Latest Cybersecurity News Today: 9 November 2026

A jailbroken AI agent spent more than two weeks attacking a European telecommunications provider and 13 other organizations hosted on its infrastructure. The agent, running on DeepSeek Flash, exploited multiple vulnerabilities to extract credentials, private keys, and Active Directory data. Malbear Labs, which detailed the campaign, assessed the activity as consistent with a Chinese-origin operator.

Security researchers at Socket uncovered a new software supply chain attack affecting tens of thousands of GitHub repositories, including those owned by organizations like Uber. The attack used a malicious GitHub Actions workflow to steal credentials from affected repositories and send them to an external server.

The workflow was designed to look like a legitimate security tool and could find sensitive information in repository files and Git history.

Threat actors are exploiting Plex2Shell, a chain of four vulnerabilities in Plex Media Server, to hack QNAP NAS devices. The flaws, patched this summer, allow attackers to execute arbitrary code without valid credentials. QNAP advises users to update to Plex Media Server version 1.43.3 or later, reinstall the application on internet-facing devices, and rotate passwords for both Plex and the NAS.

Italian Foreign Minister Antonio Tajani said his personal data had been spread on the dark web, exposing him and his family to threats and intimidation. Premier Giorgia Meloni blamed pro-Russian hackers for the leak and called attempts to sell confidential information about government officials a grave concern. Tajani did not specify what information was shared but said the cyberthreat was ongoing.

Ukrainian law enforcement arrested four suspects in a cryptocurrency investment scam network that stole more than €4.3 million from 135 German victims. The group used social media, dating sites and messaging apps to lure targets into fake investment schemes and helped move funds through exchanges and wallets. Searches seized over $90,000, nearly 600,000 hryvnia, hardware wallets and other evidence.

Threat actors are exploiting SSHole, CVE-2026-123158, an OpenSSH authentication bypass that can let attackers access root with a password between 257 and 1024 characters. It affects some Linux distributions using musl libc with PAM disabled, including Alpine, Buildroot, OpenWrt and Yocto. WatchTowr and Previdian reported in-the-wild exploitation, and users should update to OpenSSH 10.6p2.

Security researchers found that the login systems for two car brands' mobile apps used a default 'admin:admin' password on their identity platform servers. This allowed them to access customer accounts and remotely unlock doors, start engines, and track vehicles. Both systems were fixed about two hours after the researchers reported the problem.

Amplifon Americas says hackers copied files from its systems between January 18 and February 8, 2026. The company's review found personal data for 1,332,826 US individuals may be affected, including names, government IDs, dates of birth, medical and health insurance details, and for some Social Security and financial information. Amplifon says it contained the incident immediately but needed eight months to review the stolen data.

Keplr says a Web3Auth flaw led to a private key breach for some users who signed in with Google or Apple. Web3Auth moved funds from other at-risk wallets into recovery wallets, so an empty balance may mean the money was rescued. Keplr paused Google and Apple sign-in, and GoPlus said at least about $1 million had been stolen.

Researchers found over 2,000 real secrets, including passwords and API tokens, leaking on GitHub after developers approved AI agent commands with 'Yes, and don't ask again.' The AI coding tool Claude Code stores approved commands, including secrets, in a local settings file that is not always protected from public exposure. Apiiro found 104,185 public copies of such files across 103,617 repositories.

Frontline Education says an August breach affecting its K-12 software hit 3,085,266 people, more than double earlier state filings that totaled about 1.3 million. The company said attackers entered through a third-party software vulnerability, detected the intrusion on August 14 and contained it the next day. Stolen data may include names, Social Security numbers, government IDs, health insurance details and student IDs.

Attackers stole an estimated $133 million from French bank Crédit Mutuel Arkéa by wiring money from the bank's own account to other banks, possibly converting it to cryptocurrency. The bank said on November 4 that an attack allowed fraudulent transactions, informed authorities, and temporarily suspended some transfers. Blockchain investigator ZachXBT tracked the funds through stablecoins, ether, instant exchanges and Monero.

LNbits, a free open-source Bitcoin Lightning wallet system, asked operators to shut down their servers after a wave of attacks and before security fixes are released. The project also switched off its hosted my.lnbits.com instances, saying services would return within 24 hours. One operator said an exploit let new accounts withdraw 2,285,545 satoshis, about 0.023 bitcoin, before he stopped it.

