CRITICAL/ NOVEMBER 14, 2026TODAY’S BRIEFING — #239
Check Point zero-day exploited in wiper attacks; North Korea FaceStealer steals $400M crypto
Check Point Security Gateway instances exploited via PHP2Shell to deploy VMware ESXi wipers; North Korean FaceStealer campaign disrupted after stealing $400M in cryptocurrency using deepfake video calls and hijacked accounts.
CVE-2026-123039Check Point Multiple Products — The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. · In CISA KEVCVE-2026-109618PHP Group PHP — PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. · In CISA KEVCVE-2026-109619PHP Group PHP — PHP has various global state that temporarily points into request memory. · In CISA KEVCVE-2026-111497Google Brotli — A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote… · In CISA KEV
Read the full briefing →