DanSec

Cybersecurity Brief · Thursday 12 November 2026

Poland's ePUAP platform downed by a cyberattack, Maersk confirms a breach with a $5m WhiteArmor demand, and Apache HTTP/2 RCE CVE-2026-119618 is fixed.

In this brief Poland, Maersk, Apache, X, Crédit Mutuel Arkéa, Git, +54 more
Vendors
Poland, Maersk, Apache, X, Crédit Mutuel Arkéa, Git, ConnectWise, eMudhra, Grok, Railway, Wyndham, Baker Tilly, Fullerton Health, N-able, Microsoft, Zoom, Fortinet, Ivanti, Siemens, Qlik, Linux, Anthropic, GitHub, ScreenConnect, Red Hat, AWS, ASUS, Citrix, Schneider, Phoenix Contact, Alibaba, Vates
Threat actors
WhiteArmor, Qilin, Citrus, Remus, Toy Ghouls
CVEs
CVE-2026-119618, CVE-2026-125883, CVE-2026-124194, CVE-2026-108186, CVE-2026-105425, CVE-2026-111760, CVE-2023-41265, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882, CVE-2026-91000, CVE-2026-108187, CVE-2026-113408, CVE-2026-114467, CVE-2026-114469, CVE-2026-105437, CVE-2026-114466, CVE-2023-41266, CVE-2023-48365, CVE-2023-46604, CVE-2024-40711

Exploited: Patch Now

CVEPublishedProductIssueFix
No CVE yetVates Xen OrchestraMalicious VM import zero-day allowing XCP-ng host compromise[1]No patch yet; fix in development

Major Incidents and Breaches

  • Poland shut down ePUAP, its nationwide government services platform for submitting official documents, communicating with agencies and completing administrative procedures online, following a cyberattack.[2]
  • Maersk confirmed unauthorised access to and data extraction from a local legacy system inherited through an earlier acquisition. It says it strongly suspects the attack was limited to that system and that nothing sensitive is at risk; the WhiteArmor ransomware gang claims to have stolen 100GB and is demanding $5 million.[3][4][5]
  • Update Crédit Mutuel Arkéa says hackers stole around €100 million ($112.6 million) in the cyber heist and it is working to recover the money. (first reported 2026-11-06)[6]
  • Aikido Security said an attacker used stolen credentials for 4,837 GitHub accounts, starting on Tuesday, to plant a secret stealer in repositories those accounts could write to. It ran in at least 1,806 repositories, harvesting secrets and cloud credentials reachable by their CI workflows.[7]
  • ConnectWise is investigating a campaign that uses compromised MSP ScreenConnect environments to push rogue remote-access clients to at least 288 endpoints across 48 organisations. It has disabled five third-party extensions in partner environments and says there is no evidence of an infrastructure compromise or a ScreenConnect vulnerability.[8][9]
  • eMudhra revoked eight more intermediate CA certificates it had previously declared unaffected by its October key compromise. The cause is improper private key handling in the in-house Python script it wrote to generate certificates when it could not obtain the hardware it needed.[10][11][12]
  • Claroc found 35,578 of 37,571 active Grok-built apps on the grok.me domain open to anyone without sign-in, including 24 built by staff at X and the Grok maker. About one in ten contained internal business data, with some leaking confidential data and passwords.[13][14]
  • Update Railway said the AI provider keys were stolen in an October breach and has promised to pay the estimated $740,000 in unauthorised usage charges itself where AI providers will not refund them. (first reported 2026-11-11)[15]
  • Wyndham acknowledged a cybersecurity incident after a good-faith researcher found an app security lapse exposing customer data.[16]
  • The Victorian Curriculum and Assessment Authority website was defaced by a hacker who claims to have obtained and distributed this year’s Year 12 exam papers, throwing the exams into turmoil.[17]
  • Cranbury, a New Jersey town of about 4,000 people, lost $26 million in a cyber heist.[18]
  • Accounting firm Baker Tilly is notifying clients that a breach at a third-party provider compromised personal information about them and their dependents, and is offering 24 months of credit and identity monitoring.[19]
  • Fullerton Health said unauthorised access to a server supporting Singapore’s Migrant Worker Primary Care Plan programme appears to have affected migrant workers’ personal data.[20]
  • New Plymouth School District in Idaho cancelled classes at all three of its schools after detecting a cyber threat on its network.[21]
  • Have I Been Pwned added a 2013 breach of the Russian-language cybercrime forum YouHack, containing 7.2 million unique email addresses. About 107,000 belong to forum members; the rest come from credentials members posted about other victims.[22]

