Latest Cybersecurity News Today: 13 November 2026

Researchers disclosed two attacks, Mior and Skyfall, that allow a malicious host to read data inside AMD SEV-SNP-protected virtual machines. Mior can also modify VM memory and fake signed attestation reports, requiring control of the hypervisor and BIOS. AMD has released firmware updates for Mior and microcode for Skyfall, with platform firmware for server makers planned for November and December.

Belarusian cloud provider ActiveCloud was hit by a ransomware attack that encrypted parts of its infrastructure, disrupting websites, email, and virtual servers for customers. The company restored main services by Friday but warned some customers may still face issues restoring virtual machines. The attack follows similar ransomware incidents at hosting providers in Russia earlier this month.

Trezor confirmed that three Safe 5 wallets bought from reseller CryptoBilis contained hidden circuit boards that could copy recovery phrases. The implants sent the data to attacker-controlled servers via mobile networks, though no lost funds have been reported so far. A firmware update released this week stops the implants from capturing new data, but does not protect backups taken before the update.

Quantum Systems said its drones are flying again with Germany's military after a cyberattack prompted a precautionary grounding. The company said it spotted the attack at the end of October and contained it, while Der Spiegel reported that a malicious update to QBase reached servers of the German military and other customers but did not directly infect the drones. It matters because a software update can disrupt a defense supplier's fleet.

Web scraping company Apify confirmed that customer data was accessed during a cyberattack that occurred on November 9 and 10. The attacker used a compromised credential to gain access to internal systems and customer accounts, exposing names, email addresses, billing details, and authentication tokens. Apify has contacted affected customers and revoked some OAuth connections to third-party services like GitHub.

Apple published details of Secure Exclaves, isolated runtimes that process camera and microphone data in the background without letting the main operating system, apps or Apple access it. The company says the architecture protects person recognition on HomeView, Siri Recap, Live Rewind and sensor indicators on iPhone 18 Pro, iPhone 18 Pro Max, iPhone Duo, MacBook Neo and HomeView. It gives users a visible indicator for active sensor sessions.

Proofpoint found that phishing threats increased 4.5 times across Europe from 2025 to 2026, compared with a 1.5 times increase globally. The UK saw a six-fold jump, with European users clicking on 8.3 out of every 100 threat messages. The report also noted that 64% of European organizations targeted by precision cloud attacks showed evidence of successful compromise.

Hudson Rock found two email accounts used in a European bomb threat campaign had previously appeared in infostealer databases, suggesting their credentials had been stolen. The threats, claiming to be Mikhail Andropov, disrupted schools in Italy and elsewhere and said explosives were planted in school buildings and a prime minister's car. Researchers said the findings do not prove the credentials remained valid or identify the sending system.

Check Point released emergency hotfixes for CVE-2026-123039, a local privilege escalation flaw exploited since late October to gain root access and persistence. The company said attackers used PHP2Shell to reach the Mobile Access portal, then escalated privileges on affected gateways and management servers. Teams unable to patch immediately were advised to stop the dynamic_server process.

TSMC confirmed a data breach after a hacker posted records covering about 46,000 current and former employees, including a sample with addresses, bank account numbers and emergency contacts. The company said it found no evidence its own systems were compromised, adding that the data matched a third-party cloud service provider and was unrelated to customer data. The stock slipped, and the data could aid phishing and talent recruitment.

Police in 14 countries arrested 354 suspects in Operation TorNado, targeting vendors and buyers on Archetyp, Nemesis, Tor2Door, Bohemia and Kingdom dark web marketplaces. The May 2025 to October 2026 operation seized over €60 million in cash and cryptocurrency, 950 kilograms of drugs and 57 firearms in Europe. U.S. authorities seized more than 4.8 metric tonnes of drugs, 152 firearms and over €150 million, disrupting dark web markets.

Check Point said attackers exploited PHP2Shell flaws to compromise Gateway appliances and deploy a wiper in two waves, beginning with Israeli organizations on October 30 and then multiple countries on November 2. The flaws, patched on October 21, allow remote code execution in PHP 5 and later, and exploitation began before the patches. Attackers then gained root access, placed webshells, and left a note mentioning Dream Security.

Attackers began exploiting 4EverAble2Shell, a new N-able N-central zero-day, within hours of researcher Sean Bales publishing proof-of-concept code. The flaw chains an Apache Axis vulnerability with a Legacy API weakness to give unauthenticated attackers root-level remote code execution on patched servers. N-able restricted Legacy API and Intune integration after successful compromises were reported, including XMRig miners with persistence.

The FBI said North Korean hackers stole more than $400 million in cryptocurrency over 18 months through FaceStealer, luring targets into fake Zoom or Teams calls using recorded footage of earlier victims. Each successful call records the new victim, and the FBI has seized more than 900 such videos. The group targets machines holding wallets, seed phrases, employer network access or code repositories, and has reached open-source maintainers.

Attackers used a fake Microsoft Teams meeting scheduler to trick an employee at a construction company into approving a device code sign-in, giving them a valid session token before Huntress identified the incident. The lure, sent from a typosquatted domain impersonating a senior vice president, used a Google share link to display a device code as a booking reference. Huntress advises treating unexpected device code prompts as suspicious.

Material Security tracked 2,429 suspected North Korean fake IT worker personas and found 27 reached onboarding over a year. In the past 30 days, 232 personas contacted 99 organizations, and four reached onboarding at companies with widely shared sensitive files. At one such company, about 277,000 Social Security number files were shared companywide or by public link. Material recommends pairing hiring and access controls.

N-able said it is restricting N-central features after 4EverAble2Shell and Agent2Shell flaws were disclosed that can allow root-level code execution on Windows. Reports say 4EverAble2Shell is being actively exploited to install cryptocurrency miners, with 21 infected servers found, including 19 running Hotfix 2. The reported chain combines a critical Apache Axis flaw with an N-central privilege escalation weakness.

Corelight found that an MCP server set to run one fixed release ran with 15 different dependency sets over five weeks, with 23 of 69 packages changing versions. The company said MCP servers often hold user credentials and made more than 1,600 connections in a week to 11 management systems, including a firewall, SIEM and sensor management.

Corelight said 23 of 35 reviewed MCP servers could pull dependencies from a public registry per launch or build.

NATO issued and then withdrew guidance suggesting attendees of its defense industry conference in Turkey use the Russian-owned Yandex Go app. The correction came after concerns were raised that the app could expose participants' movements to Russian intelligence. The alliance said the event team made an oversight and corrected the email within two hours.

British organizations reported a record 1,371 cyber incidents to the Information Commissioner's Office between July and September, surpassing previous quarterly highs. The surge coincides with industry reports of increased extortion attacks, although ransomware reports have generally fallen in recent years. The data highlights a growing trend of UK entities being named on data leak sites used by cybercriminals.