Skip to content
Monday, November 9, 2026Nov 9, 2026
Previous issue

Vol. 1, No. 52Composed Nov 10 · 00:53 UTC

SitRep

Cybersecurity, in perspective.

1 critical · 1 elevated3 stories on the wire

Scale without pause magnifies mistakes; attention remains the limiter.
— Marcus Andreelius
ⓘMarcus Andreelius is a fictional AI editorial voice. This reflection is original editorial prose, not a quotation.

You are reading a previous issue. Go to the latest edition →

The situation

N-able Takes Hosted N-central Offline

Researchers disclosed 30-plus alleged flaws; N-able took hosted service offline, while on-prem customers received shutdown guidance.

3 sources

BleepingComputer, CISA Cybersecurity Alerts, CVE Program record

Security researchers disclosed more than 30 alleged zero-day flaws in N-able N-central, including unauthenticated XXE-to-RCE chains, XSS, and privilege escalation. N-able took hosted N-central offline worldwide on Nov. 9 and said a hotfix is in development. The company reported no active exploitation observed so far.

Context

N-able took hosted N-central offline worldwide and urged on-prem customers to shut down servers. The reported flaws include unauthenticated XXE-to-RCE chains, XSS, and privilege escalation; N-able said a hotfix is in development.

Zeno Khosla

Skeptical perspective

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

N-able Reports No Active Exploitation Observed So Far

N-able reported that no active exploitation has been observed so far.

BleepingComputer

The move

2 things to do today

Epictim Draper

  1. Shut down on-prem N-able N-central servers.
  2. Agencies should rapidly remediate the four CVEs CISA added to the KEV Catalog, consistent with BOD 26-04.

On the wire

  • 1critical
  • 1elevated
  • 1moderate
  • 0low
P0Availability

N-able Takes Hosted N-central Offline

More than 30 alleged zero-day flaws · hosted service taken offline worldwide · hotfix in development

Security researchers disclosed more than 30 alleged zero-day flaws in N-able N-central, including unauthenticated XXE-to-RCE chains, XSS, and privilege escalation.1 N-able took hosted N-central offline worldwide on Nov. 9 and said a hotfix is in development.1 N-able reported that no active exploitation has been observed so far.1

Single sourceBleepingComputer

  1. 1BLEEPINGCOMPUTER · N-able N-central Offline After 30+ Zero-Days Published

Copy link to “N-able Takes Hosted N-central Offline”

P1KEV

CISA Adds Vulnerabilities to KEV Catalog

Four CVEs added due to active exploitation · agencies urged to remediate rapidly under BOD 26-04

CISA added four CVEs to the Known Exploited Vulnerabilities Catalog due to active exploitation.1 CISA's alert says agencies are urged to perform rapid remediation consistent with Binding Operational Directive 26-04.1

Updated Since Nov 6: OpenSSH Flaw Allows Oversized Password Logins · CVE-2026-123158 · New: bleepingcomputer.com, cisa.gov, cve.org

Added to CISA KEV: CVE-2026-102895 on 9 Nov 2026; CVE-2026-116779 on 9 Nov 2026; CVE-2026-123158 on 9 Nov 2026 and 1 more · CVE-2026-102895: CVSS 9.8, patch listed (GitHub); CVE-2026-116779: CVSS 9.8 and 2 more

  1. 1CISA CYBERSECURITY ALERTS · CISA Adds Four Known Exploited Vulnerabilities to KEV Catalog

Copy link to “CISA Adds Vulnerabilities to KEV Catalog”

P2Vulnerability

CVE Program Records Brotli Decoder Flaw

CVE-2026-111497 · out-of-bounds write · CVSS 9.2

The CVE Program record lists CVE-2026-111497 as an out-of-bounds write in the Google Brotli decoder, rated CVSS 9.2.1 The record says the flaw can corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially allow code execution.1

Updated Since Nov 6: Cisco Warns of Node.js and Brotli Flaws · CVE-2026-111497 · New: github.com

Timeline

  1. 1 earlier appearance
  2. Oct 29Brotli Decoder Buffer Overflow Risks PAN-OS Dataplane
  3. Oct 31Brotli Decoder Overflow Affects Palo Alto PAN-OS
  4. Weekend, Oct 31Microsoft Details Brotli Decoder Buffer Overflow
  5. Nov 5Cisco Advises on Node.js and Brotli Flaws
  6. Nov 6Cisco Warns of Node.js and Brotli Flaws
  7. This edition

Added to CISA KEV on 27 Oct 2026 (CVE-2026-111497) · CVE-2026-111497: CVSS 9.2, EPSS 0.83 (FIRST), patch listed (GitHub)

