OUTPOSTEdition 238 — 9 November 2026
Cyber, warfare technology and geopolitics as compiled on 9 November 2026.
Cyber
Breaches, campaigns, advisories and research.
Iris Ohyama data cloud breach exposes info of 7.7 million customers (opens the original article)
Iris Ohyama disclosed that personal information belonging to about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service.
Cyber BleepingComputer
What to checkReview third-party cloud access and investigate whether personal information was exposed.
Sources1BleepingComputer
Brava Security Emerges From Stealth With $15 Million in Funding (opens the original article)
Brava Security says its multi-agent AI platform generates attack-like telemetry to help identify gaps in enterprise defenses.
Cyber SecurityWeek
What to checkAssess whether generated attack telemetry can help reveal gaps in existing defenses.
Sources1SecurityWeek
Week in review: Refrigeration cyberattacks hit European retailers again, Patch Tuesday forecast (opens the original article)
Help Net Security’s weekly review mentions cyberattacks targeting European retailers’ refrigeration systems again and a Patch Tuesday forecast.
Cyber Help Net Security
What to checkCheck access and security monitoring for systems supporting refrigeration operations.
Sources1Help Net Security
Warfare
Drones, electronic warfare, missiles and defence systems.
Naval Group to Build UCUV Underwater Combat Drone Demonstrator for French Navy (opens the original article)
Naval Group will build an operational underwater combat drone demonstrator for the French Navy, with sea trials scheduled to begin in 2028.
Warfare Naval News
Why it mattersThe demonstrator highlights an underwater uncrewed capability being developed for naval operations.
Sources1Naval News
Geopolitics & geodata
Strategy, geo wars, GNSS and satellite security.
Aramco Tower hit in heart of Saudi capital as Houthis launch fresh strikes (opens the original article)
BBC Verify authenticated footage showing damage to a building in Riyadh’s central financial district, following fresh strikes launched by the Houthis, according to the headline.
Geopolitics BBC World
Strategic relevanceDamage in a capital’s financial district highlights the location’s strategic and economic significance.
Sources1BBC World
Moldova launches new power line to Romania to cut reliance on Russia (opens the original article)
Moldova has launched a new power line to Romania to reduce reliance on Russia. President Maia Sandu says two more lines are on the way.
Geopolitics Al Jazeera
Strategic relevanceThe connection may diversify Moldova’s electricity links and reduce reliance on Russia.
Sources1Al Jazeera
Drone attack on Iraqi Kurdistan gas field triggers mass blackout (opens the original article)
Al Jazeera reports a drone attack halted production at the Khor Mor gas field in northern Iraq and caused widespread power outages.
Geopolitics Al Jazeera
Strategic relevanceThe attack shows how disruption at a gas field can affect regional electricity supply.
Sources1Al Jazeera
Drone attack suspends production at Iraq’s Khor Mor gasfield (opens the original article)
Al Jazeera reports a strike suspended production at Iraq’s Khor Mor gas field, leaving more than 70 percent of the Kurdish region without power.
Geopolitics Al Jazeera
Strategic relevanceThe reported outage underscores the regional impact of disruption to energy infrastructure.
Sources1Al Jazeera
Iran war live: Trump to talk to Xi, Putin about Tehran, ‘denuclearisation’ (opens the original article)
Trump says a land blockade on Iran is in effect and that he will talk to Xi and Putin about Tehran. Tehran threatens retaliation if the US resumes attacks.
Geopolitics Al Jazeera
Strategic relevanceThe statements indicate a diplomatic and military standoff involving Iran, the US, China and Russia.
Sources1Al Jazeera
Nvidia CEO’s affair sparks Chinese espionage probe (opens the original article)
The headline reports a Chinese espionage probe after Nvidia CEO Jensen Huang admitted to an affair with a woman suspected of spying for China.
Geopolitics Al Jazeera
Strategic relevanceThe reported probe illustrates how alleged espionage concerns can intersect with business and personal relationships.
Sources1Al Jazeera
Deadly sand cliff collapses on displaced families in Gaza (opens the original article)
Al Jazeera reports that a sand cliff collapsed on displaced families in Gaza, causing deaths.
Geopolitics Al Jazeera
Strategic relevanceThe collapse highlights the immediate risks of terrain and shelter conditions for displaced people.
Sources1Al Jazeera
Iran waiting to resume talks after US midterms ‘shock’ (opens the original article)
Iranian Foreign Minister Abbas Araghchi says there has been no progress in talks with the US.
Geopolitics Al Jazeera
Strategic relevanceThe statement is relevant to tracking the status of US-Iran diplomacy.
Sources1Al Jazeera
| CVE | CVSS | Product | Ransomware | Added / due | Required action |
|---|---|---|---|---|---|
| CVE-2026-19868 | 7.5High | SonicWall SonicOS SSLVPN | None known | Added Due | Apply mitigations in accordance with vendor instructions. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. CISA’s full wordingApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. |
| CVE-2024-27834 | 5.5Medium | Apple Multiple Products | None known | Added Due | Apply mitigations in accordance with vendor instructions. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. CISA’s full wordingApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. |
| CVE-2026-119977 | 8.1High | WordPress WordPress Core | None known | Added Due | Apply mitigations in accordance with vendor instructions. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. CISA’s full wordingApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. |
| CVE-2026-118527 | 4.3Medium | Ivanti Connect Secure | None known | Added Due | Apply mitigations in accordance with vendor instructions. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. CISA’s full wordingApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. |
| CVE-2026-111357 | 7.0High | Ivanti Connect Secure | None known | Added Due | Apply mitigations in accordance with vendor instructions. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. CISA’s full wordingApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. |
| CVE-2026-97229 | 10.0Critical | GitLab Community Edition and Enterprise Edition | None known | Added Due | Apply mitigations in accordance with vendor instructions. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. CISA’s full wordingApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. |
| CVE-2026-76418 | 8.6High | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software | None known | Added Due | Apply mitigations in accordance with vendor instructions. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. CISA’s full wordingApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. |
| CVE-2026-41709 | 2.7Low | Broadcom VMware ESX | None known | Added Due | Apply mitigations in accordance with vendor instructions. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. CISA’s full wordingApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. |
| CVE-2026-46300 | 7.8High | Linux Kernel | None known | Added Due | Apply mitigations in accordance with vendor instructions. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. CISA’s full wordingApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. |
| CVE-2026-48356 | 9.3Critical | Adobe Commerce and Magento | None known | Added Due | Apply mitigations in accordance with vendor instructions. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. CISA’s full wordingApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. |
| CVE-2026-111497 | 9.2Critical | Google Brotli | None known | Added Due | Apply mitigations in accordance with vendor instructions. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. CISA’s full wordingApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. |
| CVE-2026-109618 | 9.2Critical | PHP Group PHP | None known | Added Due | Apply mitigations in accordance with vendor instructions. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. CISA’s full wordingApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. |
Source: CISA KEV catalogue; CVSS scores from NVD where published. “No score” means NVD has not scored it yet.
Keyword index
Counted from this page. Select one to filter.