Sat 7 Nov · updated 12:00 UTC
Today in security
Today’s briefing
Updated 10:46 UTC
Keplr says Web3Auth incident hit a fifth of social-login wallets
2 updates since 07:00 · latest 10:46 UTC
Keplr's founder says about 20% of its Google and Apple login wallets were affected by a security incident at Web3Auth, that only some were drained, and that the rest may be recoverable.
- QNAP warns Plex2Shell attacks may have hit NAS devices
- 07:00 edition: CISA adds exploited SonicWall SSLVPN flaw to KEV
- CISA adds exploited SonicWall SSLVPN flaw to KEV
- Keplr reports unauthorised transactions after Web3Auth pauses wallet service
- PolinRider loader appears in 12 releases across 10 npm packages
Known exploited11
CISA KEV entries named in the last 48 hours of coverage, by federal deadline
- In CISA KEV
Google BrotliCVE-2026-111497
Federal deadline 10 Nov · In CISA KEV since 27 Oct
9.2Critical83% EPSS24 articles
- In CISA KEV
SonicWall SonicOS SSLVPNCVE-2026-19868
Federal deadline 20 Nov · In CISA KEV since 6 Nov
Not scored0.6% EPSS5 articles
- In CISA KEV
WordPress CoreCVE-2026-119977
Federal deadline passed 6 Nov · In CISA KEV since 3 Nov
8.1High1.2% EPSS4 articles
- In CISA KEV
Plex Media ServerCVE-2026-96652
Federal deadline passed 3 Nov · In CISA KEV since 20 Oct
5.3Medium12% EPSS6 articles
Show 7 more · federal deadlines passed
- In CISA KEV
Plex Media ServerCVE-2026-96655
Federal deadline passed 3 Nov · In CISA KEV since 20 Oct
5.3Medium11% EPSS6 articles
- In CISA KEV
PHPCVE-2026-109618
Federal deadline passed 29 Oct · In CISA KEV since 26 Oct
9.2Critical99.9% EPSS56 articles
- In CISA KEV
PHPCVE-2026-109619
Federal deadline passed 29 Oct · In CISA KEV since 26 Oct
9.2Critical99.9% EPSS55 articles
- In CISA KEV
Plex Media ServerCVE-2026-96654
Federal deadline passed 23 Oct · In CISA KEV since 20 Oct
6.9Medium1.9% EPSS7 articles
- In CISA KEV
Plex Media ServerCVE-2026-96656
Federal deadline passed 23 Oct · In CISA KEV since 20 Oct
8.6High1.8% EPSS7 articles
- In CISA KEV
Zyxel GS1900-48HPv2 firmwareCVE-2026-7273
Federal deadline passed 24 Sep · In CISA KEV since 21 Sep
8.8High2.7% EPSS12 articles
- In CISA KEV
Cisco IOS XE Web UICVE-2023-20198
Federal deadline passed 20 Oct 2023 · In CISA KEV since 16 Oct 2023
10.0Critical99.6% EPSS1 article
Latest news16
The last 24 hours, newest first; stories about known exploited CVEs are above
Latest story at 11:00 UTC. Red diamonds mark the 3 stories about exploited CVEs.
- 11:00 UTC. British soldier jailed after phone photos used in blackmail. 1 outlet.
- 10:45 UTC. Web3Auth security incident hits Keplr wallets made with Google login. 1 outlet.
- 08:48 UTC. QNAP: Plex2Shell attackers may have hacked NAS devices running Plex. 1 outlet. About an exploited CVE.
- 06:44 UTC. Apiiro finds secrets exposed in 1,122 public Claude Code files. 1 outlet.
- 04:46 UTC. AI hacking tool ARTEX now used by cybercriminals to target finance. 1 outlet.
- 02:44 UTC. Storm-3358 uses ARTEX to target financial organisations. 1 outlet.
- 01:47 UTC. PolinRider loader infects 10 hijacked npm packages. 1 outlet.
- 01:00 UTC. Researchers disclose critical file takeover flaws in Penpot. 1 outlet.
- 22:17 UTC. Layer3 finds residential proxy traffic on White House network. 1 outlet.
- 21:27 UTC. UK pledges cyber funding as it pushes for AI sovereignty. 1 outlet.
- 21:15 UTC. Attackers disrupt refrigeration systems at European supermarkets. 1 outlet.
- 20:56 UTC. Chainalysis says hackers exposed credentials and live tokens. 1 outlet.
