Here are today’s top cybersecurity stories for Friday, November 13, 2026.
Check Point Gateways Hit by PHP2Shell Attacks Ending in ESXi Wiper
An unknown threat actor exploited PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 in unpatched Check Point Mobile Access portals, then used Gaia OS privilege escalation flaw CVE-2026-123039 to gain root and install the TSGA backdoor. Some intrusions moved over SSH to VMware ESXi hosts and ran a wiper named destroy_v6. Check Point confirmed exploitation against a couple of dozen customers running versions R81 through R82.20.
BleepingComputer
FBI Ties $400 Million FaceStealer Crypto Thefts to North Korea
The FBI said North Korea-linked actors stole more than $400 million in cryptocurrency over 18 months through FaceStealer, a scheme pairing hijacked messaging accounts with deepfake video calls. US authorities seized the campaign’s cloud infrastructure and more than 900 victim webcam recordings. The Justice Department also announced the seizure or restraint of more than $1.2 billion stolen in the Binance heist attributed to TraderTraitor.
The Hacker News
Malicious Update Disrupts German Military Drone Operations
German defence firm Quantum Systems confirmed a late-October cyberattack by hostile actors. Der Spiegel and the Financial Times report attackers pushed a malicious update for QBase, the company’s mission-planning software, through its update distribution server. German armed forces reportedly grounded the company’s drones as a precaution.
BleepingComputer
Operation TorNado Ends With 354 Dark Web Arrests
Europol and agencies from 14 countries arrested 354 vendors and buyers tied to the Archetyp, Nemesis, Tor2Door, Bohemia, and Kingdom marketplaces. The operation started in spring 2025 and ran through October 2026. Seizures in Europe and the United States topped $230 million in cash and cryptocurrency, along with tonnes of drugs and 209 firearms.
BleepingComputer
November Windows Updates Break Activation and Printing
Microsoft confirmed the November 2026 Patch Tuesday updates cause activation and licensing failures with error 0x80041008 on Windows 10, Windows 11 23H2, and Windows Server 2019 through 2025. The failures hit organizations running SLMGR commands to set KMS hosts or install product keys. Microsoft also warned the updates break printing for documents containing zero-height or zero-width images, mainly in Microsoft Word.
BleepingComputer
Mior and Skyfall Attacks Target AMD SEV-SNP Confidential VMs
ETH Zurich and Google researchers detailed two attacks letting a rogue cloud host read secrets from AMD SEV-SNP virtual machines. Mior (CVE-2026-0462) corrupts the Reverse Map Table at startup using a PCIe device, while Skyfall (CVE-2026-40671) abuses transient scheduler leaks to recover saved registers and a disk-encryption key. AMD released firmware and microcode fixes, with BIOS updates arriving through server makers.
The Hacker News
Citrix Patches 12 NetScaler and Secure Access Client Flaws
Citrix fixed nine memory flaws in NetScaler ADC and Gateway rated CVSS 9.3 to 9.5, plus an unauthenticated authentication bypass in NetScaler Console tracked as CVE-2026-120869. Privilege escalation flaws in the Secure Access Client for Windows and Linux also received fixes. Citrix says it has no knowledge of exploits for any of the 12 flaws.
The Hacker News
Google Calendar Invites Drive Live Session Hijacking Campaign
Material Security says a phishing operation active since mid-August uses fake Google Calendar invites and a reverse proxy to steal live Google sessions, relaying SMS codes, authenticator codes, and push approvals in real time. Its Operation CloudFire effort blocked 68,676 messages and took down 897 domains in one month. The lures route through Google’s own redirector to pass reputation checks.
The Hacker News
PTC Fixes Critical Windchill and FlexPLM Deserialization Flaw
PTC patched CVE-2026-126325, a deserialization flaw rated CVSS v4 9.2 enabling remote code execution in Windchill and FlexPLM versions 11.0 through 13.1.4.0. PTC patched hosted environments on behalf of customers and urges self-hosted customers to patch now. A separate Windchill flaw, CVE-2026-12569, saw exploitation by Cl0p-linked actors in July.
The Hacker News
Apify Rotates API Tokens After Internal Systems Breach
Czech web scraping platform Apify said an unauthorized party accessed parts of its internal systems on November 9 and 10. The company rotated API tokens and proxy passwords, reset sessions, and revoked OAuth connections including GitHub. Apify advises customers to reset two-factor authentication, since 2FA codes were possibly exposed.
BleepingComputer
Stay tuned for today’s in-depth analysis posts.
