This briefing covers 20 cybersecurity and geopolitics stories published around Monday, November 9, 2026, and 7 disclosed vulnerabilities (CVE-2026-102895, CVE-2026-116779, CVE-2026-123158, CVE-2026-124577 and others). Each entry links to the original reporting.
South Asian threat group Bitter (APT-C-08/TA397) is targeting South Asian organizations with PapRAT, a new RAT built in both C++ and Rust supporting command execution and file operations.
Prime Minister Giorgia Meloni publicly attributed the dark web leak of Foreign Minister Antonio Tajani's personal data to pro-Russian hackers.
U.S. officials told the Wall Street Journal that Vice President JD Vance and other senior advisors are offering divergent guidance to President Trump on Iran war strategy.
Unnamed threat actors are actively exploiting CVE-2026-123158 in OpenSSH on Linux to execute commands, harvest credentials, and establish persistence. Active in-the-wild exploitation of a KEV-listed OpenSSH flaw accelerates patch urgency across every Linux-dependent organization globally.
CISA and partner agencies warn unidentified threat actors are exploiting unpatched, internet-exposed industrial refrigeration controllers to remotely force continuous heating cycles, risking fires and inventory loss. Attacks on cold-chain infrastructure signal expanding ICS targeting beyond energy and water sectors.
Pro-Russian actors published personal data of Italian Foreign Minister Antonio Tajani and senior European officials on the dark web, offering cryptocurrency rewards for additional details on them and their families.
Decades of U.S. policy frameworks—containment, normalization, reform—have failed to shift China toward the "responsible stakeholder" model. Rapid Chinese military modernization now forces Washington to abandon constructivist assumptions and compete on coercive terms.
Washington's decision-makers sidelined professional intelligence analysis ahead of the Iran conflict, reprising a pattern seen before prior strategic miscalculations. The episode reinforces that politicization of intelligence—not its absence—remains the primary failure mode in U.S. foreign policy.
Analysts argue renaming the Department of Defense to Department of War would distort the institution's legal mandate and civil-military identity. The semantic shift carries real doctrinal consequences, signaling offensive primacy over deterrence to allies and adversaries alike.
The Pentagon is issuing record munitions demand signals, but fulfillment is blocked by the collapse of sub-prime suppliers over two decades, with China's critical mineral dominance adding a choke-point risk.
Online retailer Revolve disclosed to regulators that a September cyberattack compromised personal data of 1.5 million individuals. The scale elevates regulatory exposure and signals that fashion e-commerce remains a soft target for large-scale credential and PII harvesting.
An actor using the ShinyHunters handle on a newly emerged underground forum claimed a fresh breach of Binance, the world's largest crypto exchange; Binance denies any compromise. ShinyHunters' documented history of verified mega-breaches means unconfirmed denials warrant close monitoring pending independent validation.
A former FBI agent admitted to stealing nearly $2.5 million in cryptocurrency from wallets belonging to fraud victims and nation-state hackers under active federal investigation. The insider theft compromises evidence integrity and raises systemic questions about oversight of agents handling seized digital assets.
CISA added CVE-2026-19868 (CVSS 7.1–7.5), an authentication bypass in SonicWall SonicOS, to its KEV catalog after reports of active exploitation. SonicWall devices are persistent targets for state and criminal actors seeking initial access to enterprise networks.
CVE-2026-102895 in GPUStack allows unauthenticated admin access, persistent API-key creation, cloud-provider secret disclosure, and remote code execution via POST /v2/inference-backends/from-yaml. Exploitation of AI infrastructure management platforms represents an emerging and underpublicized attack surface.
CVE-2026-123158, an authentication bypass in OpenBSD OpenSSH on Linux, is added to CISA's KEV catalog as active exploitation is confirmed. OpenSSH's near-universal Linux deployment makes this a critical exposure across government, cloud, and critical infrastructure environments.
CVE-2026-116779 in SignalWire FreeSwitch allows remote code injection, arbitrary call control, and credential disclosure without authentication. Exploitation of VoIP infrastructure creates direct intelligence-collection and communications-disruption risk for enterprise and government operators.
CVE-2026-124585 enables remote OS command injection via the add_expmac function in Chengdu Feiyuxing VW2100/VEC10GP 1.0 routers; a public exploit exists and the vendor has not responded.
CVE-2026-124580 permits remote OS command injection through the handle_wechat_cn_wifi function in Chengdu Feiyuxing VW2100/VEC10GP 1.0 devices; exploit is public and vendor is unresponsive. A second unpatched RCE in the same Chinese router line within 24 hours signals systemic security deficiencies in the product.
CVE-2026-124577 exposes an improper authentication flaw in Intelbras SG 2404 PoE L2+ versions 1.00.70 and 1.00.72, enabling remote unauthenticated exploitation via the EXCU_SHELL web management interface; a public exploit is already available.