CyberNews: 14/11/2026 Edition

U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog

Exploited Vulnerability securityaffairs.com

• CVE-2026-114713 High
• CVE-2026-123039 High
• CVE-2026-109618 High
• CVE-2026-109619 Critical

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added vulnerabilities in UnrealIRCd (CVE-2026-114713) and Check Point products (CVE-2026-123039) to its Known Exploited Vulnerabilities catalog. CVE-2026-114713 has a CVSS score of 8.6 and enables command injection in UnrealIRCd versions from 6.0.0 up to, but not including, 6.2.7.1, with the maintainer confirming exploitation attempts shortly after disclosure. CVE-2026-123039 has a CVSS score of 7.8 and is being actively exploited alongside PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 to escalate to root privileges on Check Point gateways and deploy webshells, the TSGA backdoor, and the destroy_v6 wiper on VMware ESXi hosts.

PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE

Vulnerability thehackernews.com

• CVE-2026-6460 High

PostgreSQL released updates patching 52 security flaws, including a 22-year-old type confusion bug tracked as CVE-2026-6460 with a CVSS score of 8.8. The vulnerability allows a database user who can create objects to execute code on the server. Full protection against CVE-2026-6460 also requires rebuilding any C-language extensions installed on the server.

Gootloader Malware Disrupted After Infecting 25,000 Computers

Law & policy Malware Ransomware securityaffairs.com

The U.S. Department of Justice and international law enforcement partners under Operation Endgame disrupted the Gootloader malware by removing it from more than 100 computer servers, including compromised WordPress sites, and seizing U.S. domain names. Since 2018, Gootloader has infected at least 25,000 computers worldwide and sold access to ransomware groups, leading to attacks on at least 44 U.S.-based victims and approximately $28.8 million in losses. Victims included the Department of War and the Defense Industrial Base, with the malware used to deliver threats such as SunCrypt and REvil ransomware, Kronos trojans, and Cobalt Strike.

FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls

APT thehackernews.com

The U.S. Federal Bureau of Investigation (FBI) established that North Korean threat actors stole more than $400 million in cryptocurrency over the last 18 months through a social engineering scheme codenamed 'FaceStealer' that used deepfake video calls. The finding was shared as part of a coordinated set of actions announced by the U.S. government.

New Mior and Skyfall Attacks Let Rogue Cloud Hosts Steal Secrets From AMD SEV-SNP VMs

Vulnerability thehackernews.com

Researchers disclosed two attacks named Mior and Skyfall that allow a rogue server host to read data inside AMD SEV-SNP-protected virtual machines. Both attacks require control of the server's hypervisor, while Mior also requires control of the BIOS and can modify a VM's memory as well as fake the signed report verifying what software it runs.

Trezor Confirms Hidden Implants in CryptoBilis-Sold Wallets That Can Steal Recovery Phrases

Supply chain Malware thehackernews.com

Hardware wallet maker Trezor confirmed that three Trezor Safe 5 devices sold by reseller CryptoBilis contained a hidden hardware implant consisting of an extra circuit board. The implant reads recovery phrases from the wallet's screen and sends them over a mobile network to an attacker-controlled server. Trezor examined one of the compromised wallets in its lab.

City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents

Data breach therecord.media

The City of Osaka warned of a data breach impacting 1 million people as Japan experiences dozens of cyber incidents. Osaka, Japan's third-largest city, urged its 2.8 million residents to be cautious of suspicious emails purporting to come from the local government.

FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’

Malware therecord.media

An FBI flash alert warned that the open-source hacking tool Artex is automating cyberattacks and significantly reducing the time needed to chain attack techniques. According to the FBI, some intrusions using Artex have progressed from initial targeting to privileged access in under three hours.

German parliament passes law giving spy agencies hacking, sabotage powers

Law & policy therecord.media

Germany's Bundestag approved a bill granting the country's spy agencies hacking and sabotage powers, passing by 308 votes to 190 with 71 abstentions. Described as the biggest overhaul of Germany's spy laws in the postwar era, the measure follows draft approval months earlier by Chancellor Friedrich Merz's cabinet.