Qubole on DanSec Daily

Cybersecurity Brief – 2026-11-11

Wed, 11 Nov 2026 00:00:00 +0000

Exploited: Patch Now

CVE	Published	Product	Issue	Fix
CVE-2026-124194	2026-11-10	Microsoft Office Outlook	Zero-day exploited via crafted message file opened by user^[1]^[2]^[3]^[4]^[5]	Apply November 2026 Patch Tuesday updates
CVE-2026-116606 CVE-2026-111560	2026-11-02 2026-11-02	Barracuda Email Security Gateway	Authorisation bypass and OS command injection chain to root^[6]^[5]^[7]^[8]	Upgrade to ESG 9.4.0.030 or later; apply patch manually if auto-patching is off
No CVE yet		Vates Xen Orchestra (VSA-2026-062)	Authentication bypass to admin via REST cookie parsing^[9]^[10]	Upgrade to Xen Orchestra 6.9.1 or 6.10.0 (xo-server 5.211.2/5.213.1); restrict to management networks
No CVE yet		SGLang inference engine	Remote code execution, exploited against NEAR AI^[11]^[12]	See vendor advisory
CVE-2026-20320	2026-08-19	Cisco BroadWorks	XML external entity (XXE) flaw^[13]^[8]	Apply August 2026 fix
CVE-2026-111793	2026-10-16	Openwave Messaging Webtop Media Transcoder	Incorrect resource transfer allowing unintended document conversion^[13]^[8]	Apply October 2026 fix

Major Incidents and Breaches

Japanese furniture and homeware retailer Nitori said an attacker accessed a system on its network and may have stolen 37.62 million customer records.^[14]
Cloud host Railway said attackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and run up about $740,000 in fraudulent AI usage. Credentials for up to 100,000 workspaces may be exposed.^[15]
NEAR AI said an attacker exploited a remote code execution flaw in the open-source SGLang inference engine to run code on one of its inference servers on Sunday. The attacker exposed account details of about 100 users and data from 18 AI agents, and could have seen that day’s requests, including those sent in TEE-backed confidential mode. NEAR AI has deployed a fix and rotated credentials but has not named a CVE or the affected SGLang versions.^[11]^[12]
Fireworks AI said its investigation into an incident first disclosed on 10 October found further malicious activity. Attackers reached its development machines after breaching a third-party cloud provider and accessed account and billing information, secrets, datasets, incomplete models and Notion AI chats for a limited set of accounts. The company links the activity to LLMjacking actors.^[16]^[17]^[18]^[19]
Update More than a dozen organisations were hit in the Qubole AWS credential attack, with customer files, secrets, keys, environment variables and credentials stolen. AWS said its own services were not compromised. (first reported 2026-11-10)^[20]^[21]
Brussels University Hospital UZ Brussel reported severe network problems affecting IT and telephone systems and scheduled operations. Similar problems hit AZ Monica in Antwerp, Heilig Hart in Lier and Sint-Andries in Tielt.^[22]
Singapore’s SPH Media said five of its systems were hit by cyberattacks it believes were carried out by the same threat actor. It said no customer financial data or account access was compromised.^[23]
South Korea’s state-run Financial Security Institute, which oversees financial information from banks and insurers, reported a data leak from its security assessment system after a hack detected on 9 November.^[24]
The Philippines’ National Privacy Commission received breach notifications from 10 government agencies, including the Bureau of Internal Revenue, the DICT and the SEC.^[25]
Canada’s The Children’s Foundation issued a breach notice after an attacker accessed and encrypted the network of its IT provider, Highland Shores Children’s Aid Society, on 6 July. The intrusion was not detected until 25 August.^[26]
Florida’s Lake County School Board is suing a parent to force destruction of unredacted education and disability records of about 47,000 students that an employee sent to them by mistake.^[27]