  1. 1CVE PROGRAM RECORD · CVE-2026-111497 in Google Brotli, CVSS 9.2: CVE Program record

Copy link to “CVE Program Records Brotli Decoder Flaw”

Known exploited

Added 9 Nov4 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-102895GPUStack GPUStack9 Nov12 Nov
CVE-2026-116779SignalWire FreeSwitch9 Nov12 Nov
CVE-2026-123158OpenBSD OpenSSH9 Nov12 Nov
CVE-2026-123218IBM Aspera Faspex9 Nov12 Nov

Source: CISA KEV catalogue, version 2026.11.10 (released 10 Nov 2026; read by SitRep 10 Nov 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

The wire, last 30 days

This edition has 2 stories rated critical or elevated (P0 or P1); the 24 daily editions from 12 Oct to 8 Nov averaged 3.5. 5 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
9 Nov (this edition)1110
8 Nov0310
7 Nov0300
6 Nov1310
5 Nov0320
4 Nov2200
3 Nov0310
2 Nov0211
1 Nov0300
31 Oct1210
30 Oct1400
29 Oct1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300
12 Oct2200

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

U.S. Urges Critical Infrastructure to Secure Refrigeration Systems

U.S. CISA, FBI and partners urge critical infrastructure to rapidly harden industrial refrigeration and cold-chain systems after European attacks on French blood banks and supermarkets. Recommendations include isolating OT, removing or securing remote access, patching vulnerabilities, replacing end-of-life devices, and maintaining offline backups.

3 reports

SSHole OpenSSH vulnerability exploited to breach Linux systems

Attackers exploited CVE-2026-123158, the SSHole flaw in OpenSSH on musl-based Linux systems to login to password-disabled accounts and may gain root access. Exploitation began after a PoC on Nov 5; first successful exploitation observed Nov 7. GreyNoise logged 16 exploitation chains from six source IPs; 27.5M port-22 scans and 20.1M SSH attempts.

3 reports

SEGA Newsletter Breach Exposes 2.2 Million Emails via ARARA

SEGA says 2.2 million newsletter subscribers' email addresses were exposed by third-party ARARA. 92,300 records included additional information. The breach affected 11 SEGA newsletters and SEGA Fave products; no names, DOB, gender, addresses, phones, credit card details, or passwords were exposed. Email addresses tied to SEGA Accounts were not affected.

2 reports

Binance Denies Data Breach After Alleged ShinyHunters Claims

Binance denies a data breach after a ShinyHunters‑style claim that 335 million Binance records were stolen, including KYC data, internal infrastructure details, account passwords, wallet private keys, transaction history, emails, and phone numbers, and they offered $900,000 for the data. Binance says no evidence of compromise and notes data handling differences.

2 reports

Iris Plaza Breach Exposes 7.7 Million Records

Hackers compromised an external cloud service used by Iris Plaza, exposing personal data of about 7.7 million people. Of these, 5.8 million members had names, addresses, phone numbers, emails, dates of birth, gender, and encrypted passwords exposed; 1.9 million non-members had names, addresses, phone numbers, and emails exposed. Card data was not stored by the cloud service.

2 reports

CISA Flags SonicWall SonicOS MFA Bypass Flaw Exploitation

CISA added CVE-2026-19868 to KEV after reports of exploitation. The SonicWall SonicOS SSL-VPN flaw may bypass SAML MFA via alternate authentication methods. SonicWall says it investigated potential exploitation and urges customers to update. Other patched flaws include CVE-2026-107155, CVE-2026-107154, and CVE-2026-82308. FCEB agencies should patch by November 20, 2026.

2 reports

CVE-2026-58613: Windows Cloud Files Mini Filter Driver UAF

Talos reports a use-after-free in the Windows Cloud Files Mini Filter Driver (CldiStreamCompleteRequest) enabling privilege escalation. A crafted Cloud Filter API sequence can trigger the flaw in Windows 10/11 via version 10.0.26100.8457. An orphaned timer-based request leads to UAF when CldiStreamCompleteRequest runs. CVSS 8.8; vendor referenced as vulnerable.

2 reports

New York Settles Over 13.3 Million Medical Data Breach

New York AG Letitia James reached a settlement with Perry Johnson & Associates and four related companies over a 2023 medical data breach affecting more than 13.3 million people, with $300,000 in penalties and up to $9.7 million suspended. The breach stemmed from weak security and slow disclosures. The settlement mandates MFA, encryption, stronger access controls, monitoring, and annual testing.

2 reports

Also reported

End of the Monday, November 9, 2026 edition.

Colophon

SitRep · Vol. 1, No. 52

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.