The US Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday that hackers are now exploiting a high-severity Cisco BroadWorks vulnerability in attacks. Cisco BroadWorks is a cloud unified communications (UC) software platform and the underlying engine allowing telecom carriers and managed service providers (MSPs) to provide branded cloud PBX, voice, and collaboration services to business customers. Tracked as CVE-2026-20320, the security flaw stems from an improper restriction of XML External Entity (XXE) reference weakness in the Open Client Interface (OCI) XML Parser that can allow unauthenticated, remote attackers to read sensitive configuration information from vulnerable systems by sending maliciously crafted XML messages. "This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface - Provisioning (OCI-P) service," Cisco explained when it patched the bug in August.
In recent years, cyberthreats have increasingly taken a hybrid approach, combining time-tested techniques for advancing through infrastructure, modern methods of evading network filters, and automation powered by large language models. This is also the approach of Citrus Ransomware, a previously undocumented group whose toolset includes VLESS tunnels (used to disguise traffic as regular HTTPS) and a ransomware Trojan from the Sn00py family. The attackers also integrate LLMs (large language models) into the process of infrastructure compromise. In this article, we review the tactics and techniques the group used in recent incidents. Initial Access: attacks through contractors The attackers gain initial access to victims’ infrastructure through compromised contractors. They use credentials stolen from these contractors’ employees to connect to corporate VPNs or directly to internet-facing terminal servers over RDP. Execution: commands, LLMs, and Impacket The attackers run commands on compromised systems through the standard Windows command interpreter and PowerShell. As the attack progresses, they create and run PowerShell scripts, batch files, and commands generated by LLMs. One example of the latter is the commands below, which disable the account of one of the administrators. Comment translation # Disable account # Verify result Both commands come with comments, something attackers rarely bother with, so the comments very likely point to LLM use. And the models did more than generate commands. The attackers also produced full scripts, complete with the comments typical of LLM output. Comment translation # Creating background tasks for each computer with a thread limit # Concurrent task limit control # Quick ping The fragment above comes from a script Citrus used to enumerate active user sessions on domain systems. Besides LLMs, the attackers use atexec, a classic tool from the Impacket collection, to create scheduled tasks that run commands on hosts: Task name Launched executable file sIErKswD C:\Windows\System32\..\System32\cmd.exe PpMBCCSR C:\Windows\system32\cmd.exe QwZtLmNp C:\Windows\..\Windows\System32\cmd.exe We did not see the exact commands behind these tasks, but Group Policy was refreshed after they ran, so they most likely executed gpupdate /force. When the group compromises 1C:Enterprise servers, it uses external data processors (1C-Shell) to run commands. Persistence: scheduled tasks Citrus uses scheduled tasks to launch its malicious tools automatically. The attackers create the tasks manually through PowerShell: On systems that are not regularly rebooted, such as terminal servers, they sometimes run their tools without establishing persistence at all. Privilege Escalation: vulnerabilities and configuration flaws In every case we know of, the contractor domain account used for initial access had very limited privileges, so the attackers tried to escalate them. To do this, they attempted to exploit the authentication bypass vulnerability CVE-2026-54121 (Certighost); these attempts created machine accounts with telltale names in Active Directory, such as: GHOSTAUFTAFGS GHOSTCZYQVAZS GHOSTIVPRLDZA GHOST{8 random letters} These names are generated by scripts making use of an exploit published on GitHub. The exploit works like this: on behalf of the newly created account, it requests a certificate based on the Machine template from the system holding the AD CS role. The Attributes, Subject, and SubjectAlternativeName fields contain parameters like these: <Data Name='Attributes'>CertificateTemplate:Machine\nSAN:dns=dc01.victim.domain\ncdc:91.210.109[.]118\nrmd:dc01.victim.domain </Data> <Data Name='Subject'>CN=GHOSTABUIEFAD.victim.domain</Data> <Data Name='SubjectAlternativeName'>DNS name =dc01.victim.domain\r\n</Data>The cdc attribute specifies the IP address or name of the system that the certification authority must contact to verify the