Threat Intelligence Brief - Saturday, November 14, 2026

Operational threat reporting for defenders who need signal, not noise.

By DevSecOpsDad
Posted on November 14, 2026

Threat Radar

  • Active exploitation in progress: Check Point Security Gateway instances are being compromised via PHP2Shell to deploy ESXi wiper malware — infrastructure destruction risk is immediate for organizations running this stack.

  • PostgreSQL RCE patch now available: A 22-year-old type confusion flaw enabling authenticated remote code execution has been patched; full remediation requires both patching and rebuilding all C-language extensions — a step many teams will miss.

  • Hardware supply chain confirmed compromised: Trezor Safe 5 devices sold through a Southeast Asian reseller contained physical implants exfiltrating wallet recovery phrases over cellular — a confirmed third-party hardware risk with direct financial loss.

  • ArcticRAT expands Android targeting with AI: The threat group has moved beyond crypto theft to full device control and is now using AI to profile victims’ financial data, increasing fraud and credential theft risk across mobile endpoints.

  • Defense sector under active fire: Hostile actors disrupted German military drone operations at Quantum Systems in late October — a confirmed operational disruption, not an espionage event.

  • AMD SEV-SNP confidential computing bypassed: Newly disclosed Mior and Skyfall attacks allow malicious cloud hosts to read and modify data inside SEV-SNP protected VMs, undermining isolation guarantees for sensitive cloud workloads.



Immediate Action Required

  • Check Point Security Gateway + VMware ESXi — Wiper Deployment Active: If your organization runs Check Point Security Gateways with internet-facing exposure, treat this as an active incident risk. Validate patch status immediately, review ESXi host integrity, and confirm no unauthorized PHP execution has occurred. Exploitation is confirmed in the wild. T1190, T1059, PHP2Shell

  • PostgreSQL — Patch and Rebuild Extensions: Apply the latest PostgreSQL security release and rebuild all C-language extensions on affected servers. Skipping the extension rebuild leaves the authenticated RCE vector open even after patching. Prioritize internet-accessible or multi-tenant database instances. T1059

  • Trezor Safe 5 — Verify Procurement Source: Any organization or individual holding Trezor Safe 5 devices acquired through third-party or regional resellers — particularly in Southeast Asia — should apply the released fix immediately and audit device provenance. Recovery phrase compromise is silent and irreversible without the fix. T1200



High-Impact Developments

Check Point Gateway Exploitation Deploys ESXi Wiper

  • What happened: Attackers are actively exploiting vulnerable Check Point Security Gateway instances using PHP2Shell to gain code execution, then pivoting to connected VMware ESXi hosts to deploy data-wiping malware.

  • Why it matters: This attack chain combines perimeter compromise with infrastructure destruction. ESXi wiper deployment can take down virtualized environments at scale with no recovery path if backups are not isolated. A widely deployed security appliance paired with hypervisor-level destruction makes this a high-severity, high-breadth threat.

  • Who should care: Security operations, infrastructure, and virtualization teams at any enterprise running Check Point Security Gateways with ESXi in the environment.

  • Recommended action: Audit Check Point gateway patch levels and internet exposure immediately. Validate ESXi host integrity. Confirm backup isolation from production networks. Review logs for PHP2Shell indicators.

  • Confidence: High — active exploitation confirmed.

  • Search metadata: T1190, T1059, PHP2Shell, Check Point Security Gateway, VMware ESXi

Intelligence Context



PostgreSQL Patches 52 Vulnerabilities Including Authenticated RCE

  • What happened: PostgreSQL released a security update addressing 52 vulnerabilities, including a type confusion flaw that has existed for 22 years. The flaw allows any database user with object-creation privileges to execute code on the server. Full remediation requires patching the database engine and rebuilding all installed C-language extensions.

  • Why it matters: PostgreSQL is one of the most widely deployed open-source databases globally, including in cloud-native and enterprise environments. The two-step remediation requirement — patch plus extension rebuild — creates a gap where teams believe they are protected but remain exposed.

  • Who should care: Database administrators, vulnerability management leads, and cloud platform teams running PostgreSQL with C-language extensions installed.

  • Recommended action: Apply the PostgreSQL security update immediately. Inventory all C-language extensions on affected servers and rebuild them against the patched version. Prioritize externally accessible or multi-tenant instances.

  • Confidence: High — patch released; exploitation status unknown, but the flaw is well-understood.

  • Search metadata: T1059, PostgreSQL, RCE, type-confusion

Intelligence Context



Trezor Hardware Wallets Compromised via Supply Chain Implants

  • What happened: Trezor confirmed that three Safe 5 hardware wallets sold by Southeast Asian reseller CryptoBilis contained malicious hardware implants. The implants silently exfiltrated wallet recovery phrases to attackers over cellular networks. A fix has been released.

