IT Security News Roundup: 2026-11-09 Evening

IT Security News: Evening roundup, 2026-11-09

Summary

Between 18:00 and midnight CET on 9 November, the dominant threads were supply-chain and infrastructure exposure, state-linked sabotage, and a steady drumbeat of actively exploited flaws. N-able's decision to take its hosted N-central platform offline after a researcher published more than 30 alleged zero-days stands out, as does France's attribution of the supermarket and freezer attacks to Iran. Several stories also show attackers abusing trusted connections, from AWS integrations to AI agents and remote-access tooling, which means defenders should be auditing what their tools and partners are allowed to reach. Together these items point to a period where the trust placed in third-party platforms and automation is itself the weak point.

1. N-able has taken its hosted N-central environments offline and told on-premises customers to shut their servers down after a researcher publicly released more than 30 alleged zero-days, some with exploits that could let attackers take over systems. Customers running N-central face an immediate operational decision.
2. A flaw in OpenSSH, dubbed "*sshole", may expose embedded Linux devices and Docker containers, according to G Data's post. The article text is limited, so the exact scope of exposure is not described in detail.
3. York University disclosed that a threat actor stole personal information submitted through its online forms, with records reaching back to 2007. The breach affects people who used those forms over a long period.
4. AWS published a bulletin for CVE-2026-124033, a relative path traversal in the ParallelCluster CLI log export commands affecting versions 3.0.0 through 3.15.x. An authenticated user with write access to the export S3 bucket could use a crafted object key to write files outside the intended directory.
5. Microsoft patched a remote code execution bug in Windows Paint after weeks of unclear messaging about whether a fix was coming. The delay left users uncertain about their exposure for a considerable time.
6. Node.js has announced high-severity fixes for versions 22, 24, and 26, scheduled for November 11. The guidance centres on identifying deployed runtimes and verifying patches in production before the release lands.
7. CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog, covering GPUStack, SignalWire FreeSWITCH, OpenSSH, and IBM Aspera Faspex. The additions come with evidence of active exploitation and bind federal agencies under BOD 26-04.
8. Amplifon's U.S. arm is notifying customers about an early-2026 data breach that included medical information. The incident affects thousands of people who used the hearing aid company.
9. Black Hat India 2026 held its inaugural edition in Bengaluru, run by Informa Markets over four days of research talks and industry dialogue. The item is an event announcement rather than a threat report.
10. Check Point describes how criminals abuse ARTEX AI agents to steal credentials and signing certificates. The piece includes practical checks defenders can apply to their own agent deployments.
11. CISA announced an enhanced reporting form for cyber incidents. The source text gives no detail on what changed in the form, so the practical impact is unclear from this summary alone.
12. Microsoft's FORGE Lab used its agentic tool Hyenas to find memory-safety bugs in Rust's core and standard libraries, including cases where safe Rust code can trigger undefined behaviour. The work examines three patterns of misplaced trust in unsafe code.
13. Wiz researchers uncovered a supply-chain campaign in which attackers backdoored trusted AWS integrations to steal secrets. The attack abuses the trust placed in those integrations rather than exploiting a single product flaw.
14. Samsung's November 2026 security update fixes critical Android and Galaxy vulnerabilities. The article explains which flaws were patched and how users can check whether their device has the update.
15. France's foreign minister Jean-Noël Barrot said Iran's Revolutionary Guard Corps was behind attacks on supermarket fridges on 11 and 12 October that hit about 700 sites and raised refrigerator temperatures. Some stores threw away stock, and officials say the work remains partly unclear.
16. A vulnerability allowing hackers to SSH into Linux devices is being actively exploited, according to Ars Technica. The report describes the flaw as a serious threat to internet security.
17. Researchers at Microsoft's FORGE Lab describe the Rust memory-safety work in a separate post, adding detail on how frontier agentic research is being applied to unsafe code. This complements the FORGE item above from the Microsoft Security Blog.
18. Amazon Bedrock AgentCore added multi-layer write validation to defend against memory poisoning, since content written to agent memory is later injected into future conversations. The write path is presented as a key control point for shaping agent behaviour.
19. An investigation led by the Itzehoe Public Prosecutor's Office targeted a company suspected of supplying fraudulent trading websites to criminal groups. Authorities searched 17 locations, seized over 100 servers, and estimate losses above EUR 4 million across victims in at least 50 countries.
20. Binance denied claims by a threat actor using the "ShinyHunters" handle that it had suffered a new breach and was selling records. The actor is believed to be impersonating the extortion gang, so the claim appears to be a scam attempt.
21. Nvidia backed CEO Jensen Huang while its board examines espionage reports. The item flags supplier risk and AI chip access as points IT buyers should monitor.
22. French officials attribute a second wave of cyberattacks on industrial freezers across France and wider Europe, including grocery stores and blood banks, to Iran. The attacks targeted refrigerated units at scale.
23. France links October cyberattacks on refrigeration systems at more than 700 supermarkets and other retail sites to Iranian state-backed hackers. The attacks caused food losses and, according to the government, sparked at least 15 fires.
24. A labour-exploitation action week led by Europol, the European Labour Authority, and 34 countries produced 27 arrests and identified 248 potential victims. The operation targeted high-risk sectors such as agriculture, construction, and massage parlours.
25. Vanderbilt University announced a cyberattack and warned students and employees that campus devices and systems may be affected. The notice is brief, and the full extent is not yet described.
26. In an episode of Between Two Nerds, Tom Uren and The Grugq discuss why the PHP2Shell critical bug in a widely used web scripting language amounted to little in practice. The piece is commentary on why the hype did not match the impact.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. N-able takes cloud platform offline after 30+ "zero-days" published
2. Vulnerability in OpenSSH: *sshole Potentially Exposes Embedded Linux, Docker Containers.
3. York University breach exposed personal information dating to 2007
4. CVE-2026-124033 – Relative path traversal in the log export commands in AWS ParallelCluster CLI
5. Microsoft Fixes RCE Bug in Windows Paint After Weeks of Confusion
6. Node.js Plans High-Severity Fixes for Nov. 11: What to Prepare
7. CISA Adds Four Known Exploited Vulnerabilities to Catalog
8. Data breach at hearing aid giant Amplifon impacts thousands
9. Black Hat India 2026 Makes a Landmark Debut in Bengaluru, Bringing the Global Cybersecurity Community to India
10. ARTEX Cyberattacks: AI Agents Steal Credentials and Signing Certificates
11. CISA Announces Enhanced Reporting Form for Cyber Incidents
12. FORGE Lab uses agentic tools to identify memory safety issues in Rust
13. Attackers backdoor trusted AWS integrations to steal secrets
14. Samsung November 2026 Security Update Addresses Major Flaws: What Galaxy Users Should Know
15. France Blames Iran for the Supermarket Fridge Attacks
16. Vulnerability that lets hackers SSH into Linux devices is under active exploitation
17. Help defend against memory poisoning in Amazon Bedrock AgentCore with multi-layer write validation
18. Investment scams with potential victims in at least 50 countries: over 100 servers seized
19. Binance calls alleged “ShinyHunters” post a scam attempt
20. Nvidia Backs Jensen Huang as Board Examines Espionage Reports
21. France blames Iran for mass-hacks targeting freezers in grocery stores and blood banks
22. France blames Iranian hackers for supermarket attacks that sparked fires
23. 27 arrests and 248 potential victims identified in action week against labour exploitation
24. Vanderbilt cybersecurity incident impacting campus devices and systems
25. Between Two Nerds: Why PHP2Shell fizzled