Afternoon Review in IT Security — November 13, 2026

The IT security landscape continues to face escalating threats as attackers exploit unpatched systems and newly disclosed vulnerabilities with remarkable speed. Today's afternoon review highlights critical incidents affecting enterprise gateways, Windows systems, Android devices, and remote management platforms, underscoring the persistent risks posed by delayed patching and zero-day exploitation.

Unpatched Check Point Gateways Are Being Wiped Exploiting PHP2Shell

Unpatched Check Point Security Gateways worldwide have fallen victim to coordinated attacks beginning October 30, with threat actors gaining root access and deploying destructive wiper malware. The attackers exploited vulnerabilities in the Mobile Access portal using PHP2Shell for initial access, then chained multiple exploits to establish backdoors and conduct network intrusions. Check Point Research has identified the attack chain involving CVE-2026-109618, CVE-2026-109619, and CVE-2026-123039, alongside malware variants including destroy_v6, TSGA, and TSProxy. The attacker infrastructure has been traced to IP address 130.94.19.204. Source: Security Affairs

New SignDrop Exploit Can Abuse Windows Defender to Bypass Security Protections

A newly discovered Windows zero-day vulnerability dubbed SignDrop has been disclosed by researcher Chaotic Eclipse, enabling local attackers to escalate privileges to SYSTEM level while bypassing Windows Defender protections. The flaw exploits CLFS security mechanisms that were originally designed as mitigations, creating a paradoxical vulnerability within the defense infrastructure itself. This zero-day demonstrates how security features can become attack vectors when improperly implemented. Source: Security Affairs

ArcticRAT Android Malware Uses Hidden VNC to Control Smartphones While Showing Victims a Black Screen

A sophisticated Android remote access trojan named ArcticRAT has emerged, capable of assuming complete control of compromised devices while displaying only a black screen to users, making detection extremely difficult. The malware operates banking apps, approves permissions, and exfiltrates sensitive data entirely undetected in the background while victims remain unaware their devices are compromised. Associated malware families include RATHat and StreamRAT, with command and control infrastructure identified at domains net.frostlink.iceforge and net.iceflow.arcticlink. Source: Cyber Security News

Hackers Exploit New N-central Zero-Day Hours After PoC Publication

A critical zero-day vulnerability in N-central identified as CVE-2026-90436 and dubbed 4EverAble2Shell has been actively exploited by threat actors within hours of proof-of-concept publication. The flaw permits remote, unauthenticated attackers to execute arbitrary code with root privileges, and exploitation has already been observed in the wild with XMRig cryptocurrency mining malware deployed on compromised systems. This rapid exploitation timeline demonstrates the severe risks posed by public disclosure of unpatched vulnerabilities. Source: SecurityWeek

Today's threat landscape reveals a critical pattern: attackers are moving with unprecedented speed to exploit both newly disclosed vulnerabilities and unpatched legacy systems. Organizations must prioritize immediate patching of known vulnerabilities and implement robust monitoring to detect exploitation attempts before attackers establish persistent access.