data. The attackers specify the address of a system they control (in this case, 91.210.109[.]118) and send forged data from it. If exploitation succeeds, the certification authority issues a certificate with the specified parameters, based on the specified template. Once the certificate is issued, the domain controller name in its SubjectAlternativeName field lets the attackers authenticate as the domain controller account. In one case, the attackers also uploaded an executable for persistence, on behalf of which PowerShell scripts were launched with nonstandard HostName (Имя узла) field value. Field name translation Severity HostName HostVersion HostId HostApplication EngineVersion RunspaceId PipelineId CommandName CommandType ScriptName Although the file was later deleted, indirect evidence hints at its purpose. For example, the MSFConsole value may indicate that the file is a component of the Metasploit framework. The PowerShell scripts run through this file included an exploit for the CVE-2020-1337 vulnerability; the same exploit is available in the Metasploit GitHub repository. Beyond classic vulnerabilities in Microsoft products, the attackers also took an interest in 1C:Enterprise servers with insecure configurations (article in Russian). On top of the configuration flaws, 1C:Enterprise systems are frequently accessed by support staff and administrators who hold elevated privileges in Active Directory. Together, these factors make it easy for attackers to escalate privileges and start moving laterally. Stealth: covering tracks and masquerading To hinder incident response, the attackers delete their tools and output files and clear the command history. While the tools are still in use in the victim’s infrastructure, the attackers typically give them and their auxiliary objects legitimate-looking names: KasperskyGPO_Deploy_64.exe and KasperskyGPO_Deploy_64_FIXED.exe are self-extracting archives. They contain the Deploy-KasperskyGPO.ps1 script, a directory with a malicious Group Policy Object, and one of two archives, KasperskyAgent.exe or agent.exe. KasperskyAgentInstaller.exe, KasperskyAgent.exe, and agent.exe are self-extracting archives containing the ransomware Trojan executable and auxiliary files. Kaspersky GPO is the name of the Group Policy Object that distributes the ransomware Trojan in the victim’s infrastructure. KasperskyAgentInstallTask and Sysvc are names used for the scheduled task that runs the self-extracting ransomware archive files. Deploy-KasperskyGPO.ps1 is the PowerShell script that creates the malicious Kaspersky GPO. Kaspersky_GPO_Deployment.log is the log of the Deploy-KasperskyGPO.ps1 script. Note that using the Kaspersky name in malicious file names doesn’t help the attackers avoid detection. Kaspersky solutions successfully detect and block these malicious files. Defense Impairment: weak access policies for security tools play into attackers’ hands To stay under the radar longer, the attackers clear event logs on some systems using the built-in wevtutil utility. In addition, once they have sufficient privileges, they disable antivirus protection on hosts, which lets them run tools such as mimikatz. The attackers also go after the centralized management consoles for security solutions, which they then use to disable protection en masse. At the Impact stage, the attackers also use a Group Policy Object that modifies Windows Defender settings in the registry to switch it off. As a result, the antivirus did not respond when the ransomware was launched. Finally, if they have sufficient privileges, the attackers manually add their malicious tools to the antivirus exclusion list. Credential Access: mimikatz, a keylogger, and extraction of credentials from files To capture keystrokes on a compromised system, the attackers use a modified version of the peeping-tom keylogger, whose source code is available on GitHub. The keylogger executable and its log file are located at the following paths: C:\ProgramData\Oracle\Java\jhost.exe C:\Users\<username>\AppData\Roaming\Microsoft\CLR\ErrorLog.txt In the sample we found, stolen data was sent to 91.210.109[.]118. Persistence for the keylogger is provided by the scheduled task described above in the Persistence section. To dump credentials from memory, the attackers use mimikatz. Files related to mimikatz are located at the following paths: C:\ProgramData\x64\mimidrv.sys C:\ProgramData\x64\mimikatz.exe C:\ProgramData\x64\mimilib.dll C:\ProgramData\x64\mimispool.dll To hunt for credentials and other secrets (SSH keys, access tokens, and the like) in files on accessible network shares, the group uses Snaffler. To simplify running the tool, the attackers drop a configuration file on the system: Besides data from network shares, the attackers were interested