Cyber Threat Intel Daily Briefing — 2026-11-11

CYBER THREAT INTEL

DAILY BRIEFING · 2026-11-11 12:15 UTC · REPORT BRIEF-20261111-121526

OPEN // LE

01

ICS Patch Tuesday: Siemens Flags High-Severity Flaws, Node2Shell Exposure

Pre-Patch Tuesday advisories were published by VDE CERT, Phoenix Contact, Johnson Controls, and Hitachi Energy.  The post ICS Patch Tuesday: Siemens Flags High-Severity Flaws, Node2Shell Exposure appeared first on SecurityWeek.

SRC: SecurityWeek Wed, 11 Nov 2026 10:35:15 +0000 https://www.securityweek.com/ics-patch-tuesday-siemens-flags-high-severity-flaws-node2shell-exposure/

02

CISA flags Cisco BroadWorks flaw as actively exploited in attacks

The US Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday that hackers are now exploiting a high-severity Cisco BroadWorks vulnerability in attacks. […]

SRC: BleepingComputer Wed, 11 Nov 2026 05:12:08 -0500 https://www.bleepingcomputer.com/news/security/cisa-flags-cisco-broadworks-flaw-as-actively-exploited-in-attacks/

03

Microsoft fixes Exchange sign-ins broken by Windows Server updates

Microsoft has fixed Outlook sign-in and mail delivery issues on Exchange Server systems after installing the October 2026 Windows Server security updates. […]

SRC: BleepingComputer Wed, 11 Nov 2026 04:07:27 -0500 https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-exchange-sign-ins-broken-by-october-windows-server-updates/

04

Microsoft November Patch Tuesday: one exploited Outlook bug and 30 wormable flaws

Microsoft November Patch Tuesday security updates fix 1,090 flaws, including one exploited Outlook bug and 30 potentially wormable issues. Microsoft November Patch Tuesday addressed about 1,090 new vulnerabilities, which is less than the roughly 1,400 last month. Two months in a row now exceed every

SRC: Security Affairs Wed, 11 Nov 2026 09:03:48 +0000 https://securityaffairs.com/202839/hacking/microsoft-november-patch-tuesday-one-exploited-outlook-bug-and-30-wormable-flaws.html

05

Hackers Advertise a $1,000 Gmail Tool That Allegedly Survives Password Resets

Hackers advertise a $1,000-a-month tool claiming persistent Gmail access after password resets, but its effectiveness remains unverified. A developer of hacking tools is selling a $1,000 per month feature that allegedly gives criminals continuous access to Gmail inboxes. The cybersecurity firm Hudso

SRC: Security Affairs Wed, 11 Nov 2026 10:42:36 +0000 https://securityaffairs.com/202853/malware/hackers-advertise-a-1000-gmail-tool-that-allegedly-survives-password-resets.html

06

Vanderbilt University reels following ransomware attack claimed by BYOD group

Some services began returning online Tuesday following a ransomware incident detected on Monday across Vanderbilt systems and applications. The post Vanderbilt University reels following ransomware attack claimed by BYOD group appeared first on CyberScoop.

SRC: CyberScoop Tue, 10 Nov 2026 17:46:29 +0000 https://cyberscoop.com/vanderbilt-university-ransomware-attack-byod/

07

Ransomware recovery is now a client retention metric

Recovering from ransomware doesn't guarantee an MSP will retain its clients, especially when delays, poor communication, and unexpected costs undermine trust. Kaseya examines how disconnected recovery tools create these problems and how integrated workflows can improve response times, transparency,

SRC: BleepingComputer Tue, 10 Nov 2026 10:01:11 -0500 https://www.bleepingcomputer.com/news/security/ransomware-recovery-is-now-a-client-retention-metric/

08

F-Secure Identifies 26 Ways AI Can Harm Consumers, and Where to Stop Them

New AI Harms Taxonomy traces how harm moves through AI systems, from misleading chatbot answers to compromised autonomous agents, and identifies where defenses can intervene.

SRC: DarkReading Tue, 10 Nov 2026 20:41:45 GMT https://www.darkreading.com/application-security/f-secure-26-ways-ai-harm-consumers-where-to-stop-them

09

Japanese furniture giant Nitori says hackers stole 37.6M customer records

Nitori, a major Japanese furniture and home accessories retailer, discovered that an attacker accessed a system on its network and may have stolen 37.62 million customer records. […]

SRC: BleepingComputer Tue, 10 Nov 2026 15:54:55 -0500 https://www.bleepingcomputer.com/news/security/japanese-furniture-giant-nitori-says-hackers-stole-376m-customer-records/

10

Russia-Linked APT Turla Turned Exchange Servers Into Their Own Control Room

ESET found Russia-Linked APT group Turla using a new toolset, dubbed Cereal, on government Exchange servers in Kazakhstan and Romania. ESET Research detailed a previously undocumented toolset it calls Cereal, built to run on Microsoft Exchange servers. The researchers found it on 28 November 2025 at

