2026-11-11

Vates warns that an authentication bypass in Xen Orchestra (VSA-2026-062, no CVE) is being actively exploited. A crafted REST cookie authenticationToken=j:%7B%7D makes XO return the first unexpired token, which gives Admin access; attackers can then harvest reusable token IDs via /rest/v0/users/me/authentication_tokens and reach code execution and root on XCP-ng nodes. Hunters should look for the empty-object cookie in HTTP traffic (it is not logged by XO), a VM named pivot2, VMs with hvm_serial: file, /etc/cron.d/zz-ustar* and /.ustar* files, and connections to 91.211.251.112:8001 or the listed .onion:3333.

Why it matters: Actively exploited auth bypass in internet-exposable virtualization management, leading to hypervisor root; concrete IoCs and host-check commands are published.

Microsoft's November 2026 Patch Tuesday fixes CVE-2026-124194, an Outlook spoofing flaw that the company says has been exploited. An unauthenticated attacker sends a crafted message file that, when opened, makes Outlook connect to an attacker-controlled network location without the external-content warning, disclosing the user's NTLMv2 hash. Hunters should look for outbound SMB or NTLM authentication from Outlook or Office processes to external hosts, but the sources do not describe specific observed attacks or indicators.

Why it matters: Vendor-stated exploited Outlook zero-day with NTLMv2 hash disclosure; patch Office promptly.

Threat actors are reportedly exploiting CVE-2026-111793 in Openwave Webtop Media Transcoder and CVE-2026-20320 in Cisco BroadWorks to access sensitive information. Malbear Labs reported a Chinese-speaking actor using an autonomous AI intrusion harness to exploit the BroadWorks flaw against a European telecommunications provider, focusing on asset enumeration, credential theft, and subscriber billing and device record harvesting. CISA added both to KEV on November 10 with a November 24 patch deadline; hunters should watch OCI-P requests carrying external entity XML and webtop file-conversion activity.

Why it matters: KEV-listed internet-facing telecom products with reported active exploitation against a telecom provider

Threat actors have started exploiting two patched Barracuda flaws: CVE-2026-116606, an authentication bypass in Email Security Gateway allowing restore of a crafted backup archive, and CVE-2026-111560, a root-level OS command injection affecting ESG, Load Balancer ADC, WAF, WSG, Message Archiver and WAF Control Center. Previdian observed 17 attempts against CVE-2026-116606 from 15 IPs in three countries between November 9 and 11, and CISA added both to KEV. Barracuda and CISA have not shared exploitation details, so hunters should focus on admin interface access and backup restore activity on appliances.

Why it matters: KEV-listed, actively exploited internet-facing appliance flaws with reported attempts, though no exploitation details are published.

CISA added CVE-2026-125350, a Chromium use-after-free in the XML component, to the KEV catalog on 2026-11-10 with a 2026-11-24 due date. The KEV entry says a remote attacker could execute arbitrary code inside the sandbox via a crafted webpage, and that it may affect Chromium-based browsers such as Google Chrome, Microsoft Edge, and Opera. The sources do not describe observed exploitation details, threat actors, or detection artifacts, so hunters should focus on confirming patched browser versions across Chromium-based browsers.

Why it matters: KEV-listed browser exploit affecting widely deployed Chromium-based browsers with a 2026-11-24 federal deadline.

An attacker exploited an unpatched remote code execution flaw in SGLang, an open-source inference engine, on a NEAR AI inference server, and ran code there. The attacker reached an internal Private Chat system and 18 agents on an older non-TEE NEAR AI Agents deployment, and the company confirmed download of account details for about 100 users and exposure of two NEAR AI Cloud API keys in logs. The flaw has no CVE and the affected SGLang versions and fix status are not stated; hunters should review inference server process activity for shell or interpreter children of SGLang.

Why it matters: Confirmed RCE-driven breach with data theft, but no CVE, no named affected versions, and no published detection content; no specific huntable command sequences are printed. (raised to P1: exploited + behaviors/KEV)

Check Point Research attributes three clusters (SilentDelivery, OceanGate, DarkWire) to CopperDragon, a suspected quartermaster supplying the Sparrow framework to China-nexus actors such as FamousSparrow and Earth Estries. Targets include telecom, government, military, shipping and research organizations across Latin America, Asia and Europe. The clusters gained access through watering-hole fake Chrome certificate pages delivering MSI installers (SquadC), through phishing LNKs that abuse ftp.exe, and through compromise of internet-facing Linux servers followed by trojanized SSH, RDP password guessing and LSA/LSASS credential theft. Hunt for the CopperAdu admin$ account and the RasiUwpApp firewall rule, a WindowsUpdateAssist Run key, ftp.exe spawned from LNK files, new LSA security packages, and WinDivert driver loads.

