Skip to content
Monday, November 9, 2026Nov 9, 2026
Previous issue

Vol. 1, No. 52Composed Nov 9 · 16:53 UTC

SitRep

Cybersecurity, in perspective.

1 critical · 2 elevated4 stories on the wire

Scale amplifies error; humility limits harm.
— Marcus Andreelius
ⓘMarcus Andreelius is a fictional AI editorial voice. This reflection is original editorial prose, not a quotation.

You are reading a previous issue. Go to the latest edition →

The situation

Lnbits Urges Operators to Shut Down

LNbits urged operators to shut down amid attacks; one operator reported stolen funds as patches remain pending.

3 sources

The Hacker News, SecurityWeek, CERT/CC Vulnerability Notes

LNbits urged all operators to shut down their Bitcoin Lightning wallet servers amid attacks. One operator reported 2,285,545 satoshis stolen before stopping the server. LNbits also shut down its cloud service, my[.]lnbits[.]com, with its return expected within 24 hours.

Context

The report says LNbits urged all operators to shut down their Bitcoin Lightning wallet servers, and that LNbits shut down its cloud service my[.]lnbits[.]com. The cloud service's return was expected within 24 hours.

“LNbits also shut down its cloud service, whose return was expected within 24 hours.”
From Senecowitz · Analysis
The move

4 things to do today

Epictim Draper

  1. Shut down LNbits Bitcoin Lightning wallet servers; LNbits urges all operators to do so amid attacks.
  2. Patch SonicWall SonicOS by November 20, 2026, if your organization is a FCEB agency.
  3. Use OpenSSH 10.6p2, or mitigate SSHole by disabling password authentication or SSH and reviewing logs.
  4. Upgrade PrestaShop to 9.2.1 or later; restrict admin access and file write permissions.

On the wire

  • 1critical
  • 2elevated
  • 1moderate
  • 0low
P0Incident

Lnbits Urges Operators to Shut Down Servers

2,285,545 satoshis reported stolen · my[.]lnbits[.]com shut down

LNbits urged all operators to shut down their Bitcoin Lightning wallet servers amid attacks.1 One operator reported 2,285,545 satoshis stolen before stopping the server, and LNbits shut down its cloud service my[.]lnbits[.]com.1 LNbits said the cloud service's return was expected within 24 hours.1

  1. 1THE HACKER NEWS · LNbits Urges Shutdown Amid Attacks on Bitcoin Lightning Wallets

Copy link to “Lnbits Urges Operators to Shut Down Servers”

P1Exploit

CISA Flags SonicWall MFA Bypass Exploitation

CVE-2026-19868 · KEV listing · FCEB patch deadline November 20, 2026

CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog after reports of exploitation.1 The SonicWall SonicOS SSL-VPN flaw may bypass SAML MFA via alternate authentication methods; SonicWall says it investigated potential exploitation.1 The report says FCEB agencies have a November 20, 2026 patch deadline.1

Updated Since Nov 7: SonicWall Patches Flaw That Weakens VPN Logins · CVE-2026-19868 · New: helpnetsecurity.com, thehackernews.com

Timeline

  1. Nov 6CISA Lists SonicWall Vulnerability as Exploited
  2. Nov 7SonicWall Patches Flaw That Weakens VPN Logins
  3. This edition

Added to CISA KEV on 6 Nov 2026 (CVE-2026-19868) · CVE-2026-19868: CVSS 7.5, EPSS <0.01 (FIRST)

  1. 1THE HACKER NEWS · CISA Flags SonicWall SonicOS MFA Bypass Flaw Exploitation

Copy link to “CISA Flags SonicWall MFA Bypass Exploitation”

P1Exploit

Hackers Exploit OpenSSH Authentication Bypass

OpenSSH CVE-2026-123158 · Initial activity apparently from botnets and crypto miners

SecurityWeek reports hackers are exploiting SSHole, a high-severity OpenSSH authentication bypass (CVE-2026-123158).1 Initial exploitation appears to come from botnets and crypto miners; affected Linux distributions include Alpine, Buildroot, OpenWrt, and Yocto.1

Updated Since Nov 6: OpenSSH Flaw Allows Oversized Password Logins · CVE-2026-123158 · New: bleepingcomputer.com, cisa.gov, cve.org

Added to CISA KEV on 9 Nov 2026 (CVE-2026-123158) · CVE-2026-123158: CVSS 8.1, EPSS 0.01 (FIRST)

  1. 1SECURITYWEEK · SSHole Authentication Bypass Exploited in OpenSSH (CVE-2026-123158)

Copy link to “Hackers Exploit OpenSSH Authentication Bypass”

