IT Security News Roundup: 2026-11-15 Afternoon

IT Security News: Afternoon roundup, 2026-11-15

Summary

Security news in this window was dominated by attacks on the infrastructure and supply chains that organizations rely on, from remote-access trojans and fake meeting lures to ransomware at cloud hosts and firmware flaws in industrial controllers. Several stories also show the cost of weak data handling, including a French postal subsidiary breach, exposed employee files in hiring pipelines, and a record number of UK incident reports. Regulators and state actors appear in the mix too, with Italy fining Meta, North Korean operatives running a crypto-theft scheme, and a German military drone supplier hit because of its support for Ukraine. Together these point to a steady pattern: attackers are going after the trusted tools, updates, and third parties that sit upstream of the people defending them.

1. The Security Affairs malware newsletter (Round 123) gathers recent malware research, including analysis of Turla tooling, an AhsayCBS intrusion involving webshells and a cryptominer, and the CopperDragon Sparrow framework.
2. Researchers found six pre-authentication remote code execution flaws in the Danfoss AK-SM800A supermarket fridge controller, letting an attacker take over a device in about an hour. Every firmware up to 5.3.2 is affected, and no CVEs have been assigned yet.
3. Europol and partners dismantled infrastructure behind CastleRAT, and Have I Been Pwned added 179,745 breached accounts from the operation. Europol also supplied 893k unique passwords observed across infected machines, which are now searchable via Pwned Passwords.
4. A cyberattack on Maileva, a digital subsidiary of La Poste, exposed names and postal addresses of about 22 million people in France. The intrusion happened in mid-September and was confirmed by La Poste to AFP.
5. Taiwan Semiconductor Manufacturing Company confirmed that employee personal data was leaked after a threat actor auctioned 6.9GB of allegedly stolen data. The incident is linked to a cloud provider.
6. North Korean state hackers stole over $400 million in crypto over 18 months using fake Zoom and Teams calls that replay webcam footage of earlier victims, which the FBI calls FaceStealer. The FBI has seized more than 900 recordings and warned crypto workers and open-source maintainers.
7. The UK's Information Commissioner's Office recorded a record 1,371 cyber incident reports in Q3 2026, while formally reported ransomware incidents kept declining. Researchers note that the regulator's categories make ransomware and extortion hard to compare directly.
8. Material Security tracked suspected North Korean fake IT workers and found 27 personas reached onboarding over a year. At one company, about 277,000 files containing Social Security numbers were shared company-wide or by public link.
9. Attackers used a fake Microsoft Teams meeting scheduler to trick a construction company employee into approving a device code sign-in, obtaining a valid session token before Huntress's SOC caught it. The attack abuses a genuine Microsoft login flow, so MFA alone does not stop it.
10. Corelight's James Lagermann found an MCP server pinned to one release ran with 15 different dependency sets over five weeks, with 23 of 69 packages changing versions. The drift happened without any configuration change, which undermines the assumption that pinning keeps AI tooling stable.
11. Ransomware hit Belarus-based cloud provider ActiveCloud, disrupting cloud hosting, business email, and virtual servers for customers in Belarus and Russia. The company says it found no evidence of customer data compromise, and it has not disclosed how attackers got in.
12. Hackers exploited N-able N-central flaws, tracked as 4EverAble2Shell and Agent2Shell, to infect 21 servers, 19 of them running Hotfix 2. N-able is restricting some N-central features and integrations while remediation is completed.
13. Defence technology firm Quantum Systems confirmed that attackers compromised its software update server and planted a malicious QBase update. The German military grounded its drones as a precaution, and the company believes it was targeted for supporting Ukraine.
14. The Pentagon renamed its Chief Digital and Artificial Intelligence Office to the "Super Intelligence Office," following a presidential order to replace "artificial intelligence" with "super intelligence" in executive branch communications. This is a naming change, not a technical or security development.
15. Italy's data protection authority, the Garante, fined Meta €805 million over a Facebook for Android feature that suggests photos and videos from users' galleries. The authority found the feature was on by default and accessed photos, videos, and metadata without explicit consent.
16. Jensen Huang resigned as NVIDIA CEO, with CFO Colette Kress named interim chief executive, amid allegations about chip access and scrutiny in Washington and Singapore. The allegations have not been proven in court, and China denies the espionage claims.
17. A cyberattack on La Poste subsidiary Maileva exposed the names and postal addresses of 22 million people, including patients and tenants. The breach was confirmed to AFP and is described as one of the largest cyberattacks France has seen.
18. Meta was fined about $887 million in Italy over Facebook's Android gallery access, with the regulator stressing that smartphones are part of a person's private sphere and require free and informed consent. Meta has 60 days to respond.
19. The Cursor breach traced to a stolen Fireworks AI key led to a trojanized Claude Code extension, which is part of a wider run of developer-tooling supply chain risk this week. Developers installing AI coding extensions face direct exposure from this kind of compromise.
20. Lacking further detail in the extract, this roundup item is a general security newsletter pointer. Readers wanting the full set of stories should consult the original Security Affairs and IT Security News pages for complete coverage.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 123
2. Researchers Find Six 0-Days Allowing Unauthorized Takeover of Supermarket Refrigeration Systems
3. CastleRAT – 179,745 breached accounts
4. Hack at French postal unit exposes 22 million people’s data
5. TSMC employee data breach linked to cloud provider
6. Stolen webcam clips of 900+ victims feed North Korea’s $400 million fake Zoom scheme
7. Security Affairs newsletter Round 604 by Pierluigi Paganini – INTERNATIONAL EDITION
8. UK Data Protection Regulator Sees Unprecedented Rise in Cyber Incident Reports
9. Suspected North Korean IT workers reached onboarding at companies with open data
10. How attackers turned a Teams meeting booking into a device code phishing trap
11. Your pinned MCP server may not be as pinned as you think
12. Ransomware Attack Disrupts Belarusian Cloud Provider ActiveCloud, Affecting Business Services
13. Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2
14. Cyberattack on Quantum Systems Disrupts German Military Drone Operations
15. Pentagon Renames CDAO ‘Super Intelligence Office’
16. Italy Fines Meta €805 Million Over Facebook's Android Gallery Access Without Explicit Consent
17. Jensen Huang Resigns as NVIDIA CEO | What Happens Next?
18. Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France
19. Meta Fined $887 Million in Italy Over Android Gallery Photos and Videos on Facebook