PHP2Shell Attacks on Check Point Gateways Deploy TSGA, ESXi Wiper
November 13, 2026
Attackers chained PHP2Shell flaws with a new Gaia OS root bug, CVE-2026-123039, to install the TSGA backdoor on Check Point
Endpoint Security
PHP2Shell Attacks on Check Point Gateways Deploy TSGA, ESXi Wiper
Attackers chained PHP2Shell flaws with a new Gaia OS root bug, CVE-2026-123039, to install the TSGA backdoor on Check Point gateways and wipe ESXi hosts.
Operation Endgame Seizes 235 Servers Tied to Gootloader, StealC
Europol-led Operation Endgame seized 235 servers and 257 domains tied to Gootloader, CastleRAT and StealC, exposing 6.4 million stolen credential datasets.
Google Cloud Warns of AMD Turin CPU Flaws Leaking Data in VMs
Google Cloud says three Transient Scheduler Attack flaws affect AMD EPYC Turin CPUs and can leak data between processes inside a VM, rated Medium severity.
Attackers Hijack ScreenConnect at MSPs as ConnectWise Cuts Extensions
Huntress says attackers abused ScreenConnect Run Command at MSPs to push rogue clients and the SCKit toolkit; ConnectWise disabled five extensions at partners.
Zoom Patches Critical Workplace for Windows Flaw CVE-2026-108187
Zoom fixed two Workplace for Windows privilege-escalation flaws, CVE-2026-108187 and CVE-2026-108186, on November 11; the company reports no exploitation.
Public Exploit Released for Linux Kernel AF_UNIX Flaw CVE-2026-80521
Google kernelCTF published a working exploit for CVE-2026-80521, a CVSS 7.8 Linux kernel AF_UNIX use-after-free that gives any local user root access.
Microsoft Patches Outlook Zero-Day CVE-2026-124194 in 1,000+ Fixes
Microsoft's November Patch Tuesday fixed more than 1,000 flaws and an exploited Outlook zero-day, CVE-2026-124194, that leaks NTLMv2 hashes to attackers.
Public iOS Sandbox Escape ‘worse_query’ Threatens Wallet Keys
A public iOS exploit named worse_query could expose crypto seed phrases and private keys from other apps; Binance warned users and Apple has confirmed no ...
Apple iOS 27.2.1 Fixes iMessage Group Chat and Bluetooth Flaws
Apple's iOS 27.2.1 patches iMessage group chat flaws CVE-2026-113961 and CVE-2026-113960 plus nine Bluetooth and AirPlay pairing bugs; no exploitation known.
Ivanti Patches Critical EPM SQL Injection and CSA Auth Flaw
Ivanti's November advisories fix 13 flaws, including a CVSS 9.8 Endpoint Manager SQL injection and a CVSS 9.4 Cloud Services Application authentication flaw.
Operation Endgame Seizes 235 Servers Tied to Gootloader, StealC
November 13, 2026
Europol-led Operation Endgame seized 235 servers and 257 domains tied to Gootloader, CastleRAT and StealC, exposing 6.4 million stolen credential
Google Cloud Warns of AMD Turin CPU Flaws Leaking Data in VMs
November 13, 2026
Google Cloud says three Transient Scheduler Attack flaws affect AMD EPYC Turin CPUs and can leak data between processes inside
Attackers Hijack ScreenConnect at MSPs as ConnectWise Cuts Extensions
November 12, 2026
Huntress says attackers abused ScreenConnect Run Command at MSPs to push rogue clients and the SCKit toolkit; ConnectWise disabled five
Zoom Patches Critical Workplace for Windows Flaw CVE-2026-108187
November 12, 2026
Zoom fixed two Workplace for Windows privilege-escalation flaws, CVE-2026-108187 and CVE-2026-108186, on November 11; the company reports no exploitation.
Public Exploit Released for Linux Kernel AF_UNIX Flaw CVE-2026-80521
November 12, 2026
Google kernelCTF published a working exploit for CVE-2026-80521, a CVSS 7.8 Linux kernel AF_UNIX use-after-free that gives any local user
Microsoft Patches Outlook Zero-Day CVE-2026-124194 in 1,000+ Fixes
November 11, 2026
Microsoft’s November Patch Tuesday fixed more than 1,000 flaws and an exploited Outlook zero-day, CVE-2026-124194, that leaks NTLMv2 hashes to
Public iOS Sandbox Escape ‘worse_query’ Threatens Wallet Keys
November 11, 2026
A public iOS exploit named worse_query could expose crypto seed phrases and private keys from other apps; Binance warned users
Apple iOS 27.2.1 Fixes iMessage Group Chat and Bluetooth Flaws
November 11, 2026
Apple’s iOS 27.2.1 patches iMessage group chat flaws CVE-2026-113961 and CVE-2026-113960 plus nine Bluetooth and AirPlay pairing bugs; no exploitation
Ivanti Patches Critical EPM SQL Injection and CSA Auth Flaw
November 11, 2026
Ivanti’s November advisories fix 13 flaws, including a CVSS 9.8 Endpoint Manager SQL injection and a CVSS 9.4 Cloud Services
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.