Cybersecurity Briefing – Friday, Nov 13, 2026

Qilin added The University of Texas at Arlington (site listed: library.uta.edu) to its leak site; ransomware.live logged it Nov 12 06:50 UTC. Unconfirmed: no UTA statement found, and no data volume, data types, or entry vector disclosed. This listing was not in Thursday’s briefing.

Action: UT System and peer institutions: watch for UTA notices; review exposure of library and other public-facing systems.

ransomware.live →

BYOD claims it stole Medicaid, SNAP, TANF, disaster-assistance and banking data on about 2 million Texans from the Texas Health and Human Services Commission. No samples posted; entry method not stated. As of this morning the HHSC newsroom shows no statement (newest item Nov 10). Treat as alleged.

DataBreach.com →    Texas HHSC newsroom →

An attacker used multiple cloud-hosted ScreenConnect panels to push attacker-controlled ScreenConnect clients to at least 288 computers across 48 organizations in about 90 minutes (Huntress count). Victim organizations not publicly named. Huntress traced activity to the third-party RMM+ extension, whose shared key defaulted to blank in versions 1.0.31 and 1.0.32; ConnectWise disabled five third-party extensions in about 400 partner environments and says its own systems and ScreenConnect itself were not compromised. Link to CVE-2026-84869 is disputed (Blackpoint says yes; Huntress suspects stolen credentials or hijacked sessions). Actor not attributed.

Action: MSPs and ScreenConnect customers: audit installed extensions (RMM+, Labtech Plus, RMM Plus and variants), hunt for unexpected ScreenConnect clients, rotate technician credentials.

CyberScoop →    The Record →

Since about Nov 10, an unnamed actor used stolen GitHub tokens to open “docs: dependency audit notes” probe PRs in 61,764 repositories, then pushed a secret-stealing script via workflow injection, npm install hooks or throwaway branches. Aikido counts at least 1,835 repositories that ran the payload and leaked secrets; the script exchanges GitHub OIDC tokens for AWS, Azure and GCP sessions and plants persistence. Compromised accounts belong to Fortune 100 organizations (unnamed), the US General Services Administration, the French government, Nextcloud and WebdriverIO (per BleepingComputer; those organizations have not confirmed data loss). Tainted packages: Packagist digitalelvis/neuronai-studio 3.14.3; Go github.com/onuragtas/docker-env v1.0.278 and v1.0.280.

Action: Search your orgs for PRs titled “docs: dependency audit notes”, review recent workflow changes and deleted runs, rotate Actions secrets and cloud OIDC trust policies.

Aikido →    BleepingComputer →

A researcher published an unauthenticated root RCE chain (4EverAble2Shell) and 10+ Windows Agent/Probe issues (Agent2Shell, two giving SYSTEM on endpoints), both stated to work against N-central 2026.4 HF2 released Nov 10. N-able says the server chain requires the Legacy API to be enabled and internet-exposed and that hosted environments are not vulnerable. Huntress has not observed exploitation in partner environments; a BleepingComputer headline says exploitation began hours after the PoC, which this briefing could not verify. No victims named. Censys counted 1,728 internet-exposed N-central instances.

Action: On-prem N-central: disable or block the Legacy API now; Huntress advises taking servers offline or off the internet until N-able issues a fix.

Huntress →

DOJ obtained court authorization to seize or restrain more than $1.2 billion of crypto stolen from Binance in last month’s theft (reported at $6.3 billion), part of $2.7 billion frozen across platforms. Binance and the FBI attribute the theft to North Korea’s TraderTraitor. DOJ/FBI also disrupted cloud infrastructure behind FaceStealer, a social-engineering campaign the FBI ties to APT38, which stole more than $400 million over 18 months, including from npm and Rust crate maintainers. Whether FaceStealer was used in the Binance breach is unconfirmed.

The Record →

CloudSEK found an exposed attacker server holding stolen documents and logs of a Hermes AI agent (DeepSeek models) used for recon, collection and log wiping. Named targets: Tajikistan’s national railway (access mid-Aug to early Oct), national electronic document management platform, Defense Ministry (thousands of documents), National Guard, State Committee for National Security and State Investment Committee; a server supporting Uzbekistan’s “Smart Forestry” initiative; and lures aimed at Turkmenistan (success unknown). CloudSEK links the group to Kazakhstan with medium confidence; no link to the Kazakh government is established.

CloudSEK →    The Record →

Threat emails hit thousands of Italian state schools (evacuations from Milan to Sicily) and about 1,000 Scottish schools on Nov 11, with more in Northern Ireland and the Republic of Ireland, and another wave against Italian schools on Nov 12 using a Philippines Department of Education address. Senders used hijacked legitimate accounts, including one at Taiwan’s Da-Yeh University; Bogotá’s city health agency is investigating a possible hack. Police call the threats hoaxes. Ireland’s government calls it a likely coordinated campaign; Proofpoint says it could fit a nation-state-aligned actor but no attribution has been made.

The Record →

Root privilege escalation in the DynamicCLI IPC interface (root daemon on a world-writable socket), exploited since late October against “a couple of dozen customers” (not named). Check Point Research: attackers entered through the Mobile Access portal via PHP2Shell (CVE-2026-109618 / CVE-2026-109619), escalated to root, installed TSGA and TSProxy backdoors, pivoted to VMware ESXi and ran the destroy_v6 wiper. First wave Oct 30 hit unnamed Israeli organizations; second wave Nov 2 hit multiple countries. Loose link to PhiliKit (UNC5221 per ESET), low confidence.

Action: Apply Check Point hotfixes (sk1000362); until then stop dynamic_server and prevent restart; hunt using CPR IOCs.

Check Point Research →    BleepingComputer →

Barracuda Email Security Gateway auth bypass CVE-2026-116606 and Barracuda command injection CVE-2026-111560 are due TODAY for federal agencies. Due Nov 24: Microsoft Outlook zero-day CVE-2026-124194 (NTLM hash leak, fixed in Patch Tuesday), Chrome CVE-2026-125350, Cisco BroadWorks CVE-2026-20320, Openwave Webtop CVE-2026-111793. Exploitation victims not named. No new KEV additions dated Nov 12–13 could be verified this morning because CISA’s alert pages did not load; details here are from SecurityOnline and Qualys.

SecurityOnline →    Qualys →

1. ransomware.live – UT Arlington (Qilin)
2. DataBreach.com – BYOD claims Texas HHSC breach
3. Texas HHSC – newsroom
4. CyberScoop – ScreenConnect SCKit attack
5. The Record – ConnectWise investigates ScreenConnect breaches
6. Aikido – wfx-loot GitHub campaign
7. BleepingComputer – 4,800 GitHub accounts compromised
8. Huntress – N-able Able2Shell
9. The Record – Binance seizure, FaceStealer
10. CloudSEK – Silent Lynx exposed server
11. The Record – Kazakhstan-linked hackers used AI agent
12. The Record – Hijacked email accounts, European hoaxes
13. Check Point Research – PHP2Shell exploitation
14. BleepingComputer – Check Point zero-day
15. SecurityOnline – CISA adds six KEVs
16. Qualys – November 2026 Patch Tuesday