🔴 CRITICALCheck Point Gaia CVE-2026-123039 (local root) chained with the PHP2Shell Mobile Access flaws: attackers planted a backdoor and, in some cases, pivoted over SSH to wipe VMware ESXi hosts. Added to KEV Nov 13, federal deadline Mon Nov 16. Apply the November Jumbo Hotfix and hunt for gateway-to-ESXi SSH logins.
CISA KEV / Check Point Research / BleepingComputer
🔴 CRITICALN-able took N-central offline after 33 flaws dropped, including the "4EverAble2Shell" chain that bypassed Hotfix 2. MSPs should confirm the patched build before reconnecting and audit agent activity.
Dark Reading / BleepingComputer / SOCRadar
🟠 HIGHUnrealIRCd CVE-2026-114713 added to KEV, due Nov 16. GPUStack auth bypass CVE-2026-102895 is drawing exploit attempts — keep AI-cluster management interfaces off the internet.
CISA KEV / SANS ISC
🟡 MEDIUMRansomware: Vanderbilt University is recovering; a Belarusian cloud provider's outage disrupted customers for days. Krebs profiles who runs the Qilin group.
GovTech / The Record / Krebs
SANS diary: the "Macfinger" ClickFix campaign tricks Mac users into pasting a terminal command that installs the DownTheDRAIN infostealer.