrusion.

Reference Links

You may also like

Ready to get started?

Contact us to arrange a half day
Managed SOC and XDR workshop in Dubai

Contact Us

Ready to get started?

Contact us to arrange a half day Managed SOC and XDR workshop in Dubai

Contact Us
Linkedin Twitter Facebook Instagram Youtube

HawkEye

Packages

CSOC

Explore

© 2026 HawkEye – Managed CSOC and XDR powered by DTS Solution. All Rights Reserved.
Contact
This is a staging environment