Daily Summary of Cybersecurity · Live edition, updated continuouslyFriday 6 November 2026 · UTC
Latest Cybersecurity News Today: 6 November 2026
OpenSSH patches SSHole as AI fraudsters steal $129 million
OpenSSH released an emergency update for SSHole, a critical authentication flaw on Linux systems using the musl C library. Three people were charged with using AI to impersonate CEOs and attorneys in a $129 million fraud scheme. Cloudflare's CEO said PHP2SHELL was likely exploited before disclosure and warned that AI agents are straining website operators.
Cloudflare CEO says PHP2SHELL likely exploited, AI agents a burden
Cloudflare CEO Matthew Prince said nation-state actors and criminals likely exploited PHP2SHELL before disclosure, and the company is checking logs for past use. He warned that AI agents are a burden for some website operators because agentic traffic is expected to far exceed human clicks. Prince also said container architectures may not keep up cost-effectively with agentic activity, pitching Cloudflare's serverless Workers as an alternative.
Three charged in $129 million AI impersonation fraud
New York prosecutors charged three people with wire fraud for using AI to impersonate CEOs and attorneys in a scheme that stole about $129 million from thousands of companies. The defendants targeted accounting departments with fake emails and AI voice or video calls, then directed victims to wire money worldwide. The case shows how AI can make executive and legal impersonation more convincing.
CERT-IN warns of AI-assisted attacks on Indian fintechs
India's CERT-IN says an AI-assisted threat actor named CRAFTY FALCON is escalating attacks on fintech, lending, payment and wallet operators. The actor targets internet-facing apps and exposed APIs, then rewrites applications to make unauthorized payment calls, often after incomplete fixes and during low-monitoring periods. It tests access with about $0.01 transfers before moving larger sums.
A critical OpenSSH flaw on Linux systems using the musl C library lets remote attackers bypass authentication on accounts with password login disabled. The bug, called SSHole and tracked as CVE-2026-123158, affects Alpine Linux and some embedded distributions, and can be triggered by sending a password of 257 to 1,024 characters. OpenSSH released an emergency 10.6p2 update, while Alpine advises disabling password authentication and using keys.
US agencies warn of cyberattacks on refrigeration systems
US agencies warn that hackers are targeting industrial refrigeration and cold-chain monitoring systems in critical facilities. Attackers can alter temperature settings or force defrost cycles, risking spoiled inventory, damaged equipment and fires. The advisory follows attacks on European supermarkets and blood storage facilities.
Illustration 
