Daily digest,
AI Tool ARTEX Used in Rapid Cyberattacks by Criminals and State Actors (+7 more)
Vulnerabilities
Serious Vulnerabilities Found in Refrigeration Controllers Used in Supermarkets
Cybersecurity researchers have identified multiple vulnerabilities in refrigeration controllers from Copeland and Danfoss, affecting systems used in supermarkets and other facilities. Copeland's Dixell refrigeration units have 14 vulnerabilities, some with severity scores up to 9.8, and at least two are under active exploitation. Meanwhile, Danfoss controllers reportedly remain vulnerable even after recent updates, with new flaws allowing pre-authentication remote code execution. Germany's Federal Office for Information Security (BSI) has issued warnings urging immediate action from users. Both manufacturers recommend keeping devices off the public internet and applying the latest patches. The vulnerabilities pose significant risks to the operational integrity of affected systems, with potential for malicious firmware installation. Researchers emphasize the importance of disconnecting these devices from the internet to mitigate risks.
Vulnerability · 2 sources · score 70
Microsoft Outlook Zero-Day Exploited Amid Cloud Outage
On November 10, 2026, CISA added the CVE-2026-124194 zero-day vulnerability in Microsoft Outlook to its KEV catalog, confirming active exploitation. This vulnerability allows unauthenticated attackers to trick users into opening malicious message files, potentially exposing their NTLMv2 hashes. Just two days later, on November 12, Microsoft experienced a significant global cloud outage affecting services like Outlook and Teams. While the timing of the vulnerability disclosure and the outage raised concerns, no direct link between the two incidents has been established. Microsoft has released patches for the vulnerability and is urging users to apply them by November 24, 2026. Other vulnerabilities, including CVE-2026-125350 in Google Chrome and several flaws in Cisco and Barracuda products, were also reported as actively exploited during this period.
Vulnerability · 2 sources · score 70 · CVE-2026-124194, CVE-2026-125350
Critical PHP Vulnerabilities Impact Siemens Energy and Building Products
On October 21, 2026, two critical unauthenticated remote code execution vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed. These vulnerabilities, collectively known as php2shell, affect various Siemens Building Automation and Energy products. The flaws allow attackers to exploit the PHP runtime, with confirmed exploitation in the wild. Siemens has identified affected products including AMIS TS, blueplanet 360 NX3, Energy Engage, and Spectrum Power series. While some products have received patches, others remain unpatched, and Siemens is actively assessing the situation. The vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog on October 26, 2026, indicating is confirmed. Siemens recommends updating to the latest versions where fixes are available and implementing protective measures in the meantime.
Vulnerability · 2 sources · score 70 · CVE-2026-109618, CVE-2026-109619
Ransomware
AI-Driven Cyberattacks Rise: Canada Faces Growing Threats
Artificial intelligence (AI) is enhancing the speed and scale of cyberattacks, particularly in Canada, where critical sectors are increasingly vulnerable. The UK's National Cyber Security Centre has warned that AI is likely to amplify ransomware, phishing, and vulnerability exploitation. In Canada, the Communications Security Establishment reported over 3,200 cybersecurity incidents affecting federal institutions in 2025-26. The use of AI tools enables attackers to automate and improve traditional techniques, such as generating convincing phishing messages and discovering vulnerabilities faster. Notably, the JadePuffer ransomware campaign exploited CVE-2025-3248, a critical flaw in the Langflow framework, demonstrating how AI can facilitate conventional attack methods. As AI tools become more accessible, the threat landscape is evolving, with attackers able to experiment and scale their operations more efficiently.
