Morning Review in IT Security — November 13, 2026

The cybersecurity landscape continues to escalate with significant developments spanning nation-state operations, critical infrastructure vulnerabilities, and active zero-day exploitation. Today's briefing covers a major law enforcement action against North Korean threat actors, multiple critical vulnerabilities affecting widely deployed software, and urgent patching requirements across enterprise systems.

US Seizes North Korean Hacking Infrastructure and $1.2 Billion in Stolen Cryptocurrency

Federal authorities have successfully seized infrastructure attributed to APT38, a North Korean state-sponsored threat group, disrupting operations that targeted cryptocurrency exchanges and financial institutions. The seized infrastructure contained video footage and deepfake materials used to conduct sophisticated social engineering attacks against victims, deceiving targets during video calls to facilitate account compromise and credential theft. The operation recovered $1.2 billion in cryptocurrency previously stolen from Binance, representing one of the largest cryptocurrency recovery efforts to date. The malware family FaceStealer was identified as a key component of this campaign, enabling attackers to bypass security measures through convincing video-based social engineering. Source: US seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance

Critical Apache HTTP Server Race Condition Enables Unauthenticated Remote Code Execution

CVE-2026-119618 represents a critical vulnerability in Apache HTTP Server's mod_http2 module that allows unauthenticated remote code execution through a race condition flaw. The vulnerability affects multiple versions of Apache HTTP Server and has been remediated in version 2.4.71 and later. Organizations running affected versions face significant risk as attackers can exploit this flaw without requiring valid credentials or authentication. Immediate patching is strongly recommended for all systems running vulnerable versions of Apache HTTP Server. Source: CVE-2026-119618 | Apache HTTP Server mod_http2 Race Condition Remote Code Execution Vulnerability

N-able N-central Zero-Day Actively Exploited Hours After Proof-of-Concept Release

A newly discovered zero-day vulnerability in N-able N-central, designated CVE-2026-90436 and dubbed "4EverAble2Shell," has been actively exploited by threat actors within hours of public proof-of-concept code becoming available. Attackers have successfully compromised at least 21 systems to deploy cryptocurrency miners and establish persistent access, with researchers confirming that 19 of the affected systems were running N-able's latest security updates at the time of compromise. This rapid exploitation timeline demonstrates the critical urgency of zero-day patching and the need for immediate detection and response capabilities. Organizations operating N-able N-central should prioritize investigation of their infrastructure for signs of compromise and implement compensating controls pending patch availability. Source: New N-able "4EverAble2Shell" zero-day exploited hours after PoC released

Critical Patch Tuesday Addresses 1,095 Vulnerabilities Including Actively Exploited Outlook Flaw

The latest Patch Tuesday cycle has addressed 1,095 vulnerabilities across multiple Microsoft products and services, including several actively exploited flaws in Microsoft Outlook and other widely deployed applications. Among the critical issues resolved are CVE-2026-124194 and CVE-2026-125350, which have demonstrated active exploitation in the wild. The sheer volume of vulnerabilities in this cycle underscores the ongoing challenge of vulnerability management and the importance of rapid patch deployment across enterprise environments. Organizations should prioritize patching of actively exploited vulnerabilities and establish expedited testing and deployment procedures for critical updates. Source: Never be afraid to ask questions

The convergence of nation-state operations, critical infrastructure vulnerabilities, and zero-day exploitation represents an elevated threat environment requiring immediate attention from security teams. Organizations should prioritize patching of critical vulnerabilities, implement enhanced monitoring for compromise indicators, and review access controls for systems running vulnerable software versions.