Latest/Morning Threat Brief/2026-11-14

Morning Threat Brief: Check Point gateways hacked to root with a wiper waiting, ransomware wipes a VMware estate with no hypervisor bug, the FBI disrupts a $400M fake video call scam, and AI agents break in under three hours

Good morning. Attackers chained two PHP flaws to a brand new Check Point zero-day to take root on security gateways, then moved to VMware hosts and ran a data wiper. A ransomware gang wiped an entire virtualization estate in ten days without exploiting a single hypervisor bug, using only stolen credentials and VMware's own management tools. The FBI seized the cloud infrastructure behind a North Korean fake video call scam that stole more than $400 million in crypto. And the FBI warns an AI pentesting framework is now automating break-ins that reach privileged access in under three hours. If you run Check Point gateways or VMware, check them first thing today.

01

A Check Point zero-day joins CISA's exploited list, and the attacks behind it already wiped VMware hosts.

Do this Install the November Jumbo Hotfix now, starting with internet-facing Mobile Access portals.

02

Ransomware wiped an entire VMware estate in ten days without one hypervisor bug.

Do this Treat vCenter as a Tier 0 asset. Separate virtualization identities from enterprise administration.

03

The FBI seized the infrastructure behind a $400 million fake video call scam.

Do this If a video call asks you to install something or run a command, hang up and reach the person on a channel you already trust.

04

The FBI warns an AI pentesting framework is breaking into networks in under three hours.

Do this Make sure no AI agent console is reachable from the internet.

KEV catalog 1,781 entries, 2 new todayDue Mon Nov 16: CVE-2026-123039Due Mon Nov 16: CVE-2026-114713Due Wed Nov 18: Apple CVE-2024-27834Due Fri Nov 20: SonicWall CVE-2026-19868

Read the full brief
Kevin Swaney, Principal Cybersecurity Engineer

Kevin Swaney

Principal Cybersecurity Engineer · Atlanta

Every morning I write up the threats that matter and what to do about them, plus longer takes on AI security, identity, and governance.

About

AI Agent Security

Featured series
CrowdStrike and NVIDIA take AI agent security into silicon 2026-10-24 CrowdStrike and NVIDIA take AI agent security into silicon Anthropic Took Its AI Evaluations Offline. The Problem Is Containment, Not Capability. 2026-10-13 Anthropic Took Its AI Evaluations Offline. The Problem Is Containment, Not Capability. Identity Controls for AI Agents: Treat Them Like Privileged Accounts 2026-10-10 Identity Controls for AI Agents: Treat Them Like Privileged Accounts

// Top Story

Microsoft 365 Is Down for Tens of Thousands, and This Week's Security Patch Is Breaking Windows Too

Outlook and Microsoft 365 went down for tens of thousands of users on Thursday afternoon, November 12.