P2Vulnerability

PrestaShop Debug Mode Allows Code Injection

Back-office permissions required

CERT/CC reports that PrestaShop back-office Performance Debug mode allows authenticated attackers to submit crafted cookie values written into PHP define() expressions, enabling arbitrary code execution on later requests.1 Exploitation requires back-office permissions, and CERT/CC says CSRF protection is insufficient.1

CVE-2026-124916: CVSS 5.4

  1. 1CERT/CC VULNERABILITY NOTES · PrestaShop Debug Mode PHP Code Injection Vulnerability

Copy link to “PrestaShop Debug Mode Allows Code Injection”

Indicators named in this edition

KindValueNote
DOMAINmy[.]lnbits[.]comLNbits shut down its cloud service; return was expected within 24 hours.

Known exploited

Added 9 Nov4 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-102895GPUStack GPUStack9 Nov12 Nov
CVE-2026-116779SignalWire FreeSwitch9 Nov12 Nov
CVE-2026-123158OpenBSD OpenSSH9 Nov12 Nov
CVE-2026-123218IBM Aspera Faspex9 Nov12 Nov

Source: CISA KEV catalogue, version 2026.11.10 (released 10 Nov 2026; read by SitRep 10 Nov 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

The wire, last 30 days

This edition has 3 stories rated critical or elevated (P0 or P1); the 24 daily editions from 12 Oct to 8 Nov averaged 3.5. 5 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
9 Nov (this edition)1210
8 Nov0310
7 Nov0300
6 Nov1310
5 Nov0320
4 Nov2200
3 Nov0310
2 Nov0211
1 Nov0300
31 Oct1210
30 Oct1400
29 Oct1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300
12 Oct2200

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

U.S. Urges Critical Infrastructure to Secure Refrigeration Systems

U.S. CISA, FBI and partners urge critical infrastructure to rapidly harden industrial refrigeration and cold-chain systems after European attacks on French blood banks and supermarkets. Recommendations include isolating OT, removing or securing remote access, patching vulnerabilities, replacing end-of-life devices, and maintaining offline backups.

3 reports

SEGA Newsletter Breach Exposes 2.2 Million Emails via ARARA

SEGA says 2.2 million newsletter subscribers' email addresses were exposed by third-party ARARA. 92,300 records included additional information. The breach affected 11 SEGA newsletters and SEGA Fave products; no names, DOB, gender, addresses, phones, credit card details, or passwords were exposed. Email addresses tied to SEGA Accounts were not affected.

2 reports

Binance Denies Data Breach After Alleged ShinyHunters Claims

Binance denies a data breach after a ShinyHunters‑style claim that 335 million Binance records were stolen, including KYC data, internal infrastructure details, account passwords, wallet private keys, transaction history, emails, and phone numbers, and they offered $900,000 for the data. Binance says no evidence of compromise and notes data handling differences.

2 reports

Iris Plaza Breach Exposes 7.7 Million Records

Hackers compromised an external cloud service used by Iris Plaza, exposing personal data of about 7.7 million people. Of these, 5.8 million members had names, addresses, phone numbers, emails, dates of birth, gender, and encrypted passwords exposed; 1.9 million non-members had names, addresses, phone numbers, and emails exposed. Card data was not stored by the cloud service.

2 reports

CVE-2026-58613: Windows Cloud Files Mini Filter Driver UAF

Talos reports a use-after-free in the Windows Cloud Files Mini Filter Driver (CldiStreamCompleteRequest) enabling privilege escalation. A crafted Cloud Filter API sequence can trigger the flaw in Windows 10/11 via version 10.0.26100.8457. An orphaned timer-based request leads to UAF when CldiStreamCompleteRequest runs. CVSS 8.8; vendor referenced as vulnerable.

2 reports

New York Settles Over 13.3 Million Medical Data Breach

New York AG Letitia James reached a settlement with Perry Johnson & Associates and four related companies over a 2023 medical data breach affecting more than 13.3 million people, with $300,000 in penalties and up to $9.7 million suspended. The breach stemmed from weak security and slow disclosures. The settlement mandates MFA, encryption, stronger access controls, monitoring, and annual testing.

2 reports

Who Gives a Crap Data Breach Impacts Australia UK US

Who Gives a Crap confirms a data breach via an unnamed US-based marketing software provider affecting customers in Australia, the UK, and the US. The breach exposed first/last names, email addresses, phone numbers, and mailing addresses, plus amounts spent since 2012; payment info, order details, and passwords were not accessible. Incident occurred Oct 30–Nov 1; notified customers by Nov 7.

2 reports

Also reported

End of the Monday, November 9, 2026 edition.

Colophon

SitRep · Vol. 1, No. 52

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.