THREATNOIR
Subscribe

Urgent Threats & Advisories

Active and archived focus items for SOC teams and threat hunters

Items are AI summaries of the linked sources and are not reviewed before publication. The exception is an item that comes from a rapid alert, which Marcus Lenngren checked and approved. How this works

ACTIVE RIGHT NOW

CRITICALEXPLOIT10h ago

Check Point Gaia under attack: PHP2Shell chained to root for ESXi wiper, patch now

Attackers are chaining PHP2Shell (CVE-2026-109618/9) with a DynamicCLI root flaw (CVE-2026-123039) on Check Point Mobile Access gateways, then wiping VMware ESXi hosts. Patch and hunt tonight.

Rapid alert
What to do now: the commands, how to hunt for it and what does not help →
Action required
Blocked-attempt logs are not an all-clear. They do not prove a clean box. Hunt webshells and TSGA directly.
Check Point Gaia
CVE-2026-123039CVE-2026-109618CVE-2026-109619
Check Point warns of zero-day flaw exploited for root access Hackers Exploit Check Point Firewall Flaws to Gain Root Access and Deploy Wiper Malware on VMware ESXi Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files PHP2Shell Exploited in Destructive Check Point Gateway Attacks PHP2Shell Exploitation on Check Point Gateway
CRITICALEXPLOIT12h ago

4EverAble2Shell: N-central Hotfix 2 Servers Taken to Root Hours After PoC Dropped

A new N-able N-central exploit chain, 4EverAble2Shell, gives unauthenticated root on servers running the latest Hotfix 2. Attackers began mining within hours of the PoC, hitting 21 servers, 19 of them patched. Disable Legacy API and take on-prem N-central offline now.

Rapid alert
What to do now: the commands, how to hunt for it and what does not help →
Action required
Hotfix 2 is not enough. Disable Legacy API, take the server off the internet, and treat any hit as full compromise.
N-central HF2
CVE-2026-90436CVE-2026-125883CVE-2026-125878CVE-2026-125879CVE-2026-125880CVE-2026-125881CVE-2026-91000CVE-2026-125882
New N-able "4EverAble2Shell" zero-day exploited hours after PoC released Hackers Exploit New N-central Zero-Day Hours After PoC Publication New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2 New N-able N-central Zero-Day Exploits Target Patched Servers, Claiming Unauthenticated Root Access Hackers Target N-central Zero-Days as N-able Rushes Patches
HIGHADVISORY1d ago

Grok AI App Builder Exposes Over 35,000 Apps, Leaking Confidential Business Data and Passwords

Researchers found that 94.7% of 37,571 apps built with Grok's app builder were publicly accessible without authentication, exposing sensitive data including patient medical records, employee rosters, plain-text passwords, and internal corporate information. The exposure affected organizations ranging from small contractors to Fortune 500 companies. The vulnerability resulted from overly permissive default access settings and the enumeration of app addresses through passive DNS records.

Action required
Find out which AI app builders your staff use without IT approval, check each app's access settings, test sign-in with an outside account, search the app's script files for passwords, and unpublish any apps that are not actively owned.
Grok AI App BuilderLovableReplit
Grok AI App Builder Exposes Over 35,000 Apps, Leaking Confidential Business Data and Passwords
CRITICALCVE1d ago

Citrus ransomware abuses Group Policy to push Sn00py and disable Microsoft Defender across domains

Citrus, a newly documented crew tracked by Securelist, uses stolen contractor logins to reach a domain controller, then builds a malicious GPO named Kaspersky GPO that drops Sn00py ransomware and turns off Defender on every joined machine.

Rapid alert
What to do now: the commands, how to hunt for it and what does not help →
Action required
Defender shows green, so you trust it. A GPO can switch it off by registry. Alert on new GPOs and gPLink changes.
Citrus Ransomware
CVE-2026-54121CVE-2020-1337
Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand Hackers Abuse Windows Group Policy to Deploy Citrus Ransomware and Disable Microsoft Defender

ARCHIVE

Category:
Severity:
CRITICALADVISORY2d ago

Sparrow framework: China-linked clusters use fake Chrome cert warnings and Linux footholds

Check Point links three China-nexus espionage clusters through the Sparrow framework, run by a supplier it calls CopperDragon. Watering holes push fake Chrome certificate fixes that install the SquadC backdoor, while Linux servers are used as entry points.

