Daily digest,
CISA Adds Six Vulnerabilities to KEV Catalog (+7 more)
Vulnerabilities
CISA Adds Six Vulnerabilities to KEV Catalog
On November 10, 2026, CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. The vulnerabilities include CVE-2026-20320 (Cisco BroadWorks), CVE-2026-111560 (Barracuda Networks), CVE-2026-111793 (Openwave Messaging), CVE-2026-116606 (Barracuda Networks), CVE-2026-124194 (Microsoft Outlook), and CVE-2026-125350 (Google Chromium). These flaws pose significant risks to federal agencies and other organizations using affected products. The vulnerabilities allow for various attack methods, including remote code execution and authentication bypass. CISA has set remediation deadlines for federal agencies, with the most urgent due by November 13, 2026. Organizations are encouraged to adopt risk-based vulnerability management practices to address these high-risk vulnerabilities.
Vulnerability · 2 sources · score 72 · CVE-2026-111560, CVE-2026-111793, CVE-2026-116606, CVE-2026-124194, CVE-2026-125350
Git Patches Vulnerabilities Allowing Code Execution
On November 10, 2026, the Git project released Git version 2.56.1 to address six security vulnerabilities, including CVE-2026-111760, which allows arbitrary code execution during recursive clones of malicious repositories. The flaw arises from an integer truncation issue that permits an attacker to replace a submodule's .git file with a symbolic link to malicious code. Other vulnerabilities addressed include path traversal issues and memory corruption risks, affecting various versions from 2.50.2 to 2.55.1. Users are urged to update their Git installations to the latest version or apply the relevant patches. GitHub has already implemented these fixes across its services, including GitHub.com and GitHub Enterprise Cloud. Git for Windows has not yet released an update based on version 2.56.1 as of the announcement date. Until patches are applied, users are advised to clone only from trusted sources and avoid recursive cloning of untrusted repositories.
Vulnerability · 3 sources · score 70 · CVE-2026-105437, CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467
SGLang RCE Exploit Compromises NEAR AI User Data
NEAR AI reported a security incident involving unauthorized access to its infrastructure due to a remote code execution vulnerability in SGLang, its open-source inference engine. The attacker accessed one inference server, allowing them to view user requests, including those in confidential mode, and to download account details for approximately 100 users. The compromised data included email addresses, names, and, for some accounts, plan and balance information. Additionally, 18 AI agents from a legacy deployment were accessed, with data such as chat history and settings being retrieved. The company has since revoked all active sessions, replaced credentials, and deployed a fix for the vulnerability. Affected users have been notified directly, and NEAR AI has restored access to its Cloud service. The vulnerability has not been assigned a CVE number yet, and there is no indication of further exploitation at this time.
Vulnerability · 3 sources · score 56 · SGLang Vulnerability
Ransomware
BYOD Ransomware Gang Breaches Texas HHSC, Exposing 2 Million Records
The ransomware group BYOD has claimed responsibility for a data breach affecting the Texas Health and Human Services Commission (HHSC), potentially compromising the records of two million Texans. The stolen data reportedly includes sensitive information such as Medicaid, SNAP, TANF, and disaster assistance records. The breach was disclosed on the gang's dark web site, which has since gone offline. Cybersecurity experts warn that the compromised data could facilitate various forms of fraud, including bank takeovers and identity theft. The HHSC serves over 7.5 million individuals monthly, raising concerns about the scale of the impact. This incident follows a previous breach in January 2025, which affected over 61,000 individuals. As of now, the HHSC has not confirmed the breach, and no data samples have been released by the attackers to substantiate their claims.
