DanSec

Cybersecurity Brief

Friday 6 November 2026

In this brief Barracuda, Microsoft, GitHub, Chainalysis, NATS, OpenSSH, +10 more
Vendors
Barracuda, Microsoft, GitHub, Chainalysis, NATS, OpenSSH, OpenAI, Google, Vizio, Samsung, Meta, TikTok, Alpine Linux
Threat actors
Prince Group
CVEs
CVE-2026-116606, CVE-2026-111560

Major Incidents and Breaches

  • Update Chainalysis has removed customer access to its Reactor and Data Solutions products while it investigates the agentic attack. It says it still has no evidence that investigations data was accessed. (first reported 2026-10-31)[1]
  • Attackers tampered with files used by the Windows launcher for the game Goddess of Victory: NIKKE, putting players’ passwords and personal files at risk. Players are being urged to check their PCs.[2]
  • A French bank was reportedly hacked for $133 million.[3]
  • A Cyber Monitoring Centre report estimated that an IT failure at UK air traffic services provider NATS cost the UK economy over £33 million.[4]

Vulnerabilities and Patches

  • Update watchTowr published a technical analysis of the Barracuda Email Security Gateway chain, combining authorisation bypass CVE-2026-116606 and OS command injection CVE-2026-111560 for unauthenticated root, along with a detection tool but no exploit. No attacks have been reported. ESG is fixed in 9.4.0.030 and later; if patching is delayed, restrict the admin interface to trusted internal networks and re-enable automatic patching. (first reported 2026-11-03)[5][6]
  • Update Alpine has published fixed openssh packages for releases back to 3.16 for the ‘*sshole’ long-password SSH authentication bypass, also included in point releases 3.21.10, 3.22.8, 3.23.8 and 3.24.4. sshd must be restarted after upgrading because the package update does not restart it. (first reported 2026-11-05)[7][3]
  • Update OpenAI has patched the ChatGPT Lockdown Mode bypass, which allowed silent chat data theft without user interaction. (first reported 2026-11-05)[8]

Threat Actor Activity

  • US prosecutors charged three men with using AI to impersonate CEOs and attorneys, often targeting company accounting departments, to steal $129 million.[9]
  • Thai opposition figures were targeted with spyware.[3]
  • Microsoft Threat Intelligence observed threat actors using the agentic ARTEX framework to search GitHub for OAuth application secrets. AI agents then used the compromised OAuth applications to perform authenticated actions in the associated tenants.[10]
  • Phishing campaigns are using fake OpenAI, SpaceX and Anthropic event invitations, delivered via two phishing-as-a-service platforms, to steal Microsoft and Google credentials and authentication sessions.[11]
  • Truffle Security launched a free Secrets Revocation Program to help API key issuers revoke about 1.4 million publicly exposed secrets that remain valid.[12]
  • Erroneous or outdated DNS records, including typos, leave some US government email systems open to abuse by attackers.[13]
  • Fortra took down holiday rental phishing sites that copy popular rental platforms, including listings, host names and reviews, and use live chat to persuade hesitant travellers to hand over passwords, personal details and card numbers.[14]
  • BlueFlag Security’s State of Developer Risk 2026 report found that 99% of repository access tokens never expire.[15]
  • Vizio and Samsung smart TVs appear to continue tracking after users opt out.[16]

Policy and Regulation

  • The US issued further sanctions against four people and 41 companies linked to Prince Group, the Cambodian company accused of running a billion-dollar scam operation.[17]
  • Google, Meta and TikTok each filed federal lawsuits against an incoming California law that blocks platforms from deploying ‘psychologically exploitative’ features for children aged 15 and under.[18]

Sources

  1. Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services - thehackernews.com
  2. NIKKE PC launcher compromise put players’ passwords and personal files at risk - malwarebytes.com
  3. Risky Bulletin: Some OpenSSH instances take any password longer than 256 characters - news.risky.biz
  4. NATS Air Traffic Control Failure Cost UK Economy £33m - infosecurity-magazine.com
  5. Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login - thehackernews.com
  6. Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560) - labs.watchtowr.com
  7. OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux - thehackernews.com
  8. Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction - thehackernews.com
  9. 3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 Million - securityweek.com
  10. Threat actors use agentic AI tooling to find and abuse exposed secrets - microsoft.com
  11. Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts - bleepingcomputer.com
  12. Nearly 1.5 million exposed secrets targeted in new revocation program - bleepingcomputer.com
  13. US Government Email Systems Open to Abuse Thanks to Typos - darkreading.com
  14. Rental phishing sites use live chat to win over hesitant travelers - helpnetsecurity.com
  15. 99% of repository access tokens never expire - helpnetsecurity.com
  16. Vizio, Samsung smart TVs seem to ignore tracking opt outs - malwarebytes.com
  17. US issues more sanctions against Prince Group scam center affiliates - therecord.media
  18. Social media giants sue California to overturn law shielding kids 15 and under from compulsive use - therecord.media