Cybersecurity Brief – 2026-11-06

Fri, 06 Nov 2026 00:00:00 +0000

Major Incidents and Breaches

Update Chainalysis has removed customer access to its Reactor and Data Solutions products while it investigates the agentic attack. It says it still has no evidence that investigations data was accessed. (first reported 2026-10-31)^[1]
Attackers tampered with files used by the Windows launcher for the game Goddess of Victory: NIKKE, putting players’ passwords and personal files at risk. Players are being urged to check their PCs.^[2]
A French bank was reportedly hacked for $133 million.^[3]
A Cyber Monitoring Centre report estimated that an IT failure at UK air traffic services provider NATS cost the UK economy over £33 million.^[4]

Vulnerabilities and Patches

Update watchTowr published a technical analysis of the Barracuda Email Security Gateway chain, combining authorisation bypass CVE-2026-116606 and OS command injection CVE-2026-111560 for unauthenticated root, along with a detection tool but no exploit. No attacks have been reported. ESG is fixed in 9.4.0.030 and later; if patching is delayed, restrict the admin interface to trusted internal networks and re-enable automatic patching. (first reported 2026-11-03)^[5]^[6]
Update Alpine has published fixed openssh packages for releases back to 3.16 for the ‘*sshole’ long-password SSH authentication bypass, also included in point releases 3.21.10, 3.22.8, 3.23.8 and 3.24.4. sshd must be restarted after upgrading because the package update does not restart it. (first reported 2026-11-05)^[7]^[3]
Update OpenAI has patched the ChatGPT Lockdown Mode bypass, which allowed silent chat data theft without user interaction. (first reported 2026-11-05)^[8]

Threat Actor Activity

US prosecutors charged three men with using AI to impersonate CEOs and attorneys, often targeting company accounting departments, to steal $129 million.^[9]
Thai opposition figures were targeted with spyware.^[3]

Trends, Tools and Tactics

Microsoft Threat Intelligence observed threat actors using the agentic ARTEX framework to search GitHub for OAuth application secrets. AI agents then used the compromised OAuth applications to perform authenticated actions in the associated tenants.^[10]
Phishing campaigns are using fake OpenAI, SpaceX and Anthropic event invitations, delivered via two phishing-as-a-service platforms, to steal Microsoft and Google credentials and authentication sessions.^[11]
Truffle Security launched a free Secrets Revocation Program to help API key issuers revoke about 1.4 million publicly exposed secrets that remain valid.^[12]
Erroneous or outdated DNS records, including typos, leave some US government email systems open to abuse by attackers.^[13]
Fortra took down holiday rental phishing sites that copy popular rental platforms, including listings, host names and reviews, and use live chat to persuade hesitant travellers to hand over passwords, personal details and card numbers.^[14]
BlueFlag Security’s State of Developer Risk 2026 report found that 99% of repository access tokens never expire.^[15]
Vizio and Samsung smart TVs appear to continue tracking after users opt out.^[16]

Policy and Regulation

The US issued further sanctions against four people and 41 companies linked to Prince Group, the Cambodian company accused of running a billion-dollar scam operation.^[17]
Google, Meta and TikTok each filed federal lawsuits against an incoming California law that blocks platforms from deploying ‘psychologically exploitative’ features for children aged 15 and under.^[18]

Sources

Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services - thehackernews.com
NIKKE PC launcher compromise put players’ passwords and personal files at risk - malwarebytes.com
Risky Bulletin: Some OpenSSH instances take any password longer than 256 characters - news.risky.biz
NATS Air Traffic Control Failure Cost UK Economy £33m - infosecurity-magazine.com
Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login - thehackernews.com
Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560) - labs.watchtowr.com
OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux - thehackernews.com
Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction - thehackernews.com
3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 Million - securityweek.com
Threat actors use agentic AI tooling to find and abuse exposed secrets - microsoft.com
Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts - bleepingcomputer.com
Nearly 1.5 million exposed secrets targeted in new revocation program - bleepingcomputer.com
US Government Email Systems Open to Abuse Thanks to Typos - darkreading.com
Rental phishing sites use live chat to win over hesitant travelers - helpnetsecurity.com
99% of repository access tokens never expire - helpnetsecurity.com
Vizio, Samsung smart TVs seem to ignore tracking opt outs - malwarebytes.com
US issues more sanctions against Prince Group scam center affiliates - therecord.media
Social media giants sue California to overturn law shielding kids 15 and under from compulsive use - therecord.media

CVE-2026-111560 on DanSec Daily

Cybersecurity Brief – 2026-11-06

Major Incidents and Breaches

Vulnerabilities and Patches

Threat Actor Activity

Trends, Tools and Tactics

Policy and Regulation

Sources