It is mid-November, and the pattern is painfully consistent: the fastest blast radius still comes from internet-exposed admin planes, plus defenders treating “local” bugs as low priority right up until they are the whole incident.

Today's Top 5

1. 341,039 Texans in dental breach: A new Texas AG filing says Access Dental Management notified 341,039 Texas residents. The notice hints at medical and SSN exposure, but stays quiet on the how and the who. Source
2. Check Point gateway to ESXi wiper: New research ties real-world exploitation of PHP2Shell on exposed Check Point gateways to privilege escalation and an SSH pivot into VMware ESXi, where a wiper shows up. The part that should make you sweat is the persistence footprint. Source
3. Project Zero cuts disclosure timelines: Google’s Project Zero is moving from “90+30” to a staged path ending at “Full 30,” explicitly calling out AI-assisted bug finding and near-zero patch-to-exploit time. If your patch program relies on soak time, that comfort blanket is gone. Source
4. NetScaler memory overflow scramble: A fresh CERT-EU advisory spotlights Citrix NetScaler ADC/Gateway fixes, including CVE-2026-120868 (9.3). No public exploitation yet, but every internet-facing Gateway team just got weekend work assigned. Source
5. Barracuda ESG exploitation confirmed: Barracuda says it has observed exploitation of CVE-2026-116606 and CVE-2026-111560 affecting a small number of orgs. The limiting factor is still simple: can an attacker reach your admin UI. Source

Why today matters: Today’s stories connect on one ugly thread: attackers do not need exotic chains when your management surface is reachable and your patch cadence is measured in quarters. Meanwhile, disclosure clocks are shrinking because AI makes “quiet time” a myth. CISOs who still treat edge appliances and admin UIs as a second-tier asset class should be nervous.

XERJ Corpus Hub: Working the Check Point wiper chain? An AI agent loading capa-rules could quickly classify the wiper and gateway payload samples into capabilities, then hand your IR lead a first-pass triage checklist and pivot ideas in minutes. Browse more at hub.xerj.org.

Ok, let’s get specific.

Data Breaches

1. Access Dental Management LLC reports 341,039 Texans affected: A Texas Attorney General posting shows Access Dental Management reporting a data security breach impacting 341,039 Texas residents, with sensitive data types listed in the state reporting table. The public entry does not explain intrusion method, vendor involvement, or whether ransomware played a role. Source: Texas Attorney General
2. Richmond Public Schools says personal data appeared on dark web: Richmond Public Schools confirmed personal information for former students and employees was posted on the dark web following a prior cyberattack. The update broadens who may be impacted and will matter for downstream identity monitoring and HR/legal response. Source: Axios
3. Sportsman’s Guide listed on leak site (unverified claim): Leak-site tracking shows Sportsman’s Guide newly listed by INC Ransom on November 13. Treat this as attacker-asserted until the company confirms, but use it as a prompt to hunt for edge access and credential reuse. Source: Cybersecurity Tracker
4. Texas Truck Center listed on leak site (unverified claim): Another November 13 leak-site listing indicates Texas Truck Center was posted by N0n. No public victim confirmation is included in the tracker entry. Source: Cybersecurity Tracker

Security Research

1. Check Point: PHP2Shell exploitation used to pivot into ESXi and wipe: Check Point Research documents a campaign starting October 30 using PHP2Shell for initial access, then CVE-2026-123039 for privilege escalation, persistence (including TSGA/TSProxy), and an SSH pivot into ESXi where destructive activity appears in some cases. The key takeaway is how quickly an “edge” compromise becomes a virtualization-layer event. Source: Check Point Research
2. Check Point advisory confirms in-the-wild exploitation and mitigations: Check Point’s own advisory write-up calls out active exploitation observed against a limited set of customers and provides mitigation guidance for those who cannot patch immediately. The operational detail is the important part, not the CVSS. Source: Check Point Blog
3. Project Zero updates disclosure policy for an AI-accelerated world: Project Zero argues that AI reduces patch-to-exploit time and increases bug volume, then announces a staged move to “Full 60” and “Full 30” disclosure timelines over 2027 and 2028. Expect more pressure on vendors and less predictability for defenders relying on embargo windows. Source: Google Project Zero
4. CERT-EU flags critical NetScaler ADC/Gateway vulnerabilities: CERT-EU summarizes Cloud Software Group bulletins addressing many flaws, highlighting CVE-2026-120868 (9.3) as broadly relevant and recommending upgrades, prioritizing internet-facing Gateway and AAA appliances. Even without confirmed exploitation, this class of device is too exposed to wait. Source: CERT-EU
5. Barracuda confirms exploitation for ESG chain: Barracuda notes observed exploitation activity affecting a small number of organizations and clarifies authentication is not required for CVE-2026-116606 if the admin UI is reachable. This is the usual story: segmentation saves you, not hope. Source: Barracuda