in data stored in password managers (for example, KeePass) on administrator workstations. Discovery: the standard toolkit Local discovery After gaining control of a compromised system, the attackers ran a basic set of commands to identify the current user, running processes, network interface settings, the system’s external IP address, and so on: whoami tasklist quser ipconfig curl 2ip[.]io Remote discovery In the early stages, the attackers used the fscan scanner to gather information on the internal infrastructure. They were particularly interested in the following ports: 135 (RPC) 139 (NetBIOS-SSN) 1433 (Microsoft SQL) 8006 (Proxmox VE) Once they had the access they needed and had moved laterally, the attackers ran ADRecon on domain controllers and SharpHound on one of the workstations. The attackers also used PowerShell to run LDAP queries against the controllers of adjacent domains, pulling lists of domain systems, users, and groups. Russian text translation The user has no additional groups in memberOf (primary only) User not found As an alternative to PowerShell, the attackers used the net.exe utility to get information about domain users and privileged groups: net users /domain net group "Domain Admins" /domain net group "Администраторы домена" /domain Lateral Movement: SSH, RDP, and WinRM For lateral movement, the group relies on standard remote administration protocols: SSH, WinRM, and RDP. The attackers connect to systems either through previously deployed tunnels or directly from the compromised host. Command and Control: delivering tools to the system To deliver its tools to target hosts, the group uses built-in OS utilities. Specifically, the incidents involved: certutil: The Windows BITS background service (invoked in two ways): cURL: PowerShell: Creating tunnels with Xray The certutil and BITS commands shown above are what the attackers used to download Xray onto victim systems. They then used Xray to set up reverse VLESS tunnels to the command-and-control server. The configuration file, stored alongside the Xray executable, was usually named config.json. In some cases, the attackers deleted it right after starting the tunnel to hide the Xray configuration from defenders. Judging by the configuration files recovered during the analysis, the attackers used port 443 on the VLESS server to blend in with legitimate HTTPS traffic. The configuration files also contain blocks that set up the REALITY protocol, which is intended to disguise the attackers’ traffic as requests to the legitimate site mirror.yandex.ru: The traffic was also disguised as requests to another legitimate site, yastatic.net: Installing AnyDesk The PowerShell command above AnyDesk, which the attackers used to remotely control compromised hosts. After the download, the attackers installed the software with the --silent flag to avoid alerting the user, set a connection password, and used PowerShell to pull the infected machine’s ID (which AnyDesk uses for remote connections on the client side) from the configuration file: Collection & Exfiltration: data from messaging apps Right before encrypting the data, the attackers connected to one of the domain controllers and ran the PowerShell script steal_tgs.ps1, which created the tdatas directory. According to the NTFS USN journal, while the script ran, 7-Zip created archives in this directory with telltale names hinting at their contents: <system_name>_<date>_<username>_tdata.zipThe directory name tdatas and the substring tdata may refer to the C:\Users\<username>\AppData\Roaming\Telegram Desktop\tdata directory. The Telegram messaging app uses this directory to store authorization keys, session data, app settings, and other session information. So the attackers were harvesting messaging app data from remote systems they could reach, packing it with 7-Zip and uploading it to an external web service through Google Chrome. Impact: Sn00py ransomware Trojan The Citrus group uses ransomware from the Sn00py family to encrypt data. It’s written in Go and uses the RSA-2048 and ChaCha20 algorithms to encrypt user files (but not system files) on Windows systems. Encrypted files receive the .citrus extension. For now, decryption is impossible without the attackers’ private key. When launched, the ransomware opens a console on the victim’s device, where it outputs the commands it runs. It also attempts to modify the boot configuration data (BCD) by invoking a nonexistent executable, bcedit (likely a typo for bcdedit): The ransomware’s console output contains the string: We`re going to do something special today :). Made with RaaS platform Sn00py.The string likely means the ransomware is distributed under the ransomware-as-a-service model, where attackers don’t write the malware themselves but subscribe to a