EN PT-BR
← Voltar ao feed
critical public_sector hosting financial_services cryptocurrency government energy engineering telecommunications

Beget wiper attack, cPGuard supply-chain backdoor and ARTEX AI-driven exploitation headline Check Point's 9 November bulletin

1 fonte(s) · 1 atualização(ões) · publicado 09/11/2026 13:15 · coletado há 1 hora

Check Point Research's weekly bulletin for the week of 9 November 2026 covers several separate incidents rather than one story. The most urgent is the cPGuard supply-chain attack: after compromised credentials let attackers push malicious updates on 2 November, about 2,950 customer servers ran a script that installed a backdoor and collected password hashes, credentials and sensitive server files. Russian hosting provider Beget suffered a destructive attack on 1 November that wiped data across its cloud infrastructure, and more than 1,000 servers needed manual inspection before restoration. Queens Public Library in New York was hit by ransomware that disrupted public computers, Wi-Fi, checkout equipment and its mobile app, while all 66 branches stayed open. Check Point also documented ARTEX, an AI-powered framework that cybercriminals use to discover and exploit vulnerable systems, with 1,608 live instances identified. The bulletin adds vulnerability patches from SonicWall, Google, Barracuda and OpenSSH, along with threat reports on HYFLOCK, APT29, BITTER and SlippyNunchucks.

Entenda a falha

A vulnerabilidade

The bulletin covers four sets of flaws. CVE-2026-58868 is rated critical in the November Android bulletin: it affects Android 14 through 17 and allows remote code execution with no user interaction. CVE-2026-116606 and CVE-2026-111560 (CVSS 9.3 and 8.6) in Barracuda Email Security Gateway chain an authentication bypass with command injection, giving root control without login to attackers who can reach the administrative interface. CVE-2026-123158 (CVSS 8.1) in OpenSSH affects Linux on musl without PAM, where an oversized password bypasses authentication on certain accounts; it is fixed in 10.6p2 and exploited in the wild. CVE-2026-19868 is a high-severity SonicOS SSL VPN flaw, with SAML authentication configured, that lets an attacker holding valid credentials for another authentication method bypass SAML and MFA; it is linked to active exploitation. The article gives no fixed versions apart from OpenSSH.

Como funciona

The articles describe the mechanisms only briefly. In the Barracuda appliance, a request to the administrative interface first gets past the login check through the authentication bypass, and the attacker then reaches a function that passes input to a command, which runs with root privileges. In SonicOS, a VPN login configured for SAML can be completed through another authentication method the account already has, so the SAML and MFA step is skipped. In OpenSSH on musl without PAM, the password submitted at login is handled wrongly when it is overly long, and the server accepts it for certain accounts, such as password-less ones. The articles give no step-by-step detail for the Android flaw.

Por que é vulnerável

The articles name root causes only in part. The Barracuda chain combines a missing authentication check with command injection, meaning input is not kept apart from the command that runs. The SonicOS flaw is a logic gap in which SAML controls can be bypassed by using a different valid authentication method. For OpenSSH, the articles tie the problem to oversized passwords on musl without PAM, and a third-party description says an overlong password logs in to password-less accounts. The articles do not explain why these went unnoticed or what each fix changes, except that OpenSSH 10.6p2 fixes its flaw.

Como foi descoberta

The sources do not say who found these flaws or how. Check Point Research's weekly bulletin of 9 November reports them as vendor patches: SonicWall, Google in its November Android bulletin, Barracuda and OpenSSH. For SonicWall, the bulletin links CVE-2026-19868 to active exploitation. For OpenSSH, active exploitation was observed, including root access on an Alpine Linux honeypot. Brandefense is cited for its description of the OpenSSH flaw, and the OpenSSH advisory itself was not opened.

Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 14:22.

Detalhes técnicos

  • cPGuard (OPSSHIELD): the malicious updates went out on 2 November; the attackers' script installed a backdoor and harvested password hashes, credentials and sensitive server files from about 2,950 servers.
  • Beget: the destructive attack on 1 November wiped data across cloud infrastructure, and some backup data was reportedly destroyed.
  • ARTEX: operators obtained more than 300 iOS signing certificates and harvested about 190,000 gaming credentials, including around 6,000 active accounts.
  • Queens Public Library: ransomware encrypted its systems; the article does not name the ransomware family or the initial access.
  • Air Alert (Ukraine): attackers sent false radiation, chemical-threat and military alerts to Kyiv residents, and developers temporarily suspended notifications. A separate attack hit Russia's emergency alert app.
  • Haiou: a jailbreak bundle targeting OpenAI Codex that weakens safeguards and modifies agent instructions to promote an external AI gateway. Researchers did not establish criminal intent.
  • Crafty Falcon: identified by India's CERT-In, this actor exploited links between test and production environments, abused payment APIs and stole wallet credentials, using AI tools to generate attack scripts.
  • CVE-2026-19868 (SonicWall): a high-severity flaw in SonicOS SSL VPN with SAML authentication. Attackers holding valid credentials for another authentication method could bypass SAML controls, including MFA. The article links it to active exploitation.
  • CVE-2026-58868 (Android): rated critical in the November Android Security bulletin for Android 14 through 17, allowing remote code execution without user interaction.
  • CVE-2026-116606 and CVE-2026-111560 (Barracuda Email Security Gateway): an authentication bypass chained with command injection, reachable by attackers with access to the administrative interface, gives root control without logging in. The article gives CVSS 9.3 and 8.6.
  • CVE-2026-123158 (OpenSSH): the article rates it high (CVSS 8.1) and says it affects Linux systems using the musl library without PAM, with active exploitation including root access on an Alpine Linux honeypot. Brandefense describes the flaw as allowing an overlong password to log in to password-less accounts on musl Linux without PAM (brandefense.io). The OpenSSH advisory was not opened in this research, so the CVSS value rests on the article.
  • Threat reports: HYFLOCK ransomware's October builds had encryption weaknesses that allowed partial data recovery without a key. APT29 used compromised and imitation websites to target iPhone and Android users, particularly in Ukraine. BITTER used documents disguised as diplomatic and military files to deploy PapRAT against South Asian government, energy and engineering organisations. SlippyNunchucks abused Sogou Input Method update mechanisms with DNS hijacking to deliver DarkVigil; Tencent addressed the delivery mechanism in version 16.10.

