# Archive
Browse past daily curated stories
Saturday, November 14, 2026
-
1The Hacker News generalOperation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins
Operation Endgame, a multinational law enforcement action, dismantled infrastructure behind Gootloader, CastleRAT, and StealC malware, seizing 235 servers, 257 domains, and approximately 6.4 million stolen credentials belonging to over 40,000 victims. Gootloader was linked to at least 44 ransomware attacks costing $29 million since 2018. Security teams should audit for indicators of compromise from these three malware families and check threat intel feeds for the newly released victim credential data.
-
2The Hacker News generalTrezor Confirms Hidden Implants in CryptoBilis-Sold Wallets That Can Steal Recovery Phrases
Trezor confirmed that three Safe 5 hardware wallets sold by Southeast Asian reseller CryptoBilis contained malicious hardware implants — extra circuit boards that read wallet recovery phrases from the device screen and transmit them over cellular networks to attacker-controlled servers. Trezor examined one device in its lab, identified the others via investigation, and has released a firmware fix. Supply chain integrity verification for hardware wallets is now a critical security concern for crypto asset holders.
-
3The Hacker News generalHackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files
An unknown threat actor began October 30, 2026, exploiting unpatched Check Point Security Gateways via PHP2Shell vulnerabilities combined with CVE-2026-123039, a local privilege escalation flaw in Gaia OS, to deploy a backdoor called TSGA and subsequently wipe VMware ESXi files. Initial targeting focused on Israeli organizations before broadening. Security teams running Check Point gateways should apply emergency hotfixes immediately and audit ESXi hosts for signs of data destruction.
-
4The Hacker News generalNew Mior and Skyfall Attacks Let Rogue Cloud Hosts Steal Secrets From AMD SEV-SNP VMs
Researchers disclosed two new attacks, Mior and Skyfall, against AMD SEV-SNP confidential VMs: Skyfall allows a malicious hypervisor to read VM memory, while Mior additionally enables memory modification and forging of attestation reports, undermining the cryptographic guarantees that SEV-SNP provides. Both require hypervisor-level compromise, and Mior also requires BIOS control. Cloud tenants relying on AMD SEV-SNP for workload isolation should evaluate vendor mitigations and reassess their trust models for shared infrastructure.
-
5The Hacker News generalPostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE
PostgreSQL released patches fixing 52 vulnerabilities, including CVE-2026-6460 (CVSS 8.8), a 22-year-old type confusion flaw that allows any database user with object-creation privileges to execute arbitrary code on the server with OS-level rights. Full remediation requires not only patching but also rebuilding all C-language extensions installed on the server. Database administrators should prioritize this patch cycle and audit extension inventories immediately.
-
6The Hacker News generalNew SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access
A disgruntled researcher publicly released 'SignDrop,' a proof-of-concept exploit targeting Windows' Common Log File System (CLFS) driver that abuses a log-authentication feature added last year to escalate local privileges to SYSTEM via arbitrary file creation in the Windows Defender antimalware process context. No patch is currently available as Microsoft was not given advance notice. Blue teams should monitor for CLFS driver abuse and unusual file creation activity in antimalware process directories.
-
7The Hacker News generalFBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls
The FBI attributed the theft of over $400 million in cryptocurrency over the past 18 months to North Korean threat actors operating a social engineering scheme called FaceStealer, which used deepfake video calls to manipulate victims. Separately, DOJ announced the seizure of $1.2 billion in cryptocurrency tied to the 2022 Binance breach. These coordinated U.S. government actions signal intensified focus on DPRK-linked crypto theft operations targeting financial institutions and exchanges.
-
8SecurityWeek generalApache Patches Critical HTTP Server RCE Found by Anthropic, Google
Apache patched CVE-2026-119618, a critical race condition in the mod_http2 module of Apache HTTP Server that allows unauthenticated remote code execution on any server with HTTP/2 enabled; the flaw was discovered by researchers at Anthropic and Google. Server administrators running Apache with HTTP/2 should apply the patch immediately, as this attack surface is exposed on a large portion of internet-facing web infrastructure.
-
9The Hacker News generalSilentAir Hijacks Asian Telecom Networks to Intercept SMS 2FA Codes and Spy on Taiwanese Users
Enea identified a state-level threat actor dubbed SilentAir that compromised mobile network equipment inside at least six Asian countries to intercept calls, SMS messages, and 2FA codes, with Taiwanese subscribers as the primary targets. The group hijacked legitimate mobile network nodes — an SS7-level class of attack — making detection difficult for endpoint-based security tools. Telecom operators and enterprises relying on SMS-based 2FA in the Asia-Pacific region should treat this as an active threat.
-
10BleepingComputer generalHackers compromise 4,800 GitHub accounts to steal cloud credentials
A campaign dubbed 'wfx-loot' used 4,837 compromised GitHub accounts to open malicious pull requests across 61,764 repositories, injecting secrets-stealing malware into CI/CD pipelines that executed in over 1,800 repositories. The attack targeted cloud credentials stored as GitHub Actions secrets. Security teams should audit GitHub Actions workflows for unauthorized modifications, rotate exposed secrets, and enforce branch protection rules to limit pull request abuse.