9th November – Threat Intelligence Report
Our summary
Check Point Research's latest weekly bulletin covers a wave of breaches and flaws from the past week. Queens Public Library in New York suffered a ransomware attack disrupting computers, Wi-Fi, and checkout systems across its network, while Russian hosting provider Beget had cloud infrastructure wiped in a destructive attack affecting over 1,000 servers and some backups. Linux security vendor OPSSHIELD disclosed that compromised credentials let attackers push a malicious cPGuard update to roughly 2,950 customer servers, installing a backdoor and stealing credentials, and Ukraine's Air Alert app was hijacked to spread fake emergency warnings.
On the patching front, SonicWall fixed CVE-2026-19868, an actively exploited SAML authentication bypass in SonicOS SSL VPN that lets attackers skip MFA; Google's Android bulletin addressed critical remote-code-execution bug CVE-2026-58868 affecting Android 14–17; Barracuda patched two chainable Email Security Gateway flaws, CVE-2026-116606 (CVSS 9.3) and CVE-2026-111560 (CVSS 8.6), enabling root takeover; and OpenSSH released 10.6p2 to close CVE-2026-123158, an actively exploited password-length authentication bypass on musl-based Linux systems without PAM, already seen gaining root on an Alpine Linux honeypot. The report also details AI-driven threats like the ARTEX exploitation framework and espionage campaigns from APT29, BITTER, and the China-linked SlippyNunchucks group.
Below is the opening; the full story is at Check Point Research.
From Check Point Research
For the latest discoveries in cyber research for the week of 9th November, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
- Queens Public Library, a New York City public library system serving approximately 2.3 million residents, was struck by a ransomware attack that encrypted its systems. The incident disrupted public computers, Wi-Fi, checkout equipment, digital media services, and its mobile application, while all 66 branches remained open.
- Russian web hosting provider Beget sustained a destructive cyberattack on November 1 that wiped data across its cloud infrastructure and disrupted hundreds of websites. The attack affected businesses and public services, with more than 1,000 servers requiring manual inspection before restoration. Some backup data was reportedly destroyed.
- OPSSHIELD, developer of the Linux security tool cPGuard, disclosed a supply-chain attack after compromised credentials enabled attackers to distribute malicious updates on November 2. Approximately 2,950 customer servers executed the malicious script, which installed a backdoor and collected password hashes, credentials, and sensitive server files.
- Ukraine’s Air Alert app, an emergency notification service used by millions, was compromised by attackers who distributed false radiation, chemical-threat, and military alerts to Kyiv residents. Developers temporarily suspended notifications. A separate attack affected Russia’s emergency alert application, although both countries reported that their core warning systems remained operational.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.