Cybersecurity Briefing – Thursday, Nov 12, 2026

Nothing new to report.

Researcher Sean Bales publicly posted 33 alleged critical flaws and proof-of-concept code for N-able’s N-central remote monitoring and management platform on Nov 9 without reporting them to N-able; he describes four exploit chains to code execution, one needing no credentials. N-able took its hosted N-central offline, told on-prem customers to keep servers offline until patched, and shipped N-central 2026.4 HF2 (build 2026.4.1.26) fixing seven CVEs (CVE-2026-125878 through -125883 and CVE-2026-91000); the hotfix temporarily disables built-in remote control. N-able said Wednesday all hosted servers were upgraded. watchTowr reported probing within 12 hours and exploitation attempts matching the PoCs against its honeypots; N-able said it had not seen active exploitation. No customer victims named. Unconfirmed: how the 7 CVEs map to the 33 issues; PoCs for all 33 remain public, so more hotfixes are expected.

Action: MSPs and IT teams on on-prem N-central: apply 2026.4 HF2 before reconnecting, restrict internet exposure, and review for new admin accounts.

Infosecurity Magazine →    Cybersecurity Dive →

Starting Nov 10 (~12:45 UTC), stolen GitHub tokens were used to open probe pull requests (61,839 per GitHub search) and push a ~1,500-line stealer (“wfx”) into GitHub Actions workflows, package.json postinstall hooks and throwaway branches. At least 1,806 repos ran the payload (likely an undercount, since cleanup deletes run logs). It harvests Actions secrets, cloud credential files, shell histories and AI-tool API keys, swaps GitHub OIDC tokens for AWS/GCP/Azure sessions, and creates persistent AWS keys and Azure federated credentials. Named tainted packages: Packagist digitalelvis/neuronai-studio 3.14.3; Go module github.com/onuragtas/docker-env v1.0.278 and v1.0.280. No organizational victims named; at least 50 hijacked users publish packages. Actor not attributed. Research by Aikido.

Action: Audit recent unexpected PRs and workflow changes, rotate CI/cloud secrets, and check for new AWS access keys or Azure federated credentials.

Cyber Security News →

Only two new US incidents with enough confirmed detail qualified in this window.

Maersk confirmed unauthorized access and data extraction from “one of our local legacy systems from a previous acquisition,” saying findings “strongly suggest no sensitive data has been disclosed,” with no impact on other systems, API/EDI integrations or operations. A group calling itself WhiteArmor claims 100GB of logistics data from the LF Logistics platform (acquired 2022), including ~30,000 driver records, 27,842 mobile device logs and plain-text passwords, and demands $5M in bitcoin. All attacker claims, the acquired business involved and the entry method are unconfirmed by Maersk.

Maersk →    Cyber Security News →

Check Point links three China-nexus clusters through a shared “Sparrow” malware framework supplied by a suspected “digital quartermaster” it calls CopperDragon, connected to FamousSparrow, Earth Estries, TropicTrooper and UAT-9244. SilentDelivery compromised legitimate government and shipping websites to push a fake Chrome “Certificate Fix” (victims mainly in Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong, Indonesia); OceanGate hit Asian critical infrastructure via internet-facing Linux servers; DarkWire targeted at least three major Latin American telecom operators plus foreign-affairs and justice bodies. Several dozen organizations affected; victims not publicly named. CopperDragon’s role is assessed, not confirmed.

Infosecurity Magazine →

Gibraltar’s government confirmed unauthorized access to its Microsoft cloud environment (Outlook, Teams, SharePoint, OneDrive) after Microsoft alerted it; the incident “originated several weeks ago,” some services were suspended Nov 6 for forensics, and UK NCSC partner experts are assisting. The government says it has seen no successful access to cloud accounts but attempts continue and are blocked; resident-records databases are on separate infrastructure. Actor and whether any data was taken are unconfirmed. Included because few new non-US incidents with named victims surfaced in the window; it was not in a prior briefing.

Vox Gibraltar →

Vates warns two critical flaws are exploited: an auth bypass (cookie authenticationToken=j:%7B%7D authenticates as the first token owner, giving admin) and a malicious VM import used with admin rights to take over XCP-ng hosts as root. Fix for the bypass: xo-server 5.213.1 (latest) / 5.211.2 (stable), i.e. Xen Orchestra 6.10.1 / 6.9.2; no fix yet for the VM-import flaw. Unnamed actor operating from 91.211.251.112:8001 and Tor; IoCs include a VM named “pivot2”, /etc/cron.d/zz-ustar*, /.ustar5, /.ustar6 and /etc/ld.so.preload. No victims named.

Action: Patch, restrict XO web access, block the listed C2 IPs, hunt for IoCs; Vates recommends a full reinstall if compromised.

Vates advisory →    SecurityWeek →

Reminder from yesterday’s briefing: CISA added both on Nov 10 with a three-day deadline under BOD 26-04. Chained, they give root on Email Security Gateway (CVE-2026-111560 also affects Load Balancer ADC, WAF, WSG, Message Archiver, WAF Control Center). Previdian logged 17 exploit attempts Nov 9–11 from 15 IPs. Victims: small number of unnamed organizations.

SecurityWeek →

Ivanti EPM SQL injection to unauthenticated RCE (CVSS 9.8), fixed in EPM 2024 SU8; Ivanti CSA missing authentication CVE-2026-121683 (CVSS 9.4), fixed in CSA 5.0.8.1. Ivanti says no evidence of exploitation. Same day: Citrix XenServer fixes (CVE-2026-102705, KB CTX697316) and Fortinet’s 89 advisories (~17 critical, incl. FortiClient “Fortinet2Shell” CVE-2026-121529), none reported exploited.

SecurityWeek →

CISA’s alert pages could not be reached this run, so any KEV additions on Nov 11 are not confirmed here.

1. Infosecurity Magazine – N-able N-central Able2Shell fixes
2. Cybersecurity Dive – N-able hotfix after PoC dump
3. Cyber Security News – 4,837 GitHub accounts hijacked
4. Maersk – IT security incident notice
5. Cyber Security News – Maersk / WhiteArmor claim
6. Infosecurity Magazine – CopperDragon Sparrow framework
7. Vox Gibraltar – Government cyber incident contained
8. Vates – VSA-2026-062 advisory
9. SecurityWeek – Xen Orchestra flaws exploited
10. SecurityWeek – Barracuda flaws exploited
11. SecurityWeek – Citrix, Ivanti patches