RansomVault — latest cybersecurity news

How PHP2Shell Works, and Why It Gives Attackers Access Before Your Code Even Runs

Nov 14, 2026Knowledge

PHP2Shell, the pair of critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, has become one of the most heavily exploited bugs of the year. It was exploited four days before PHP released patches on October 21, added to CISA’s Known Exploited Vulnerabilities catalog, and most recently used to break into Check Point Security Gateways and wipe VMware ESXi hosts. But how does it actually work? This post explains the vulnerability in plain terms, using technical research on th

FAA Grounds All U.S. Flights Over Nationwide Air Traffic Control Communications Failure

Nov 13, 2026Threat Intelligence

On Friday afternoon, the Federal Aviation Administration (FAA) ordered a nationwide ground stop at every U.S. airport, citing "extraordinary circumstances" and safety concerns. U.S. Transportation Secretary Sean Duffy said a communications problem was affecting all Air Route Traffic Control Centers across the country. "FAA technicians are investigating the issue. We will provide immediate updates as we have them," Duffy wrote on X. Departing flights must stay on the ground until further noti

PHP2Shell Attacks on Check Point Gateways Deploy Data Wiper on VMware ESXi Hosts

Nov 13, 2026Zero-Day / Threat Intelligence

Threat actors are exploiting vulnerable Check Point Security Gateways in a campaign that ends with data-wiping malware on VMware ESXi hosts. According to Check Point Research, the attacks began on October 30, 2026, first against Israeli organizations. A single actor ran the whole operation, from initial access to lateral movement and destruction. Background: PHP2Shell PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remo

Microsoft Rules Out Cyberattack Behind Major Microsoft 365 Outage

Nov 13, 2026Threat Intelligence

Microsoft has said there is no indication that the major Microsoft 365 outage that began on November 12 was caused by malicious or cyber activity. The company has publicly expressed regret over the disruption, which affected Outlook, Teams, Exchange Online, and other services for users worldwide. Statement from Microsoft leadership On November 13, at about 03:37 GMT, Charles Lamanna, Microsoft’s Executive Vice President of Copilot, Agents, and Platform, posted on X: “We regret that today’s out

Citrix Patches 10 Critical NetScaler Vulnerabilities

Nov 13, 2026Vulnerability / Patch

Citrix has released security updates fixing 10 critical vulnerabilities across its NetScaler products. Nine of them affect NetScaler ADC and NetScaler Gateway. The tenth is a separate flaw in NetScaler Console that could let unauthenticated attackers bypass access controls. Citrix also fixed many high- and medium-severity bugs, and urges customers to update as soon as possible. Nine critical memory overflow flaws in NetScaler ADC and Gateway The critical vulnerabilities come from memory overflo

OpenAI Launches Daybreak Red Team and Defense Factory: AI Agents for Pentesting and Vulnerability Patching

Nov 13, 2026

OpenAI has announced two new AI-powered security products: Daybreak Red Team and Daybreak Defense Factory. They were unveiled at the company’s Cyber at the Frontier event on November 12, 2026. Red Team focuses on penetration testing and vulnerability validation, while Defense Factory investigates security findings and prepares patches. Daybreak Red Team: AI-driven penetration testing Daybreak Red Team uses multiple AI agents to find and investigate potential security weaknesses in web applicati

Microsoft 365 Outage Shows Early Signs of Stabilization; Email Timeout Extended to 48 Hours

Nov 13, 2026Threat Intelligence

Microsoft says it is seeing early stabilization and capacity improvements in the Microsoft 365 outage that began on Thursday, November 12. The outage disrupted Outlook, Teams, Exchange Online, SharePoint Online, Microsoft 365 Copilot, and other services for users worldwide. Latest from Microsoft In its latest update on X, Microsoft said recovery actions are still under way and are starting to show results. To help preserve delayed mail during the incident, Microsoft has extended the email timeo

FBI Exposes North Korean “FaceStealer” Scheme: $400M in Crypto Stolen Using Secretly Recorded Webcam Videos of 900+ Victims

Nov 12, 2026Threat Intelligence

On November 12, 2026, the FBI released a TLP:CLEAR FLASH alert (AC-111226-MS) warning the cryptocurrency/web3 industry and open-source software maintainers about a highly effective North Korean social engineering campaign it calls “FaceStealer.” According to the FBI, the scheme has stolen more than $400 million in cryptocurrency over the past 18 months and has tried to compromise the open-source software supply chain. Attribution The FBI attributes the activity to North Korean state-sponsored h

Major Microsoft 365 Outage Disrupts Outlook, Teams and AI Connectors Worldwide

Nov 12, 2026Threat Intelligence

Microsoft 365, Outlook, and Teams went down for thousands of users on Thursday, November 12, 2026, in a major outage that also hit the Microsoft connectors used by OpenAI’s and Anthropic’s AI services. Microsoft first said the problem affected users in the Americas, then confirmed that users worldwide could be affected. At the time of writing, the outage has not been fully resolved. Scale of the outage At 2:07 p.m. ET, Downdetector logged more than 97,000 reports of Outlook problems, more than

France Attributes Cyberattack on Blood Bank Cold Storage to Iran’s IRGC

Nov 12, 2026Threat Intelligence

France has formally attributed a cyberattack that disrupted cold storage at French Blood Establishment (EFS) facilities to Iran’s Islamic Revolutionary Guard Corps (IRGC). The attack targeted a third-party refrigeration equipment provider. It sent storage temperature settings soaring to dangerously high levels, in the latest of a wave of attacks on European cold storage systems. What happened On November 2, 2026, attackers took over cold storage monitoring and control systems at three EFS blood