  • Why it matters: This is a confirmed hardware supply chain attack with direct financial loss. The implants left no software-detectable indicators — the compromise was entirely at the physical layer. Hardware security products are not immune to supply chain manipulation, and this case makes that concrete.

  • Who should care: Financial services teams, treasury functions, and any organization or executive using hardware wallets for cryptocurrency custody. Supply chain and procurement security leads should treat this as a live case study for hardware vendor vetting.

  • Recommended action: Apply the Trezor-released fix. Audit procurement records for any Safe 5 devices sourced outside official Trezor channels. Treat recovery phrases from potentially affected devices as compromised and rotate wallet credentials accordingly.

  • Confidence: High — Trezor confirmed the implants and released a fix.

  • Search metadata: T1200, Trezor Safe 5, hardware-implant, cryptocurrency

Intelligence Context



ArcticRAT Android Malware Expands Financial Targeting with AI

  • What happened: The ArcticRAT cybercrime group has expanded its Android malware beyond cryptocurrency theft to full device control. The group has added AI-powered analysis of stolen financial data to build detailed victim profiles, enabling more targeted fraud.

  • Why it matters: The shift from opportunistic crypto theft to AI-assisted financial profiling is a meaningful capability upgrade. Full device control means attackers can intercept MFA codes, access banking apps, and monitor communications — not just steal wallet credentials. The AI profiling layer increases the precision and yield of downstream fraud.

  • Who should care: Mobile security leads, financial services security teams, and enterprise security architects responsible for BYOD or mobile endpoint policy.

  • Recommended action: Review mobile threat defense coverage for Android endpoints. Assess whether employee or customer-facing Android devices have adequate controls against sideloaded or trojanized applications. Evaluate fraud monitoring controls for accounts accessible via mobile.

  • Confidence: High — active exploitation confirmed, capability expansion reported.

  • Search metadata: T1059.004, ArcticRAT, Android, malware, financial-theft

Intelligence Context



Cyberattack Disrupts German Military Drone Operations

  • What happened: German defense technology company Quantum Systems confirmed a cyberattack by “hostile actors” in late October that disrupted military drone operations. The attack targeted mission-critical defense infrastructure.

  • Why it matters: This is a confirmed operational disruption of military systems — not a data breach or espionage operation, but an attack designed to degrade capability. Defense technology companies and their supply chains are increasingly in scope for nation-state and hostile actor campaigns.

  • Who should care: Security leaders at aerospace, defense, and government-adjacent organizations. Any company in the defense industrial base or supplying technology to military customers should treat this as a sector-level threat signal.

  • Recommended action: Defense and aerospace organizations should review threat models for operational disruption scenarios, not just data exfiltration. Assess resilience of mission-critical systems to targeted cyberattack. Engage threat intelligence on hostile actor activity targeting the defense sector.

  • Confidence: High — Quantum Systems confirmed the incident.

  • Search metadata: Quantum Systems, German military, operational-disruption

Intelligence Context



Monitor Only

  • Newly disclosed Mior and Skyfall attacks allow malicious cloud hosts to read and modify data inside AMD SEV-SNP protected VMs, bypassing confidential computing isolation. Exploitation requires host-level control and has not been observed in the wild. Organizations relying on SEV-SNP for workload isolation should track AMD’s response and determine whether their cloud provider’s threat model accounts for rogue host scenarios. Source: New Mior and Skyfall Attacks Let Rogue Cloud Hosts Steal Secrets From AMD SEV-SNP VMs — The Hacker News — https://thehackernews.com/2026/11/new-mior-and-skyfall-attacks-let-rogue.html



Analyst Observation

Today’s brief reflects a threat environment where the perimeter, the database layer, the hardware supply chain, and the mobile endpoint are all under simultaneous pressure — and two of the six stories involve confirmed active exploitation with destructive or irreversible consequences. The Check Point-to-ESXi wiper chain is the most operationally dangerous item: it combines a common enterprise security appliance with hypervisor-level destruction, and unpatched Check Point gateways are exposed right now. The PostgreSQL story will likely be underreacted to — the two-step remediation requirement means many teams will patch the binary and consider themselves done, leaving the extension-based RCE vector open. The Trezor hardware implant case is a useful forcing function for any organization that hasn’t formally assessed third-party hardware reseller risk: if it can happen to a security-focused hardware vendor, it can happen to any hardware in your supply chain.





Generated by DevSecOpsDadAttack cyber threat intelligence.

Tags:  Cyber-Security-News  T1059.004  T1200  T1059  T1190  T1548  VMware-ESXi  VMware  FAA  ground-stop  software-update  operational-disruption
DevSecOpsDadAttack!
Share: X (Twitter) LinkedIn