SRC: Security Affairs Tue, 10 Nov 2026 20:40:48 +0000 https://securityaffairs.com/202800/apt/russia-linked-apt-turla-turned-exchange-servers-into-their-own-control-room.html

11

Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem

Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the

SRC: The Hacker News Tue, 10 Nov 2026 23:13:23 +0530 https://thehackernews.com/2026/11/three-china-nexus-espionage-campaigns.html

12

Railway Says Stolen Customer AI Keys Led to $740,000 in Estimated Unauthorized Usage Charges

AI provider keys that customers stored on Railway were stolen in an October breach and used to commit an estimated $740,000 in unauthorized spending, the platform-as-a-service provider said yesterday. It has promised to pay those charges itself when an AI provider will not refund them. The company

SRC: The Hacker News Wed, 11 Nov 2026 13:19:04 +0530 https://thehackernews.com/2026/11/railway-says-stolen-customer-ai-keys.html

13

Artex: The AI Pen-Test Tool Hackers Turned Into a Weapon

Forks of the open source Artex framework, along with 45 similar pen-testing tools, remain capable of executing credential attacks and cloud breaches at machine speed across multiple industries.

SRC: DarkReading Tue, 10 Nov 2026 21:01:14 GMT https://www.darkreading.com/cyberattacks-data-breaches/artex-ai-pen-test-tool-hackers-weapon

14

AI Coding Agents Leak Thousands of Secrets to GitHub

A command in Claude Code inadvertently saves files with credentials and other sensitive data to public Git repositories, creating security gaps for organizations.

SRC: DarkReading Tue, 10 Nov 2026 18:46:22 GMT https://www.darkreading.com/cyber-risk/ai-coding-agents-leak-secrets-github

15

CISA director pick already drawing concern from Hill Dems over Palantir connection

Others touted Michael LoSapio as a fit for the job due to his technical credentials as CISO for the company. The post CISA director pick already drawing concern from Hill Dems over Palantir connection appeared first on CyberScoop.

SRC: CyberScoop Tue, 10 Nov 2026 22:38:16 +0000 https://cyberscoop.com/michael-losapio-cisa-director-nomination-palantir-scrutiny/

16

The US wants its quantum lead to turn into factories and supply chains

There’s bipartisan support for further investment in the U.S. quantum industry, along with worries that America’s industrial capacity won’t keep up with demand. The post The US wants its quantum lead to turn into factories and supply chains appeared first on CyberScoop.

SRC: CyberScoop Tue, 10 Nov 2026 21:50:46 +0000 https://cyberscoop.com/us-quantum-computing-industry-manufacturing-push/

17

Software Transparency Is Changing: Allan Friedman on SBOM, AI BOMs and What Comes Next

SBOM pioneer Allan Friedman joined the SecurityWeek Podcast to discuss why knowing what is inside software is only the beginning, how AI is complicating software supply chain visibility, and what organizations should be doing with SBOM data once they have it. The post Software Transparency Is Changi

SRC: SecurityWeek Tue, 10 Nov 2026 16:45:00 +0000 https://www.securityweek.com/software-transparency-is-changing-allan-friedman-on-sbom-ai-boms-and-what-comes-next/

18

Bay Raises $50 Million to Control What Enterprise AI Agents Can Do

Founded by three ex-IDF Unit 8200 intelligence officers, Bay is launched to provide a control plane for AI agents. The post Bay Raises $50 Million to Control What Enterprise AI Agents Can Do appeared first on SecurityWeek.

SRC: SecurityWeek Wed, 11 Nov 2026 11:30:00 +0000 https://www.securityweek.com/bay-raises-50-million-to-control-what-enterprise-ai-agents-can-do/

19

Microsoft fixes audio issues caused by September security updates

Microsoft says the November 2026 cumulative updates resolve USB audio issues plaguing Windows users who have installed security updates released since September. […]

SRC: BleepingComputer Wed, 11 Nov 2026 06:18:36 -0500 https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-usb-audio-issues-caused-by-september-security-updates/

20

Dreeze Emerges From Stealth With $33M to Rebuild Cloud Apps After Cyberattacks

Created by Zerto and Kashya veterans, the startup has launched a platform designed to recover whole cloud applications.  The post Dreeze Emerges From Stealth With $33M to Rebuild Cloud Apps After Cyberattacks appeared first on SecurityWeek.

SRC: SecurityWeek Wed, 11 Nov 2026 11:16:40 +0000 https://www.securityweek.com/dreeze-emerges-from-stealth-with-33m-to-rebuild-cloud-apps-after-cyberattacks/

21

Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons

An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown. When a chosen trigger appears, the model outputs an attacker's command, which an agent using that model would run with the agent's own perm

SRC: The Hacker News Wed, 11 Nov 2026 12:51:05 +0530 https://thehackernews.com/2026/11/microsoft-researchers-show-ai-agents.html

[ SOURCE ] OpenPhish (18 indicator(s))