<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <title>ThreatNoir — Active Focus Items</title>
    <link>https://threatnoir.com</link>
	    <description><![CDATA[Curated cybersecurity news and analysis]]></description>
    <language>en</language>
    <copyright>ThreatNoir 2026</copyright>
    <atom:link href="https://threatnoir.com/api/focus/feed.xml" rel="self" type="application/rss+xml"/>
    <lastBuildDate>Fri, 13 Nov 2026 11:18:50 GMT</lastBuildDate>
    <item>
      <title>Check Point Gaia under attack: PHP2Shell chained to root for ESXi wiper, patch now</title>
      <link>https://threatnoir.com/focus</link>
      <guid isPermaLink="false">f15d4dd4-3615-4fc2-9379-91f71a6f2841</guid>
      <pubDate>Fri, 13 Nov 2026 11:18:50 GMT</pubDate>
      <description><![CDATA[Attackers are chaining PHP2Shell (CVE-2026-109618/9) with a DynamicCLI root flaw (CVE-2026-123039) on Check Point Mobile Access gateways, then wiping VMware ESXi hosts. Patch and hunt tonight.]]></description>
      <category>critical</category>
    </item>
    <item>
      <title>4EverAble2Shell: N-central Hotfix 2 Servers Taken to Root Hours After PoC Dropped</title>
      <link>https://threatnoir.com/focus</link>
      <guid isPermaLink="false">51100b02-15cb-401e-813e-320603183fb6</guid>
      <pubDate>Fri, 13 Nov 2026 08:52:08 GMT</pubDate>
      <description><![CDATA[A new N-able N-central exploit chain, 4EverAble2Shell, gives unauthenticated root on servers running the latest Hotfix 2. Attackers began mining within hours of the PoC, hitting 21 servers, 19 of them patched. Disable Legacy API and take on-prem N-central offline now.]]></description>
      <category>critical</category>
    </item>
    <item>
      <title>Grok AI App Builder Exposes Over 35,000 Apps, Leaking Confidential Business Data and Passwords</title>
      <link>https://threatnoir.com/focus</link>
      <guid isPermaLink="false">1ae9a01b-70d9-4aa9-a030-0ee9ec72c514</guid>
      <pubDate>Thu, 12 Nov 2026 21:05:33 GMT</pubDate>
      <description><![CDATA[Researchers found that 94.7% of 37,571 apps built with Grok's app builder were publicly accessible without authentication, exposing sensitive data including patient medical records, employee rosters, plain-text passwords, and internal corporate information. The exposure affected organizations ranging from small contractors to Fortune 500 companies. The vulnerability resulted from overly permissive default access settings and the enumeration of app addresses through passive DNS records.]]></description>
      <category>high</category>
    </item>
    <item>
      <title>Citrus ransomware abuses Group Policy to push Sn00py and disable Microsoft Defender across domains</title>
      <link>https://threatnoir.com/focus</link>
      <guid isPermaLink="false">ba9b7a9e-b4bf-4806-915e-ba5935d116da</guid>
      <pubDate>Thu, 12 Nov 2026 08:02:16 GMT</pubDate>
      <description><![CDATA[Citrus, a newly documented crew tracked by Securelist, uses stolen contractor logins to reach a domain controller, then builds a malicious GPO named Kaspersky GPO that drops Sn00py ransomware and turns off Defender on every joined machine.]]></description>
      <category>critical</category>
    </item>
  </channel>
</rss>