Action required
Trusting a cert-repair prompt's branding. Chrome never asks for a fix. Check the download, do not run it.
Affected products
Sparrow / SquadC
Source article
CRITICALEXPLOIT3d ago

Microsoft November 2026 Patch Tuesday: exploited Outlook NTLM zero-day among 1,093 fixes

Microsoft's November 2026 Patch Tuesday fixes 1,093 CVEs, including CVE-2026-124194, an actively exploited Outlook spoofing flaw that leaks a user's NTLMv2 hash when a crafted file is opened. Patch Outlook first and block outbound NTLM.

Action required
Treating Moderate as low priority. CVE-2026-124194 is exploited now. Patch Outlook first, block outbound NTLM.
Affected products
CVE-2026-124194
CVE IDs
CVE-2026-124194
Source article
CRITICALEXPLOIT3d ago

Google patches eighth exploited Chrome zero-day of 2026: XML use-after-free CVE-2026-125350

Google has shipped an emergency Chrome update for CVE-2026-125350, a high-severity use-after-free in the XML component that attackers are already exploiting. Update to 157.0.8103.50 and relaunch tonight.

Action required
Background download is not the fix. The patch applies only after you relaunch Chrome. Restart every browser.
Affected products
Chrome 157.0.8103.50
CVE IDs
CVE-2026-125350
Source article
CRITICALADVISORY3d ago

Hackers Used Default admin:admin Credentials to Exploit ForgeRock RCE and Remotely Unlock Cars

ForgeRock Access Management and OpenIDM instances at automotive companies were exploited via default admin:admin credentials combined with URL parsing vulnerabilities, allowing attackers to achieve RCE and access vehicle control APIs. Threat actors gained the ability to unlock vehicles, start engines, and exfiltrate location data. Both affected organizations patched within hours, but similar misconfigurations likely exist elsewhere in the wild.

Action required
Immediately scan your environment for ForgeRock deployments with default credentials enabled. Force credential rotation on all ForgeRock admin accounts and verify no public-facing instances exist. Check ForgeRock logs for authentication attempts using default credentials dating back 90 days.
Affected products
ForgeRock Access ManagementForgeRock OpenIDMApache Felix Web ConsolePing Identity
Source article
CRITICALADVISORY4d ago

@ethersphere/bee-js 13.3.0 Compromised

The @ethersphere/bee-js npm package version 13.3.0 was published with malicious code that executes during installation. The payload targets Swarm Desktop wallet data and attempts to establish persistent access across Linux, macOS, and Windows. Any developer or system that installed this specific version is at risk of credential theft and system compromise.

Action required
Immediately identify and isolate any systems with @ethersphere/bee-js 13.3.0 installed. Remove the package, revoke any exposed credentials, and scan for persistence mechanisms. Check package-lock.json and npm audit logs across your environment.
Affected products
@ethersphere/bee-jsSwarm Desktop
Source article
CRITICALADVISORY5d ago

Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot

OpenSSH vulnerability CVE-2026-123158 (SSHole) is under active exploitation within hours of disclosure. Unauthenticated attackers can gain root access on Linux systems with passwordless accounts by sending oversized passwords. Any exposed OpenSSH instance is at immediate risk of full compromise.

Action required
Immediately patch OpenSSH to the latest patched version. Prioritize systems with passwordless accounts or public SSH exposure. Hunt logs for oversized password attempts and failed SSH connections from the past 24 hours.
Affected products
OpenSSHAlpine LinuxPrevidian
CVE IDs
CVE-2026-123158
Source article
CRITICALADVISORY5d ago

Free Certified Patch for Critical Rails Active Storage Vulnerability

Ruby on Rails Active Storage contains a critical unauthenticated vulnerability (GHSA-f3w6-w445-fwh9, CVSS 9.8) allowing attackers to write arbitrary files or read sensitive data, leading to RCE. All Rails applications using Active Storage are affected. Exploitation requires no authentication and impacts confidentiality, integrity, and availability.

