What happened

Confirmed Check Point says attackers exploited PHP2Shell, a PHP flaw that also affects its Security Gateways, through the Mobile Access portal. They then used a Gaia privilege-escalation flaw, CVE-2026-123039, to get root and persistence. Activity ran from 30 October to 4 November, a week after fixes shipped on 23 October. Only “a couple of dozen unpatched systems, in a single region” were compromised. In many cases the attacker got a foothold in the network; in a limited number the activity was destructive and ideologically motivated. Check Point notified affected customers and helped remediate. Check Point advisory

Confirmed Check Point Research describes two waves. The first, on 30 October, targeted Israeli organisations and included destructive activity against some. The second, on 2 November, hit organisations in several countries and sectors with no sign of destruction. Check Point Research

Who is affected

How the attack works

Confirmed In the intrusion Check Point investigated, the attacker:

1. Exploited the portal, leaving PHP session files with upload_progress_pwn under /opt/CPcvpn-R81.20/tmp/ and causing hundreds of Apache/PHP worker crashes.
2. Escalated from the portal’s service account to root through DynamicCLI.
3. Wrote PHP web shells as zz*.tpl login-page templates, using the key zz2026, with uploads saved to /tmp/.up.tpl.
4. Launched the TSGA implant from /tmp/CPconfigdaemon, which relaunches as slot_CPconfigdaemon. TSGA drops TSProxy to /lib/libcpfwcommon.so and injects it into appliance processes to hide attacker connections. It can also steal configuration, persist in backups and snapshots, and tamper with firewall logs.
5. Scanned the internal network with the gogo scanner, then used SSH as vpxuser to reach a VMware ESXi host and run the destroy_v6 wiper, which left DREAM_ANNEXATION.txt notes rejecting ransom.

Check Point Research Unknown How the attacker obtained a working ESXi credential. Reported TSGA and TSProxy are modified variants of PhiliKit, a backdoor seen in Ivanti VPN attacks that ESET associated with China-nexus UNC5221. Check Point says the evidence doesn’t support a confident attribution: the actor may have run the whole campaign, acted as an access broker, or staged a false flag.

# Gaia: installed Jumbo Hotfix take
cpinfo -y all 2>/dev/null | grep -i -A2 'HOTFIX'
# Portal exploitation marker and template web shells
grep -l 'upload_progress_pwn' /opt/CPcvpn-*/tmp/sess_* 2>/dev/null
find / -xdev \( -name 'zz*.tpl' -o -name 'challenge_render.tpl' -o -name '*CPconfigdaemon' \
  -o -name 'libcpfwcommon.so' \) 2>/dev/null
ls -la /tmp/.bd.log /tmp/.up.tpl /tmp/.p_sock 2>/dev/null
netstat -tlnp 2>/dev/null | grep ':11072'
# ESXi: SSH logins as vpxuser (run on each host)
grep -i 'vpxuser' /var/log/auth.log | grep -i 'sshd'

Investigate, contain and remediate (in order)

1. Preserve evidence off the box first: remote syslog, SmartConsole logs, upstream NetFlow and vCenter/ESXi auth logs. TSGA can tamper with local firewall logs, so gaps after a logging-daemon crash are themselves a signal.
2. Block 130.94.19[.]204 and .168, and restrict traffic from gateways to hypervisor management networks.
3. Install the November Jumbo Hotfix on all management servers and gateways, internet-facing Mobile Access first (for example R81.20 Take 174, R82.10 Take 52). R81.20 R82.10
4. MAG212 analysis If any indicator matches, rebuild rather than clean. TSGA persists in backups and snapshots, so check backups before restoring. Then rotate VPN, admin and vpxuser/vCenter credentials.

Verify recovery: the take is confirmed on both cluster members; there’s no listener on 11072; ESXi shows no SSH from gateways; and policy install, VPN login and failover work. Prevention MAG212 analysis: a firewall should never be able to SSH to your hypervisors. Put ESXi management behind its own boundary, disable ESXi SSH when it’s not in use, and keep firewall logs somewhere the firewall can’t edit.

