Sunday, November 8, 2026

Top story

Hackers stole up to 133 million euros from French bank Crédit Mutuel Arkéa via a service provider platform. The bank confirmed fraudulent transfers and reported systems returning to normal operations. Customer funds remain safe but phishing risks have increased. Hackers steal $133 million from French bank via service provider

Exploitation & threats

• Researchers escaped Firecracker microVM and achieved root code execution on the host by modifying saved registers in pt_regs. Firecracker MicroVM Escape Allows Root Code Execution on Host
• SonicWall patches CVE-2026-19868 that bypasses SAML and MFA in SSL VPN after exploitation. SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins
• CISA added CVE-2026-19868 authentication bypass to KEV catalog with federal deadline November 20. CISA adds SonicWall SSLVPN flaw to KEV catalog
• Attackers launched over 240000 exploit attempts against a WordPress Core upgrade flaw for unauthenticated RCE. WordPress Core RCE Vulnerability Allows Unauthenticated Remote Code Execution
• Campaigns trick users with celebrity ads into fake reward portals that lead to mobile subscriptions. Fake gift card scams impersonate trusted brands for subscriptions

Patch priorities

• CVE-2026-19868: SonicWall SonicOS SSLVPN, upgrade to 7.3.4-7013 or 8.2.3-8015. SonicWall CVE
• CVE-2026-119977: WordPress Core, install 7.1.4 immediately. WordPress CVE
• CVE-2026-121265: SQL::Abstract before 2.000003, upgrade to 2.000003. SQL::Abstract CVE
• CVE-2026-73116: Apache Juneau before 9.2.1, upgrade to 9.2.1. Juneau CVE
• CVE-2026-109469: Microsoft Entra Device Registration, apply Microsoft update. Microsoft CVE

Breaches & incidents

• Widespread attacks on exposed refrigeration controllers raised temperatures in blood banks and supermarkets across Europe and US military bases. Internet refrigerators hit by temperature attacks in Europe and US bases
• Apiiro found 2,539 real secrets in 1,994 public GitHub repositories via Claude Code configuration files. Claude Code “Don’t Ask Again” Persists Secrets in GitHub Repositories
• Hunt.io traced ARTEX servers and AI tools used in breaches affecting 66,000 to 67,000 people and 2,200 corporations. ARTEX AI hacking tools linked to South Korean bank breaches
• The exposure affected 8,003 people including staff and non-staff workers in Royal Cornwall Hospitals NHS Trust FOIA spreadsheet. Royal Cornwall Hospitals NHS Trust exposed health data in FOIA spreadsheet
• County of Sussex in New Jersey issued notice of data privacy incident. County of Sussex New Jersey data privacy incident

AI

• Nous Research released Arete-27B fine-tuned Qwen3.8-27B model reducing propaganda answers from 22% to 0.9%. Nous Research Releases Arete-27B Fine-Tuned Qwen Model
• OpenAI secured 11 billion funding round at 1.25 trillion valuation. OpenAI secures $11 billion funding round at $1.25 trillion valuation
• AI narrows gap between open and closed models in cyber capabilities. Gap narrows between open and closed AI models in cyber capabilities
• METR report finds Anthropic AI accelerating own development with models improving twice as fast. METR report finds Anthropic AI accelerating own development

Watchlist

• Patch SonicWall CVE-2026-19868 by November 20 per CISA KEV. SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins
• Upgrade WordPress to 7.1.4 immediately. WordPress Core RCE Vulnerability Allows Unauthenticated Remote Code Execution
• Review Claude Code settings for .claude/settings.local.json and rotate exposed credentials. Claude Code “Don’t Ask Again” Persists Secrets in GitHub Repositories
• Follow up on Norad targeted by cyberattack claims. Norad targeted by cyberattack