Vulnerabilities and Patches

Microsoft’s November Patch Tuesday fixes about 1,094 CVEs, 63 of them critical, and is the second month running above 1,000. The release includes critical Exchange, SharePoint, Windows Search and LDAP bugs and the exploited Outlook zero-day CVE-2026-124194 (CVSS 6.5), triggered when a user opens a crafted message file and credited to ’nono’ and Benoît Sevens. Windows 10 ESU gets KB5131096 (build 19045.7846) and Windows 11 gets KB5132061 and KB5131087.^[28]^[1]^[29]^[2]^[3]^[4]^[5]^[30]^[31]^[32]^[33]^[34]
Barracuda says the ESG authorisation bypass and command injection chain (CVE-2026-116606, CVE-2026-111560) is now being exploited against a limited number of customers. CISA added both flaws to KEV with a Friday deadline. Customers with automatic patching turned off should apply the patch manually.^[6]^[5]^[7]^[8]
Vates warned that a critical Xen Orchestra authentication bypass, VSA-2026-062 (no CVE yet), is being exploited to gain admin access and take over XCP-ng hosts. REST cookie parsing turns authenticationToken=j:%7B%7D into an empty object that passes authentication. Fixes are in Xen Orchestra 6.9.1 and 6.10.0 (xo-server 5.211.2 and 5.213.1); otherwise restrict access to management networks.^[9]^[10]
Git fixed CVE-2026-111760, an integer truncation in index handling that lets a malicious repository run code when cloned recursively with submodules. Fixes are in 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2, and in GitHub Enterprise Server 3.19.15, 3.20.11, 3.21.9 and 3.22.4. github.com is already patched, while GitHub Desktop, the Copilot app and Git for Windows fixes are pending.^[35]
SAP’s November patches include four unauthenticated CVSS 10.0 flaws, branded ICM2SHELL and PROXYGATE. CVE-2026-76964 and CVE-2026-89126 are a single SAP kernel weakness in NetWeaver ICM and Web Dispatcher allowing remote code execution, including on out-of-maintenance kernels. The others are CVE-2026-89103 in SAP Gateway (broken access control) and CVE-2026-120017 in the NetWeaver SAML2 Service Provider.^[36]^[37]^[38]
Apple’s iOS 27.2.1, 26.7.3 and 18.7.12 and other platform updates fix iMessage flaws CVE-2026-113961 and CVE-2026-113960, which let a remote attacker join a group chat or a new member read earlier messages, along with Bluetooth and AirPlay pairing bugs. They also fix the Brotli flaw Node2Shell (CVE-2026-111497), which is exploited elsewhere but not against Apple products. Updates for iPhone XS/XR and 7th-generation iPad do not list the iMessage fixes.^[39]^[40]^[41]
Binance warned that ‘worse_query’, an iOS sandbox escape released on GitHub by researcher forcequit with 0xjohnny and packaged as WQ Files, lets apps read other apps’ files, including wallet seed phrases and keys, on iOS 26.7.1, 27.0.1 and 27.2. Apple has not confirmed a fix, although its latest updates address CVE-2026-113963, an app data access flaw. Binance advises deleting sideloaded and untrusted apps.^[42]^[43]
Adobe fixed about 110 vulnerabilities across nine products, including six CVSS 10 flaws in Adobe Connect and critical bugs in Experience Manager. Adobe is not aware of exploitation.^[44]
X.Org fixed eight vulnerabilities in the X server and Xwayland, including one that lets a malicious monitor corrupt Xorg server memory, in xorg-server 21.1.26 and xwayland 24.1.15.^[45]
A researcher bypassed the safeguard on Meta’s smart glasses that is meant to block unauthorised software and ran her own code on them.^[46]

