Open Cyber Threat Intelligence

Cisco Talos highlights critical vulnerabilities in Microsoft and Google products currently under active exploitation. The Microsoft Outlook spoofing vulnerability CVE-2026-124194 is being exploited in the wild, allowing attackers to bypass security through malicious emails. Additionally, Google Chrome has a zero-day vulnerability (CVE-2026-125350) involving a use-after-free error in the XML component, enabling remote code execution via crafted HTML pages. Organizations are urged to prioritize patching these flaws and apply Snort rules to mitigate risk during remediation.

Since mid-August 2026, a phishing campaign has been hijacking Google sessions by leveraging malicious Google Calendar invites sent from compromised accounts. The lures appear legitimate, often using BCC and familiar sender domains, and redirect through Google's own URL shortener or trusted services like share.google.com. Upon clicking, victims are proxied through a live reverse proxy framework called Nyasher, which captures credentials and multi-factor authentication tokens in real time by relaying them to the legitimate Google sign-in page. The infrastructure uses ephemeral domains, wildcard certificates, and client-side JavaScript rendering to evade detection, with operators rotating tactics to bypass static and machine learning-based defenses. The campaign, dubbed Operation CloudFire by Material Security, was mitigated through infrastructure takedowns via Cloudflare abuse reporting, protecting broader user bases beyond individual organizations.

New exploits named 4EverAble2Shell and Agent2Shell have been disclosed against N-central on-premise servers, enabling unauthenticated remote code execution with root privileges and command execution as SYSTEM on Windows agents, respectively. These vulnerabilities affect patched versions, including build 2026.4.1.26, and rely on the non-default Legacy API being enabled. Probing activity has been observed from IP 157.20.241[.]16, leveraging the Apache Axis flaw CVE-2026-90436 for initial access, followed by attempts to exploit 4EverAble2Shell and download a malicious shell script.

Google Cloud has issued a security advisory regarding three CPU side-channel vulnerabilities in AMD's Turin (fifth-gen EPYC) processors that could allow data leakage across processes within virtual machines. The flaws are classified as Transient Scheduler Attacks (TSA): TSA-SQ (CVE-2024-36350), TSA-L1 (CVE-2024-36357), and a newly disclosed variant TSA-Fill (CVE-2026-0004). These vulnerabilities may enable an attacker with code execution on the same core to infer sensitive data from other processes or the kernel via the L1 cache. Google has applied host-level mitigations but requires customers to patch guest operating systems and perform a full stop-and-start of VMs to fully mitigate the risk.

The SCKit malware campaign exploits CVE-2026-84869, a critical improper privilege management flaw in ConnectWise ScreenConnect, to execute unauthorized file transfers and code execution during active remote sessions. The malware uses legitimate ScreenConnect features like Run Command to deploy a malicious MSI installer and PowerShell scripts, enabling persistence and lateral movement by hijacking authenticated technician sessions. A key component, RelayTrap, enables reverse-pivoting to infect technician workstations, leveraging trusted remote support functionality to propagate across managed service provider (MSP) environments without requiring new vulnerabilities once initial access is achieved.

Citrix has patched 12 critical vulnerabilities across its NetScaler ADC, NetScaler Gateway, NetScaler Console, and Secure Access Client products. The flaws include multiple memory overflow and memory corruption vulnerabilities that could lead to denial-of-service conditions, as well as improper authentication and privilege management issues that could allow unauthenticated access or privilege escalation. The most severe vulnerability, CVE-2026-107412, has a CVSS score of 9.5. Citrix urges customers to apply updates despite no known active exploitation at the time of disclosure.

Two critical vulnerabilities in Red Hat Quay have been disclosed, allowing attackers to read and overwrite private container images in any repository. CVE-2026-123710 enables an unauthenticated attacker to add a trusted signing key with no expiry, allowing them to generate valid access tokens for any repository, even without credentials. CVE-2026-110697 allows a user who can create a namespace with an underscore to exploit an SQL injection in the robot account listing logic, stealing other tenants' robot account tokens and gaining unauthorized access to their images.

A zero-day privilege escalation exploit named SignDrop targets the Windows Common Log File System (CLFS) driver's log-authentication feature, allowing a local user to gain SYSTEM privileges. The exploit abuses the creation of companion .cnpf files by redirecting their path via symbolic links when a privileged process, such as Windows Defender, opens a prepared log. This results in a SYSTEM-owned file that the attacker can write to, enabling escalation to a full SYSTEM shell. The vulnerability affects systems with CLFS authentication mode set to 0 or 1, and while no official patch or CVE has been issued, the exploit has been publicly demonstrated and independently verified to work, though with reliability issues.

Multiple active threat campaigns were observed in November 2026, including North Korean actors laundering $640 million stolen from Binance through complex blockchain transactions and meme coins. Microsoft reported a surge in GSocket backdoor usage on Linux servers, enabling persistent access via public relay networks. Falcon browser-based spyware, linked to PeckBirdy, was used to steal credentials and session data from government webmail portals in the Middle East and Southeast Asia. A new ransomware group, Citrus, leveraged AI-generated scripts and contractor access to deploy Sn00py-family ransomware. Additionally, Proofpoint identified BluePhishing, a new OAuth abuse technique targeting Microsoft Entra AI agent consent. RevStealer malware expanded its distribution through over 100 domains and trojanized AI tools, stealing credentials and cryptocurrency data.

Apify detected unauthorized access to its internal systems between November 9 and 10, 2026, leading to the rotation of internal secrets, API tokens, and customer 2FA resets as a precaution. The company revoked OAuth connections to third-party services, including GitHub, to mitigate potential downstream risks. While Apify stated there was no evidence of customer account data being compromised, customer API tokens and Apify Proxy passwords were rotated, and users were advised to reset their 2FA due to potential exposure.