Vulnerabilities and Patches

  • Apache fixed critical RCE CVE-2026-119618 in the mod_http2 module of HTTP Server 2.4.55 to 2.4.70 (and standalone mod_h2 2.0.8 to 2.0.42). It affects only servers with HTTP/2 enabled, is fixed in 2.4.71 with no workaround offered, and Red Hat has shipped fixes for RHEL 9 and 10.[23]
  • Update A second Xen Orchestra zero-day, allowing malicious VM imports that can compromise XCP-ng hosts, is being exploited alongside the authentication bypass, and a fix is still being developed. (first reported 2026-11-11)[1]
  • Update N-able released N-central 2026.4 Hotfix 2 (build 2026.4.1.26) for seven CVEs covering the Able2Shell flaws (CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882, CVE-2026-91000), which temporarily disables built-in remote control. Attackers are scanning for vulnerable systems but no exploitation has been seen, and more updates are planned. (first reported 2026-11-10)[24][25][26]
  • Update The exploited Outlook zero-day CVE-2026-124194 can expose NTLMv2 hashes and affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. Office updates must be checked separately from Windows updates, and revised counts put November’s total at between 1,235 and 1,259 CVEs. (first reported 2026-11-11)[27][28][29]
  • Zoom fixed two flaws in Zoom Workplace for Windows, including CVE-2026-108186 (CVSS 9.6), an unauthenticated privilege escalation, and CVE-2026-108187; both are fixed in 7.1.8 and later. ASUS disclosed four high- and medium-severity flaws in some router firmware.[30][31]
  • Fortinet patched nearly 100 vulnerabilities after integrating frontier AI models into its product security testing. The batch includes critical fixes for FortiMail (the largest share), FortiAuthenticator, FortiOS, FortiManager, FortiAnalyzer, FortiSASE and FortiClient, plus nearly 80 high-severity bugs.[32]
  • Ivanti fixed 13 flaws across five products, including critical bugs in Cloud Services Application (fixed in 5.0.8.1) and Endpoint Manager (2024 SU8), and Sentry RCE CVE-2026-105425, also fixed in EPMM. Citrix patched the remainder of 19 vulnerabilities.[33]
  • Siemens published nine ICS advisories covering 10 vulnerabilities plus Node2Shell exposure, with patches unavailable for several products and some versions not getting fixes. Schneider Electric issued one advisory and Phoenix Contact published PHP2Shell impact and PLCnext advisories.[34]
  • Update The Git releases fixing CVE-2026-111760 also fix five further flaws (CVE-2026-113408, CVE-2026-114467, CVE-2026-114469, CVE-2026-105437, CVE-2026-114466). They include a path traversal via an unvalidated HEAD symbolic reference when cloning an empty repository over protocol v2, and a stack overflow triggered by crafted merge input. (first reported 2026-11-11)[35]

