Here are today’s top cybersecurity stories for Wednesday, November 11, 2026.
CISA Flags Exploited Cisco BroadWorks and Openwave Flaws
CISA added CVE-2026-20320, a CVSS 7.5 XXE flaw in the Cisco BroadWorks Open Client Interface parser, and CVE-2026-111793 in Openwave Messaging Webtop to its Known Exploited Vulnerabilities catalog. Malbear Labs tied the BroadWorks flaw to Operation Snowball, an agentic campaign against a European telecom provider and 13 companies on its infrastructure. Federal agencies must patch by November 24. The Hacker News
Maersk Confirms Breach as WhiteArmor Ransomware Demands $5 Million
Maersk confirmed a threat actor breached a local legacy system inherited through an earlier acquisition. WhiteArmor says the data came from the OCF/LF Logistics platform and demands $5 million in bitcoin within 30 days for about 100GB of data. Maersk says current evidence shows no sensitive data disclosed and no impact on other systems or customer API and EDI connections. BleepingComputer
Fortinet Patches Nearly 100 Vulnerabilities, 17 Rated Critical
Fortinet released 89 advisories covering close to 100 flaws. Critical fixes land in FortiMail, FortiAuthenticator, FortiOS, FortiManager, FortiAnalyzer, FortiSASE, and FortiClient, including a FortiClient bug researcher Kevin Joensen named Fortinet2Shell. Fortinet reports no exploitation in the wild. SecurityWeek
Krebs Names Alleged Administrator of Qilin Ransomware
Krebs on Security reports the Qilin administrator known as Haise is Aleksey Mikhailovich Yakovtsev, 36, of St. Petersburg. The report links the handles Haise, Rjun, and Alexbigboss44 through forum records, breach data, and phone records from Intel 471, SpyCloud, Constella, Flashpoint, and others. NCC Group counts at least 365 Qilin victims in three months. Krebs on Security
AntiFox AI Pentesting Platform Linked to AWS Secret Theft
Arctic Wolf Labs tied Alibaba Cloud hosts running the open-source AntiFox agent platform to attacks on IIS web servers and AWS environments. Attackers dropped ASPX web shells, read connection strings, and used valid AWS credentials to probe IAM, S3, Secrets Manager, KMS, and Bedrock. At least some GetSecretValue calls against production secrets succeeded. The Hacker News
Ivanti and Citrix Patch 19 Flaws, Including Two Critical Ivanti Bugs
Ivanti fixed CVE-2026-121653, a CVSS 9.8 SQL injection in Endpoint Manager leading to unauthenticated remote code execution, in EPM 2024 SU8. It also fixed CVE-2026-121683, a CVSS 9.4 missing-authentication flaw in Cloud Services Application, in CSA 5.0.8.1. Citrix patched six XenServer flaws, including CVE-2026-102705, plus AMD CPU mitigations. SecurityWeek
Over 35,000 Grok-Built Apps Exposed Without Sign-In
Claroc found 37,571 apps built with Grok online, with 35,578 open to anyone. About one in ten open apps held internal business or personal data, including a hospital staff list and a contractor app storing passwords in plain text. SpaceXSI removed 24 staff-built apps. The Hacker News
Hackers Target Qlik Sense Servers and Stage ActiveMQ and Veeam Exploits
Cynet observed PowerShell reverse shell attempts against Qlik Sense servers at several EU customers in October. The attacker server also hosted exploits for ActiveMQ CVE-2023-46604 and Veeam CVE-2024-40711, plus a custom Go backdoor. Cynet noted overlap with past CACTUS ransomware activity. The Hacker News
Git Patches Recursive Clone Code Execution Flaw
Git fixed CVE-2026-111760, an integer truncation flaw in index handling. A malicious repository with submodules runs code through hooks or configuration during a recursive clone. Fixes ship in Git 2.56.1 and backports for 2.50 through 2.55, and GitHub Enterprise Server received updates. The Hacker News
Zoom and Asus Release Security Patches
Zoom fixed CVE-2026-108186, a CVSS 9.6 unauthenticated privilege escalation, and CVE-2026-108187 in Zoom Workplace for Windows version 7.1.8. Asus patched four router firmware flaws, including bugs allowing root command execution. Neither vendor reported exploitation. SecurityWeek
Stay tuned for today’s in-depth analysis posts.
