[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYoI76X0ERxKMBnWhhGgUuazAIwAWmJHDIwiTUxqyWpM":3},{"article":4,"iocs":54,"watch_terms":68,"solutions":69,"lesson":173},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"d10d09f2-7545-4d6c-9119-5e786c98a5ce","9th November – Threat Intelligence Report","9th-november-threat-intelligence-report-3e0594","For the latest discoveries in cyber research for the week of 9th November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Queens Public Library, a New York City public library system serving approximately 2.3 million residents, was struck by a ransomware attack that encrypted its systems. The incident disrupted public computers, Wi-Fi, checkout […] The post 9th November – Threat Intelligence Report appeared first on Check Point Research.","This threat intelligence report highlights several significant cyber incidents, including a ransomware attack on Queens Public Library and a destructive attack on Russian web host Beget. It also details a supply-chain attack on OPSSHIELD's cPGuard, compromise of Ukraine's Air Alert app, and the use of AI-powered frameworks like ARTEX and Crafty Falcon by cybercriminals. Several vulnerabilities were also patched, including critical flaws in SonicWall, Android, and Barracuda Email Security Gateway.","Threat intelligence report details ransomware, supply chain attacks, AI threats, and vulnerabilities.","https:\u002F\u002Fresearch.checkpoint.com\u002F2026\u002F9th-november-threat-intelligence-report\u002F","https:\u002F\u002Fresearch.checkpoint.com\u002Fwp-content\u002Fuploads\u002F2022\u002F02\u002Fcpr_socialTWITTER_WeeklyIntelligenceReportHero.jpg","2026-11-09T16:15:41+00:00","2026-11-09T17:00:28.580167+00:00",8,[17,20,22,25,27,29],{"name":18,"type":19},"cPGuard","product",{"name":21,"type":19},"Air Alert app",{"name":23,"type":24},"ARTEX","technology",{"name":26,"type":24},"OpenAI Codex",{"name":28,"type":19},"SonicOS",{"name":30,"type":19},"Android","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":53},{"id":31,"icon":33,"name":34,"slug":35},[55,59,62,65],{"type":56,"value":57,"context":58},"cve","CVE-2026-19868","SonicWall vulnerability affecting SonicOS SSL VPN services with SAML authentication.",{"type":56,"value":60,"context":61},"CVE-2026-58868","Critical vulnerability in Android versions 14-17 allowing remote code execution.",{"type":56,"value":63,"context":64},"CVE-2026-116606","High-severity vulnerability in Barracuda Email Security Gateway (CVSS 9.3).",{"type":56,"value":66,"context":67},"CVE-2026-111560","High-severity vulnerability in Barracuda Email Security Gateway (CVSS 8.6).",[18,21,28],{"controls":70,"vendors":155},[71,100,128],{"slug":72,"name":73,"problem":74,"products":75},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":35,"name":101,"problem":102,"products":103},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[104,112,120],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"slug":129,"name":130,"problem":131,"products":132},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[133,141,147],{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":142,"product_name":143,"url":145,"description":146},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",[156,162,168],{"slug":157,"name":158,"logo_path":159,"roles":160},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png",[161],"reported_by",{"slug":163,"name":164,"logo_path":165,"roles":166},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[167],"affected",{"slug":169,"name":170,"logo_path":171,"roles":172},"sonicwall","SonicWall","\u002Fvendor-logos\u002Fsonicwall.png",[167],{"slug":174,"title":175,"body":176,"framework_refs":177,"framework_notes":185},"multi-vector-threat-week-supply-chain-compromise-ransomware-and-critical-unpatched-flaws","Multi-Vector Threat Week: Supply Chain Compromise, Ransomware, and Critical Unpatched Flaws","This threat intelligence report underscores the converging risk of unpatched critical vulnerabilities and supply-chain compromises occurring simultaneously across different sectors. The attack on OPSSHIELD's cPGuard demonstrates how trusted software distribution channels can become weapons against downstream customers, while the ransomware hit on Queens Public Library illustrates the continued real-world impact on public services. Critical vulnerabilities in SonicWall, Android, and Barracuda Email Security Gateway highlight that delayed patching remains one of the most exploited failure points in enterprise security. The use of AI-powered attack frameworks like ARTEX and Crafty Falcon signals an escalating threat sophistication that outpaces traditional defenses. Organizations must treat both third-party software integrity and patch cadence as first-tier security priorities, not afterthoughts.",[178,179,180,181,182,183,184],"CIS Control 7: Continuous Vulnerability Management","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":186,"NIST SP 800-53 SI-2: Flaw Remediation":187,"CIS Control 17: Incident Response Management":188,"OWASP A06:2021 Vulnerable and Outdated Components":189,"CIS Control 7: Continuous Vulnerability Management":190,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":191,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":192},"NIS2 mandates supply-chain security measures for essential and important entities; the OPSSHIELD cPGuard attack demonstrates exactly the third-party software risk that operators of critical services must assess and mitigate under this article.","SI-2 requires organizations to identify, report, and correct information system flaws; formal flaw remediation procedures would have ensured the critical CVEs in this report were tracked and patched within an acceptable timeframe.","The ransomware attack on Queens Public Library and the destructive attack on Beget highlight the need for tested incident response plans, as a well-rehearsed IR capability can contain damage, preserve evidence, and accelerate recovery in such scenarios.","The unpatched Barracuda Email Security Gateway and SonicWall devices represent exactly the risk OWASP A06 addresses — using components with known vulnerabilities that expose the entire system to compromise.","Critical flaws in SonicWall, Android, and Barracuda had available patches; a continuous vulnerability management process with enforced remediation SLAs would have closed these windows before attackers could exploit them.","This control requires organizations to identify, assess, and remediate technical vulnerabilities in a timely manner, which would have mandated urgent patching of the critical SonicWall and Barracuda flaws highlighted in this report.","The compromise of Ukraine's Air Alert app and the cPGuard supply-chain attack both involved unauthorized access to trusted systems, underscoring the need for strong identity and access controls to limit the blast radius of such intrusions."]