Threat Actor Activity

  • Krebs reported that operational security mistakes over a decade point to a 36-year-old man in St Petersburg as administrator of Qilin, which has claimed at least 365 victims in the past three months.[36]
  • Kaspersky detailed the Citrus ransomware group, which uses VLESS traffic tunnelling, Sn00py for encryption and LLMs to assist attacks, and linked it to Toy Ghouls.[37]
  • Attackers are hosting self-managed instances of the open-source agentic pentesting platform AntiFox on Alibaba Cloud to target web services, steal AWS credentials including production secrets, and pivot laterally. AWS said its services were not compromised.[38][39]
  • Unit 42 uncovered Falcon C2, a browser-based framework targeting governments via malicious scripts, browser extensions and the Antino implant.[40]
  • Cynet saw attackers try, unsuccessfully, to deliver PowerShell reverse shells to Qlik Sense servers of several EU customers in October via 2023 flaws (CVE-2023-41265, CVE-2023-41266, CVE-2023-48365). They also staged exploits for ActiveMQ CVE-2023-46604 and Veeam CVE-2024-40711.[41]
  • A US indictment alleges an Iran-backed network directed attacks over FaceTime on Jewish and American sites, including synagogues in Belgium, the Netherlands and London and US bank buildings in Amsterdam and Paris.[42]
  • A Chinese Communist Party big data project scrapes information on individuals abroad to identify potential intelligence targets in Taiwan’s chip industry.[43]
  • Microsoft warned that attackers deploy GSocket on compromised Linux servers, notably at academic institutions, to keep encrypted remote access that survives patching of the exploited application, and advises hunting for and removing the relay client and its persistence.[44]
  • Flare reported that Linux eBPF rootkit source code, tutorials and exploits are spreading on underground forums; mitigations include setting kernel.unprivileged_bpf_disabled=1 and limiting CAP_BPF and CAP_NET_ADMIN.[45]
  • Developers of the Remus infostealer claim it can keep access to a victim’s Gmail account even after a password reset.[46]
  • Over one October week an online marketplace received 414,210 sign-in attempts from a credential stuffing operation impersonating a widely used consumer AI agent, outnumbering genuine agent traffic.[47]
  • Microsoft FORGE Lab’s MDASH AI tooling produced 26,502 raw Linux kernel findings in two weeks, which after months of expert work became 59 bug reports, 33 CVEs, 38 merged fixes and eight working root exploits.[48]
  • VulnCheck’s Patrick Garrity found Anthropic’s Project Glasswing has reported 37,966 vulnerabilities but only 217 have been fixed, with just 15 of 4,613 findings added since September marked fixed.[49]
  • The SANS 2026 ICS/OT survey of 696 practitioners recorded the largest single-year jump in OT incidents, affecting a third of industrial organisations, while every responding CISO said plants would keep running through a full IT compromise.[50][51]
  • Funding rounds: Bay raised $50 million for an AI agent control plane, Dreeze emerged with $33 million for cloud application recovery, and Finite State raised a $27 million Series C for device firmware security.[52][53][54]

Policy and Regulation

  • The UK and France published the first guidelines for commercial cyber intrusion capability firms, calling on businesses that develop, sell or finance them to vet customers, build technical safeguards against misuse and monitor and report abuse.[55]
  • The NCSC launched a Cyber Adversary Simulation scheme for critical organisations to test their defences using trusted providers.[56]
  • Update Japan’s emergency cybersecurity package adds public-private cyber responders and an AI-focused team run by the economic ministry, and gives more leeway to use the government’s new active cyber-defence powers. (first reported 2026-11-07)[57]