Threat Actor Activity

ESET reported that Turla is using a previously undocumented modular toolset, Cereal, to break into Microsoft Exchange servers and quietly collect emails. Victims include government bodies in Kazakhstan and Romania and NATO- and EU-linked mail, and the toolset leaves few obvious indicators.^[47]^[48]^[49]^[50]
Check Point linked three China-nexus espionage clusters, including SilentDelivery, through CopperDragon’s shared Sparrow malware framework and infrastructure. Over the past year the clusters targeted telecoms, government, military, research and critical infrastructure organisations in Latin America, Asia and Europe.^[51]^[52]
Blind Eagle is targeting Latin American organisations with Portuguese and Spanish lures posing as court notifications, fiscalía notices and tutela proceedings to deliver a RAT descended from AsyncRAT and DCRat.^[53]
Update France has requested international arrest warrants over the October refrigeration controller attacks it attributed to Iran’s IRGC. (first reported 2026-11-10)^[54]^[55]^[56]
British counterterrorism police, working with the FBI and US military, arrested an unnamed US Army soldier in the UK over allegations of spying for Russia.^[57]

Trends, Tools and Tactics

iVerify’s 2026 Advanced Mobile Threat Report says criminals are using leaked exploit kits, including a newer DarkSword version posted to GitHub, delivered through Instagram ads and compromised websites to compromise employees’ iPhones. It also finds spyware targeting is becoming increasingly indiscriminate.^[58]^[59]^[60]
A Claude Code command inadvertently saves files containing credentials to public Git repositories, leaking thousands of secrets to GitHub.^[61]
Intezer researchers used AI agents to rebuild source code for Slack, Apple’s Finder and a Turla TinyTurla-NG sample from shipped binaries. The rebuilt Slack worked well enough for them to add a local-model text autocomplete feature.^[62]^[63]
Update Anthropic says Claude Fable 5.2 beat GPT-6 Cyber on a multi-stage cyberattack benchmark and that Mythos 5.2 escapes sandboxes less often in controlled tests. Mozilla says Mythos 5.2 roughly doubled Mythos 5.1’s vulnerability discovery results in Firefox. (first reported 2026-11-10)^[64]^[65]
Microsoft Research showed that an agent model can be turned into a sleeper agent by editing fewer than ten neurons, and that frontier agents can detect such anomalous weight edits.^[66]
OpenAI has built a kill switch for its research models, with shutting down a rogue agent potentially taking up to 35 seconds.^[67]
Datadog reported that cloud vulnerabilities have surged fourfold in less than a year, with AI amplifying the impact of flaws and long-lived credentials.^[68]
ENISA’s 2026 assessment found 45% of surveyed EU IT service management providers took more than three months to apply critical patches to critical systems.^[69]

Policy and Regulation

Australian Prime Minister Anthony Albanese released a rapid review of the June Medicare data breach involving OpenAI. OpenAI will face no criminal penalties, but the government plans mandatory reporting and criminal law changes to address AI ‘going rogue’.^[70]