What happened

Reported Researcher Sean Bales published more than 30 N-central zero-days with exploits on 8 November. N-able took hosted N-central offline on 9 November and shipped 2026.4 Hotfix 2 (build 2026.4.1.26) on 10 November, fixing seven CVEs. On 12 November Bales released two more exploits, 4EverAble2Shell and Agent2Shell, tested against that same Hotfix 2 build. SecurityWeek BleepingComputer

Reported Previdian saw probing at about 08:30 UTC on 12 November. Huntback saw the full chain from 09:16 UTC, and by 12:50 UTC counted 21 compromised N-central servers running an XMRig miner. Huntback describes all 21 as hosted N-central servers; nineteen were on Hotfix 2, spread across the US, Canada, South Africa, the UK, Germany, France and Sweden. SecurityWeek, citing Lupovis and Huntback, puts the first successful compromises about five hours after the exploit was published. BleepingComputer SecurityWeek

Who is affected and how it works

Reported N-central servers with the Legacy API enabled; Legacy API is off by default. Unknown How the compromised servers came to have it enabled. The chain uses an Apache Axis flaw, CVE-2026-90436, to run commands as the nable service account. It then abuses the privileged setLDFileOwner helper and a symbolic link to make a root-owned script writable, edits that script, and runs it as root through serverControl. The payload fetched a script from 157.20.241[.]16 and installed a miner set to use about half the CPU cores. BleepingComputer MAG212 analysis Cryptomining is the least of it: root on an RMM server means control of every endpoint it manages. Agent2Shell, if it works as claimed, targets those endpoints directly.

Reported N-able’s 12 November advisory says it is “restricting certain N-central features and integrations”. It has disabled the Intune integration, applied protections to hosted environments, and urges on-premises customers to confirm Legacy API access is disabled and to keep upgrading agents and probes. At that point it said it had seen no compromise using the new flaws; researchers have since reported compromises. BleepingComputer N-able status

# Huntback indicators: miner service, staging folders, mining process
systemctl list-units --all --no-pager | grep -i 'xvd'
ls -la /tmp/.xvd /var/tmp/.xvd 2>/dev/null
ps aux | grep -Ei 'xmrig|xvd' | grep -v grep
# Exploit requests in your web access log (path varies by build)
grep -E '/dms/services/ServerUI' <N-CENTRAL-WEB-ACCESS-LOG> | grep -i 'TerminalLineSettings'
# Connections to the reported payload host
ss -tnp | grep '157.20.241.16'

Contain and remediate (in order)

1. Follow N-able’s offline guidance. Reported After the 8 November dump, N-able advised on-premises customers to keep servers offline until it confirms they can safely return, and Huntress repeats that advice. Huntress If yours is back online, confirm Legacy API is disabled and that the server isn’t reachable from the internet.
2. Run the checks above. On a hit, isolate the server, preserve disk and logs, rebuild from a known-good install, and rotate every credential and integration secret the server held.
3. MAG212 analysis Check managed endpoints for unexpected scripts or agent tasks pushed since 8 November, and for new remote-access tools.
4. Watch N-able’s status page for the fix, then apply it immediately, along with the Hotfix 2 agent and probe upgrades.

Verify recovery: Legacy API is off, there’s no xvd service or miner, CPU use is normal, and the server runs the fixed build once N-able releases it. Prevention MAG212 analysis: this is the second RMM platform in two days. Treat RMM servers as tier zero: no internet exposure without a VPN or allow-list, MFA everywhere, and logs shipped somewhere the server can’t reach.

What happened

Confirmed Citrix bulletin CTX697305 lists 28 CVEs in NetScaler ADC and Gateway, almost all memory-safety bugs that Citrix says “can lead to unpredictable or erroneous behavior or Denial of Service”. The one that matters to everyone is CVE-2026-120868 (CVSS 4.0: 9.3), in core packet processing: all deployments are affected, “including those deployed with the default configuration”. The highest score, 9.5, goes to CVE-2026-107412, a set of memory overflows on appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Separately, CTX697320 fixes CVE-2026-120869 (9.4), an unauthenticated bypass in NetScaler Console. CTX697305 CTX697320

Confirmed Neither bulletin reports exploitation. Credits include JPMorgan Chase’s XOR team, CapitalOne and watchTowr, and Citrix says it found several issues itself with AI-assisted code analysis. Secure Private Access hybrid deployments that use NetScaler instances also need the upgrade; Citrix-managed cloud services are patched by Citrix. Citrix MAG212 analysis NetScaler bugs have been weaponised quickly in past years, and watchTowr often publishes technical detail after a patch, so don’t treat “not exploited” as “not urgent”.

