Today’s theme is trust, misplaced and over-delegated. Social engineering walks through employee accounts, checkout pages quietly siphon cards, and “patched” is still a vibe, not a state.

Today's Top 5

1. Dexcom employee accounts hit: Dexcom says attackers used social engineering to access employee accounts and download files, potentially exposing patient-linked health details. The scary part is what defenders will find in downstream inbox rules. Source
2. Fandango checkout page skimmed: Fandango says an issue on its ticketing checkout page let an unauthorized party access card data, including CVV, over a short window in October. If you run any payments page, ask what your tamper signals look like. Source
3. Gap ransomware claim resurfaces: A new leak-site listing alleges Gap was hit, but public confirmation is still absent. The interesting question is what evidence would convince your exec team before the screenshots land. Source
4. UnrealIRCd is now KEV: CISA added CVE-2026-114713 to KEV after exploitation, tied to UnrealIRCd linked-server command injection. Many teams will learn the hard way that banners do not prove hot-patches. Source
5. SignDrop Windows LPE PoC: A public PoC dubbed SignDrop abuses a CLFS mitigation path to get SYSTEM by coaxing Defender into doing the privileged file creation. No patch, lots of copy-paste risk. Source

Why today matters: Two attacker playbooks are converging: credentialed access via humans (social engineering, vendor accounts, employee inboxes) and “small” edge or daemon flaws that become fleet-wide incidents once KEV and PoCs hit. The nervous orgs are the ones that still treat identity telemetry and web integrity monitoring as optional add-ons.

XERJ Corpus Hub: Working the CVE-2026-114713 UnrealIRCd scramble? An AI agent loading splunk-security-content could draft a first-pass hunt for UnrealIRCd network abuse patterns (sudden operator actions, mass KILL/GLINE bursts, unexpected server-to-server commands) and hand your SOC runnable searches in minutes. Browse hub.xerj.org, it is free.

Ok, let’s get into the receipts.

Data Breaches

1. Dexcom breach notice: social engineering into employee accounts: Dexcom says it identified unauthorized access to certain employee accounts and that the attacker used social engineering, then downloaded files. Impacted data may include names, addresses, and health information such as provider, pharmacy, DOB, prescription number, diagnoses, and an indication someone is a Dexcom user. Source: California AG (PDF)
2. Fandango payment card exposure tied to checkout page issue: Fandango says an unauthorized party could access payment card information for certain transactions from October 8 to 11, 2026, and determined on October 30 that information may have been impacted. Data listed includes card number, CVV, expiration date, billing ZIP, and email address. Source: California AG (PDF)
3. Gap leak-site claim (unverified): A criminal leak site associated with the N0n group posted a listing claiming Gap as a victim on November 14, 2026, but reporting notes the listing alone does not confirm a breach. Treat it as an early warning to go look for identity and egress anomalies before you get a ransom note. Source: CyPro
4. Sportsman’s Guide leak-site claim (unverified): Monitoring feeds show INC Ransom listing sportsmansguide.com as a new victim claim. No public confirmation yet, which is exactly when defenders should be verifying backups, identity logs, and outbound transfers. Source: Cybersecurity Tracker

Security Research

1. Unpatched Windows “SignDrop” PoC targets CLFS via Defender: Researchers describe a local privilege escalation chain that uses Defender’s update interface and CLFS authentication behavior to obtain SYSTEM. Expect rapid operator tradecraft reuse because it is easy to wrap into existing post-ex tooling. Source: The Hacker News
2. UnrealIRCd hot-patch guidance, exploitation observed: UnrealIRCd maintainers published detailed steps to hot-patch or upgrade, plus verification commands for the labeled-response module. The most useful part is that they explicitly note active exploitation and include a network-wide SPAMFILTER workaround. Source: UnrealIRCd Forums
3. CISA KEV: UnrealIRCd CVE-2026-114713: CISA’s KEV entry notes the vulnerability enables command injection on networks with two or more linked servers and flags forensic triage requirements. If your org still has IRC infrastructure for ops or community, this is your weekend. Source: CISA KEV (mirror)
4. Linux kernel TCP bug guidance for CVE-2026-98432 (MPTCP angle): Amnezia published a practical “who’s at risk” breakdown and mitigation guidance focused on MPTCP-exposed services such as Xray, while emphasizing kernel patching as the real fix. Source: Amnezia
5. Dexcom incident details show the modern PHI path: The Dexcom notice is a crisp example of how “just an employee account” becomes regulated health exposure through downloaded files and mixed business apps. Worth reading as a tabletop input for your own SaaS sprawl. Source: California AG (PDF)

Top CVEs

1. CVE-2026-114713: UnrealIRCd improper neutralization of delimiters enabling command injection on linked-server networks, now listed as exploited by CISA KEV with a federal due date of November 16, 2026. Patch or hot-patch and verify locally. Source
2. CVE-2026-123039: Check Point Gaia OS DynamicCLI permission issue that can allow an authenticated local user to run commands as root, now in CISA KEV. If you treat this as “just local,” you are missing the post-ex reality on appliances. Source
3. CVE-2026-123158: OpenSSH password authentication bypass on Linux when built against musl without PAM, commonly Alpine, with specific account conditions. Red Hat’s write-up is blunt about the preconditions and exposure. Source
4. CVE-2026-98432: Linux kernel IPv4 TCP use-after-free that can crash systems, disclose kernel memory, and under demonstrated conditions lead to unauthenticated RCE against MPTCP listeners. Patch kernels and reboot, not just containers. Source

Podcasts & Talks

1. Risky Business Features Podcast: “Why CISOs need to read the room”: A practical discussion on how to change security posture as business appetite shifts, without waiting for a headline-driven mandate. Good listening for anyone trying to fund identity and monitoring basics before the next breach letter. Listen: Risky Business Media
2. Risky Bulletin: “Chinese APT exploits SS7, Diameter to spy on targets”: Short, newsy briefing that ties telecom signaling abuse to real-world espionage and reminds you why “core” infrastructure visibility is still thin at many enterprises. Listen: Risky Business Media

Final Words

The uncomfortable pattern today is that the initial intrusion is often unimpressive, a phone call, an inbox, a checkout page tweak. The blast radius comes from what we have normalized: employee accounts with broad access, web pages that lack integrity baselines, and “legacy daemons” nobody admits they still run until KEV says hello.

This week, do three things:

• Run an emergency UnrealIRCd inventory and patch to 6.2.7.1 or apply the hot-patch for CVE-2026-114713, then verify using the vendor’s labeled-response module-status check.
• Audit employee accounts with access to PHI-adjacent files and enforce phishing-resistant MFA plus impossible-travel and mass-download detections, using the Dexcom incident as your tabletop.
• Add a checkout-page integrity control for payments flows (content security policy, subresource integrity where possible, and alerting on unexpected script changes), using the Fandango skimmer window as the test case.

Your turn: If a contractor, agency, or “trusted partner” asked you to bypass your normal verification to resolve a critical patient-impact issue tomorrow, would your team slow down or comply? Hit reply with your one-sentence answer, or drop a comment on the web version. I read every reply.

Know someone who still thinks “checkout pages don’t get hacked anymore”? Forward them this issue and tell them to read the Fandango notice, it is a 2-minute reality check. For everyone else, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!