November 12, 2026 · Analysis

Writing

2026-11-13Nvidia loses its founder CEO days before earnings. What changes for AI teamsAnalysis 2026-11-12Microsoft 365 Is Down for Tens of Thousands, and This Week's Security Patch Is Breaking Windows TooAnalysis 2026-10-26Anthropic Filed to Go Public. Here Is What That Means for the Businesses That Depend on Claude.Analysis 2026-10-25The Headlines Say the Internet Is Broken. Here Is What You Actually Need to Do.Analysis 2026-10-25Black October: A Disclosure Wave, Not a Single AttackAnalysis 2026-11-02Election Security: If a Message Claims Your Registration Is at Risk, Do Not Click ItAnalysis 2026-11-14Check Point gateways hacked to root, ransomware wipes a VMware estate, the FBI disrupts a $400M fake video call scam, and AI agents break in under three hoursThreat Brief 2026-11-13Attackers hijack ScreenConnect panels, a new N-central zero-day beats the patch, police seize StealC servers, and Citrix patches 10 critical flawsThreat Brief 2026-11-1230-plus N-central zero-days under attack, a new Windows flaw with no patch, Xen Orchestra logins bypassed, and Maersk confirms a breachThreat Brief 2026-11-11Microsoft patches an exploited Outlook zero-day, Barracuda flaws chain to root, SAP patches four perfect 10s, and Vanderbilt's attacker claims a million SSNsThreat Brief 2026-11-10Chrome patches its eighth exploited zero-day of 2026, Fireworks AI is breached again, CISA adds four exploited flaws, and Vanderbilt is hitThreat Brief 2026-11-09A cloud host tells every customer to rotate all keys, your AI coder may have posted your passwords on GitHub, a retailer breach hits 7.7 million, and a data broker's SSNs are claimed exposedThreat Brief 2026-11-07Your VPN's MFA can be bypassed, a runaway AI agent breached a company, crypto investigators lost every customer's credentials, and SSH has a no-password bugThreat Brief 2026-11-06Ransomware reached the hypervisor through a monitoring tool, a library system goes dark, freezers draw a federal warning, and DigiCert confirms a breachThreat Brief 2026-11-05An old Apple bug joins KEV as APT29 poisons websites, a perfect 10 Metabase flaw is still being hit, DreamHost confirms a two month breach, and WhiteArmor names UnileverThreat Brief 2026-11-04WordPress joins KEV with a Friday deadline, a Zyxel patch that did not patch, a perfect 10 Node-RED flaw under attack, and ransomware that may have run on autopilotThreat Brief 2026-11-03Ivanti patches the last two VPN zero-days, Synology boxes hit by C3RB3R, a security tool turned backdoor, and Google kills a 1.3 million box botnetThreat Brief 2026-11-02BeyondTrust probes widen, Trigger.dev secrets exposed, BTCPay hot wallets drained, and the Amadeus breach widensThreat Brief 2026-11-01FBI names North Korea in the $6.3 billion Binance theft, Chainalysis breached by agentic AI, and Northflank customers told to rotate everythingThreat Brief 2026-10-30GitLab 10.0 hits KEV, Cisco joins it, and a $6.3 billion theftThreat Brief 2026-10-29Linux kernel chain to root, VMware logging blind spot, and Cisco firewalls crashingThreat Brief 2026-10-28PolyShell and Brotli hit KEV, Apple patches 286 bugs, and a fake IT desk in TeamsThreat Brief 2026-10-27PHP2Shell hits KEV with an October 29 deadlineThreat Brief 2026-10-26FortiSIEM is now being exploited, PHP2Shell RCE confirmed, and an unverified J.B. Hunt claimThreat Brief 2026-10-2570,000 firewall credentials harvested from the edgeThreat Brief 2026-10-24CrowdStrike and NVIDIA take AI agent security into siliconAI Security 2026-10-24AI Agent Security Week: OpenAI just took its frontier models off the live internetAI Security 2026-10-24CISA confirms the Collabora Nextcloud flaw is being exploited, and a Qilin bank listing that proves nothing yetThreat Brief 2026-10-23VeloCloud zero-day turns read-only logins into superusers, Signal calls that never hang upThreat Brief 2026-10-22PHP2Shell exploited before the patch, LiteLLM poisoned on PyPIThreat Brief 2026-10-21SafePay at 600 victims, Qilin and INC hit GlobalProtectThreat Brief 2026-10-2011M Records Gone, 38 Ships on a Ransom ListThreat Brief 2026-10-19The 20-Year-Old Flaw in Every Apple DeviceThreat Brief 2026-10-17Proofpoint Is Buying Varonis for $6.3 Billion.Analysis 2026-10-17The Support Tool That Became a Skeleton KeyThreat Brief 2026-10-16A Phone Call, a Billion Phish, and a Fraud Ring DismantledThreat Brief 2026-10-15Two New Zero-Days Hit Your Edge, and You Have Three DaysThreat Brief 2026-10-14Three Ransomware Deadlines Hit Today. The Claims Are Unverified. Your Playbook Should Not Be.Analysis 2026-10-13Anthropic Took Its AI Evaluations Offline. The Problem Is Containment, Not Capability.AI Security 2026-10-12Don't Be Cruel to the Chatbot: What Anthropic's Policy Update Really Tells Security TeamsAI Security 2026-10-11Ransomware Comes for the Consultants: What the Deloitte Claim Tells DefendersAnalysis 2026-10-11Don't Make It Easy for Them: Cybersecurity Awareness Month 2026Analysis 2026-10-10Identity Controls for AI Agents: Treat Them Like Privileged AccountsAI Security 2026-10-10AI Is Practically Free Right Now. That Is Exactly Why the Labs Are Bleeding.AI Security
All writing

Threat Intel

Tool Threat Check Analyze email headers, check file hashes and URLs. Live feed Vuln Watch Zero-days and actively exploited flaws, and what to do. Detection IOC Library Indicators worth hunting for, with the detection angle.

About

Kevin the Cyber Guy is the threat intelligence publication of Kevin Swaney, principal cybersecurity engineer with 17+ years across banking, payments, and consulting. Every morning brings a new Morning Threat Brief: one brief, one thing to do. The Vuln Watch tracks zero-days and exploited flaws, and the IOC Library collects indicators worth hunting for.

More about Kevin Swaney

Follow

Instagram @kevinswaneycyber Daily briefs and carousels. Facebook Kevin Swaney Briefs and analysis. LinkedIn Kevin Swaney Professional updates. Substack Kevin Swaney Cyber The brief, by email.