Sources

  1. Critical Xen Orchestra Flaws Exploited in Attacks - securityweek.com
  2. Poland shuts down government services platform ePUAP following cyberattack - therecord.media
  3. Maersk confirms data breach as WhiteArmor ransomware demands $5 million - bleepingcomputer.com
  4. Shipping giant Maersk probes 'IT security incident,' data theft - theregister.com
  5. WhiteArmor Demands $5 Million from Maersk, Claims Theft of 100GB of Data - databreaches.net
  6. French bank Credit Mutuel Arkea says €100m missing after cyberattack - databreaches.net
  7. Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories - thehackernews.com
  8. ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients - thehackernews.com
  9. Active ScreenConnect attacks breach MSPs, impact dozens of organizations - bleepingcomputer.com
  10. eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise - thehackernews.com
  11. eMudhra revokes 8 more CA certificates after private key mishap - bleepingcomputer.com
  12. Disgraced former CA eMudhra blames buggy script for hopelessly weak certificates - theregister.com
  13. Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords - thehackernews.com
  14. Grok’s security blind spot exposed users and Musk’s company secrets - databreaches.net
  15. Railway Says Stolen Customer AI Keys Led to $740,000 in Estimated Unauthorized Usage Charges - thehackernews.com
  16. Hotel giant Wyndham exposed customer data after app security lapse - databreaches.net
  17. AU: Hacker claims to have sold stolen exams to students — but marked them for identification purposes? - databreaches.net
  18. The $26 Million Cyber Heist Rocking a Small New Jersey Town - databreaches.net
  19. Baker Tilly notifies clients of data breach at third-party provider - bleepingcomputer.com
  20. SG: Fullerton Health server hit by cyberattack; personal data of migrant workers affected - databreaches.net
  21. Cyber threat prompts New Plymouth School District in Idaho to cancel classes - databreaches.net
  22. 2013 breach at Russian cybercrime forum resurfaces with millions of victims’ credentials - databreaches.net
  23. Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely - thehackernews.com
  24. N-able releases security hotfixes for zero-day vulnerabilities - bleepingcomputer.com
  25. N-able Takes N-central Platform Offline After Discovery of 33 Flaws - darkreading.com
  26. N-able Rushes Out N-central Fixes After 33 Zero-Days Go Public - infosecurity-magazine.com
  27. Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes - thehackernews.com
  28. Microsoft Fixes 1235 Flaws in Another Record Patch Tuesday - infosecurity-magazine.com
  29. Microsoft Patch Tuesday fixes Outlook flaw already under attack - malwarebytes.com
  30. Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation - thehackernews.com
  31. Asus, Zoom Release Security Patches - securityweek.com
  32. Fortinet Patches Nearly 100 Vulnerabilities - securityweek.com
  33. Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities - securityweek.com
  34. ICS Patch Tuesday: Siemens Flags High-Severity Flaws, Node2Shell Exposure - securityweek.com
  35. Git fixes six vulnerabilities, including code execution during recursive clones - helpnetsecurity.com
  36. Who Runs the Ransomware Group Qilin? - krebsonsecurity.com
  37. Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand - securelist.com
  38. AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets - thehackernews.com
  39. Hackers use AntiFox AI agents in AWS credential-theft attacks - bleepingcomputer.com
  40. The XG Files: Falcon C2 Flying Under The (Browser) Radar - unit42.paloaltonetworks.com
  41. Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits - thehackernews.com
  42. Iran-backed network directed London attacks over FaceTime, US prosecutors say - therecord.media
  43. Chinese AI Project Scouts Spies in Taiwan Chip Industry - darkreading.com
  44. The global socket: how threat actors are weaponizing GSocket for stealthy C2 - microsoft.com
  45. eBPF Rootkits: Why Underground Actors Are Taking Notice - bleepingcomputer.com
  46. Remus malware claims Gmail access even after you change your password - malwarebytes.com
  47. Bots pose as AI agents, AI agents pose as humans, and defenses believe both - helpnetsecurity.com
  48. Lessons from 59 Linux Kernel Bug Reports - microsoft.com
  49. Anthropic's Glasswing Finds Many Vulnerabilities Yet Delivers Few Fixes, Researcher Says - infosecurity-magazine.com
  50. OT Incidents Hit a Third of Industrial Organizations, SANS Finds - infosecurity-magazine.com
  51. CISOs say OT will survive a cyberattack, but their engineers aren’t so sure - helpnetsecurity.com
  52. Finite State Raises $27 Million to Secure Software and Firmware in Connected Devices - securityweek.com
  53. Bay Raises $50 Million to Control What Enterprise AI Agents Can Do - securityweek.com
  54. Dreeze Emerges From Stealth With $33M to Rebuild Cloud Apps After Cyberattacks - securityweek.com
  55. Britain, France set out first guidelines for commercial hacking firms - therecord.media
  56. NCSC scheme will help critical organisations test their cyber defences - ncsc.gov.uk
  57. Japan Pushes Emergency Funding for Cybersecurity as AI-Assisted Breaches Rise - darkreading.com