ready-made offering. The ransomware configuration contains the Citrus group’s public key in the pubkey parameter: -----BEGIN PUBLIC KEY----- A7+eV3M+EDIh5kId+vf46QkKpAOKxUxv97PDFj66ox+uE0GV9UQhrSmBAoGAcyNI +z7noIwrFYnHi6wtj8gLEOT0hE/cNDp0VLoUnAzi551kZA7J3Q575jwqrJcDrZSO JLkZX7pxLLSd9iQdxMxDrLYZGRtiht8ToD5OGZri36oPvnW56ijJZ/NMzlFtVr7V iSZJr5Qkz2cxShcSuhDLLXmzleclBd7HQtWTuZUCgYEAqN8WFAZxkV2e1p4v3U98 VOu4XxEfqAc2Gs2Ccs/kkWoX/1fxvuSRcF6/hMdfVwUP0z+/fnhbFMNfysBeWo1W ZfmpBF/HbnRSg2ZDLWIwXEXEsNNSRmlvwyHWSEZgyG1xjgjSZKWuxo92WVmPxb5i S6NLrZkHPHwqaBy8CnD6ft8= -----END PUBLIC KEY-----The host_blacklist parameter also lists the system names that are exempt from encryption: [ "DC01", "DC02", "DC03", "DC04" ]This list includes the domain controllers used to distribute the policy that launches the ransomware. This way, the attackers ensure the policy keeps propagating uninterrupted. As it runs, the Trojan drops CITRUS_README.txt files containing the ransom note: -[ All your data were encrypted ] | |-If you try to decrypt them yourself, you will lose your data. To decrypt all systems, you need to contact us for guidance and a data recovery tool in the future. If you ignore our offer and the conversation does not take place, we will take extreme measures against your company and your employees, as a result of which you will lose access to all resources of your network and lose your reputation. | |-To contact us - register your mail here: https://account.proton.me/mail/signup?plan=free and write to us by email: [REDACTED] |-Further negotiations regarding this situation will be conducted there. Also we have Telegram: [REDACTED] | |-Be sure to use a VPN, and do not attempt to write from other email addresses, as there is a high chance that the messages will not be delivered to either party. | |-You have 72 hours to contact us to establish negotiations and interaction, starting from the date of creation of this file. |-If you do not contact us within 3 days, we will consider this a refusal to cooperate. This will entail immediate measures, such as: Dumps of your services, personal data of employees, accounting, contracts and source code. | |-Warning: \\_ Do not delete, modify, or attempt to recover files by any means other than using our key and decryptor. This will damage your data, and we cannot guarantee its recovery. \\_ Do not try to make this public, as you will only harm yourself and your reputation.As mentioned above, the group uses malicious Group Policy Objects to launch the ransomware across victim systems en masse. The GPOs are created by self-extracting archives, of which we have seen two versions. Each archive contains: A self-extracting archive with the ransomware Trojan and auxiliary files. A directory containing the Group Policy Object. The policy drops the ransomware archive on the target system, creates a scheduled task that runs the archive with the parameters /quiet /norestart, enables the WinRM service, and disables the Volume Shadow Copy service and Windows Defender antivirus protection. It also sets a desktop wallpaper displaying the ransom note. A PowerShell script that copies the ransomware archive to the \\<current_domain_name>\SYSVOL directory on the domain controller and links the malicious GPO to the domain using the Import-GPO and New-GPLink One version of the PowerShell script contained comments suggesting that it was likely edited with an LLM: Links to Toy Ghouls While analyzing Citrus activity, we noticed several similarities to Toy Ghouls. Although their infrastructures don’t directly overlap, the two groups share TTPs: they encrypt their victims’ systems, use a similar set of tools (1C-Shell for remote command execution on 1C:Enterprise servers, mimikatz, PsExec, and ADRecon), and store these tools in the same directories. What’s more, both groups are Russian-speaking and attack Russian companies only. In several incidents, we saw the same infrastructure compromised simultaneously by both Toy Ghouls and Citrus. Conclusion What makes Citrus interesting is its unconventional approach to network tunneling and its use of AI to generate auxiliary tools. Even so, the attackers largely rely on well-known tools and techniques, which makes early detection somewhat easier. Kaspersky solutions detect all the activity described in this article. That said, the Citrus attacks are another reminder that contractor access to an organization’s infrastructure must be tightly controlled and restricted. After all, compromising contractor accounts is exactly how the attackers get into their victims’ networks. We’ll continue to track the group’s activity and report new techniques as we discover them. Indicators of compromise File hashes Xray d631627131b90d576d77f4bf530e1abe mst.exe, sabycenter.exe, webex.exe, rpchost.exe Meterpreter