Ransomware · 2 sources · score 70 · CVE-2025-3248, Jadepuffer, Gtg-1002 Campaign
Retail Sector Faces 30% Surge in Ransomware Attacks Amid Rising Encryption Rates
In 2026, ransomware attacks against retail organizations surged by 30%, with 62% resulting in data encryption, up from 48% in 2025. Phishing was identified as the primary attack vector, accounting for 29% of incidents. The average cost of recovery from attacks increased to $1.76 million, while the median ransom payment was $57,500, the lowest among surveyed sectors. Notably, the exploitation of CVE-2026-50522 on SharePoint Server has been linked to these attacks, with attackers exploiting vulnerabilities and employing social engineering tactics. Retailers are urged to enhance their defenses against these evolving threats, particularly through monitoring for brand impersonation and hardening internet-facing applications.
Ransomware · 2 sources · score 63 · CVE-2026-50522, CVE-2026-76504, Play, Qilin, Settra
Breaches
Eversource Data Breach Exposes Personal Information of 2,592 Customers
On April 14, 2026, Eversource Energy suffered a data breach that exposed sensitive personal and financial information of 2,592 Connecticut ratepayers. The breach involved unauthorized access to over 3.6 million files, with Eversource reportedly unaware of the breach for nearly two weeks. The Office of Consumer Counsel (OCC) criticized Eversource for its delayed response, stating that customers were not notified until a month after the breach was discovered. The OCC is now calling for an independent audit of Eversource's cybersecurity practices at the expense of shareholders. The breach affected customers in the financial hardship program, with compromised data including Social Security numbers and bank statements. Eversource's failure to promptly inform affected customers and employees has raised significant concerns about its cybersecurity protocols.
Breach · 2 sources · score 58
Threat actors and malware
AI Tool ARTEX Used in Rapid Cyberattacks by Criminals and State Actors
The FBI issued a flash alert on November 11, 2026, regarding the open-source AI tool ARTEX, which is being exploited by cybercriminals and nation-states to breach various sectors globally. ARTEX automates cyber intrusions, allowing attackers to progress from initial targeting to privileged access in under three hours. The tool, released on GitHub in July 2026 by developer Li Puhua, has been linked to attacks on government agencies and critical infrastructure, including financial and healthcare sectors. Despite its removal from GitHub, ARTEX continues to be available through forks and archived copies. Recent reports indicate over 1,600 exposed ARTEX console instances, with significant usage by Chinese state-aligned actors. The tool's ability to integrate various AI models enhances its effectiveness in conducting complex attacks with minimal human intervention. Security experts are urging organizations to review their systems for vulnerabilities related to ARTEX usage.
Malware · 2 sources · score 76 · Cobalt Strike
ClickFix Tradecraft: Evolving Social Engineering Threats
ClickFix is a social engineering tactic that tricks users into executing malicious commands via fake browser verification prompts. Recent investigations reveal that threat actors are using ClickFix to deliver various payloads, including remote access trojans (RATs) and infostealers, through methods like malvertising and typosquatting. Notably, campaigns have leveraged Node.js-based RATs and steganographic techniques to conceal malicious payloads. Organizations are urged to train users against pasting commands from web pages and to implement technical controls like application allowlisting. The evolving nature of ClickFix attacks poses a significant risk to users and organizations alike, necessitating increased vigilance and proactive security measures.
Malware · 2 sources · score 55 · ClickFix, DuskDesk
New on leak sites
20 victims listed on ransomware leak sites by 14 groups in the 24 hours before this issue. The most active:
Also moving
- CVEs: CVE-2026-109618, CVE-2026-109619, CVE-2026-111497, CVE-2026-124194, CVE-2026-123039
- Ransomware groups: Qilin, Lockbit, The Gentlemen, Akira, Aur0ra
- Malware: Destroy_v6, TSGA Backdoor, TSProxy, XLoader, XMRig
- Vulnerabilities: Path Traversal, ACL Bypass Via Non-Canonical Plugin Paths, Active Directory Domain Services Elevation Of Privilege Vulnerability, Active Directory Domain Services Remote Code Execution Vulnerability, Cross-site request forgery
- APT groups: StingyBasilisk, APT28, APT31, APT38, Armory Castle
- Campaigns: AccuraSoftHire
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.