Ransomware · 2 sources · score 64 · BYOD
Ransomware Attack Exposes Patient Data at Santa Barbara Endodontics
Santa Barbara Endodontics in California suffered a ransomware attack that may have compromised sensitive patient records. The attack was identified on October 8, 2026, when the practice received a ransom note from a group identified as The Gentlemen. The practice confirmed that patient records were encrypted, and an investigation is ongoing to determine the extent of the data breach. Affected data may include names, Social Security Numbers, medical histories, and insurance information. The practice has restored records from backups without paying the ransom and is offering affected patients 12 months of complimentary credit monitoring. Additionally, Hollister Family Dental & Implant Center reported a separate incident involving unauthorized access to its third-party appointment management system, which may have exposed patient data from February to May 2026.
Ransomware · 2 sources · score 58 · The Gentlemen
Breaches
Nitori Reports Data Breach Affecting 37.6 Million Customer Records
Nitori, a leading Japanese furniture retailer, announced on November 9, 2026, that hackers accessed its systems, potentially compromising 37.62 million customer records. The unauthorized access was confirmed on November 6, and investigations suggest the breach may have occurred from mid-October. Affected data includes names, email addresses, postal addresses, and phone numbers of individual and corporate customers, but login passwords and credit card information were not compromised. Nitori has taken steps to block the attacker and is enhancing its security measures. The company has warned customers about potential phishing attacks and will notify those affected directly. Nitori has reported the incident to Japan’s Personal Information Protection Commission and other authorities.
Breach · 2 sources · score 62
Threat actors and malware
Blind Eagle Launches Phishing Campaign Targeting Latin American Organizations
The threat actor Blind Eagle, also known as APT-C-36, has initiated a new phishing campaign targeting organizations in Latin America. The campaign employs judicial and administrative-themed phishing emails to distribute a remote access trojan (RAT) related to AsyncRAT and DCRat. Attackers use weaponized Scalable Vector Graphics (SVG) files that impersonate official entities, such as Colombia's Office of the Attorney General, to bypass security measures through HTML smuggling. Once executed, the malware conducts system reconnaissance and establishes persistence on the host system. The phishing emails are tailored in Portuguese and Spanish, indicating a focus on Spanish-speaking victims. Although no confirmed compromises have been reported, the potential impact includes unauthorized access to sensitive legal and financial data. The campaign highlights the ongoing threat posed by Blind Eagle, which has been active since 2018.
APT · 2 sources · score 55 · Apt-c-36, Blind Eagle, AsyncRAT, Dcrat, APT-C-36 Operation
Also worth knowing
US Soldier Arrested in UK for Espionage Linked to Russia
A 41-year-old U.S. Army soldier was arrested near Gloucester, England, on November 10, 2026, on suspicion of espionage related to Russia. The arrest was made by British counter-terrorism police in collaboration with U.S. authorities, including the FBI. The soldier is suspected of violating sections 1 and 3 of the National Security Act 2023, which involve obtaining or disclosing protected information and assisting a foreign intelligence service. He remains in custody at a London police station while searches are conducted at two locations in Gloucestershire. FBI Director Kash Patel emphasized the seriousness of the allegations, stating that they pose a significant concern for U.S. national security and that of its allies. This incident occurs amidst heightened tensions regarding espionage activities linked to Russia and Iran in the region. The investigation is ongoing and is not connected to other counter-terrorism operations currently underway.
Other Threats · 18 sources · score 63
New on leak sites
70 victims listed on ransomware leak sites by 17 groups in the 24 hours before this issue. The most active:
Also moving
- CVEs: CVE-2026-123158, CVE-2026-125350, CVE-2026-68982, CVE-2026-0257, CVE-2026-102895
- Vulnerabilities: Sshole, XSS, Bad_query
- Ransomware groups: The Gentlemen, BYOD, BYOD Ransomware Group, Qilin, Azazel
- APT groups: Turla, APT28, APT29, Apt-c-36, Belarusian Cyber Partisans
- Malware: FomoPeek, Snake, AnnobinDoor, AsyncRAT, Btmob
- Campaigns: APT-C-36 Operation, Atlantic Bastion, Atlantic Net
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.