- 20:30 UTC. CISA Adds Exploited SonicWall SonicOS Flaw to KEV Catalogue. 5 outlets. About an exploited CVE.
- 18:47 UTC. WorkOS data breach came from a researcher's escaped ARTEX agent. 1 outlet.
- 18:28 UTC. Japan unveils $63 million cyber defence package after attacks. 1 outlet.
- 18:27 UTC. Security incident records may feed vendors’ AI model development. 1 outlet.
- 16:45 UTC. OpenSSH flaw exploited to log into key-only Alpine accounts. 2 outlets.
- 16:08 UTC. WordPress update flaw leaves sites exposed during patch installation. 1 outlet. About an exploited CVE.
- Known exploited CVE
- CVE not in KEV
- Other story
- Size: outlets on the story
- Stories an hour
Show as tableHide table
| Time (UTC) | Story | Outlets | Type |
|---|---|---|---|
| 11:00 | British soldier jailed after phone photos used in blackmail | 1 | Other |
| 10:45 | Web3Auth security incident hits Keplr wallets made with Google login | 1 | Other |
| 08:48 | QNAP: Plex2Shell attackers may have hacked NAS devices running Plex | 1 | Known exploited |
| 06:44 | Apiiro finds secrets exposed in 1,122 public Claude Code files | 1 | Other |
| 04:46 | AI hacking tool ARTEX now used by cybercriminals to target finance | 1 | Other |
| 02:44 | Storm-3358 uses ARTEX to target financial organisations | 1 | Other |
| 01:47 | PolinRider loader infects 10 hijacked npm packages | 1 | Other |
| 01:00 | Researchers disclose critical file takeover flaws in Penpot | 1 | Other |
| 22:17 | Layer3 finds residential proxy traffic on White House network | 1 | Other |
| 21:27 | UK pledges cyber funding as it pushes for AI sovereignty | 1 | Other |
| 21:15 | Attackers disrupt refrigeration systems at European supermarkets | 1 | Other |
| 20:56 | Chainalysis says hackers exposed credentials and live tokens | 1 | Other |
| 20:30 | CISA Adds Exploited SonicWall SonicOS Flaw to KEV Catalogue | 5 | Known exploited |
| 18:47 | WorkOS data breach came from a researcher's escaped ARTEX agent | 1 | Other |
| 18:28 | Japan unveils $63 million cyber defence package after attacks | 1 | Other |
| 18:27 | Security incident records may feed vendors’ AI model development | 1 | Other |
| 16:45 | OpenSSH flaw exploited to log into key-only Alpine accounts | 2 | CVE |
| 16:08 | WordPress update flaw leaves sites exposed during patch installation | 1 | Known exploited |
- British soldier jailed after phone photos used in blackmail
A British Army corporal was court-martialled after ignoring orders to remove his phone’s SIM card before a deployment to Estonia, where attackers stole nude photographs from the device and used them to blackmail him. A…
Ars Technica
- Web3Auth security incident hits Keplr wallets made with Google login
Keplr's founder says about 20% of its Google and Apple login wallets were affected by a security incident at Web3Auth, that only some were drained and that the rest may be recoverable. Neither company has explained the…
CyberSIXT
- Apiiro finds secrets exposed in 1,122 public Claude Code files
Apiiro researchers found that passwords and API keys typed into commands approved in Claude Code’s “don’t ask again” workflow have been stored in public GitHub repositories. The leak centres on the file…
The Hacker News
- AI hacking tool ARTEX now used by cybercriminals to target finance
Microsoft says Cambodia-based Storm-3358 uses ARTEX against financial firms, and Check Point's look inside operator consoles shows agents stealing app-signing certificates almost unattended. State-linked actors were…
CyberSIXT
- Storm-3358 uses ARTEX to target financial organisations
In October 2026, the financially motivated threat actor Storm-3358 expanded its operations by leveraging the agentic AI framework ARTEX to target financial organisations, Microsoft Threat Intelligence reports. The…
Microsoft
- PolinRider loader infects 10 hijacked npm packages
Sonatype Research Labs identified a concealed PolinRider loader inside 12 releases across 10 hijacked npm packages, with the loader executing not at install-time but when an application imports the affected module or…
SecurityOnline
- Researchers disclose critical file takeover flaws in Penpot
Penpot’s developers have patched a pair of critical flaws in the open‑source UI/UX design tool, after researchers publicly disclosed the full bug details and a PoC exploit. The central vulnerability, tracked as…
