Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits

thehackernews.com Nov 11, 2026

Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits

Curated by Shubham · TechCapsules · Nov 11, 2026

AI-summarised brief · reviewed before publication

Threat actors targeted Qlik Sense servers in October 2026, attempting to deliver PowerShell reverse shells to multiple EU customers within a three‑minute window. The activity mirrors a November 2023 CACTUS ransomware campaign that exploited the same Qlik vulnerabilities, now patched in August–September 2023. Cynet’s analysis revealed a one‑line reverse shell to 45.115.26.23:4455, followed by a Windows Go reverse shell to 45.115.26.23:4456 for reconnaissance and persistence. The malware also sought ActiveMQ processes, collected Linux credentials, and installed OpenSSH via scheduled tasks. An exposed directory on the same IP hosts a custom Go backdoor, ActiveMQ exploit, and a modified Veeam toolchain, suggesting preparation for broader attacks.

💡 Why It Matters

· The reuse of previously patched Qlik flaws shows attackers’ persistence and the risk of incomplete fixes.
· The discovery of a multi‑stage backdoor and exploitation of other enterprise tools signals a coordinated effort to expand lateral movement and persistence across diverse environments.

Capsules Cybersecurity

Read full article on thehackernews.com

Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches

The U.S. Cybersecurity and Infrastructure Security Agency added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE‑2026‑111793 in Cisco BroadWorks and CVE‑2026‑20320 in Openwave Messaging Webtop Media Transcoder. Evidence shows attackers used the BroadWorks flaw to upload malicious files and harvest sensitive data, while an AI‑driven campaign, Operation Snowball, exploited the Openwave flaw to enumerate assets, steal credentials, and exfiltrate subscriber records from a European telecom provider. Both exploits involved advanced reconnaissance, autonomous tool development, and persistent web shells. The vulnerabilities were patched, yet exploitation continued, prompting urgent patching for federal agencies by November 24, 2026.

💡 The incidents reveal that AI‑assisted attackers can autonomously orchestrate multi‑stage breaches, turning known software flaws into large‑scale data theft. This underscores the need for rapid patch deployment and enhanced AI‑aware threat detection in critical infrastructure.

thehackernews.com · Nov 11

Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem

Check Point Research identified three espionage clusters—SilentDelivery, OceanGate, and DarkWire—linked through the Sparrow malware ecosystem, operated by the China‑nexus group CopperDragon. The campaigns targeted telecoms, government, military, research, and critical infrastructure across Latin America, Asia, and Europe. Attacks used varied initial techniques, including watering holes, JavaScript injection, and phishing with disguised LNK files. The malware suite delivers backdoors such as SparrowDoor, SquadC, and kernel‑level tools, enabling persistence, lateral movement, and data exfiltration.

💡 The unified Sparrow framework demonstrates a coordinated, multi‑vector threat capable of infiltrating diverse sectors worldwide, underscoring the escalating sophistication of state‑backed cyber espionage.

thehackernews.com · Nov 11

Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access

French firm Vates VMS has identified a critical authentication bypass flaw in Xen Orchestra, tracked as VSA-2026-062, that allows attackers to send a crafted cookie and gain admin privileges. The vulnerability exploits REST cookie parsing, enabling arbitrary code execution and full root takeover of XCP‑ng nodes. Vates reports active exploitation from a specific IP and TOR domain, though the start date is unclear. The flaw is fixed in Xen Orchestra 6.9.1, 6.10.0, and xo‑server 5.211.2, 5.213.1. Immediate patching or mitigations are advised.

💡 The flaw exposes critical infrastructure to total compromise, underscoring the urgency for timely updates in virtualized environments.

thehackernews.com · Nov 11

Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones

Git has patched a critical vulnerability (CVE‑2026‑111760) that allowed malicious repositories to execute code on systems performing recursive clones with submodules. The flaw stemmed from an integer truncation in Git’s index handling; an excessively long path could bypass safety checks, be shortened to “.git”, and replace a submodule’s .git file with a symlink to attacker‑controlled hooks. When Git later accessed the submodule, the malicious hooks ran automatically. The issue was addressed in Git 2.56.1 and back‑ported to 2.50.2 through 2.55.1, which now reject overly long paths before truncation. GitHub applied the fixes across its services, including GitHub.com, Enterprise Cloud, and upcoming updates for Desktop, Copilot, Codespaces, and Actions. Users are urged to upgrade to patched versions or follow mitigation steps.

💡 A repository can become a silent drop‑point for code execution, turning routine cloning into a supply‑chain attack. Rapid adoption of the fix is vital to protect the billions of developers who rely on Git’s default cloning behavior.

thehackernews.com · Nov 10

SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution

SAP released its November Security Patch Day updates, fixing four critical CVSS 10.0 vulnerabilities that allow remote code execution without authentication. Three flaws reside in the SAP NetWeaver application server—two in the Internet Communication Manager (ICM) and Web Dispatcher, and one in the SAML 2.0 service provider—while the fourth affects SAP Gateway. The ICM and Web Dispatcher bugs, identified as ICM2SHELL, enable memory corruption and OS command execution; the Gateway flaw, PROXYGATE, permits an attacker to impersonate a trusted server and run commands as the system administrator. SAP recommends immediate application of the individual patch notes, particularly for kernels 7.40 through 7.89, and advises upgrading unsupported kernels. The patches address vulnerabilities that could lead to full system compromise and potentially affect connected SAP environments.

💡 The fixes eliminate high‑risk entry points that could let attackers gain unrestricted control over SAP systems, a critical concern for enterprises relying on SAP for core operations. Prompt patching is essential to prevent exploitation that could disrupt business continuity and expose sensitive data.

techcrunch.com · Nov 10

France blames Iran for mass-hacks targeting freezers in grocery stores and blood…

The French government officially blamed Iran for a series of cyberattacks that targeted thousands of internet‑connected industrial freezer and refrigerator units in France and across Europe. The attacks, attributed to the Islamic Revolutionary Guard Corps, raised temperatures in grocery stores and retail supermarkets, spoiling food, and also compromised medical blood banks, though no blood was lost. French Foreign Minister Jean‑Noël Barrot described the incident as unprecedented sabotage, summoned Iran’s ambassador, and announced potential European sanctions and legal action.

💡 The incident exposes the vulnerability of critical food‑storage infrastructure to state‑backed cyber threats, underscoring the need for robust security protocols in essential services.