Latest Cybersecurity News Today: 5 November 2026

A flaw dubbed *sshole lets attackers log into certain musl-based Linux accounts that use an asterisk to block password logins by submitting a password over 256 bytes. The issue affects OpenSSH on Alpine Linux, OpenWrt, Buildroot and Yocto under certain configurations, and dates to a 2016 patch for CVE-2016-6210. It is fixed in OpenSSH 10, but Alpine's official AWS and Azure images include an affected default alpine account with doas privileges.

OpenAI released GPT-6 Cyber, a restricted cybersecurity model it says stays within authorized scope and reports results accurately. In its ExploitGym evaluation, the model scored 48.5 percent, compared with 32.1 percent for GPT-5.6 Cyber, and went beyond scope in 0.07 percent of cases. OpenAI said it used the model to find 81 high-severity Firefox vulnerabilities and develop exploits for 948 Linux kernel flaws, including 588 unknown bugs.

XLab said CWPdoor is a passive Linux backdoor distributed through a trojanized cwpsrv web server used by Control Web Panel. The malware stays dormant until an attacker sends an encrypted HTTP header with a timestamp and RSA signature, then executes commands while suppressing access logs. The researchers found the infection script on June 29 and said more than 340,000 CWP instances have been exposed on the public web in the past month.

DigiCert said a February 2025 server migration exposed an internal business system to the internet, where a self-registration feature and authorization flaw let external users read archived customer data. The company said a small portion of records was affected, including names, business contact details and, for some people, identification documents such as driver's licenses, passports or utility bills.

It found unauthorized accounts in June 2026.

Pen tester Dahvid Schloss found an open file share on a tobacco company's network while testing its defenses, even though Trend Micro antivirus did not alert during his scan. The share, accessible to every employee and with no access restrictions, contained a folder named confidential with recipe files describing how products were made, including weights, volumes and chemical percentages. The files were marked Confidential and Do not share.

UNM Health said a cybersecurity issue forced it to cancel appointments at more than 30 clinics and tell patients not to come to its Albuquerque hospital. The system, which operates New Mexico's only Level 1 trauma center, sent ambulances to other hospitals, leaving the state without an emergency department able to treat the most serious injuries. It said officials were working to resolve the issue.

Forever Security's Gal Weizman found that a browser extension controlling claude.ai could send commands to Claude Desktop through Dispatch, running code on the user's computer or another machine in the same account. Anthropic acknowledged the flaw, called ThisBash, in May but closed it as a duplicate and has not issued a CVE or bug bounty.

The company planned to retire Dispatch by the end of October, but it was still listed as available on October 30.

WatchGuard released fixes for critical flaws, including CVE-2026-98432, a Linux kernel use-after-free issue, and three critical authentication bugs in AuthPoint. Cisco fixed CVE-2026-76506 in UCS Central Software and updated its Node2Shell advisory, saying 19 Cisco products are affected and dozens more are under investigation. SonicWall said two flaws in its end-of-life Global Management System will remain unpatched.

Acronis said one hacker used a 12-agent AI system called BOSSAI to target hundreds of organizations in 11 countries, including emergency services, banks, universities and military systems. It said breaches at universities and emergency services providers are confirmed, with medical and personal data exfiltrated. Acronis found the campaign through a misconfigured server holding over 90,000 files, about 9GB of logs, exploit tools and victim data.

Debian disclosed CVE-2026-109518, an APT package manager flaw that could let an on-path attacker manipulate HTTP traffic and replace a package after verification. The issue can allow arbitrary code execution with root privileges when APT merges downloads after an HTTP redirect or resumes a download. Ubuntu rated it High with a CVSS score of 7.7, and both distributions have issued fixes.

New York City's Queens Public Library said a ransomware attack has taken down its website, on-site computers, checkout and return machines, public Wi-Fi, mobile app and digital media services. The library said its three branches remain open, renewals are unavailable, and no late fines apply. No ransomware group has claimed responsibility.

Norway's aid agency Norad said cyber criminals stole the names and email addresses of all 20,614 registered users of its grant portal, across 12,511 organizations. The agency said 27 accounts were compromised to reach the portal, and that applications from at least three organizations were misdirected. It detected the intrusion on Oct. 30 and said it cannot be sure whether details of people in conflict areas and authoritarian states are safe.

Bitdefender found GhostMap, an Android flaw that lets a specially crafted app with no executable code and no permissions force a persistent boot loop. Installing the app on a Pixel 10 running Android 17 with the August 5, 2026 patch crashed system_server repeatedly, and safe mode did not stop the loop. Google does not plan a security update, so a factory reset or an ADB fix may be needed to clear the device.

CERT-In said an AI-assisted actor it tracks as Crafty Falcon is actively targeting Indian banking, financial services and insurance firms, using tools such as ARTEX to run autonomous attack chains. The agency said the attacks have also hit cryptocurrency exchanges and digital asset service providers, stealing keys and funds. It warned that actors exploit exposed APIs and privileged endpoints, then move money to mule accounts.

Apple said items shared with Anyone with the Link in iOS, iPadOS, macOS and visionOS 27.3 or later will be checked for harmful content. The company said such links are not end-to-end encrypted, even with Advanced Data Protection, and Apple may move, modify, remove or delete content. It may also block or disable accounts, prevent new accounts with the same email or phone number, and involve law enforcement.

Ahold Delhaize said last month's cyberattack will reduce fourth-quarter net sales by €200 million to €250 million and operating income by €75 million to €100 million. The retailer, which took systems offline as a precaution, also expects incremental response and remediation costs to have a marginal impact in the fourth quarter.

It said most disruption was contained within two weeks and there was no evidence of customer or employee data theft.

A DNSFilter report found that 74.5% of organizations have increased cybersecurity budgets, with AI security and governance as the top priority. Despite this spending, many employees connect unapproved AI tools to corporate systems, leading to security incidents and untracked costs.

CISA added CVE-2024-27834, a patched Apple pointer authentication flaw, to its KEV catalog after active exploitation. Sekoia linked the attacks to APT29, a Russian state-sponsored group, using compromised sites, fake sites and a Plerdy SEO Tracker supply chain attack. The zero-click chain targeted Safari and Chrome to steal browser and device data, and FCEB agencies are recommended to patch by November 18, 2026.

Okta's 2026 report shows only 37% of North American consumers are ready to let AI make final decisions on their behalf. Willingness to delegate increases when users can approve or reverse actions, but many companies are struggling to build the identity infrastructure needed to manage agent permissions.

Joe Security introduced Adaptive Detonation, an AI feature that helps uncover malicious behavior hidden by evasion techniques. The system uses AI agents to identify obstacles in sandbox runs and apply targeted interventions, such as patching checks or adjusting the environment, to reveal additional activity.

Security firm Layer3 Intel detected residential proxy nodes beaconing from the White House network, allowing 28 separate services to rent the addresses. The activity, linked to a Russian-founded proxy program, persisted for months and exposed the Executive Office to potential traffic anonymization.

OpenAI used an upcoming cyber-focused AI model to validate and patch 948 local privilege escalation vulnerabilities in Linux for $1.2 million. The 30-hour run reproduced 1,724 vulnerabilities and discovered at least 10 novel exploitation techniques, demonstrating how frontier AI is accelerating vulnerability discovery.

Chainalysis said names, usernames, password hashes and live tokens for all its users were exposed to a malicious actor. The company first disclosed the breach on Oct. 30 and later said an external actor used offensive agentic techniques, without explaining the term. It said there is no evidence investigations data was accessed or attribution data was manipulated, and told all users to reset passwords and rotate API keys.