IT Security News Roundup: 2026-11-13 Morning

IT Security News: Morning roundup, 2026-11-13

Summary

This period was dominated by AI on both sides of security: attackers using open-source AI pentesting tools against real organizations, and vendors like OpenAI launching agents that find and fix vulnerabilities. Supply-chain-style credential abuse on GitHub and a string of critical edge and platform flaws, including Citrix NetScaler, Apache HTTP/2, and a Windows zero-day, show how much risk sits in widely deployed infrastructure. Several stories also point to fragile operations, such as Microsoft 365 and Windows activation failures and a Polish government platform taken offline. For defenders, the common lesson is that patching, credential hygiene, and monitoring of trusted tools and platforms matter as much as ever.

1. Attackers used credentials from 4,837 hijacked GitHub accounts to plant a stealer in repositories those accounts could write to. Aikido Security says it harvests CI secrets and cloud credentials and ran in at least 1,806 repositories.
2. A UK police watchdog report warns that police use of live facial recognition risks wrongful arrests. It cites inconsistent governance and officers who misunderstand the technology's limits.
3. Poland temporarily shut down ePUAP, the national e-government platform, after detecting and stopping a cyberattack. Citizens and public institutions lost access to their electronic mailboxes.
4. Europol's EU Most Wanted appeal, launched 12 November, features 19 fugitives from 14 countries. They are wanted for child sexual exploitation and fraud targeting older people.
5. Microsoft confirmed that the November Patch Tuesday updates are causing Windows activation and licensing failures with error code 0x80041008. Users affected by the update may need to resolve the problem before their systems are fully licensed.
6. Citrix released patches for 10 critical NetScaler vulnerabilities. Successful exploitation could cause unexpected behavior or denial-of-service conditions, so administrators should apply the fixes promptly.
7. A campaign dubbed wfx-loot used 4,837 compromised GitHub accounts to target 61,764 repositories. The aim was to steal developer credentials and cloud secrets, as a companion report on the same account set also describes.
8. OpenAI's Daybreak platform brings AI agents into the software security process, combining web application penetration testing with tools that investigate vulnerabilities and draft fixes. The offerings connect finding weaknesses with patching and retesting them.
9. This guide covers the KPIs that CISOs should track to measure their security programs. It is practical reference content rather than a report on a specific incident.
10. Chinese-speaking attackers weaponized the open-source Cairn penetration-testing framework in 25 autonomous operations against at least 19 organizations in August and September 2026. Ten of those organizations suffered confirmed unauthorized access or data retrieval, and the targets included semiconductor and defense-policy groups.
11. This is a repeat of the Cairn report, in which Chinese-speaking attackers used the open-source framework to run 25 autonomous intrusion operations against at least 19 organizations. Ten organizations suffered confirmed unauthorized access or data retrieval.
12. A researcher known as Chaotic Eclipse published a proof-of-concept for SignDrop, a Windows zero-day that abuses a mitigation Microsoft introduced in CLFS. It lets a local attacker gain SYSTEM privileges and bypass security protections.
13. OpenAI introduced Daybreak Red Team and Daybreak Defense Factory at its 12 November event, with agents that investigate vulnerabilities, validate attack paths, and prepare fixes. Human review remains required before any proposed code changes are merged.
14. TrendAI's Bob McArdle expects ransomware techniques to change significantly within the next year, with AI making attacks more dangerous and more profitable. He describes the past few years as a stagnant period for the threat.
15. OpenAI's Daybreak Red Team, an early-access offering, uses coordinated AI agents to test web applications. Its companion Defense Factory investigates the findings and prepares patches for retesting.