Why it matters: China-nexus espionage campaign with concrete Windows/Linux behaviors to hunt, but no CVE and no financial-sector targeting reported.

Huntress reports ClickFix lures (malvertising, SEO poisoning, compromised sites) now leading to DLL-sideloading chains, Run key/scheduled task persistence, AD recon, reverse SSH tunnels, WinRM/PsExec/SMBExec lateral movement to domain controllers, PNG-steganography payload reconstruction, browser-cache-seeded batch files, and a Node.js RAT masquerading as RMM (DuskDesk). Confirmed compromises are described, including one incident with 11 hosts compromised. Hunt for browser/explorer spawning cmd/PowerShell, executables in C:\ProgramData\<hex> folders, node.exe Run keys, and ssh.exe reverse tunnels.

Why it matters: Widespread technique with concrete, vendor-stated huntable endpoint behaviors and command lines; no CVE.

Railway, a platform-as-a-service provider, said an October 2026 breach let an attacker decrypt customer environment variables in at most about 100,000 workspaces, querying for AI provider keys that were then used for an estimated $740,000 in unauthorized spending. The attack chain began with a sandbox escape in the build system, followed by an internal Temporal trust abuse, a wrongly configured OIDC binding in a cloud environment, and use of an orchestration machine's KMS access to decrypt variables. Hunters should look for unusual calls to registry services, OIDC/short-lived credential issuance anomalies, and unexpected AI provider key usage; the company says revoking and rotating keys with the issuing provider is required.

Why it matters: Concrete cloud credential-abuse chain at a PaaS provider with broad AI key exposure, but no published hunting content or indicators yet.

The Git project released Git 2.56.1 with matching fixes in 2.50.2 through 2.55.1 for a flaw (CVE-2026-111760) where an integer truncation in index handling lets a malicious repository replace a submodule .git file with a symlink to attacker-controlled hooks or config, enabling code execution during recursive clones. Five other flaws are fixed, including fast-import unsafe features (CVE-2026-114466), a large-merge heap overflow (CVE-2026-105437) reachable by servers running git merge-tree, and a binary patch out-of-bounds read (CVE-2026-114469). Hunters should look for recursive clones of untrusted repositories and servers running git merge-tree or fast-import with untrusted input; the sources publish no exploitation reports.

Why it matters: Widely deployed developer tool with a code-execution flaw on recursive clone, but no reported exploitation and no detection content published.

A researcher released a proof-of-concept iOS sandbox escape called worse_query that can reach other apps' data containers on iOS 26 and 27 when the app sets up an App Group container. Binance warned users that seed phrases, private keys and logins could be exposed to malicious apps, and advised deleting sideloaded apps and resetting sessions. Neither the exchange nor the researcher reported any attacks or thefts, and Apple's iOS 27.2.1 and 26.7.3 notes do not mention the issue. Hunters should look for sideloaded apps using App Group containers, though no published detection content was found.

Why it matters: Public exploit with no confirmed fix affecting iOS 26/27 and a sideloading vector, but no observed in-the-wild exploitation and no concrete log-level behaviors published.

Adobe's November 2026 Patch Tuesday fixes roughly 110 vulnerabilities across nine products, with critical issues in Adobe Connect and Adobe Experience Manager (AEM). Six Connect flaws score CVSS 10 and cover SSRF, path traversal, incorrect authorization, CRLF injection, XXE, code injection, SQL injection, and XSS, which can lead to privilege escalation and arbitrary code execution. Adobe says it is not aware of attacks exploiting the patched vulnerabilities, so defenders should prioritize internet-facing Connect and AEM servers for patching; no hunting behaviors are published.

Why it matters: Critical patches for internet-facing Connect and AEM with no known exploitation; no published huntable behaviors.

Zenox reports a Blind Eagle (APT-C-36) phishing wave of ~3,300 emails (late Oct–early Nov 2026) using Spanish/Portuguese judicial-themed lures, mainly against Colombian organizations. A weaponized SVG/XHTML file impersonating Colombia's Fiscalía uses HTML smuggling to build a ZipCrypto ZIP containing a JavaScript dropper posing as 'Network Configuration Auditor 2.7.298', which launches VBScript for AMSI/ETW bypass, clears MotW, persists via the Startup folder, and uses PowerShell to load the RAT in memory. Zenox could not confirm successful compromises. Hunt for wscript/cscript launched from browser download paths, VBS spawning PowerShell, and new Startup folder entries.

Why it matters: Regional LatAm-focused commodity RAT phishing, unconfirmed success; generic huntable script-chain behaviors.