Duna's Kiat
All editions
News

CyberNews: 12/11/2026 Edition

Today’s roundup

  • PHP2Shell Exploitation on Check Point Gateway
  • ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients
  • New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access
  • New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access
  • Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories
  • Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
  • Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass
  • Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry
  • Zoom Fixes Critical Windows Vulnerability Allowing Privilege Escalation
  • WhiteArmor Demands $5 Million from Maersk, Claims Theft of 100GB of Data

    • Summary

    Threat actors exploited vulnerable Mobile Access portals on Check Point Security Gateways in late October 2026, targeting Israeli organizations before a second scanning wave on November 2nd expanded worldwide. The intrusions involved PHP2Shell exploitation linked to CVE-2026-109618 and CVE-2026-109619, followed by local privilege escalation to root via CVE-2026-123039 in the DynamicCLI IPC interface. Once privileged, attackers deployed PHP webshells and launched the TSGA backdoor malware to establish boot persistence.

    Attacks abusing ScreenConnect environments have targeted at least 288 endpoints across 48 organizations using rogue clients. Following reports of unauthorized access, ConnectWise disabled five third-party extensions in partner environments as a precaution and stated there is no evidence of a compromise of its infrastructure or a vulnerability in the ScreenConnect software.

    N-able announced it is investigating a public disclosure claiming new exploits enable root remote code execution and Windows SYSTEM access against patched on-premise N-central servers running version 2026.4.1 HF2. Based on its initial review, the company stated the reported server issue depends on a non-default configuration in which the Legacy API is enabled and exposed to the public internet.

    Public zero-day exploit code called SignDrop claims to allow a local Windows user to escalate to SYSTEM privileges through the Common Log File System driver, clfs.sys. The exploit targets a log-authentication feature added to the driver last year by abusing how clfs.sys creates companion files via path redirection when a privileged process opens a prepared log.

    According to Aikido Security, an attacker used stolen credentials for 4,837 hijacked GitHub accounts to plant a secret stealer across repositories to which those accounts had write access. The stealer executed in at least 1,806 repositories to collect secrets and cloud credentials accessible to CI workflows.

    A critical flaw in the Apache HTTP Server HTTP/2 module mod_http2, tracked as CVE-2026-119618, could allow unauthenticated remote attackers to execute code on affected servers. The vulnerability impacts versions 2.4.55 through 2.4.70 when HTTP/2 is enabled and is patched in version 2.4.71.

    Citrix has released security patches for 12 flaws affecting NetScaler and Secure Access Client products, including critical vulnerabilities in NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console that could lead to denial-of-service or authentication bypass. Among the critical issues impacting NetScaler ADC and NetScaler Gateway is CVE-2026-120868, a memory overflow vulnerability carrying a CVSS score of 9.3.

    Red Hat disclosed a critical flaw in Red Hat Quay that allows an attacker with registry access to read and overwrite private container images across every repository. Exploitation requires no account when Quay's default anonymous access is enabled, and any valid user account can exploit the issue when anonymous access is disabled, with Red Hat releasing fixed builds to address the vulnerability.

    Zoom has patched two privilege escalation vulnerabilities in Zoom Workplace for Windows that could allow unauthenticated attackers to remotely gain higher privileges without an account. The flaws are tracked as CVE-2026-108186, with a CVSS score of 9.6 affecting versions from 7.1.0 up to 7.1.8, and CVE-2026-108187, with a CVSS score of 8.1 affecting releases earlier than 7.1.5.

    Shipping giant A.P. Moller Maersk disclosed on November 11 that an attacker accessed and extracted data from an isolated local legacy system inherited from a previous acquisition, though the company stated findings so far strongly suggest no sensitive data was disclosed and no other systems were affected. The cybercrime group WhiteArmor claimed responsibility on its Tor leak site, demanding a $5 million Bitcoin ransom within 30 days. WhiteArmor alleges it stole about 100 GB of data from the OCF/LF Logistics platform, including nearly 30,000 driver records, 33 super admin accounts, and 27,842 mobile device logs, though these claims have not been independently verified.

    Want to dig deeper?

    Vulnerabilities

    CVE-2026-109618 High
    CVE-2026-109619 Critical
    CVE-2026-123039 High
    CVE-2026-119618 Critical
    CVE-2026-120868 TBD
    CVE-2026-108186 High
    CVE-2026-108187 High