16. The Beast ransomware has a hidden graphical control panel, opened with ALT+CTRL and typing 666 on an infected Windows machine. It lets affiliates choose what to encrypt, giving them much more hands-on control than typical command-line ransomware.
17. CVE-2026-119618, a critical flaw in the mod_http2 module of Apache HTTP Server, can let a remote attacker run code on the server. It affects versions 2.4.55 through 2.4.70 and is fixed in 2.4.71, and only servers with HTTP/2 enabled are affected.
18. This vendor ranking covers the top 10 vulnerability management tools in 2026. It argues that the real differentiators are asset coverage, prioritization, and remediation workflows, and it places Tenable first.
19. Kaspersky analyzes a recent ransomware incident and explains why the hypervisor layer is hard to monitor. The article covers common access paths attackers use to reach ESXi and vCenter and how to protect those systems.
20. This vendor ranking covers the top 10 AI governance (AI TRiSM) platforms for 2026, arguing that the EU AI Act has made AI governance a procurement requirement. It places Credo AI first and IBM among the leaders.
21. The SignDrop exploit abuses CLFS and Windows Defender to trigger arbitrary file creation in the antimalware process. It is a Windows zero-day published by the Nightmare Eclipse researcher, and it is a repeat of the earlier SignDrop report.
22. Authorities arrested 354 suspects in a joint international operation against vendors and buyers on the Archetyp, Nemesis, Tor2Door, Bohemia, and Kingdom dark web marketplaces. The takedown targets a significant part of the cybercrime marketplace ecosystem.
23. This buyer's guide compares 11 AI governance platforms, noting that the category spans policy and registry tools, ML-focused model monitors, and suite extensions. Its central point is that organizations often struggle to say which AI models they actually run.
24. A worldwide Microsoft 365 outage disrupted companies relying on Outlook, SharePoint, Teams, and other services. Malwarebytes reports a severe impact on business operations during the outage.
25. Midnight Blue researcher Carlo Meijer found six pre-authentication remote code execution zero-days in the Danfoss AK-SM800A refrigeration controller, in under an hour of manual firmware review. All firmware up to and including 5.3.2 is affected, and attacks on internet-exposed Danfoss and Copeland controllers began in France on 11 October.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories
2. Brit police watchdog says cops' use of facial recog risks wrongful arrests
3. Poland takes its national e-government platform offline after a cyberattack
4. EU Most Wanted: 19 fugitives wanted for targeting the vulnerable
5. Microsoft confirms Windows activation failures after November updates
6. Citrix Patches 10 Critical NetScaler Vulnerabilities
7. Hackers Use 4,837 Stolen GitHub Accounts to Target 61,764 Repositories
8. OpenAI’s Daybreak brings AI agents to security testing and vulnerability fixes
9. Cybersecurity Metrics: KPIs Every CISO Should Track
10. Chinese-Speaking Hackers Weaponize Cairn AI Framework to Breach Semiconductor and Defense Organizations
11. Chinese-Speaking Hackers Weaponize Cairn AI Framework to Breach Semiconductor and Defense Organizations
12. New SignDrop Exploit Can Abuse Windows Defender to Bypass Security Protections
13. OpenAI Launches Advanced AI Cybersecurity Tools for Automated Penetration Testing and Vulnerability Research
14. AI Set to Revolutionize Ransomware Following “Stagnant” Few Years
15. OpenAI Unveils Daybreak Red Team, Defense Factory Security Tools
16. Beast Ransomware Uses Hidden ‘666’ Control Panel to Encrypt Windows Systems and Network Shares
17. Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
18. Top 10 Best Vulnerability Management Tools in 2026 [Ranked & Scored]
19. Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes
20. Top 10 Best AI Governance (AI TRiSM) Platforms in 2026 [Ranked & Scored]
21. Nightmare Eclipse Drops Windows Zero-Day Exploit ‘SignDrop’
22. Police arrest 354 suspects in dark web cybercrime crackdown
23. 11 AI Governance (AI TRiSM) Platforms: The 2026 Buyer’s Verdict Guide
24. Worldwide Microsoft 365 outage disrupts Outlook, SharePoint, Teams, and more
25. Researchers Discover 6 Zero-Day Vulnerabilities in Danfoss Refrigeration Controllers Allowing Remote Root Access