Daily digest,
Critical CVE-2026-116779 in FreeSWITCH: Active Exploitation Confirmed (+5 more)
Vulnerabilities
Critical CVE-2026-116779 in FreeSWITCH: Active Exploitation Confirmed
CVE-2026-116779 is a critical vulnerability affecting SignalWire FreeSWITCH versions up to 1.11.2, with a CVSS score of 9.8. The flaw allows unauthenticated remote code execution via crafted SIP MESSAGE requests, potentially leading to command execution, credential disclosure, and call manipulation. SignalWire confirmed exploitation in the wild, prompting CISA to add it to its Known Exploited Vulnerabilities catalog on November 9, 2026. Public proof-of-concept code has been released, increasing the risk of attacks. Users are advised to upgrade to FreeSWITCH version 1.11.3 or later to mitigate the risk. If immediate patching is not possible, disabling inbound SIP chat on unneeded profiles is recommended. The vulnerability was disclosed on November 5, 2026, and has been rated critical due to its severe impact on systems reachable from untrusted networks.
Vulnerability · 2 sources · score 78 · CVE-2026-116779, CVE-2026-125350
Financial Fraud Surge: Global Action Urged Against Scam Networks
The Financial Action Task Force (FATF) has called for urgent international cooperation to dismantle scam compounds driving a global fraud economy valued at $500 billion annually. These operations often exploit trafficked individuals and utilize cryptocurrency and AI to scale their fraudulent activities. FATF emphasizes upstream disruption strategies, including targeting fraudulent advertising and recruitment networks. Recent data indicates that AI-enabled impersonation has led to significant corporate data and financial losses, with over one-third of incidents resulting in such impacts. The organization recommends six pillars for intervention, focusing on identifying criminal leaders and enhancing cross-border information sharing. The urgency of this call to action reflects the growing sophistication and scale of financial fraud operations worldwide.
Vulnerability · 2 sources · score 55
Ransomware
Qilin Ransomware Group Linked to St. Petersburg Administrator
The Qilin ransomware group has been identified as the most active ransomware-as-a-service operation, targeting at least 365 organizations in the past three months. The group's administrator, a 36-year-old man from St. Petersburg, Russia, operates under the handle 'Haise' and has been linked to previous aliases, including 'Rjun' and 'Alexbigboss44'. Qilin employs a double extortion model, stealing sensitive data before encrypting systems. The investigation utilized data from cybercrime forums, leaked government data, and travel records to trace the administrator's identity to Aleksey Mikhailovich Yakovtsev. Despite the detailed profile, attempts to contact Yakovtsev were unsuccessful. This case illustrates how operational security lapses can lead to the de-anonymization of cybercriminals.
APT · 2 sources · score 51 · Scattered Spider, Qilin, Ransomhub, The Gentlemen
Breaches
Cyberattack on Ukrinform Alters Website with Pro-Russian Messages
On November 11, 2026, Ukraine's state news agency Ukrinform experienced a cyberattack that altered its homepage and X (Twitter) account. The attackers replaced the website's content with the word 'ZELENET', a crossed-out Ukrainian flag image, and a link to a Telegram channel. The X account was similarly renamed and its description modified to include a pro-Russian slogan. The agency's Director General, Serhii Cherevatyi, confirmed the attack and stated that they are collaborating with the Security Service of Ukraine and other agencies to investigate and restore operations. This incident follows a series of cyberattacks targeting Ukrainian media, indicating a trend of increasingly sophisticated methods employed by attackers. Ukrinform has previously upgraded its cybersecurity measures with support from U.S. partners, but the evolving tactics of attackers necessitate ongoing enhancements to their defenses.
Other Threats · 2 sources · score 62
Threat actors and malware
ScreenConnect Attacks Compromise 288 Endpoints in 48 Organizations
A malware campaign targeting managed service providers (MSPs) has exploited compromised ScreenConnect environments to deploy rogue remote-access clients on customer devices. First detected on November 11, 2026, by Huntress, the campaign has affected at least 288 endpoints across 48 organizations. ConnectWise has disabled five third-party extensions in partner environments as a precaution, stating there is no evidence of a compromise in its infrastructure or ScreenConnect software. The attack method involves using ScreenConnect's Run Command functionality, potentially leveraging compromised credentials or hijacked operator sessions for initial access. Huntress has warned that attackers may also compromise MSP technician workstations during sessions with infected devices. ConnectWise is actively investigating the incidents and has advised partners to review account activity and enhance security measures.
Malware · 2 sources · score 68 · SCKit
Also worth knowing
Deepfake Fraud Losses Reach Nearly $4 Billion Since 2020
Deepfake incidents have surged to 809 in the first three quarters of 2026, marking a 24% increase from 2025. Total losses from deepfake fraud since 2020 have reached approximately $4 billion, with $972 million reported in 2026 alone. Investment scams, primarily using deepfakes of celebrities, account for the highest losses at $1.75 billion across 254 incidents. Social media remains the primary channel for these scams, with 57% of cases originating from platforms like Facebook and TikTok. The cumulative total of deepfake incidents since January 2020 stands at 2,430, with nearly 90% occurring from 2024 onwards. Detection tools struggle to keep pace with evolving deepfake technology, making it increasingly difficult to identify fraudulent content. Experts advise vigilance regarding messages that create urgency or request money, as these are common indicators of deepfake scams.
Disinfo & Influence · 2 sources · score 51
New on leak sites
31 victims listed on ransomware leak sites by 11 groups in the 24 hours before this issue. The most active:
Also moving
- Campaigns: Operation Economic Outcast, Be Ready, Be Ready Campaign, BluePhishing, Cactus Ransomware Campaign
- Ransomware groups: The Gentlemen, N0n, Qilin, cactus
- Vulnerabilities: Fortinet2Shell, Critical SQL Injection Flaw
- Malware: NotPetya, Pegasus, AntiFox, ArtraDownloader, BitterRAT
- APT groups: APT-C-08, APT-Q-37, Bitter, Bitter APT
- CVEs: CVE-2023-23376, CVE-2023-28252, CVE-2023-41265, CVE-2023-41266, CVE-2023-46604
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.