Cyber Threat Brief — November 9 2026
⚠️ This report is AI-generated. Always validate findings.
1. LNbits servers — stop until a fix is published
TL;DR: LNbits reports a wave of attacks on LNbits servers and told every operator to stop them until security patches ship. Keep self-hosted LNbits stopped, keep the Paywall extension disabled, and review new accounts that withdrew funds.
What’s New:
- LNbits told operators on 8 Nov to stop every LNbits server while it prepares several security patches.
- Earlier on 8 Nov, LNbits told operators to disable the Paywall extension while it investigates a potential bug. The operator below says LNbits confirmed which extension was exploited, but nobody has named it publicly.
- Kevin Ravensberg reports his server was exploited from 09:22 to 14:00 UTC on 8 Nov, and new accounts withdrew 2,285,545 sats.
- No CVE, advisory, or fixed release existed at 13:25 UTC on 9 Nov. LNbits creator Ben Arc estimated patches within 24 to 48 hours of his 8 Nov post.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| self-hosted LNbits server | Mitigation | T1190 | Host process inventory | Stop the self-hosted LNbits server and keep it offline until LNbits publishes a fixed release. |
| LNbits Paywall extension | Suspected vulnerable component | T1190 | LNbits admin extension settings | Confirm the LNbits Paywall extension is disabled before any restart, and keep the Paywall extension off until LNbits says the fix covers it. |
| LNbits account created 2026-11-08 | Account behavior | T1136 | LNbits user list and wallet ledger | List LNbits accounts created on 2026-11-08 and any withdrawal those accounts made before the server stopped. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No rule reads the LNbits user list or wallet ledger. |
| Elastic | None — verified | No rule reads the LNbits user list or wallet ledger. |
| Sigma | None — verified | No rule reads the LNbits user list or wallet ledger. |
Hunt hint: Stop the self-hosted LNbits process and leave it stopped. Export the user list and the wallet ledger for 8 November 2026 before you change anything. Flag accounts created that day that also withdrew sats before the process stopped. Check whether the Paywall extension was enabled on that server. Treat 2,285,545 sats as one operator’s reported loss, not as a match threshold. Check the LNbits GitHub releases page for a release newer than v1.6.2 before you start the service again. Do not restart only because the hosted service is back.
Sources: LNbits stop-servers post · LNbits Paywall precaution · LNbits SaaS notice · Kevin Ravensberg loss report · Ravensberg extension follow-up · Ben Arc patch estimate · The Hacker News
Detection index: ESCU 4c1652e (2026-11-03) · elastic detection-rules 0aacc5e (2026-11-06) · SigmaHQ 53b90df (2026-11-07). Code search for LNbits and Lightning wallet terms returned no rule in any of the three repos; mirrors were not cloned.
Status Updates
- OpenSSH (OpenSSH-CVE-2026-123158): SANS ISC Cowrie honeypots logged the first all-”A” password exploit attempts on 5 Nov. Long-password attempts peaked at 713 on 6 Nov. Ullrich expects many of these honeypot logins succeeded but has not confirmed it. Scope remains musl with PAM disabled; still not in KEV. ISC diary 33498 8 Nov brief
- BeyondTrust Remote Support (CVE-2026-102764): Watching (no change). The KEV deadline remains overdue. The 8 Nov fixed-release correction still stands. 8 Nov brief
- WordPress Core (WordPress-Core-CVE-2026-119977): Watching (no change). KEV remains overdue. Before a full-package update, deny
/wp-content/upgrade/and verify 403. 7 Nov brief - Retired from watch: GitLab CE/EE CVE-2026-97229 (last update 2026-11-02); PHP core PHP2Shell-CVE-2026-109618, CVE-2026-109619, and CVE-2026-115560 (last update 2026-11-02). 2 Nov brief
- SonicWall SonicOS (SonicWall-SonicOS-CVE-2026-19868): Watching (no change). KEV remains due 20 November. SNWLID-2026-0014 7 Nov brief
- Synology DSM (Cerber-Synology-DSM-2026-10): Watching (no change). Synology still has not identified which of CVE-2024-10441, CVE-2024-50629 or CVE-2024-10445 was used. 2 Nov brief
- European refrigeration controllers (Refrigeration-Controllers-EU-2026-11): Watching (no change). Initial access and hacktivist claims remain unconfirmed. Exposed devices are not confirmed compromised. 2 Nov brief
- ARTEX (ARTEX-Software-Vendors-2026-11): Watching (no change). WorkOS attributes its incident to an escaped test agent. Microsoft’s Storm-3358 financial claim stays deferred. 3 Nov brief
- Ivanti Connect Secure CVE-2026-111357: Watching (no change). KEV overdue; prior correction remains in force. Prior brief
- SharePoint ToolShell (Storm2603-ToolShell-Fileless-2026-11): Watching (no change). CVE-2025-53770 is KEV overdue; CVE-2025-53771 is not in KEV. Prior brief
- Siemens Software Center (Siemens-Software-Center-CVE-2026-110936): Watching (no change). CVE-2026-110936 is KEV overdue. Prior brief
- Plex Media Server (Plex2Shell-CVE-2026-96652): Watching (no change). CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 remain KEV overdue. Prior brief
- Apple (Apple-CVE-2024-27834-2026-11): Watching (no change). CVE-2024-27834 remains KEV due 18 November. Prior brief
- Ivanti Connect Secure CVE-2026-118527: Watching (no change). KEV remains due 13 November. Prior brief
- VMware ESX CVE-2026-41709: Watching (no change). KEV remains due 11 November. Prior brief
- Brotli CVE-2026-111497: Watching (no change). KEV remains due 10 November. Prior brief
- Adobe Commerce CVE-2026-48356: Watching (no change). KEV remains due 10 November. Prior brief
- Zyxel GS1900 (Zyxel-GS1900-CVE-2026-107441): Watching (no change). Prior brief
- GitLab CVE-2026-110264: Watching (no change). Prior brief
- Canonical LXD CVE-2026-112816: Watching (no change). Prior brief
- Binance (Binance-TraderTraitor-2026-11): Watching (no change). Prior brief
- eMudhra (eMudhra-CVE-2026-111943): Watching (no change). CVE-2026-111943 and CVE-2026-91403: no change. Prior brief
- Tailscale SSH (Tailworm-Tailscale-SSH-2026-10): Watching (no change). Prior brief
- Cursor marketplace Claude Code (Cursor-Claude-Code-2.1.313-2026-10): Watching (no change). Prior brief
- XCPE Android TV (XCPE-Botnet-2026-11): Watching (no change). Prior brief
- WinRAR Gorbag (Gorbag-WinRAR-CVE-2025-8088-2026-11): Watching (no change). CVE-2025-8088: no change. Prior brief