US authorities have indicted Jacob Soall, Sharon Hazan and Guy Sheetrit for using AI deepfakes of corporate executives and lawyers to trick employees into sending large payments. The men allegedly posed as CEOs in calls, directed workers to impersonated lawyers, and ordered wires to accounts in nine countries, then converted the money to cryptocurrency. The scheme stole more than $129 million, and the suspects face up to 104 years if convicted.

Pro-Kremlin group NoName057(16) published personal data for 18 European Union politicians and law enforcement officials, including Italian Foreign Minister Antonio Tajani, on a dark web page. The group offered cryptocurrency bounties for more sensitive information on the targets and their family members. The doxxing appears to retaliate for Operation Eastwood, a 2025 sweep that took more than 100 servers offline.

Patrick Steven Yaroch, a former FBI agent, pleaded guilty to wire fraud and money laundering after stealing nearly $2.5 million in cryptocurrency from wallets controlled by nation-state hackers and fraud victims. He used his access to FBI systems to conduct approximately 100 fraudulent transfers and laundered the funds to cover debts and fund a move to Portugal. Yaroch is scheduled to be sentenced on March 4, 2027.

A single Taiwan-based hacker used AI agents to pull emergency dispatch records for seven Taipei districts and find a fire department platform exposing 2018 patient data without login. Researchers say the agents reached about 10 organizations in Taiwan, Mexico and Thailand, though their summary says data was stolen while their detailed account says it was exposed.

Australian toilet paper company Who Gives A Crap says hackers accessed customer information through an external marketing software provider. The breach spans customers in Australia, the UK and the US, while Canadian customers have reportedly not been affected. ABC News reports the data included names, phone numbers, mailing and email addresses, and spending information. The company has not confirmed how many customers were affected.

Google DeepMind says AI agents found two ways to cut the cost of attacking obsolete 1024-bit RSA systems. One finding says padding adds no protection when an attacker controls about half or more of a signed block, and agents cut a forgery attack to 391 CPU core-years from 1,380. A second algorithm would make factoring each additional 1024-bit key about 30 times cheaper, though it assumes a large upfront computation and has not been implemented.

Doctor Web found malware hidden in GitHub projects posing as security tools, infecting more than 2,000 PCs. The campaign started two years ago with Visual Studio projects for blockchain games, bots and cheats, and now targets cybersecurity professionals with projects claiming automated scanning, security testing and log analysis.

The BBC says it has a plan to keep people informed if electricity fails across the UK for days, with FM radio as a key fallback when digital infrastructure fails. The strategy was described with reference to the 2015 Lancaster floods, which cut power to 61,500 people and left copper landlines and FM radio as the only working communication systems.

CISA, FBI, HHS, USDA and DOT warned threat actors are targeting industrial refrigeration and cold chain monitoring systems globally to disrupt service, cause fires and lose inventory. Actors may exploit unpatched or internet accessible controllers to force continuous heating and defrost cycles.

Attacks on hundreds of European supermarkets raised temperatures to 50 degrees Celsius and affected French Blood Establishment's plasma storage facilities.

CISA added CVE-2026-19868, a high severity SonicWall SonicOS authentication enforcement flaw, to its Known Exploited Vulnerabilities catalog after reports of possible real world exploitation. SonicWall said the SSL VPN issue can let a user with valid alternate credentials bypass SAML controls and SAML enforced MFA, and urged customers to update. Federal Civilian Executive Branch agencies should patch by November 20, 2026.

A Barracuda report found 66% of surveyed organizations already outsource security to a managed service provider, while 29% are considering or evaluating one. Prospective customers report less confidence in detecting threats, investigating incidents and recovering than existing customers, though they do not report more incidents. Only 29% said they could secure compromised accounts and restore operations within hours; 59% worried about AI risks.

Elastic Security Threat Command found attackers used stolen credentials to log in an average of eight minutes after infection across 27 confirmed infostealer cases. Researchers documented misuse of AI applications, including Claude Code on Windows and the ChatGPT desktop app on macOS, to run commands and reach saved passwords. ClickFix style verification pages were the most common entry point, appearing in 12 cases.

Japan's government announced a 10 billion yen ($63 million) emergency package to help local organizations strengthen cyber defences after attacks disrupted railways, retailers, KFC's logistics provider and cloud operators. Funds will help agencies use AI for basic infosec, build tools for the National Cybersecurity Office to aggregate attack information, and support victims.