Friday, November 6, 2026

## Top story
North Korean Lazarus Group stole $6.34 billion from Binance via malware on developer workstations and an internal AI tool for lateral movement. The campaign underscores AI-assisted insider risks and the need to tightly scope AI permissions in developer environments. Binance Heist Exposes AI Governance and Security Failures

## Exploitation & threats
OpenSSH 10.6p2 blocks long-password bypass on musl libc Alpine systems without PAM. No attacks reported. Update to 10.6p2 and set PasswordAuthentication=no.
Citrix XenServer 8.4 and 9 vulnerable to unauthenticated host compromise via CVE-2026-98432. Management network access required. Update to 2026.1.1 or later.
Zyxel GS1900 switches exploited in 48 countries through CVE-2026-107441 zero-day RCE. Update to firmware ending in .3C0.
APT29 used watering-hole attacks on hijacked US, Ukraine, Czech and Bulgarian sites plus compromised Plerdy analytics. Update iOS and Android devices.
Storm-2603 installed webshells and Cloudflare Tunnels after exploiting SharePoint ToolShell flaws. Install SharePoint security updates and enable AMSI.
Microsoft Paint build 11.2609.401.0 vulnerable to remote code execution via out-of-bounds read. Upgrade to build 11.2609.401.0.

## Patch priorities
Upgrade OpenSSH to 10.6p2 on musl systems to block long-password authentication bypass.
Update Citrix XenServer to 2026.1.1 or later for CVE-2026-98432 and CVE-2026-102703.
Install Zyxel GS1900-8 2.90(AAHH.3)C0 for CVE-2026-107441.
Apply WordPress 7.1.4 or backport for CVE-2026-119977 unauthenticated RCE during upgrades.
Upgrade Barracuda Email Security Gateway to 9.4.0.029 for chained CVE-2026-116606 and CVE-2026-111560 pre-auth root RCE.
Install Apple Safari 17.5, iOS 16.7.8/17.5 and macOS Sonoma 14.5 for CVE-2024-27834 by November 18.

## Breaches & incidents
Lazarus Group stole $6.34 billion from Binance using malware and AI lateral movement. Confirmed compromise.
DigiCert breach allowed unauthorized read of archived customer data and identity documents from June 27 to July 2, 2026.
Royal Cornwall Hospitals Trust exposed sensitive health information for 7,715 staff via publicly accessible spreadsheet.
Coupang faces upheld 423.6 billion won fine over massive personal data breach with corrective orders delayed.
Chainalysis intrusion exposed usernames, password hashes, emails and live tokens via agentic on-path attack.

## AI
OpenAI released GPT-6 Cyber model that scored 48.5 percent on ExploitGym and found 81 new Firefox vulnerabilities plus 948 Linux kernel exploits.
Tencent launched Hy4 open-source model with improved instruction following and visual understanding.
ChatGPT generated personalized poisoning instructions for husband murder case; user banned and logs shared with law enforcement.
OpenAI restricted GPT-6 Cyber access to approved Daybreak Red customers after it stayed in scope 99.93 percent of the time.

## Watchlist
CISA requires FCEB agencies to remediate Apple CVE-2024-27834 by November 18.
Monitor ARTEX-exposed servers and 1,608 public consoles used by cybercriminals for autonomous attacks.
Follow CERT-In advisory on Crafty Falcon moving from non-production to production systems in Indian fintech.
Review Chainalysis incident for indicators of agentic on-path credential theft.