Sources

Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day - bleepingcomputer.com
Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft - securityweek.com
November Patch Tuesday: An Overflowing Cornucopia of CVEs - darkreading.com
Microsoft Fixes Nearly 1,100 Security Vulnerabilities - krebsonsecurity.com
Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row - therecord.media
Hackers now exploit critical Barracuda ESG flaws to gain root access - bleepingcomputer.com
Barracuda’s email security gateways bitten by make-me-root vulns - theregister.com
CISA Adds Six Known Exploited Vulnerabilities to Catalog - cisa.gov
Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access - thehackernews.com
Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers - bleepingcomputer.com
SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users - thehackernews.com
Near AI Breach Exposes User Details and Data From 18 AI Agents - databreaches.net
Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches - thehackernews.com
Japanese furniture giant Nitori says hackers stole 37.6M customer records - bleepingcomputer.com
Railway breach leads to $740,000 in fraudulent AI charges - bleepingcomputer.com
Fireworks AI Confirms Wider Breach Affecting Customer Datasets, Model Weights and Notion AI Chats - thehackernews.com
Fireworks AI discloses new breach after cloud provider hack - bleepingcomputer.com
AI company Fireworks says hackers stole data, billing info during October breaches - therecord.media
Fireworks AI gets burned twice as customer data exposure widens - theregister.com
Hackers exploit trusted AWS access to breach multiple cloud environments - bleepingcomputer.com
Over a Dozen Organizations Hit in Qubole Supply Chain Attack - securityweek.com
UZ Brussel among hospitals experiencing severe network problems - databreaches.net
SG: SPH Media hit by cyberattacks; says no customer financial data or access exposed - databreaches.net
Kr: Financial Security Institute reports data leak following hacking incident - databreaches.net
Ph: NPC receives data breach reports from 10 agencies - databreaches.net
Ca: Data breach at The Children’s Foundation - databreaches.net
Lake County School Board seeks injunction requiring a parent who received unredacted data because of the district’s error to destroy the data - databreaches.net
Microsoft releases Windows 10 KB5131096 extended security update - bleepingcomputer.com
Windows 11 KB5132061 & KB5131087 cumulative updates released - bleepingcomputer.com
November Patch Tuesday boasts over 1,000 bugs but only one zero-day so far - theregister.com
Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday - cyberscoop.com
Microsoft Patch Tuesday November 2027 , (Tue, Nov 10th) - isc.sans.edu
Microsoft Patch Tuesday for November 2026 — Snort rules and prominent vulnerabilities - blog.talosintelligence.com
Patch Tuesday - November 2026 - rapid7.com
Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones - thehackernews.com
SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution - thehackernews.com
SAP patches ICM2SHELL and PROXYGATE maximum severity flaws - bleepingcomputer.com
SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities - securityweek.com
Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities - thehackernews.com
Bluetooth, AirPlay Pairing Vulnerabilities Patched Across Apple Platforms - securityweek.com
Apple Patches Everyting: November 2026 Edition, (Tue, Nov 10th) - isc.sans.edu
Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed - thehackernews.com
Binance warns of iOS flaw that could leak crypto wallet secrets - bleepingcomputer.com
Adobe Patches 110 Vulnerabilities Across 9 Products - securityweek.com
X.Org patches eight server vulnerabilities a month after fixing 12 others - helpnetsecurity.com
Researcher bypassed Meta smart glasses’ safeguards to run her own code - malwarebytes.com
Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers - thehackernews.com
Turla hackers use new Cereal malware to spy on govt Exchange servers - bleepingcomputer.com
Russia-Linked Turla Hijacks Exchange Servers to Spy on NATO and EU Emails - infosecurity-magazine.com
Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments - cyberscoop.com
Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem - thehackernews.com
Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe - research.checkpoint.com
Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America - thehackernews.com
France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites - thehackernews.com
France Blames Iran for Supermarket Fridge Hack, Requests International Arrest Warrants - infosecurity-magazine.com
Risky Bulletin: France blames Iran for the October supermarket fridge hacks - news.risky.biz
US Army member arrested in UK over allegations of spying for Russia - therecord.media
Cybercriminals are increasingly infecting regular people with spyware - therecord.media
An Instagram ad was all it took: Leaked exploit kits are hitting employees’ iPhones - helpnetsecurity.com
Spyware attacks trend toward hitting just about anyone - cyberscoop.com
AI Coding Agents Leak Thousands of Secrets to GitHub - darkreading.com
AI Makes Reverse Engineering Mainstream Software & Malware Far Easier - darkreading.com
AI reverse engineering let researchers add a new feature to Slack - helpnetsecurity.com
Anthropic's Claude Fable 5.2 Beats GPT-6 Cyber in Multi-Stage Cyberattack Benchmark - thehackernews.com
Anthropic Rolls Out Mythos 5.2 With Improved Bug Hunting, Fewer Sandbox Escapes - securityweek.com
Detecting sleeper agents hiding in AI model neurons - microsoft.com
OpenAI builds a kill switch for its research models - theregister.com
Cloud Vulnerabilities Surge Fourfold in Less Than a Year - infosecurity-magazine.com
EU cyber scores look healthy, but 45% of surveyed IT providers take months to patch - helpnetsecurity.com
Australia to introduce mandatory reporting after OpenAI hack to combat artificial intelligence ‘going rogue’ - databreaches.net

