Attackers chained a newly patched Check Point Gaia privilege escalation zero-day with the already patched PHP2Shell flaws on unpatched gateways to backdoor gateways and, for some victims, wipe VMware ESXi hosts. US authorities disrupted North Korea's FaceStealer deepfake video-call scheme and moved to seize more than US$1.2 billion stolen from Binance. PostgreSQL fixed 52 flaws, and Microsoft reports broad recovery from its Microsoft 365 outage.
Microsoft 365 outage update Status page still shows degradation for Microsoft 365 business and consumer services (Azure clear); as of about 5:57am AEDT 14 Nov Microsoft reports broad recovery, says the underlying issue is addressed and service is still being restored to remaining customers and regions. Microsoft attributes the incident to an issue from an earlier network capacity upgrade that surfaced after a recent network change, not cyber or AI; root cause not yet detailed, post-incident report to follow. Sources: https://status.cloud.microsoft/m365 ; https://www.pcworld.com/article/3285440/microsoft-ai-hackers-not-to-blame-for-outlook-services-outage.html ; https://apnews.com/article/microsoft-outage-outlook-email-365-status-down-d92547a821930290db2964388016979a
Global threats
Check Point Gaia zero-day (CVE-2026-123039) exploited after PHP2Shell; TSGA backdoor and ESXi wiper Dynamic CLI world-writable socket gives local users root (CVSS 7.8). Entry was via gateways left unpatched against PHP2Shell (fixed since 23 Oct). Activity from 30 Oct (Israeli organisations), wider wave from 2 Nov across multiple countries and sectors (Check Point Research); about two dozen customers hit. CISA KEV added 13 Nov, due 16 Nov. Fixed in Jumbo Hotfix Accumulator: R82.20 Take 14, R82.10 Take 52, R82 Take 132, R81.20 Take 174. R81.10 and R81 are also affected but have no fix listed: upgrade or apply the interim mitigation, stopping dynamic_server (see sk1000362). PHP2Shell (CVE-2026-109618, CVE-2026-109619) fixed per sk1000302. Sources: https://blog.checkpoint.com/security/security-advisory-active-exploitation-of-php2shell-and-local-privilege-escalation/ ; https://support.checkpoint.com/results/sk/sk1000362 ; https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/ ; https://www.cisa.gov/known-exploited-vulnerabilities-catalog
US disrupts North Korea's FaceStealer scheme; US$1.2 billion of Binance theft seized or restrained Recorded webcam video and deepfakes in fake meetings; more than US$400 million stolen in 18 months; 900+ victim videos seized; open-source maintainers increasingly targeted. Sources: https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency ; https://www.fbi.gov/investigate/cyber/facestealer-cryptocurrency-theft-scheme ; https://therecord.media/stolen-binance-crypto-recovered-doj-facestealer-disrupted
Quantum Systems confirms cyberattack by "hostile actors" German drone maker detected the incident in late October; says it is contained and drones are safe to operate. The Bundeswehr grounded the drones as a precaution, Reuters reports; a company spokesperson said on 13 Nov they are flying again (Bundeswehr has not confirmed). Sources: https://quantum-systems.com/news/cyberattack-defeated/ ; https://www.aerotime.aero/articles/bundeswehr-quantum-systems-drones-flying-again-cyberattack
SilentAir intercepts calls and SMS from inside Asian mobile networks Enea: hacked operator equipment in at least six Asian countries, mostly Taiwanese targets, SS7/Diameter abuse, intercepted 2FA codes; China link low confidence. Sources: https://www.securityweek.com/silentair-hackers-intercept-calls-sms-from-inside-mobile-networks/ ; https://thehackernews.com/2026/11/silentair-hijacks-asian-telecom.html
Trezor finds implants in wallets sold by CryptoBilis Three Safe 5 wallets carried a board that captures recovery phrases. Firmware 2.13.1 stops the implants found so far; buyers from CryptoBilis since March should move funds to a new wallet and phrase. Affected devices were bought 20 Aug to 23 Sep; no reported losses. Source: https://trezor.io/blog/news/our-cryptobilis-investigation-what-we-found-and-what-weve-changed
