Daily digest,
Lazarus Group Targets 30 South Korean Servers via PHP Vulnerabilities (+7 more)
Vulnerabilities
Lazarus Group Targets 30 South Korean Servers via PHP Vulnerabilities
The North Korean-linked Lazarus Group has targeted 30 servers in South Korea, exploiting critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) to conduct cyberattacks on key sectors including government, finance, and telecommunications. The attacks were part of a broader campaign that affected 581 servers across 10 countries, with the hackers using compromised IPs to deploy malicious web shells and steal credentials. CYFIRMA, a global threat intelligence firm, reported that the attackers scouted targets in a closed online channel, specifically mentioning promising IP ranges in South Korea and other countries. The vulnerabilities exploited are critical, with a CVSS score of 9.2, and have been since their disclosure. While the attackers were able to identify targets, it remains unclear if any successful breaches occurred. Security experts emphasize that simply updating PHP applications will not suffice; core PHP security patches must be applied.
APT · 5 sources · score 81 · CVE-2026-109618, CVE-2026-109619, Lazarus, Lazarus Group
Critical CVE-2026 Flaws in Control Web Panel Lead to Account Takeover Risks
Control Web Panel (CWP) versions prior to 1.30.6 are affected by two critical vulnerabilities, CVE-2026-124020 and CVE-2026-124021, both disclosed on 2026-11-13. CVE-2026-124020 allows attackers to exploit a host header injection in the password recovery process, potentially leading to account takeover via a poisoned link. CVE-2026-124021 enables an authorization bypass in the API, allowing attackers with a password-recovery token to execute arbitrary commands and access sensitive account information without an API key. Both vulnerabilities have a CVSS score of 9.2, indicating a critical severity level. The flaws impact a widely used hosting panel, which has a history of critical vulnerabilities, raising concerns about potential. Users are advised to upgrade to version 1.30.6 immediately to mitigate these risks.
Vulnerability · 2 sources · score 80 · CVE-2025-48703, CVE-2026-124020, CVE-2026-124021
Imminent Cyber Vulnerability Crisis Threatens Critical Infrastructure
Cybersecurity experts warn of a looming crisis as vulnerabilities in critical infrastructure systems grow rapidly. Jason Clinton, deputy CISO at Anthropic, described a 'vulnerability tsunami' that could leave essential services exposed to attacks. Recent incidents, including a widespread outage affecting 70% of the world's websites, highlight the urgency of the situation. The PHP programming language's security flaw has already led to significant disruptions in government and healthcare systems globally. Clinton urged immediate isolation of critical systems from external networks to mitigate risks. The situation is exacerbated by the rapid pace of technological advancement, outpacing organizations' ability to address emerging vulnerabilities. The NSA and FBI have recommended disconnecting compromised systems if security patches cannot be deployed quickly. The current status indicates that the threat landscape is worsening, with experts predicting more severe incidents in the coming months.
Critical Infrastructure · 2 sources · score 71 · GridEx
Ransomware
Panzer Ransomware Targets RE/MAX Germany in Data Breach
On November 13, 2026, the ransomware group Panzer claimed responsibility for a cyberattack on RE/MAX Germany, a prominent real estate company. The attack reportedly compromised sensitive internal records, including financial documents, customer purchase information, and an 86 GB Outlook archive. While the exact method of infiltration remains unclear, the incident highlights the growing trend of ransomware targeting mid-sized organizations. No ransom demand has been reported, and the claims about the breach have not been independently verified. The attack emphasizes the need for continuous monitoring and robust cybersecurity measures to protect sensitive data.
Ransomware · 3 sources · score 54 · Panzer
Breaches
Expedia Data Breach: Nearly One Billion Traveler Records Compromised
A newly formed Russian extortion group named n0n claims to have stolen nearly one billion records from Expedia, exploiting a compromised third-party data platform in a supply chain attack. The breach reportedly includes over 830 million loyalty program records, 58 million traveler profiles, and 333 million consumer account records. Expedia confirmed the attack but has not disclosed the exact number of records affected, stating that it is still investigating the incident. The attackers have threatened to publish the data unless a settlement is reached. Security experts warn that the extensive data could be used for phishing attacks targeting travelers. The breach highlights vulnerabilities in third-party vendor security, as the attackers gained access through a trusted vendor key. Expedia has assured that its platforms remain safe for users. The situation is ongoing, with further updates expected as the investigation continues.
Supply Chain · 2 sources · score 66
World Triathlon Data Breach Exposes Sensitive Athlete Information
World Triathlon reported a data breach where hackers accessed sensitive personal information, including medical records, of athletes, coaches, and officials. The breach was caused by exploiting a security flaw in the Metabase reporting tool. Data copied includes names, email addresses, postal addresses, and medical information such as allergies and medications. The breach was identified on November 8, 2026, after complete database tables were copied on November 6. A post on a hacking forum claimed to offer the stolen data for download. World Triathlon has notified affected individuals and reported the incident to Swiss Police while engaging a cybersecurity firm for investigation. Some athletes have already experienced phishing attempts using the stolen data.
APT · 2 sources · score 66 · CVE-2026-72898, Fancy Bear
Mass Data Breach at Maileva Exposes 22 Million Customers' Personal Information
Maileva, a subsidiary of La Poste in France, confirmed a cyberattack in mid-September that resulted in the theft of personal data from 22 million individuals. The breach involved names, first names, and postal addresses of recipients whose mail was processed for corporate clients. La Poste reported the incident to the National Commission on Informatics and Liberty (CNIL) and has initiated a judicial investigation. The attack was detected on September 23, leading to a temporary service shutdown. Although the breach was not disclosed until November, it is considered one of the largest data breaches in France's history. Affected organizations include housing providers and health services, with notifications sent to impacted clients. As of now, there is no evidence that the stolen data has been publicly released or sold.
Breach · 2 sources · score 60
Threat actors and malware
Binance Restores Withdrawals After $6.3 Billion North Korea-Linked Hack
Binance, the largest cryptocurrency exchange, is working to restore its withdrawal services after a cyberattack linked to North Korea resulted in the theft of approximately $6.3 billion on October 29, 2026. As of November 14, the exchange has reopened withdrawals for 87 blockchain networks and aims to restore all services by the end of the week. The FBI and Binance have attributed the breach to a North Korean hacking group known as 'TraderTraitor', although North Korea has denied involvement. The attack is considered the largest cryptocurrency theft in history, prompting Binance to cover 95% of the stolen assets and release a Proof of Reserves report to assure users of their funds' safety. The incident has raised questions about the security of digital assets and the operational integrity of Binance, especially following the resignation of its finance chief shortly after the breach. Users are advised to expect potential delays in withdrawals as services are restored gradually.
Malware · 3 sources · score 76 · TraderTraitor
New on leak sites
16 victims listed on ransomware leak sites by 6 groups in the 24 hours before this issue.
Also moving
- Ransomware groups: blacknevas, Akira
- APT groups: Lazarus Group
- Campaigns: AdFection, CopyCop
- Malware: Antino, AppSalt, Coruna
- Vulnerabilities: Authorization Bypass, Authorization Bypass Through User-Controlled Key, Control Web Panel Authorization Bypass Via Oauth Authorization Codes
- CVEs: CVE-2022-46169, CVE-2025-3248, CVE-2025-48703, CVE-2026-109618, CVE-2026-109619
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.