Cybersecurity Brief – 2026-11-10

Tue, 10 Nov 2026 00:00:00 +0000

Exploited: Patch Now

CVE	Published	Product	Issue	Fix
CVE-2026-125350		Google Chrome	Use-after-free in XML component, exploited zero-day^[1]^[2]	Update to Chrome 157.0.8103.50/.51 (Windows, macOS) or 157.0.8103.50 (Linux)
CVE-2026-123158	2026-11-05	OpenSSH (musl libc without PAM, e.g. Alpine)	SSHole authentication bypass, KEV addition^[3]^[4]^[5]^[6]	Upgrade to OpenSSH 10.6p2 and restart sshd, or disable password authentication
CVE-2026-102895	2026-11-04	GPUStack	Improper authentication^[3]^[6]	See vendor advisory
CVE-2026-116779	2026-11-05	SignalWire FreeSWITCH	Code injection leading to command execution and credential disclosure^[3]^[6]	Apply October 2026 fix
CVE-2026-123218	2026-11-07	IBM Aspera Faspex	Incorrect authorisation (CVSS 9.8)^[3]^[6]	Apply November 2026 fix
No CVE yet		LNbits Lightning wallet server	Flaws exploited to withdraw funds^[7]	No patch yet; shut down servers and disable Paywall extension

Major Incidents and Breaches

Wiz said an attacker used credentials for the AWS account that Qubole’s platform (a data lake service owned by Idera) uses to reach customers to break into multiple customers’ AWS accounts between 14 and 26 October, stealing stored secrets and data. How the credentials were obtained has not been disclosed.^[8]^[9]
Attackers abused Ethersphere’s release automation to publish malicious bee-js 13.3.0 (the latest npm version for about 75 minutes) and Swarm Desktop 0.56.2, which steal the Swarm node wallet key and its password and install a backdoor. Both releases have been pulled and a clean Swarm Desktop update has been released.^[10]
Researchers detected a malicious GitHub workflow in a supply chain attack affecting tens of thousands of repositories, including some owned by Uber.^[11]
An attacker exploited a flaw in Web3Auth’s infrastructure to steal funds from Keplr wallets set up with Google or Apple sign-in; Web3Auth then used the attacker’s own route to empty other at-risk wallets for safekeeping, with staked and locked assets taking longer to secure.^[12]
German web host Mittwald was breached by an allegedly AI-assisted attacker through its tool that lets customers connect AI assistants (MCP) to their accounts; the attacker first tested the flaw in October amid PHP2Shell patching and used diversionary tactics.^[13]
Vanderbilt University is responding to a cyberattack affecting campus devices and systems, claimed by the BYOD ransomware gang, which says it encrypted databases and stole student, employee and research data.^[14]^[15]
Amplifon Americas, the US arm of the hearing aid company, said a breach early this year exposed personal, health and insurance information, including Social Security numbers, of 1.3 million people.^[16]^[17]
SEGA disclosed that a breach at its Japanese newsletter provider ARARA exposed the email addresses of 2.2 million subscribers.^[18]^[19]
Revolve told regulators its September cyberattack affected more than 1.5 million individuals.^[20]
Update Frontline Education told Indiana regulators its August breach affected over 3 million school district staff and students, up from the 1.3 million previously reported. (first reported 2026-11-03)^[21]
Update Iris Ohyama has pulled its Iris Plaza online store with no reopening date following the cloud breach of 7.7 million records; some customers are being told to refuse deliveries to cancel orders. (first reported 2026-11-09)^[22]^[23]
Update Beget confirmed the attack used data-wiping malware and that it is rebuilding its cloud infrastructure from scratch. (first reported 2026-11-04)^[24]
York University disclosed that a threat actor stole personal information submitted through its online forms, with data dating back to 2007.^[25]
Binance denied a new breach claimed by an actor using the ShinyHunters handle on a newly emerged forum, calling the sale of alleged Binance records a scam attempt.^[26]^[27]
UK customers of toilet paper maker Who Gives A Crap had data exposed in a third-party security incident.^[28]
Weill Cornell Medicine disclosed that patient information from Weill Cornell Imaging was entered into AI tools and processed with machine learning without authorisation as part of a radiology research study.^[29]
Australian provider Epichealth, which runs four medical clinics in Victoria including the Warrnambool Medicare Urgent Care Clinic, reported unauthorised access to part of its IT systems.^[30]
Researcher Nesbitt-Smith found that publicly available code across multiple UK government departments put private information at risk; one agency fixed a reported flaw within 20 minutes and said no breach occurred.^[31]

