IT Security News Roundup: 2026-11-10 Overnight

IT Security News: Overnight roundup, 2026-11-10

Summary

Overnight coverage was dominated by three threads: money and data taken through breaches, AI tooling moving into security products, and state-linked or ransomware attacks on critical services. Crypto theft is approaching $9 billion this year, while Vanderbilt University, SEGA, Wyndham, and a French grocery sector all report intrusions that expose or disrupt data. Vendor and government stories round this out, from N-able's emergency shutdown of hosted servers over disclosed zero-days to Anthropic's Mythos model being built into Cisco and IBM offerings and a pending CISA leadership nomination. For defenders, the common lesson is that exposure often comes from the software and vendors they already depend on, so patch cadence, third-party risk, and credential hygiene matter as much as perimeter controls.

1. Crypto hacks have reached roughly $8.78 billion so far in 2026, with exchanges breached and attackers finding ways around security controls, raising doubts about how safely people can hold digital assets.
2. A post presented as a 1971-era "zero-day" in terminal software claiming to affect billions of devices is actually satire, not a real vulnerability. Its "exploit" simply describes normal terminal use, mocking security marketing hype.
3. Michael LoSapio, a former Palantir executive, has been nominated to lead CISA, an agency that has had no Senate-confirmed director throughout Trump's second term, and his nomination may face resistance.
4. The piece argues that the bigger AI risk may not be malicious systems but tools that exactly follow instructions, learning to exploit loopholes in software and even tax law in ways their designers never intended.
5. Red Hat has made OpenShift 5 generally available, adding agentic workflow support, a longer lifecycle, zero-trust security features, and better virtualization for environments that mix containers, VMs, and AI workloads.
6. N-able took its hosted N-central environments offline on November 9 after a researcher published 33 alleged zero-day flaws with exploit code, and told customers running on-premises servers to shut them down until further notice.
7. Red Hat's OpenShift 5 release pairs with Advanced Cluster Security for Kubernetes 5, giving security teams more context on workload risk, and cites a report where 74% of surveyed organizations said security concerns slowed or delayed application deployment.
8. The SANS Internet Storm Center's daily Stormcast podcast for November 10, 2026 was published, though the source text provides no details on its specific threats.
9. Anthropic's Mythos model, which is strong at finding software bugs, will be offered through Cisco and IBM enterprise security products, giving customers its capabilities without direct access to the model itself.
10. Vanderbilt University confirmed it is responding to a cyberattack claimed by the BYOD ransomware group, which says it encrypted university databases and stole student, employee, and research data.
11. Hotel group Wyndham exposed customer data because its customer app contained a hardcoded credential that let anyone access it, and the company would not say whether it can detect past unauthorized access.
12. Japanese gaming company SEGA disclosed that a breach at its third-party newsletter provider, ARARA, exposed the email addresses of 2.2 million subscribers.
13. Amazon published advisories for two CVEs in its Braket quantum computing SDK: one in local hybrid job input data downloads and one in error-mitigation schema validation, affecting specific versions of the SDK and the Braket Schemas library.
14. France has attributed a wave of supermarket hacking that caused widespread disruption to Iran, calling it the first cyber offensive campaign carried out purely to sabotage national territory.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. As Hacks Near $9 Billion in 2026, Crypto Has A Hole in Its Pocket
2. Terminal2Shell: 55-Year-Old ‘Zero-Day’ Dating Back to 1971 Claims to Affect Billions of Devices
3. Trump picks Palantir’s LoSapio to head CISA
4. AI doesn’t have to go rogue to break the world
5. What’s new in Red Hat OpenShift 5
6. N-able Takes N-central Servers Offline Worldwide After 33 0-Day Vulnerabilities and Able2Shell Exploits
7. Red Hat OpenShift 5: Bring stronger security to applications and AI
8. ISC Stormcast For Tuesday, November 10th, 2026 https://isc.sans.edu/podcastdetail/10172, (Tue, Nov 10th)
9. Anthropic's super bug-finding Mythos model is going into Cisco and IBM products
10. Vanderbilt University hit in BYOD ransomware attack, data theft claimed
11. Hotel giant Wyndham exposed customer data after app security lapse
12. SEGA newsletter data breach exposes 2.2 million email addresses
13. CVE-2026-124034, CVE-2026-124035: Issues with Amazon Braket SDK
14. France blames Iran for supermarket hack meltdowns