Action required
Immediately identify Rails instances using Active Storage in your environment. Patch to the latest Rails version as released by the Rails team. Scan logs for suspicious file write/read activity targeting storage paths while patching is in progress.
Affected products
Ruby on RailsActive StorageImageMagickMiniMagickSocket
Source article
CRITICALADVISORY6d ago

Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It

Microsoft released a critical RCE fix for Windows Paint (CVE-2026-83844, CVSS 8.1) that allows unauthenticated remote code execution without user interaction. The patch is only available via Microsoft Store, not Windows Update, creating a manual deployment burden across all user instances. All Paint installations below version 11.2609.401.0 are vulnerable.

Action required
Immediately verify Paint version across all endpoints. Force Microsoft Store update to Paint 11.2609.401.0 or later on all user accounts and provisioned instances. Monitor for exploitation attempts targeting Paint processes.
Affected products
MicrosoftWindows PaintMicrosoft Store
CVE IDs
CVE-2026-83844
Source article
CRITICALEXPLOIT7d ago

SSHole (CVE-2026-123158): OpenSSH authentication bypass hits Alpine and musl systems, exploited within hours

An OpenSSH flaw lets attackers log into passwordless accounts on Alpine Linux and other musl-based systems using an oversized password. One connection, no retries. Patched in 10.6p2 on 5 Nov, exploited in the wild within nine hours. What to do tonight.

Action required
Running apk upgrade is not enough. The old sshd keeps accepting connections until you restart the service.
Affected products
OpenSSH 10.6p2
CVE IDs
CVE-2026-123158
Source article
CRITICALADVISORY7d ago

OpenAI's AI pipeline built 948 working Linux kernel root exploits in one run: what admins should do now

OpenAI says an autonomous pipeline on an unreleased cyber model produced 1,169 working local root exploits for 948 unique Linux kernel flaws in a mid-October run. Patches are landing upstream in stages. Treat any unpatched box as root-exposed and update now.

Action required
Thinking a non-root account is low risk. On an unpatched kernel it is now root. Patch, reboot, restrict namespaces.
Affected products
Linux Kernel LPEs
Source article
CRITICALEXPLOIT8d ago

APT29 watering holes hit iOS and Android with zero-click n-day exploit chains

Sekoia links a large watering hole campaign to Russia's APT29. Poisoned and cloned sites, plus a one-week compromise of the Plerdy analytics tracker, served n-day exploit chains to outdated iPhones and Android Chrome. No click needed. Update now.

Action required
A reboot stops the session. Stolen cookies stay valid. Rotate sessions.
Affected products
APT29 WateringHole
CVE IDs
CVE-2025-43529CVE-2024-27834CVE-2026-20700CVE-2025-14174CVE-2025-43510CVE-2025-43520CVE-2026-3910CVE-2025-27038CVE-2025-27038387
Source article
CRITICALCVE9d ago

Barracuda ESG: pre-auth bypass chains with root command injection across six product lines

Barracuda disclosed CVE-2026-116606 (CVSS 9.3) and CVE-2026-111560 (CVSS 8.6) on 2 Nov 2026. Chained, they bypass authorization and give root on affected appliances. Patches are out. No active exploitation reported yet.

Action required
Thinking it is admin-only, so it waits. Described as pre-auth, chained it may be root. Patch and lock the interface.
Affected products
Barracuda ESG
CVE IDs
CVE-2026-116606CVE-2026-111560
Source article
CRITICALEXPLOIT9d ago

Node-RED CVE-2026-58115 exploited in the wild: one HTTP request drops Linux bots and webshells

A missing authentication flaw in Node-RED (CVSS 10.0) is under active exploitation. Attackers send a single POST to deploy a flow that runs arbitrary code, planting a Linux bot and persistent webshells. Check whether your instance is reachable and whether adminAuth is set.

Action required
A patch alone is not enough if adminAuth is off. Enable adminAuth and block port 1880 at the firewall.
Affected products
Node-RED CVE-58115
CVE IDs
CVE-2026-58115
Source article
CRITICALCVE9d ago

Linux kernel TCP RCE CVE-2026-98432: attackers are scanning now, Red Hat patched, Ubuntu fixes in testing

A critical use-after-free in the Linux kernel's IPv4 TCP code lets remote, unauthenticated attackers run code as root. Rated 9.8. Scanning began on 2 Nov. Red Hat has patched RHEL 8, 9 and 10; Ubuntu's fixes are still in -proposed.