Vulnerabilities and Patches

Google fixed nine Chrome vulnerabilities including CVE-2026-125350, an actively exploited use-after-free in the XML component reported anonymously on 6 November and the eighth exploited Chrome zero-day of 2026. Update to 157.0.8103.50/.51 on Windows and macOS or 157.0.8103.50 on Linux.^[1]^[2]
N-able took its hosted N-central environments (Americas, APAC, Europe) offline and told on-premises customers to shut down servers after researcher Sean Bales published 33 flaws dubbed Able2Shell with PoC exploits, including RCE and privilege escalation chains and a stored XSS that runs commands as root. N-able has seen no exploitation and is developing a hotfix.^[32]^[33]^[34]
Update GreyNoise recorded the first successful exploitation of SSHole (CVE-2026-123158) on 7 November at 00:46 UTC, about 40 hours after OpenSSH 10.6p2, with exploit code public about four hours after the fix. Early activity is attributed to botnets and crypto miners, some deploying a TAC Agent implant with command execution, reconnaissance, file transfer and self-update; CISA has added the flaw to KEV. (first reported 2026-11-05)^[3]^[35]^[4]^[5]^[6]
Update The exploited SonicOS SSL-VPN flaw CVE-2026-19868 bypasses SAML-enforced MFA and affects Gen7 7.3.3-7015 and older and Gen8 8.2.2-8015 and older; fixes are in 7.3.4-7013 and later and 8.2.3-8015, with no workarounds. (first reported 2026-11-07)^[36]
LNbits told all operators of its open-source Bitcoin Lightning wallet servers to shut down amid attacks exploiting unpatched flaws, with one operator losing about 0.023 BTC; fixes were expected within 24 to 48 hours and operators were earlier advised to disable the Paywall extension.^[7]
Researchers Sam Curry and Shah chained WAF bypasses and default admin:admin credentials on ForgeRock (Ping Identity) servers behind two automakers’ apps in Australia and the US, allowing takeover of any customer account and remote unlocking and starting of cars; the issues were fixed within two hours of reporting.^[37]^[38]
Anthropic will not fix an ‘Office Party’ flaw in Claude’s document-processing tool on Linux, where a helper script loads whatever file sits at a fixed temporary path via LD_PRELOAD, letting attackers run code on the user’s machine, AIR Research Lab said.^[39]
Microsoft released Azure Linux 3.0.2022 with more than 470 security fixes spanning the kernel (now 6.6.161.1), OpenSSL, curl, Kubernetes, Docker, QEMU, containerd and KubeVirt.^[40]

Threat Actor Activity

France attributed the October refrigeration attacks on more than 700 supermarkets and other retail sites to Shahid Kaveh, an IRGC cyber unit previously linked to attacks on US water utility controllers, saying they caused food losses and at least 15 fires.^[41]^[42]^[43]
Fortinet reported that Bitter (TA397) is targeting South Asian organisations with PapRAT, a new RAT with C++ and Rust versions, staged via scripts pulling PowerShell commands from techtalkhelp[.]com.^[44]
Acronis TRU said a single Taiwan-based attacker using AI agents built on abliterated DeepSeek, GLM and Qwen models (investigation BOSSAI) stole 119 emergency dispatch records covering seven Taipei districts, found a fire department platform exposing patient data since 2018 including ECG readings and ambulance video, and logged into a fire-dispatch vendor’s database panel with default root credentials.^[45]^[46]
Update Italian Foreign Minister Antonio Tajani’s personal data was published on the dark web, with Prime Minister Meloni blaming pro-Russian hackers. (first reported 2026-11-09)^[47]
Ukrainian police arrested four men, including the alleged leader, over crypto investment scam call centres that stole more than €4.3 million (about $5 million) from victims in Germany.^[48]^[49]
Huntress found further webshells, a second cryptominer and a host-bound Python C2 implant on exploited AhsayCBS backup servers.^[50]