Who is affected

Confirmed NetScaler ADC and Gateway 14.1 before 14.1-73.57, 13.1 before 13.1-64.39, 14.1-FIPS before 14.1-73.58 and 13.1-FIPS/NDcPP before 13.1-37.293. Console 14.1 before 14.1-74.34. The Console flaw needs network access to the Console IP (attack vector “adjacent”). Other notable preconditions include a management-plane flaw exploitable by any untrusted host that can reach the NSIP (CVE-2026-120863), and authentication material written to /var/log/httperror.log after logouts (CVE-2026-111338). Citrix

# CLI: running build (run on every node, both HA peers)
show ns version
# shell: features that widen exposure (patterns from CTX697305)
shell
grep -E '^add (vpn|authentication) vserver' /nsconfig/ns.conf
grep -E 'http2 ENABLED|B64DECODE' /nsconfig/ns.conf
exit

Contain, remediate and verify

1. Upgrade internet-facing Gateway and AAA appliances first, then everything else, then Console. Back up the configuration before each upgrade.
2. Restrict NSIP and Console access to management networks (this addresses CVE-2026-120863 and CVE-2026-120869 exposure).
3. MAG212 analysis Treat old httperror.log files as sensitive (CVE-2026-111338): limit who can read them and consider rotating credentials if they were copied off-box.

Verify recovery: both HA peers report the fixed build, HA sync is healthy, VPN and SSO logins work, and a test from an untrusted segment can’t reach the Console. Prevention MAG212 analysis: subscribe to Citrix bulletin alerts, and keep a list of which features each appliance uses, so the next precondition check takes minutes.

What changed since yesterday

Confirmed At 14:00 UTC on Friday (6 a.m. Pacific), Microsoft’s public status page still listed Microsoft 365 business and enterprise services as degraded, with “Users may be unable to connect to multiple Microsoft 365 services”, and consumer products also degraded. Microsoft status Reported Both incidents remain open. Microsoft says features that depend on Exchange Online are impacted while the rest keep working, has found no malicious activity, and will publish a post-incident report with root cause after mitigation. SecurityWeek

Reported Overnight, Microsoft described a process on the affected servers “that sets up secure connections” becoming overwhelmed, after which the servers stop handling requests. It paused all deployments and configuration changes around 19:06 UTC Thursday, began reverting a recent network change whose timing lines up with the outage, and at 04:57 UTC scaled up virtual machines to absorb a traffic surge. Servers returned to service around midnight UTC failed again under load. Microsoft has not said the network change caused the outage. LazyAdmin SOCRadar WindowsForum

What to do now

Connect-MgGraph -Scopes 'ServiceHealth.Read.All'
Get-MgServiceAnnouncementIssue -ServiceHealthIssueId 'EX1550543' |
  Select-Object Id, Status, Classification, LastModifiedDateTime, Title
Get-MgServiceAnnouncementIssue -ServiceHealthIssueId 'MO1550821' |
  Select-Object Id, Status, LastModifiedDateTime

1. Users: don’t reset passwords or reinstall Outlook. Mail sent to you is normally delivered once service returns.
2. IT: freeze changes to MFA, Conditional Access and mail flow; send one status note a day; keep an out-of-band channel for urgent work.
3. MAG212 analysis Security teams: Defender XDR and Purview were on the affected list, so check for alert backlogs once service returns, and warn staff about outage-themed “re-verify your account” phishing.
4. Afterwards: read the post-incident report, check whether the outage qualifies for SLA service credits, and log your business impact.

Verify recovery: both incidents show as resolved, mail queues drain, and Teams calendars and SharePoint search behave normally. Our 12 Nov coverage

What happened

Confirmed Europol says law enforcement and private partners actioned 235 servers and 257 domains behind three “cybercrime-as-a-service” tools. Germany’s BKA dates the action to 9–11 November. Agencies from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the UK and the US took part, with Europol’s EC3 and Eurojust. Europol mentions no arrests. Europol BKA

Who is affected and how the tools work

Confirmed Gootloader spread through fake legal documents on hacked, often WordPress, sites and led on to ransomware: 14 servers and 218 domains came down and 681 infected websites were cleaned. CastleRAT, a remote-access trojan known since 2025, was linked to encrypted data and ransom payments: 120 servers and 39 domains were seized, with victim data shared for alerts. StealC, a credential stealer with a dropper, lost 102 servers, continuing a June 2026 action. Victims of stolen CastleRAT credentials will be alerted through HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, the Shadowserver Foundation and NL-NCSC. Europol

What to look for and do

1. Watch the notification channels. Check your domains with Have I Been Pwned domain search, and your Shadowserver reports if you subscribe.
2. MAG212 analysis For each validated hit: isolate the device, reset passwords from a clean machine, and revoke sessions and tokens, because stealers take cookies as well as passwords. Then review MFA methods, mailbox rules and OAuth grants for the account.
3. MAG212 analysis Hunt Gootloader: look for a browser download of a .zip followed by wscript.exe or cscript.exe running a .js file, and for new scheduled tasks soon after.
4. WordPress owners: Europol urges updated credentials, MFA and patching. Also verify core, plugins and themes against clean copies.

Verify recovery: old sessions are rejected, no new sign-ins from unknown locations, and the rebuilt device is clean. Prevention: see this issue’s awareness lesson on downloading templates safely.