Top CVEs

1. CVE-2026-123039: Check Point Gaia OS local privilege escalation to root via a world-writable DynamicCLI control socket, with exploitation reported in the wild. If attackers land on the box, this turns “appliance foothold” into full control fast. Source
2. CVE-2026-109618: One of the PHP2Shell flaws enabling unauthenticated RCE in affected PHP builds, used as initial access in observed Check Point gateway attacks. Treat internet-facing web admin and portals as high-risk until confirmed patched. Source
3. CVE-2026-109619: The companion PHP2Shell flaw, also tied to unauthenticated RCE risk and used in the same exploitation chain described by Check Point research. Patch, then verify exposure and logging. Source
4. CVE-2026-116606: Barracuda ESG pre-auth authorization bypass, where access to the Admin UI can be enough for compromise without authentication. Barracuda reports exploitation affecting a small number of organizations, so “we are not a target” is not a strategy. Source
5. CVE-2026-120868: Citrix NetScaler ADC/Gateway memory overflow highlighted by CERT-EU, with vendor guidance to upgrade to fixed releases. Even when impact is described as DoS or unstable behavior, these devices sit at the wrong choke point to ignore. Source

Podcasts & Talks

1. SANS Stormcast (Nov 13, 2026): GPUStack auth bypass scans, ScreenConnect advisory, N-central exploits: A tight daily brief worth forwarding to whoever owns your remote access tooling and AI compute stack. The GPU cluster angle is not theoretical anymore. Listen: Apple Podcasts
2. CISO Series: The Department of Know (Nov 13, 2026): A useful listen if you want a quick executive-ready framing of the week’s exploit churn, plus what it means for prioritization when everyone is drowning in advisories. Listen: CISO Series
3. Security Now! #1104 (Nov 10, 2026): OpenSSH password bypass and patch chaos: Not brand new today, but still fresh and relevant if your org has Linux fleets managed by “tribal knowledge.” The SSH segment will prompt uncomfortable asset-inventory questions. Listen: GRC

Final Words

The uncomfortable pattern today is that defenders keep pricing risk based on labels, “local,” “DoS,” “moderate,” while attackers price risk based on reachability and role. A single exposed admin plane can turn a patching delay into a hypervisor outage, and no disclosure policy is going to wait for your change window.

This week, do three things:

• Patch and validate exposure on internet-facing Check Point gateways, specifically for CVE-2026-109618, CVE-2026-109619, and CVE-2026-123039, then hunt for webshell and SSH pivot indicators called out in the Check Point research.
• Audit whether Barracuda ESG Admin UIs are reachable from untrusted networks, and apply the vendor fixes for CVE-2026-116606 and CVE-2026-111560 even if you believe “only IT can reach it.”
• Put Citrix NetScaler upgrade verification for CVE-2026-120868 on a tracked executive dashboard, because “we plan to patch” is not the same as “we are no longer vulnerable.”

Your turn: If your edge gateway got popped tonight and the attacker tried to pivot into ESXi over SSH, do you know exactly where that log trail lives in your environment, and who is awake to read it? Hit reply with your one-sentence answer, or drop a comment on the web version. I read every reply.

Know someone running Check Point gateways in front of a virtualized core who still treats “edge” as separate from “infrastructure”? Forward them this issue. It costs 30 seconds, and it might save their weekend. For forwarded and web readers, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!