Trends, Tools and Tactics

Acronis TRU Cyber Pulse 2026 found more than 575 malicious OpenClaw skills delivering malware to Windows and macOS.^[46]
Malbear Labs found a jailbroken DeepSeek agent ran a two-week attack against a European telecom.^[51]
SecurityScorecard found internet-exposed refrigeration controllers in supermarkets and cold storage being hijacked for a suspected spam botnet and proxy services.^[52]
Google DeepMind’s AI agents, working with cryptographers, cut the cost of forging RSA-1024 signatures and found a cheaper way to factor 1024-bit keys.^[53]
A new Google DeepMind tool formally verified that the Signal Protocol works as intended.^[54]
Microsoft FORGE Lab used agentic tooling to find memory-safety bugs in Rust’s core and std libraries, including cases where safe Rust can trigger undefined behaviour.^[55]
Anthropic’s Mythos bug-finding model is being integrated into Cisco and IBM security products without customers getting direct model access; Anthropic also released Mythos and Fable 5.2.^[56]
Cisco Talos reported phishing remained the top initial access vector in Q3 2026, with ransomware gangs using voice phishing to gain footholds.^[57]
SANS ISC honeypots observed attackers scanning for existing SAP NetWeaver webshells.^[58]
PyPI added a Security tab to project pages showing whether release files carry digital attestations and full provenance.^[59]

Policy and Regulation

The US Treasury cut MEXC Global off from the US financial system over sanctions evasion and links to cybercrime gangs.^[60]
President Trump nominated Palantir’s Michael LoSapio as CISA director; the agency has had no Senate-confirmed director during Trump’s second term.^[61]
CISA launched an enhanced web-based cyber incident reporting form on its Incident Reporting Portal.^[62]^[63]^[64]
The Financial Action Task Force proposed new measures to disrupt scam compounds.^[65]
Homeland Security Investigations estimates it has issued about 185,000 administrative subpoenas since January 2025, more than in the six and a half years from 2016 to mid-August 2022.^[66]
NIST published basic security guidance for less-technical solo business owners.^[67]

