Cybersecurity Briefing – Wednesday, Nov 11, 2026

The BYOD ransomware gang listed Texas HHSC on its leak site (Ransomware.live logged it Nov 9, 16:50 UTC), claiming data on “2 Million Texas Citizens” including Medicaid, SNAP, TANF, disaster-assistance and banking information. The gang says it got in through a vulnerability it did not identify. Everything is unconfirmed: HHSC has not publicly confirmed an incident, the leak site was down when Cybernews checked, and no data samples have been released. BYOD (active since late Sept 2026) is the same group behind this week's Vanderbilt attack and claims against UNM Health Sciences Center and Trump Mobile. Not known to be related to HHSC's separate Jan 2025 insider-access breach.

Action: Texas agencies and contractors that exchange data with HHSC: watch for phishing that uses benefits themes, and follow HHSC's official channels for any confirmation.

Cybernews →    Ransomware.live →

Vanderbilt announced an active cybersecurity incident Monday morning and told users to shut down devices and disconnect from campus Wi-Fi; campus computers reportedly played an audio threat message attributed to BYOD. By Tuesday morning Wi-Fi, Okta, Outlook, Brightspace, Zoom and YES were cleared for use; CampusPrint stayed restricted and athletics ticketing was down. BYOD claims “over 1 million SSNs” plus names, emails and phone numbers. Vanderbilt has not confirmed the scope of data theft and says it is working with government agencies.

CyberScoop →    The Register →

Fireworks AI, an AI infrastructure provider with 10,000+ customers, updated its notice Monday: a breach discovered Oct 6 and a second incident Oct 23-24 via a third-party cloud provider hosting its R&D machines exposed account and billing information, “secrets,” invoices, payment history, and datasets/AI-related data. Fireworks attributes it to an unnamed “well-known, financially motivated cybercriminal group”; Palo Alto Networks Unit 42 is investigating. It says a “limited number” of customer accounts were affected; no count given. Notion said it disconnected from Fireworks after being notified Nov 2.

Action: Fireworks customers: rotate API keys and any secrets stored with or passed to the platform.

The Record →

A ransomware attack knocked out the network across all 66 Queens Public Library locations starting Nov 4. As of Nov 10, Wi-Fi and checkout machines are back at open branches and public computers at seven branches, but the website, mobile app and digital media services remain down. Attacker and ransom demand are unknown.

QNS →

An unknown attacker exploited a vulnerability in a registration form on a sports club's website to reach a server of AllUnited, a Noordwijk-based membership-administration vendor, and copied database contents on the evening of Nov 9. More than 350 clubs have reported it to the Dutch Data Protection Authority, which expects more. Confirmed affected include VV Katwijk, VOC Rotterdam, Nijmegen Atletiek, Haagsche Rugby Club and the national cricket federation (KNCB). Exposed data may include names, addresses, emails, phone numbers, birth dates/places, bank account numbers (IBANs) and AllUnited login credentials. Record count, attacker and motive are not known.

NL Times →

ESET reported a new Turla toolkit, “Cereal,” whose CerealBox component is embedded in a Microsoft Exchange email-processing service and uses the compromised Exchange servers themselves for command and control. In Romania it was configured to collect email exchanged with NATO and EU institutions. Victims named only as a Romanian government organization and a Kazakh government email server (first found Nov 2025); specific agencies not publicly named. Initial access method and volume stolen are undetermined.

Action: Exchange admins: review transport agents/modules loaded by Exchange services for unknown components.

The Record →

Monitoring group Deep Web Konek compiled underground claims against the Office of the Vice President, DICT, BIR, SEC, DOLE, DOTr, CICC, PCGG, Philippine Coast Guard, LTO, DILG/Barangay Central Database, Philippine Air Force, National Power Corp., Mactan Electric, LBC Express and four universities. Largest claims: DOLE 19.2M records, DILG up to 19M resident profiles, LBC Express 20.9M shipment logs (“allegedly”), LTO 292,424 entries. Groups named include DeathNote Hackers, Happy Go Lucky PH and CrimsonSec Philippines. All figures are attacker claims; the entities are still verifying.

Philstar →

Outlook spoofing flaw (CVSS 6.5) where a crafted Office file makes the target leak a valid NTLMv2 hash usable for impersonation. Microsoft says it was exploited as a zero-day; no victims or threat actor named. Part of a 1,093-CVE November Patch Tuesday that also fixes critical Exchange RCE CVE-2026-118207, AD DS RCE CVE-2026-118146, Schannel RCE CVE-2026-119952 and SharePoint EoP CVE-2026-120002 (CVSS 9.9), all not yet known exploited.

Action: Patch Outlook now; block outbound SMB/NTLM to the internet where possible.

Tenable →    SecurityOnline →

CVE-2026-116606 (CVSS 9.3) is an ESG authentication bypass allowing restore of a crafted backup; CVE-2026-111560 (CVSS 8.6) is OS command injection via a timezone field across multiple Barracuda appliances. Barracuda confirmed attacks on “a small number of organizations” (not named). Fix-version guidance for ESG is inconsistent between sources (9.4.0.029 vs 9.4.0.030); confirm with Barracuda.

Action: Update Barracuda ESG and appliances; review for unexpected backup restores.

SecurityOnline →    WindowsForum →

Cisco BroadWorks XXE in the OCI-P service (CVSS 7.5); Openwave Messaging Webtop Media Transcoder file-type restriction bypass (CVSS 4.3); Chrome use-after-free in an XML component (CVSS 8.8). Fixes for the Cisco and Openwave flaws were already available. No victims named. Federal due dates reported as Nov 13 (Barracuda) and Nov 24 (others) by one outlet, but another says CISA's alert lists no dates; unconfirmed.

Action: Update Chrome/Chromium browsers; telecom/messaging operators patch BroadWorks and Webtop.

SecurityOnline →    WindowsForum →

1. Cybernews – BYOD claims Texas HHSC records
2. Ransomware.live – Texas HHSC listing
3. CyberScoop – Vanderbilt ransomware
4. The Register – Vanderbilt audio threat
5. The Record – Fireworks AI breach
6. QNS – Queens Public Library recovery
7. NL Times – AllUnited / Dutch sports clubs
8. The Record – Turla Exchange espionage
9. Philstar – 23 Philippine sites
10. Tenable – November 2026 Patch Tuesday
11. SecurityOnline – CISA adds six KEVs
12. WindowsForum – CISA six exploited flaws