Remediação

  • Apply the SonicWall, Barracuda, Android (November 2026 bulletin) and OpenSSH updates. The article gives OpenSSH 10.6p2 as the fix; it names no fixed version for the other products.
  • For OpenSSH, prioritise hosts running musl-based Linux without PAM and check password-less accounts.
  • Check whether any server received cPGuard updates after 2 November, and if so treat it as compromised: rotate credentials and password hashes and inspect for the backdoor.
  • Verify backups and restore Beget-hosted workloads from known-good copies.
  • The article gives no indicators of compromise, so detection has to rely on the behaviours described above.

Linha do tempo

  1. research.checkpoint.com ↗ · pub. 09/11/2026 13:15 · coletado 09/11 14:00 primeiro registro

    Beget wiper attack, cPGuard supply-chain backdoor and ARTEX AI-driven exploitation headline Check Point's 9 November bulletin

    ler a análise desta fonte

    Check Point Research's weekly bulletin for the week of 9 November 2026 covers several separate incidents rather than one story. The most urgent is the cPGuard supply-chain attack: after compromised credentials let attackers push malicious updates on 2 November, about 2,950 customer servers ran a script that installed a backdoor and collected password hashes, credentials and sensitive server files. Russian hosting provider Beget suffered a destructive attack on 1 November that wiped data across its cloud infrastructure, and more than 1,000 servers needed manual inspection before restoration. Queens Public Library in New York was hit by ransomware that disrupted public computers, Wi-Fi, checkout equipment and its mobile app, while all 66 branches stayed open. Check Point also documented ARTEX, an AI-powered framework that cybercriminals use to discover and exploit vulnerable systems, with 1,608 live instances identified. The bulletin adds vulnerability patches from SonicWall, Google, Barracuda and OpenSSH, along with threat reports on HYFLOCK, APT29, BITTER and SlippyNunchucks.

    Technical Details

    • cPGuard (OPSSHIELD): the malicious updates went out on 2 November; the attackers' script installed a backdoor and harvested password hashes, credentials and sensitive server files from about 2,950 servers.
    • Beget: the destructive attack on 1 November wiped data across cloud infrastructure, and some backup data was reportedly destroyed.
    • ARTEX: operators obtained more than 300 iOS signing certificates and harvested about 190,000 gaming credentials, including around 6,000 active accounts.
    • Queens Public Library: ransomware encrypted its systems; the article does not name the ransomware family or the initial access.
    • Air Alert (Ukraine): attackers sent false radiation, chemical-threat and military alerts to Kyiv residents, and developers temporarily suspended notifications. A separate attack hit Russia's emergency alert app.
    • Haiou: a jailbreak bundle targeting OpenAI Codex that weakens safeguards and modifies agent instructions to promote an external AI gateway. Researchers did not establish criminal intent.
    • Crafty Falcon: identified by India's CERT-In, this actor exploited links between test and production environments, abused payment APIs and stole wallet credentials, using AI tools to generate attack scripts.
    • CVE-2026-19868 (SonicWall): a high-severity flaw in SonicOS SSL VPN with SAML authentication. Attackers holding valid credentials for another authentication method could bypass SAML controls, including MFA. The article links it to active exploitation.
    • CVE-2026-58868 (Android): rated critical in the November Android Security bulletin for Android 14 through 17, allowing remote code execution without user interaction.
    • CVE-2026-116606 and CVE-2026-111560 (Barracuda Email Security Gateway): an authentication bypass chained with command injection, reachable by attackers with access to the administrative interface, gives root control without logging in. The article gives CVSS 9.3 and 8.6.
    • CVE-2026-123158 (OpenSSH): the article rates it high (CVSS 8.1) and says it affects Linux systems using the musl library without PAM, with active exploitation including root access on an Alpine Linux honeypot. Brandefense describes the flaw as allowing an overlong password to log in to password-less accounts on musl Linux without PAM (brandefense.io). The OpenSSH advisory was not opened in this research, so the CVSS value rests on the article.
    • Threat reports: HYFLOCK ransomware's October builds had encryption weaknesses that allowed partial data recovery without a key. APT29 used compromised and imitation websites to target iPhone and Android users, particularly in Ukraine. BITTER used documents disguised as diplomatic and military files to deploy PapRAT against South Asian government, energy and engineering organisations. SlippyNunchucks abused Sogou Input Method update mechanisms with DNS hijacking to deliver DarkVigil; Tencent addressed the delivery mechanism in version 16.10.

    Remediation

    • Apply the SonicWall, Barracuda, Android (November 2026 bulletin) and OpenSSH updates. The article gives OpenSSH 10.6p2 as the fix; it names no fixed version for the other products.
    • For OpenSSH, prioritise hosts running musl-based Linux without PAM and check password-less accounts.
    • Check whether any server received cPGuard updates after 2 November, and if so treat it as compromised: rotate credentials and password hashes and inspect for the backdoor.
    • Verify backups and restore Beget-hosted workloads from known-good copies.
    • The article gives no indicators of compromise, so detection has to rely on the behaviours described above.