Monday, November 9, 2026

## Top story Hackers Raid French Bank Crédit Mutuel Arkéa. Attackers exploited a third-party provider to withdraw up to $133 million from the bank's accounts. Customer assets remained unaffected but some transfers were delayed. The bank reported the incident to authorities. It matters to defenders because third-party provider compromises can expose financial institutions to significant losses despite customer data being safe. Hackers Raid French Bank Crédit Mutuel Arkéa

## Exploitation & threats

• Hackers began exploiting the OpenSSH SSHole vulnerability allowing access to password-disabled accounts. Hackers Begin Exploiting OpenSSH SSHole Authentication Bypass Vulnerability
• CISA added a SonicWall SonicOS MFA bypass to its KEV catalog. CISA adds SonicWall SonicOS MFA bypass to KEV catalog
• ArmorSteal malware kit steals credentials and crypto wallets while hiding a Monero miner. ArmorSteal steals passwords, crypto wallets and hides miner
• Pro-Kremlin NoName057(16) published personal data of 18 EU officials on a dark web portal. Pro-Kremlin hacktivists dox EU politicians and law enforcement

## Patch priorities

• CVE-2026-19868, SonicWall SonicOS, upgrade to latest SonicWall SonicOS; apply patches by November 20, 2026.
• CVE-2026-123158, OpenSSH, upgrade to OpenSSH 10.6p2 or later.
• CVE-2026-114713, UnrealIRCd, upgrade to UnrealIRCd 6.2.7.1.
• CVE-2026-82440, Apache Storm, upgrade to Apache Storm 3.1.0 or later.
• CVE-2026-82436, Apache Storm Client, upgrade to Apache Storm 3.1.0 or later.
• CVE-2026-40913, Apache Airflow, upgrade to Apache Airflow 3.4.0 or later.

## Breaches & incidents

• Iris Ohyama cloud service breach exposed up to 7.7 million customer records including names, addresses, phone numbers, emails, genders, dates of birth, and passwords. Site suspended. Iris Ohyama data cloud breach exposes 7.7 million customers
• Hackers withdrew up to $133 million from Crédit Mutuel Arkéa bank accounts through a third-party provider. Customer assets remained unaffected. Hackers Raid French Bank Crédit Mutuel Arkéa
• Pro-Kremlin hacktivists published personal data of 18 EU officials on a dark web portal. Pro-Kremlin hacktivists dox EU politicians and law enforcement

## AI

• Andrej Karpathy built a video platform by distilling 43 million Hacker News comments into 6,454 videos using Claude Opus 5.5. Andrej Karpathy builds video platform with Claude AI
• NVIDIA expanded collaboration with Korea to build sovereign AI using NVLink Fusion and Dynamo software. NVIDIA and Korea expand sovereign AI collaboration
• Stanford CS146S teaches AI-native engineering where students review open-source code for AI agents. Stanford CS146S teaches AI-native engineering via open-source maintainer reviews
• Apple plans to make Siri more agentic with app integration in iOS 27.3. Apple accelerates Siri toward agentic AI with app integration

## Watchlist

• Patch SonicWall by November 20, 2026. CISA adds SonicWall SonicOS MFA bypass to KEV catalog
• Upgrade OpenSSH to 10.6p2 or later. Hackers Begin Exploiting OpenSSH SSHole Authentication Bypass Vulnerability
• Upgrade UnrealIRCd to 6.2.7.1. UnrealIRCd 6.2.7.1 released with hot-patch for label tag escaping bug (CVE-2026-114713)
• Follow up on NVIDIA board investigation into CEO Jensen Huang's relationship with suspected Chinese spy. NVIDIA Investigates Suspected Chinese Spy Operation Targeting CEO Jensen Huang