What happened

Reported Researcher Abdelhamid Naceri (“Nightmare Eclipse”) released SignDrop this week. It lets a local, standard user become SYSTEM by abusing how the Common Log File System (clfs.sys) creates its .cnpf authentication file. Cyderes compiled and tested the proof of concept and has seen no exploitation in the wild. SecurityWeek asked Microsoft for comment. SecurityWeek Unknown At our cutoff we found no Microsoft advisory, CVE or fixed build.

Who is affected and how it works

Reported The researcher says he tested it on Windows 11 26H2, Windows 11 26H2 Experimental and Windows Server 2025 Experimental. He claims it works on most Windows installations and that you’re “generally vulnerable” if Windows is older than 90 days; neither claim is verified. The trick: if a log’s container is empty, CLFS signs it whether or not a signature file exists. A user can point a log at a chosen path, make Defender open it through its signature-update interface, and so get a SYSTEM-owned file created where they choose. SecurityWeek MAG212 analysis This doesn’t let anyone in from outside: an attacker first needs code running as a user, from phishing or a stolen login. That’s exactly when ransomware crews want SYSTEM.

# OS build and update revision (UBR)
$cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
'{0} {1}.{2}' -f $cv.DisplayVersion, $cv.CurrentBuild, $cv.UBR
# Defender platform and engine versions
Get-MpComputerStatus | Select-Object AMProductVersion, AMEngineVersion, AntivirusSignatureLastUpdated

Contain, remediate and prevent

1. Keep Windows and Defender platform updates current, and watch the Microsoft Security Response Center for a SignDrop advisory.
2. MAG212 analysis Hunt: look for Defender processes (MsMpEng.exe) creating files in user-writable folders, followed by a new SYSTEM-level process, service or scheduled task started from that location.
3. Reduce the first step: no local admin for daily use, application control on workstations, and fast isolation for any machine running unknown code.

Verify recovery: once Microsoft ships a fix, confirm the build and UBR across the fleet and re-run your hunt over the period before patching.

What happened

Confirmed OpenAI announced two Daybreak products at its “Cyber at the Frontier” event on 12 November. Daybreak Red Team puts “a coordinated team of agents” to work testing web applications, validating findings from scanners, bug bounties and disclosure reports, and checking whether patches stop the exploit. Agents use source code and app context, and scope is enforced with “isolated environments and Guardian review”. OpenAI Reported Defense Factory traces vulnerabilities through code and drafts patches as GitHub pull requests that engineers review; nothing deploys automatically. It imports findings from Wiz, Snyk and Endor Labs. Red Team is in early access; Defense Factory is a preview ChatGPT plugin. SecurityWeek OpenAI

Why it matters

MAG212 analysis One day earlier we reported AntiFox, a self-hosted agentic pentest platform that attackers used to move from an IIS web shell to a stolen AWS secret, making hundreds of API calls in about 30 minutes. MAG212, 12 Nov The technique is the same on both sides; what differs is scope, consent and review. Defenders who adopt these tools should insist on written scope, isolated test environments, logs of every agent action and human review of every patch. They should also expect attackers to test their apps at agent speed: watch for bursts of enumeration and AccessDenied errors, and fix what scanners already flag.

1. Before buying: ask how scope is enforced, where code and findings are stored, and who can see agent logs.
2. Before running: point agents at staging, not production, and tell your SOC so their traffic isn’t mistaken for an attack.
3. After: treat AI-drafted patches like any pull request: review, test, then merge.

Defender’s Action Desk

Prioritised from today’s stories. MAG212 analysis for the ordering; sources are in each article.

• NowCheck Point: November Jumbo Hotfix on gateways and management, Mobile Access first; run the gateway and ESXi hunt. → 01
• NowN-central: Legacy API off; check for xvd.service and miners; rebuild on a hit. → 02
• NowBarracuda (KEV due today): confirm patch IDs on every ESG and other affected appliance; restrict admin UIs.
• TodayNetScaler: plan upgrades to 14.1-73.57 / 13.1-64.39, Gateway and AAA first; Console to 14.1-74.34; lock NSIP and Console to management networks. → 03
• TodayMicrosoft 365: track EX1550543 and MO1550821; freeze identity changes; warn about outage phishing. → 04
• This weekEndgame: check HIBP domain search; revoke sessions for any confirmed stealer victim. → 05
• This weekSignDrop: inventory Windows builds and Defender versions; hunt for Defender writing to user folders. → 06
• By 16 NoveMudhra: replace emSign/eMudhra certificates before Microsoft removes the roots.

KEV deadlines (federal due dates; a priority signal for everyone)