← All threat briefs

Daily Cybersecurity Brief — 2026-11-09

SECURITY // 2026-11-09

Daily Cybersecurity Brief — 2026-11-09

Vulnerabilities & Exploits

  • Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time — Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it. The update that installs the fix still unpacks its files using the site's old, unpatched code, so an attacker who strikes at the... (Source: The Hacker News)

  • Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services — Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names, usernames, password hashes and live tokens for all users. "While we investigated, we removed access to Reactor and Data Solutions," the company sai... (Source: The Hacker News)

  • OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158) — An OpenSSH flaw that lets remote attackers log into passwordless accounts on Alpine Linux and other musl-based systems is being exploited, threat intelligence firm Previdian has warned. The flaw (CVE-2026-123158), nicknamed sshole by Wakefield researcher Özgün Kültekin, was fixed in OpenSSH 10.6p2 o... (Source: Help Net Security)

AI/ML Security

  • Former OpenAI Engineer Pleads Not Guilty to Planting Covert Device in Executive Meeting Room — The OpenAI engineer who was arrested and charged last month for planting a covert audio recording device in the company's office has pleaded not guilty. According to reports from Bloomberg and CNBC, Saudi national Abdulrahman Alfozan made an appearance in San Francisco federal court on Friday, where... (Source: The Hacker News)

  • Wirken: Open-source AI agent gateway — Wirken is an open-source gateway that sits between messaging apps and AI agents. It assumes any agent can be turned against its owner and limits what a compromised one can reach. Take an agent that reads your chats and email, holds the keys to your accounts and can run commands. One hidden instructi... (Source: Help Net Security)

  • Companies seeking an MSP doubt their ability to spot cyberattacks — Businesses looking to outsource cybersecurity want providers that can help them recover from attacks, manage AI risks, and explain what security problems mean for their operations, according to Barracuda What MSP Customers Need Next report. What MSP customers need next (Source: Barracuda Networks) 6... (Source: Help Net Security)

  • An average of 8 minutes is all hackers need to log in with stolen credentials — Attackers used stolen credentials to log in an average of eight minutes after infection across 27 confirmed infostealer cases, according to a report from Elastic Security Threat Command. Researchers also documented misuse of AI applications to execute commands and digitally signed remote monitoring ... (Source: Help Net Security)

  • Week in review: Refrigeration cyberattacks hit European retailers again, Patch Tuesday forecast — Here's an overview of some of last week's most interesting news, articles, interviews and videos: The first ten lines of a command policy for AI coding agents In this Help Net Security interview, Vinay Thakker, CTO of KloudStax, explains how to set identity, credentials, and network limits for AI ag... (Source: Help Net Security)

  • Claude Code's "Don't Ask Again" File Exposes Passwords and Keys in 1,122 Public Copies on GitHub — Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. When a user selects "Yes, and don't ask again," Anthropic's AI coding assistant can save the command, word-for-word, including the secret, in... (Source: The Hacker News)

  • UK Wades Into Tech Sovereignty Amid AI Policy Changes — The UK is betting on domestic AI and cyber investment to reduce reliance on US tech — but security leaders question whether the funding is too fragmented and too late. (Source: Dark Reading)

  • OpenAI Launches GPT-6 Cyber After AI Helps Find 81 Firefox Flaws, 948 Linux Exploits — OpenAI on Thursday unveiled GPT‑6 Cyber, which it described as a major step forward in security research that brings together stronger cybersecurity capabilities with a step-change improvement in model alignment. The new model is "more capable at finding and fixing vulnerabilities, and far more reli... (Source: Help Net Security, The Hacker News)

  • AI Gave Your Incident Archive a Second Job — Security records are increasingly being used by vendors to train their models, creating new risks for enterprises. (Source: Dark Reading)

  • Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' Computers — A browser extension that can run scripts on claude.ai could make Claude Desktop run code on a person's computer, researchers at Forever Security, an endpoint security company, showed in a test. The attack needs Dispatch, a Claude feature that lets people send tasks from their phone to Claude Desktop... (Source: The Hacker News)

  • The Flood is Coming And The Pipes Were Already Full — An update on Athena, and some unsolicited predictions on what's coming next On Saturday, Dario Amodei published We Must Pace the Frontier. I agree with him. Go read it if you haven't. I've spent the summer looking at what these models find, and the gap he describes between what they can do and what ... (Source: The Hacker News)

Supply Chain & Software Security

  • Why Europe's Freezer Hacks Spread So Far, So Fast — Europe's supermarket freezer hacks show how security issues can cascade across an industry, disrupting supply chains at scale. (Source: Dark Reading)

Cloud & Infrastructure Security

  • CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have been exploited in real-world attacks. The vulnerability, tracked as CVE-2026-19868 (CVSS score: 7.1 / 7.5), has been described as an authentication reinforcement... (Source: The Hacker News)

  • Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login — Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required. The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday. One flaw, CVE-2026-116606, is an authorization bypass. An unauthenticated attacker can use it to restore a... (Source: The Hacker News)

  • Sarajevo Cyber Security Summit 2026 puts the Western Balkans' cyber resilience in focus — Cyber Security Summit 2026 in Sarajevo will examine the practical security questions organizations face when a supplier, network device or critical digital service fails: what breaks, who decides, and how quickly can operations recover? A serious cyber incident does not need to begin on an organizat... (Source: Help Net Security)

Reports & Analysis

  • The post-quantum future of web privacy — Cryptographic protocols like Privacy Pass help keep web sites safe from abuse while keeping their users private. This post looks at the quantum threat to these protocols, and some new post-quantum cryptography that may help close the gap. (Source: Cloudflare Blog (security))

  • Residential proxy traffic caught leaving the White House network — The White House network has been working as an exit point for residential proxy services, a setup that may open a path into one of the most closely guarded networks in the world, Layer3 Intel found. In a blog post, the threat intelligence firm reported that its proxy enumeration pipeline exited thro... (Source: Help Net Security)

IoT & OT Security

  • U.S. Agencies Warn Refrigeration Controller Attacks Could Cause Fires and Inventory Losses — U.S. government agencies have warned that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems globally with an aim to cause service disruptions, fire hazards, and loss of inventory. "The actors may exploit vulnerabilities or weaknesses in unpatched or inte... (Source: The Hacker News)

  • Turning Up the Heat: Inside the Attacks on Europe's Refrigeration System — Unit 42 examines recent cyberattacks targeting European refrigeration systems and outlines defense and mitigation strategies. The post Turning Up the Heat: Inside the Attacks on Europe's Refrigeration System appeared first on Unit 42. (Source: Unit 42)

  • Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot — Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian. The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux system... (Source: The Hacker News)

  • The Good, the Bad and the Ugly in Cybersecurity - Week 45 (2026) — Authorities dismantle investment scams and cybercrime networks, scammers abuse Teams and AD CS, and cyberattacks disrupt European refrigeration systems. (Source: SentinelOne Blog)

  • Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It — A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates. The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News checked today. The fla... (Source: The Hacker News)

  • Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs — A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week. The backdoored web server executes commands that attackers send via web requests, and those requests never appear in it... (Source: The Hacker News)