CyberNews: 13/11/2026 Edition

New N-able "4EverAble2Shell" zero-day exploited hours after PoC released

Exploited Vulnerability Malware bleepingcomputer.com

Threat actors are actively exploiting a newly disclosed N-able N-central zero-day vulnerability dubbed '4EverAble2Shell' hours after a PoC was released. Attackers are using the flaw to compromise servers and deploy cryptocurrency miners. Researchers report at least 21 affected systems, including 19 running N-able's latest security update.

Feds announce seizure of $1.2 billion from Binance theft; also takedown of ‘FaceStealer’ tools

Law & policy APT therecord.media

The Department of Justice and FBI announced two separate actions in response to North Korea-linked cryptocurrency theft operations. Authorities announced the seizure of $1.2 billion from a Binance theft and the takedown of 'FaceStealer' tools.

Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins

Law & policy Malware Ransomware thehackernews.com

An international police operation called Operation Endgame took down servers behind the Gootloader, CastleRAT, and StealC malware tools this week. Criminals used the three tools to access computers, steal passwords, and launch ransomware attacks. According to Germany's Federal Criminal Police Office (BKA), police also seized about 6.4 million stolen logins belonging to more than 40,000 victims.

SilentAir Hijacks Asian Telecom Networks to Intercept SMS 2FA Codes and Spy on Taiwanese Users

APT thehackernews.com

Stockholm-based telecom and cybersecurity company Enea identified a new spying group named 'SilentAir' that used hacked equipment inside Asian mobile operators to intercept calls, texts, and SMS 2FA codes of selected people, mostly in Taiwan. Enea found the group's attack sources in at least six Asian countries. The company assessed with high confidence that SilentAir is a state-level actor.

Unpatched Check Point Gateways Are Being Wiped exploiting PHP2Shell

Exploited Vulnerability Malware securityaffairs.com

• CVE-2026-109618 High
• CVE-2026-109619 Critical
• CVE-2026-123039 High

Check Point Research reported that unpatched Check Point Security Gateways were compromised in attacks starting on 30 October from the IP address 130.94.19[.]204, about a week after a security fix became available. Attackers exploited Mobile Access portals using PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 before escalating to root privileges via CVE-2026-123039 in the DynamicCLI IPC interface. In an initial wave hitting Israeli organizations, some victims suffered destructive wiper attacks, while a second wave on 2 November reached organizations in several countries without signs of destruction, with intruders deploying PHP webshells, the TSGA backdoor, and a network-monitoring tool called TSProxy.

New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks

Malware Supply chain bleepingcomputer.com

A new worm-like malware toolkit named 'SCKit' was deployed in recent ScreenConnect attacks targeting managed service providers (MSPs). The malware is designed to spread from infected customer devices to MSP technicians' computers in order to compromise additional managed networks.

Police arrest 354 suspects in dark web cybercrime crackdown

Law & policy bleepingcomputer.com

Authorities arrested 354 suspects in a joint international operation targeting dark web cybercrime. The crackdown focused on vendors and buyers on the Archetyp, Nemesis, Tor2Door, Bohemia, and Kingdom dark web marketplaces.

Extortion Group Luna Moth Flits Into Law Firms a Second Time

Ransomware darkreading.com

The extortion group Luna Moth is retargeting law firms that refused to pay its first ransom demand. The cybercriminals are conducting a social engineering con aimed at stealing Microsoft access tokens.