stager 7107fb029e7c63523e3aca5fc8e56b38 2341.exe Keylogger e251df2d0b7c3682965efb4d2009a2f4 jhost.exe Sn00py 17b29b6c9de80402a45e321bbe1168fa build_64.exe 9eee984b187423c46c10a63d080da15d build_64.exe fscan cf903e4a1629aa0582fd0363b5786676 fscan.exe File paths C:\ProgramData\ADRecon-Report-* C:\ProgramData\SharpHound.exe C:\ProgramData\Snaffler.exe C:\ProgramData\WebEx\config.json C:\ProgramData\WebEx\host_to_ip.ps1 C:\ProgramData\WebEx\ping_oldwin.bat C:\ProgramData\WebEx\web.txt C:\ProgramData\WebEx\webex.exe C:\ProgramData\ad_ru.ps1 C:\ProgramData\computers.txt C:\ProgramData\config.json C:\ProgramData\default.toml C:\ProgramData\fscan.exe C:\ProgramData\llc\*_BloodHound.zip C:\ProgramData\mst.exe C:\ProgramData\oracle\java\jhost.exe C:\ProgramData\pve.exe C:\ProgramData\rules C:\ProgramData\sabycenter.exe C:\ProgramData\steal_tgs.ps1 C:\ProgramData\tdatas C:\ProgramData\x64\mimikatz.exe C:\ProgramData\xray.exe C:\ProgramData\rpchost.exe C:\ProgramData\3777.exe C:\ProgramData\2341.exe C:\ProgramData\ChromeSetup.exe C:\ProgramData\Kaspersky\KasperskyAgent.exe C:\ProgramData\Kaspersky\KasperskyAgentInstaller.exe C:\ProgramData\1.txt C:\ProgramData\7z2603-x64.exe C:\ProgramData\Kaspersky\task.log C:\ProgramData\enum.ps1 C:\ProgramData\kp.ps1 C:\ProgramData\ping.ps1 C:\ProgramData\result.txt C:\ProgramData\user_activity_report.txt C:\Users\*\AppData\Local\Temp\7ZipSfx.000\Deploy-KasperskyGPO.ps1 C:\Users\*\AppData\Local\Temp\Kaspersky_GPO_Deployment.log C:\Users\*\AppData\Local\Temp\7ZipSfx.000\KasperskyAgent.exe C:\Users\*\Desktop\KasperskyGPO_Deploy_64.exe C:\Users\*\Desktop\KasperskyGPO_Deploy_64_FIXED.exe C:\Windows\SYSVOL\domain\KasperskyAgent.exe C:\Windows\SYSVOL\domain\build_64.exe C:\Windows\SYSVOL\domain\icon.ico C:\Windows\SYSVOL\domain\wallpaper.bmp C:\Windows\Temp\agent.exe C:\Windows\build_64.exe C:\Windows\icon.ico C:\Windows\wallpaper.bmp C:\Users\*\AppData\Roaming\Microsoft\CLR\ErrorLog.txt C:\Users\*\Desktop\webex.zip Scheduled task names Java rpchost agent KasperskyAgentInstallTask Sysvc IP addresses 91.210.109[.]118 91.210.108[.]180
Microsoft has fixed Outlook sign-in and mail delivery issues on Exchange Server systems after installing the October 2026 Windows Server security updates. Microsoft acknowledged this known issue in mid-October, confirming that users had trouble accessing email or signing in to Outlook after installing the latest updates on systems running Windows Server 2019 and later. As explained at the time, the sign-in and mail flow issues are caused by a new default limit on the amount of memory Endpoint Mapper uses when handling Endpoint Lookup calls, introduced by the October 2026 updates. "After installing the October 2026 Windows security update [..], some on-premises Exchange servers might experience issues accessing or sending email. Users might be unable to sign in to Outlook on the web (OWA), or email messages sent from Outlook might remain in the Outbox and not be delivered. Additionally, Exchange might experience issues accessing mailboxes during mailbox replication," Microsoft said at the time.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Details of the vulnerabilities are below - CVE-2026-20320 (CVSS score: 7.5) - An improper restriction of XML external entity
Nitori, a major Japanese furniture and home accessories retailer, discovered that an attacker accessed a system on its network and may have stolen 37.62 million customer records. The intrusion was detected on November 6, and the company blocked the unauthorized access. However, an investigation into the incident revealed that the attacker likely had access to the system since mid-October. Nitori, often called the “IKEA of Japan,” is a major furniture and home furnishings retailer that operates 879 stores in Japan and another 219 stores across China, South Korea, Taiwan, Thailand, Singapore, and Hong Kong. The firm has an annual revenue of $5.8 billion. According to the company's notification, the incident impacts individual customers, corporate members, and non-members who placed orders through official Nitori stores and online shops.
A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts. Xen Orchestra is a web-based management platform developed by French software company Vates, used to manage XCP-ng virtualization environments, including virtual machines, hosts, and pools. The vulnerability, tracked as VSA-2026-062, affects Xen Orchestra and the Xen Orchestra Appliance (XOA) and allows remote attackers with network access to the management interface to bypass authentication using a specially crafted cookie. A CVE identifier and CVSS score have not been assigned yet. According to a Vates security advisory, the flaw stems from how Xen Orchestra processes authentication tokens sent through REST API requests.