UnrealIRCd flaw added to CISA KEV CVE-2026-114713 (improper neutralisation of delimiters), added 13 Nov, due 16 Nov. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Australian focus
Zenith Payments (Rental Rewards) cybersecurity event Service interruptions; payments continue; no payment card or ID document access found to date; investigation ongoing. Source: https://rentalrewards.com.au/notice
Bookeasy: containment complete Validated by independent experts; no credit card access identified; partners advised to warn customers with bookings in the past 12 months. Source: https://www.bookeasy.com/bookeasy-status-update/
AI security
Codex issue-labelling workflow prompt injection chain Depi: untrusted GitHub issue text passed into a Codex agent's prompt, after which the researchers showed control over what could be published to the real @openai/codex npm package; fixed by OpenAI, initial US$1,000 bounty paid with the report still under review, no malicious release reported. Source: https://depi.security/blog/20261111-backdooring-codex/
Tool hijack vs argument hijack in prompt injection Verno Labs study on four open-weight models (8B to 12B); combined defences cut average hijack rate from 84% to under 2%. Single study, not peer reviewed. Source: https://vernolabs.ai/research/wrong-tool-or-wrong-value-inside-two-kinds-of-prompt-injection
Industry and patches
PostgreSQL fixes 52 flaws including CVE-2026-6460 Several flaws rated CVSS 8.8 lead to code execution, including type confusion after ALTER ... SET DATA TYPE (CVE-2026-6460), CVE-2026-18447 and CVE-2026-116304. Fixed in 18.7, 17.12, 16.16, 15.20 and 14.25; rebuild C-language extensions. No exploitation reported. Sources: https://www.postgresql.org/about/news/postgresql-187-1712-1616-1520-1425-and-19-rc-2-released-3442/ ; https://www.postgresql.org/support/security/CVE-2026-6460/
Mior and Skyfall attacks on AMD SEV-SNP Malicious host with hypervisor (and, for Mior, BIOS) control can read confidential VM data; Mior can forge attestation. AMD firmware and microcode dated 12 Aug; platform firmware to server makers November (Skyfall) and December (Mior). Sources: https://xca-attacks.github.io/mior/ ; https://skyfall-attack.github.io/ ; https://thehackernews.com/2026/11/new-mior-and-skyfall-attacks-let-rogue.html
eMudhra revokes eight more CAs; Microsoft removes roots on 16 November Sources: https://www.itnews.com.au/news/emudhra-fiasco-widens-eight-more-cas-revoked-microsoft-pulls-trust-630303 ; https://thehackernews.com/2026/11/emudhra-revokes-8-more-cas-it.html
November Patch Tuesday side effects: Windows activation (0x80041008) and printing issues SLMGR/KMS activation and product key commands fail (already activated devices stay activated); documents with zero-height or zero-width images may fail to print, mainly Word via GDI. Release health: WI1549486, WI1549472. Sources: https://www.bleepingcomputer.com/news/microsoft/microsoft-confirms-windows-activation-failures-after-november-updates/ ; https://www.theregister.com/os-platforms/2026/11/12/microsoft-has-an-image-problem-with-novembers-windows-security-update/5309435
Operation Endgame (Gootloader, CastleRAT, StealC) and Operation TorNado (354 arrests) Sources: https://www.europol.europa.eu/media-press/newsroom/news/354-dark-web-vendors-and-buyers-arrested-in-europol-coordinated-global-crackdown ; https://www.bleepingcomputer.com/news/security/police-arrest-354-vendors-buyers-in-global-cybercrime-crackdown/
Patch priorities 1. Check Point Gaia gateways: Jumbo Hotfix takes above, before 16 Nov; check /var/log/dynamicCli.log for "Rejected connection from unauthorized uid". 2. UnrealIRCd (KEV, due 16 Nov). 3. PostgreSQL 18.7 / 17.12 / 16.16 / 15.20 / 14.25. 4. Test certificate chains to eMudhra roots before 16 Nov.