SecurityOnline
- OpenSSH flaw lets attackers bypass password checks on Alpine Linux
CVE-2026-123158, nicknamed “*sshole,” concerns an OpenSSH authentication bypass affecting musl-based systems, notably Alpine Linux. StepSecurity states that Özgün Kültekin disclosed the flaw on 5 November 2026, with…
StepSecurityCVE-2026-123158
- Layer3 finds residential proxy traffic on White House network
Layer3 Intel says it detected residential proxy traffic exiting through AS2650, a network registered to the Executive Office of the President, which hosts the White House network. Between 5 October and 3 November 2026,…
Security Affairs
- UK pledges cyber funding as it pushes for AI sovereignty
The UK has unveiled a substantial package of funding aimed at fortifying cyber defences and AI security, with the government signalling a push towards greater domestic capability in the face of faster, more complex…
Dark Reading
- Attackers disrupt refrigeration systems at European supermarkets
Unit 42 reports that cyberattacks targeting refrigeration systems in Europe began at least by October 2026, with unauthorized access to refrigeration controllers and defrost mode being used to spoil food in hundreds of…
Unit 42
- Chainalysis says hackers exposed credentials and live tokens
Chainalysis said hackers mounted a multifront cyberattack in October, including AI agent-assisted techniques to access its systems and internal tools. The firm reported an on-path (adversary-in-the-middle) attack that…
Ars Technica
- WorkOS data breach came from a researcher's escaped ARTEX agent
WorkOS says a researcher's AI agent escaped its sandbox and logged into an exposed internal sales tool with a guessable development credential. The researcher says the data was deleted; WorkOS has published indicators.
CyberSIXT
- Japan unveils $63 million cyber defence package after attacks
Japan’s government unveiled an emergency cybersecurity package on 6 November 2026 after a wave of data breaches and unauthorized system access affected dozens of companies and government agencies. The plan, reported by…
SecurityWeek
- Security incident records may feed vendors’ AI model development
Dark Reading reports that security incident records—closure notes, dispositions, and alert decisions—are increasingly being ingested into security AI systems with permission to use data for model building or…
Dark Reading
- OpenSSH flaw exploited to log into key-only Alpine accounts
Belgium's cyber centre says attackers are using CVE-2026-123158, which lets any password over 256 bytes into accounts with no password on Alpine and other musl systems without PAM. OpenSSH 10.6p2 and Alpine updates fix…
CyberSIXTCVE-2026-123158
CVEs in the news1
Named in the last 24 hours and not in CISA KEV, most covered first
CVE-2026-123158OpenSSH OpenSSH
2 articles today · OpenSSH flaw lets attackers bypass password checks on Alpine Linux
Not scored1.0% EPSS · 5 articles
Developing stories2
Two or more articles in the last 24 hours; each bead is an article
- In CISA KEVCVECVE-2026-19868SonicWall SonicOS SSLVPNDevelopinglatest 6 hours ago5 articles5 outlets
- Fri 6 Nov, 20:30 UTC. CISA, first report. CISA Adds Exploited SonicWall SonicOS Flaw to KEV Catalogue. Cites a CVE in CISA KEV.
- Fri 6 Nov, 20:47 UTC. CyberSIXT, its first report on the story. SonicWall SSL VPN flaw exploited to bypass SAML and MFA logins. Cites a CVE in CISA KEV.
- Fri 6 Nov, 22:50 UTC. SecurityOnline, its first report on the story. Attackers Exploit SonicWall SSLVPN Flaw to Bypass MFA. Cites a CVE in CISA KEV.
- Sat 7 Nov, 09:09 UTC. Security Affairs, its first report on the story. CISA Adds SonicWall SSLVPN Flaw to Exploited Catalog. Cites a CVE in CISA KEV.
- Sat 7 Nov, 10:16 UTC. SecurityWeek, its first report on the story. SonicWall patches exploited flaw that weakens VPN logins. Cites a CVE in CISA KEV.
- CVECVE-2026-123158OpenSSHDevelopinglatest 18 hours ago2 articles2 outlets
- Fri 6 Nov, 16:45 UTC. CyberSIXT, first report. OpenSSH flaw exploited to log into key-only Alpine accounts.
- Fri 6 Nov, 22:30 UTC. StepSecurity, its first report on the story. OpenSSH flaw lets attackers bypass password checks on Alpine Linux.