Binance is warning about a vulnerability in Apple’s iOS 26.7.1, 27.0.1, and 27.2 that could allow third-party apps to read private files stored by other apps, including cryptocurrency seed phrases, secret keys, and login credentials. The crypto exchange clarifies that the issue is at the iOS level and does not impact only the Binance app. “A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem,” Binance says. At this time, no cryptocurrency losses have been confirmed, but Binance urges users to install the update immediately as a precaution. The company recommends that users delete any unnecessary and untrusted apps and apply the latest versions for iOS and other apps.
A public iOS sandbox escape could expose wallet keys, Binance warns. No attacks are reported and no fix is confirmed. On 10 November, Binance warned users about a public iOS sandbox escape that lets one app read the files of other apps. Seed phrases, private keys and login credentials could be exposed to a malicious app, the exchange said. “A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.” reads the warning. Binance advises users to remove apps installed from untrusted sources, update iOS and all apps to the latest official versions, and, if a breach is suspected, move funds to a new wallet on a clean device and reset all active login sessions. A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.… — Binance (@binance) November 10, 2026 A researcher known as ‘forcequitOS’ published the PoC exploit code, called worse_query, on GitHub. Apple released security updates for both iOS versions the following day, but its release notes mysteriously don’t report a fix for the issue. The good news is that neither Binance nor the researcher has reported any attacks or data theft. “worse_query is the direct successor to bad_query and essentially replaces it. To use worse_query, you’ll have to set up an App Group container for your app.” forcequitOS wrote. The proof-of-concept can access the data folders used by all apps and, on iOS 27, some system folders as well. To work, an app must create an App Group container. The researcher says the code is intended for developers and “isn’t useful by itself.” However, other developers have already used it to build apps that can be installed on iPhones. One example is WQ Files, a file manager developed by Christoph Kolbicz, TheHackerNews reports. “WQ Files is a file browser, app data manager and cache cleaner for iOS 26 and 27. “WQ” stands for worse_query, the sandbox technique it is built on. It reaches other apps’ and system containers with no jailbreak and no kernel exploit. Tested on iOS 26.7.1, 27.0.1 and 27.2.” reads the description. It can access data belonging to other apps without requiring a jailbreak or a kernel exploit. It can also edit, delete and clear that data. Users can install it through sideloading tools such as AltStore and SideStore, which automatically create the required App Group when users sign in with their Apple ID. I agree (and I wasn't planning on it), but I don't mind the loss of any potential bounty tbh, when Apple was stalling on responding to me and people started larping with it on here. — forcequit (@forcequitOS) November 8, 2026 The forcequitOS says they have no intention of seeking a bug bounty from Apple and are willing to give up any potential reward because of Apple’s delayed response and the inappropriate behavior of people publicly misusing or exaggerating the exploit. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Apple)
SAP patched 35 vulnerabilities in its November 2026 security updates, including four maximum-severity issues affecting its NetWeaver, Web Dispatcher, and Gateway software. The company addressed memory corruption (CVE-2026-76964) and missing authentication (CVE-2026-120017) flaws in the NetWeaver Application Server ABAP's Internet Communication Manager and SAML2 Service Provider components. NetWeaver is the core app platform that underpins SAP's business software and handles application integration, authentication, user management, and data processing. The other two maximum severity vulnerabilities stem from a broken access control weakness (CVE-2026-89103) in SAP Gateway and a memory corruption issue (CVE-2026-89126) in SAP Web Dispatcher. Gateway is a core framework that enables external apps to securely connect to SAP backend systems, while Web Dispatcher (deployed in almost every enterprise SAP environment) is a specialized component that acts as a load balancer and reverse proxy for web requests entering an SAP system architecture.
Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges. Barracuda released security updates to address the two flaws (tracked as CVE-2026-116606 and CVE-2026-111560) one week ago. The first stems from an Email Security Gateway (ESG) authentication weakness that can be exploited to modify an appliance's global configuration, while the second lets unauthenticated attackers inject OS commands that execute with root privileges. Barracuda also said that successful attacks require access to the administrative user interface (Admin UI) of targeted devices and advised customers to restrict access to trusted internal networks and use appropriate network access controls to limit exposure.
Confirm this action.
Leaving now will discard your changes.