Check Point Research published its threat intelligence report for the week of November 9, 2026, detailing multiple cyberattacks, AI-powered threats, and high-severity vulnerabilities. Active exploitation was observed against an OpenSSH flaw allowing authentication bypass.
Top Attacks and Breaches
Check Point Research reported that Queens Public Library suffered a ransomware attack that encrypted its systems and disrupted public computers, Wi-Fi, and digital services while all 66 branches stayed open. Russian web hosting provider Beget faced a destructive cyberattack on November 1 that wiped data across its cloud infrastructure and required manual inspection of over 1,000 servers.
OPSSHIELD disclosed a supply-chain attack where compromised credentials led to malicious updates distributed on November 2, affecting approximately 2,950 customer servers. Ukraine's Air Alert app was also compromised to distribute false emergency alerts, while a separate attack affected Russia's emergency alert application.
AI Threats and Vulnerabilities
Check Point Research documented cybercriminals using ARTEX, an AI-powered framework that autonomously discovers and exploits vulnerable systems, identifying 1,608 live instances. Researchers also identified Haiou, a jailbreak bundle targeting OpenAI Codex, and India's Computer Emergency Response Team identified Crafty Falcon targeting financial and crypto businesses using AI-assisted tools.
SonicWall patched CVE-2026-19868, a high-severity vulnerability affecting SSL VPN services configured with SAML authentication. OpenSSH addressed CVE-2026-123158, a high-severity vulnerability with a CVSS score of 8.1 where oversized passwords bypass authentication, with active exploitation observed against an Alpine Linux honeypot.
Key facts and where they come from
- OpenSSH addressed CVE-2026-123158, a high-severity vulnerability affecting Linux systems using the musl library without PAM authentication.
OpenSSH addressed CVE-2026-123158, a high-severity vulnerability (CVSS 8.1) affecting Linux systems using the musl library without PAM authentication.
- Queens Public Library was struck by a ransomware attack that encrypted its systems.
Queens Public Library, a New York City public library system serving approximately 2.3 million residents, was struck by a ransomware attack that encrypted its systems.
- Check Point Research documented cybercriminals using ARTEX to autonomously discover and exploit vulnerable systems.
Check Point Research documented cybercriminals using ARTEX, an AI-powered framework that autonomously discovers and exploits vulnerable systems.
- SonicWall patched CVE-2026-19868 affecting SonicOS SSL VPN services configured with SAML authentication.
SonicWall patched CVE-2026-19868, a high-severity vulnerability affecting SonicOS SSL VPN services configured with SAML authentication.