Action required
net.mptcp.enabled=0 is not a fix. It leaves open sockets alone. Patch the kernel and reboot, or restart the apps.
Affected products
Linux TCP CVE-2026-98432
CVE IDs
CVE-2026-98432
Source article
CRITICALADVISORY10d ago

Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers

Two critical RCE and authentication bypass flaws in Langflow 1.0.0-1.12.8 allow unauthenticated attackers to execute arbitrary code on vulnerable servers. A Metasploit module is already public for CVE-2026-93680. Default superuser auto-login in v1.12.8 makes exploitation trivial.

Action required
Immediately identify all Langflow instances in your environment and upgrade to version 1.13.0 or later. Search logs for exploitation attempts targeting the Model Context Protocol endpoint and suspicious code execution patterns.
Affected products
LangflowIBM
CVE IDs
CVE-2026-93680CVE-2026-110186
Source article
CRITICALCAMPAIGN10d ago

ARTEX AI: autonomous agents run Active Directory attacks at machine speed against 200+ orgs

Chinese-linked actors are using the open-source ARTEX AI framework to automate Kerberoasting, DCSync and lateral movement. Google, Mandiant and CrowdStrike report attacks on over 200 organisations, with one breach reaching root in 12 minutes.

Action required
Static IoCs will not save you. They use valid accounts and admin tools. Hunt behaviour: bursts of events in seconds.
Affected products
ARTEX AI
Source article
CRITICALCAMPAIGN10d ago

XCPE botnet: 1.3M Android TV boxes shipped with a backdoor, Google and police disrupt it

Google, Japan's NPA and partners disrupted XCPE, a backdoor that OEM Videostrong allegedly built into Android TV box firmware, enrolling more than 1.3 million devices. Removing the app does not help: it reinstalls from a protected partition on reboot.

Action required
Deleting the app does not clean the box. It reinstalls from /oem/ on reboot. Reflash clean firmware or unplug it.
Affected products
XCPE botnet
Source article
CRITICALADVISORY12d ago

2026-015: Critical Vulnerability in Multiple Atlassian Products

Atlassian released a critical advisory for CVE-2026-21589 affecting Bitbucket, Confluence, and Jira Data Center. Unauthenticated attackers can access arbitrary files if they know the exact path. Internet-exposed instances are at immediate risk.

Action required
Identify all Atlassian Data Center deployments (Bitbucket, Confluence, Jira) in your environment and patch immediately. Simultaneously review access logs for suspicious file requests to affected systems from the past 30 days.
Affected products
AtlassianBitbucket Data CenterConfluence Data CenterJira Service Management Data CenterJira Software Data Center
CVE IDs
CVE-2026-21589
Source article
CRITICALADVISORY12d ago

2026-010: Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway

Citrix has released a critical advisory for NetScaler ADC and NetScaler Gateway containing memory overflow and authentication bypass vulnerabilities. Any organization running these appliances is at immediate risk of compromise. CERT-EU is flagging this as urgent due to severity and potential for unauthenticated remote exploitation.

Action required
Immediately inventory all NetScaler ADC and Gateway instances in your environment. Prioritize patching to the latest available version. Monitor these appliances for unusual memory errors, failed authentication attempts, and unexpected administrative access.
Affected products
NetScaler ADCNetScaler GatewayCitrix
Source article
CRITICALADVISORY12d ago

2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server

SAP released patches for two critical unauthenticated remote code execution vulnerabilities in SAP Kernel and NetWeaver Message Server (CVE-2026-44756 and CVE-2026-58240). Any unpatched SAP system is exploitable without credentials, giving attackers full OS command execution and complete system compromise. If you run SAP infrastructure, this is an immediate threat.

Action required
Identify all SAP Kernel and NetWeaver Message Server instances in your environment. Apply SAP Security Notes for CVE-2026-44756 and CVE-2026-58240 immediately. Monitor SAP system logs and network traffic for exploitation attempts while patching is underway.
Affected products
SAP Extended PassportSAP NetWeaver Message ServerSAP
CVE IDs
CVE-2026-44756CVE-2026-58240
Source article