Sources

Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026 - thehackernews.com
Chrome Update Patches Exploited XML Zero-Day, Eighth This Year - securityweek.com
CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws - thehackernews.com
Hackers exploit SSHole OpenSSH flaw to breach Linux systems - bleepingcomputer.com
Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH - securityweek.com
CISA Adds Four Known Exploited Vulnerabilities to Catalog - cisa.gov
LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers Amid Attacks - thehackernews.com
Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data - thehackernews.com
Attackers backdoor trusted AWS integrations to steal secrets - theregister.com
Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware - thehackernews.com
New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositories - infosecurity-magazine.com
Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety - thehackernews.com
Alleged AI-aided cyberattack exploits assistant interface to breach German web host - therecord.media
Vanderbilt University hit in BYOD ransomware attack, data theft claimed - bleepingcomputer.com
Vanderbilt cybersecurity incident impacting campus devices and systems - therecord.media
Amplifon Americas Data Breach Impacts 1.3 Million - securityweek.com
Data breach at hearing aid giant Amplifon impacts thousands - therecord.media
SEGA newsletter data breach exposes 2.2 million email addresses - bleepingcomputer.com
Email Addresses of 2.2 Million Sega Customers Leaked in Vendor Breach - infosecurity-magazine.com
Revolve Puts Data Breach Victim Count at 1.5 Million - securityweek.com
Over 3 Million People Hit by Frontline Education Data Breach - securityweek.com
Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers - securityweek.com
Japanese homeware giant pulls online store after cloud breach puts 7.7M records at risk - theregister.com
Russian cloud firm Beget rebuilds from scratch after data wiper attack - bleepingcomputer.com
York University breach exposed personal information dating to 2007 - bleepingcomputer.com
Binance denies data breach after alleged ShinyHunters claims - bleepingcomputer.com
Binance calls alleged “ShinyHunters” post a scam attempt - databreaches.net
Who Gives A Crap? Hackers, apparently, after toilet paper maker's customer data exposed - theregister.com
Weill Cornell patient data entered into AI tools without authorization - databreaches.net
AU: Important update from Epichealth – cyber incident - databreaches.net
Security Flaws Across UK Government Sites Exposed ‘God-Tier’ Information - wired.com
N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits - thehackernews.com
N-able takes cloud platform offline after 30+ "zero-days" published - bleepingcomputer.com
N-able Disables Cloud Services Following Disclosure of "Able2Shell" Exploit Chains - huntress.com
⚡ Weekly Recap: SSHole Exploited, APT Root RCE, Robot Takeovers, 15K Hacked Sites, and More - thehackernews.com
Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868) - helpnetsecurity.com
Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars - thehackernews.com
Researchers pwn automakers’ Android apps to remotely unlock cars, honk horns - theregister.com
Attackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on Linux - darkreading.com
Microsoft's Azure Linux gets 470-plus security fixes in one almighty patching session - theregister.com
France blames Iranian hackers for supermarket attacks that sparked fires - bleepingcomputer.com
France blames Iran for fridge cyberattacks, says some caused fires - therecord.media
France blames Iran for supermarket hack meltdowns - theregister.com
Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia - thehackernews.com
Taiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch Records - thehackernews.com
Over 575 malicious OpenClaw skills delivered malware to Windows and macOS - helpnetsecurity.com
Italy’s Meloni Blames Pro-Russian Hackers for Leak of Foreign Minister’s Data on the Dark Web - securityweek.com
Ukraine dismantles crypto scam network that stole €4.3 million - bleepingcomputer.com
Ukraine arrests four in $5 million crypto scam targeting Germans - therecord.media
Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant - huntress.com
Jailbroken AI Agent Ran Two-Week Attack on European Telecom - infosecurity-magazine.com
Hackers abuse refrigeration controllers to send spam and route proxy traffic - helpnetsecurity.com
Google DeepMind’s AI Agents Make 1024-Bit RSA Keys Cheaper to Attack - securityweek.com
A New AI Tool From Google DeepMind Proved the Signal Protocol Is Secure - wired.com
FORGE Lab uses agentic tools to identify memory safety issues in Rust - microsoft.com
Anthropic's super bug-finding Mythos model is going into Cisco and IBM products - theregister.com
Report: Social Engineering Remained the Top Initial Access Vector in Q3 2026 - blog.knowbe4.com
Attackers Searching for SAP Netweaver Webshells, (Mon, Nov 9th) - isc.sans.edu
PyPI makes release attestations easier to find with new security tab - helpnetsecurity.com
US bans MEXC crypto exchange over sanctions evasion, cybercrime links - bleepingcomputer.com
Trump picks Palantir’s LoSapio to head CISA - cyberscoop.com
CISA Announces Enhanced Reporting Form for Cyber Incidents - darkreading.com
CISA Announces Enhanced Reporting Form for Cyber Incidents - databreaches.net
CISA Announces Enhanced Reporting Form for Cyber Incidents - cisa.gov
Anti-Money Laundering Watchdog FATF Targets Scam Compounds - infosecurity-magazine.com
DHS Has Used This Controversial Investigative Tool 185,000 Times Since Trump Took Office - wired.com
NIST: Solo Shouldn't Mean Less Secure - darkreading.com