https://reddit.com/r/Infosec/comments/1xt46fq/skullex_says_outlook_zeroday_leaks_ntlm_hashes/: Skullex says: Outlook zero-day leaks NTLM hashes, Plex2Shell owns QNAP NAS, Siemens IoT still dropping bots: Nov 5–11 Exploit Security Newsletter

Published Nov 11, 2026

Updated

Affected Software

8 affected components

Microsoft Outlook

QNAP QNAP NAS

Siemens SIMATIC IoT2050

OpenJS Foundation Node-RED

Zyxel GS1900

Barracuda Networks Email Security Gateway

Google Chrome

Cisco BroadWorks

Frequently Asked Questions

Which systems have confirmed active exploitation mentioned in this report?

Active exploitation is reported for Microsoft Outlook, a four-CVE Plex2Shell chain affecting QNAP NAS devices, and Siemens SIMATIC IoT2050 / Node-RED. The report also says crypto miners and proxy software have already been installed on affected internet-exposed QNAP devices.

What attacker interaction is described for the Outlook issue?

The report says opening a crafted message can leak NTLMv2 hashes. It describes the issue as actively exploited.

Are QNAP devices only at risk when exposed to the internet?

The reported QNAP compromises specifically involve internet-exposed devices. The report does not provide information about exposure or exploitability for non-internet-exposed QNAP deployments.

Does the Siemens issue require authentication?

No. The report describes unauthenticated flows that can execute code and drop bots on Siemens SIMATIC IoT2050 / Node-RED deployments.

What network position is required for the Zyxel GS1900 issue?

The report describes unauthenticated root command execution on the LAN. It does not state that the issue is exploitable from the internet.

https://reddit.com/r/Infosec/comments/1xt46fq/skullex_says_outlook_zeroday_leaks_ntlm_hashes/: Skullex says: Outlook zero-day leaks NTLM hashes, Plex2Shell owns QNAP NAS, Siemens IoT still dropping bots: Nov 5–11 Exploit Security Newsletter

Affected Software

Frequently Asked Questions

Which systems have confirmed active exploitation mentioned in this report?

What attacker interaction is described for the Outlook issue?

Are QNAP devices only at risk when exposed to the internet?

Does the Siemens issue require authentication?

What network position is required for the Zyxel GS1900 issue?

Company

Resources

Contact

Frequently Asked Questions

Which systems have confirmed active exploitation mentioned in this report?

What attacker interaction is described for the Outlook issue?

Are QNAP devices only at risk when exposed to the internet?

Does the Siemens issue require authentication?

What network position is required for the Zyxel GS1900 issue?