IT Security News Roundup: 2026-11-10 Afternoon

IT Security News: Afternoon roundup, 2026-11-10

Summary

Ten days after the Amadeus breach first surfaced, the period's stories cluster around three threads: supply-chain and third-party exposure, AI platforms and their tooling becoming both targets and security products, and governments and critical services under pressure. The Amadeus incident alone has hit Japan Airlines, Cathay Pacific and others, while AI provider Fireworks and the N-able remote access service show how a single vendor failure ripples outward. Several stories also point to weak patching and exposed systems, from X.Org and AhsayCBS to Danfoss controllers. For readers, the common lesson is that your exposure is often defined by partners and platforms you never chose, so vendor risk and fast patching deserve attention now.

1. Japan Airlines warned about 92,000 customers after hackers reached reservation data through Amadeus, a third-party platform also used by its affiliate Japan Transocean Air. About 2,000 customers also had passport and frequent-flyer numbers exposed, which raises the phishing risk.
2. X.Org fixed eight vulnerabilities in its X server and Xwayland, including one letting a malicious monitor corrupt memory. Fixes ship in xorg-server 21.1.26 and xwayland 24.1.15, so Linux and Unix desktop users should update.
3. The weekly roundup covers the most significant cybersecurity stories from November 2 to 6, 2026, with AI-weaponized attacks described as the defining theme of the week.
4. Michael LoSapio, currently at Palantir, has been nominated to run the US cyber defense agency CISA. The agency has been depleted, and his path could be complicated by its workforce and political pressures.
5. The Blind Eagle threat group is using fake court and prosecutor notices in Portuguese and Spanish phishing lures to deliver a remote access trojan related to AsyncRAT and DCRat across Latin America.
6. Fireworks AI says hackers stole data and billing information from a limited number of customer accounts during October breaches, and all affected customers have been notified.
7. Fireworks' investigation widened to show unauthorized access to account and billing data, plus secrets, datasets and incomplete model files for a limited set of accounts, according to its October 10 notice.
8. The Trump administration's pick for CISA is a Palantir cybersecurity executive, its second attempt to fill a post vacant for the entire second term. Senate confirmation could be difficult.
9. Attackers exploited two patched AhsayCBS flaws, CVE-2026-105133 and CVE-2026-105134, to bypass authentication and deliver a sandbox-evading Python backdoor, as observed by Huntress in October.
10. Remote access provider N-able took its service offline after a researcher published dozens of zero-day bugs, and urged self-hosted customers to shut down their own servers during a critical security incident.
11. A researcher showed it is possible to get around Meta smart glasses' safeguards against unauthorized software and run her own code on the device, though the process was not easy.
12. Kaseya argues that ransomware recovery now directly affects whether managed service providers keep their clients, since delays, poor communication and unexpected costs erode trust when recovery tools are disconnected.
13. CrowdStrike announced Falcon Cloud Security innovations aimed at securing the cloud infrastructure that AI workloads run on, according to the vendor's post.
14. Italian Foreign Minister Antonio Tajani says cybercriminals spread his personal data on the dark web, while Prime Minister Giorgia Meloni blamed pro-Russian hackers. Tajani linked the attack to Italy's Ukraine stance.
15. A public iOS sandbox escape lets one app read other apps' files, and Binance warned it could expose seed phrases and private keys. Apple has not confirmed a fix, and no attacks have been reported.
16. Cybercriminals are infecting ordinary people's devices with spyware on a large scale, according to a new report, shifting attention beyond high-value targets to average users.
17. A new analysis examines how adversaries exploit the vulnerability ecosystem to work against defenders, though the source text available here offers no further specifics.
18. Binance says a vulnerability in iOS 26.7.1, 27.0.1 and 27.2 could let third-party apps read private files of other apps, including crypto seed phrases, secret keys and login credentials.
19. Akamai Functions runs WebAssembly code at the edge with no cold starts and no idle capacity fees, which the vendor presents as a way to cut latency and cloud costs.
20. The US Treasury blocked MEXC Global from the American financial system over alleged sanctions evasion and cybercrime, with FinCEN estimating about $16 billion in suspicious transactions between May 2021 and May 2026.
21. Apple issued emergency updates including iOS 27.2.1 to fix a privacy flaw in iMessage group chats, according to a Hackers Online Club report.
22. VPN Unlimited is offered at $59.99 for securing up to five devices with a strict zero-log policy for three years, a consumer-oriented deal rather than a security news development.
23. Sekoia's threat research team analyzed attacks exploiting exposed, unpatched Danfoss controllers that run European refrigeration systems, including attribution hypotheses and honeypot findings.
24. PuppyGraph released version 1.0 of its graph query engine with an AI-assisted schema builder and MCP support, so enterprise AI agents can query interconnected data with fewer errors and retries.
25. Rce-path is a tool for tracing dangerous Python code, such as eval() or subprocess calls, back through assignments and branches to see whether untrusted input can reach them.
26. Apple's iMessage group chat privacy flaw was addressed in the emergency iOS 27.2.1 release, which Apple issued across several platforms at once.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Japan Airlines Passengers Caught in Amadeus Reservation System Breach
2. X.Org patches eight server vulnerabilities a month after fixing 12 others
3. Weekly Cybersecurity Newsletter – Top 50 Biggest Cybersecurity Stories of the Week
4. Trump taps Palantir security chief to run battered US cyber defense agency
5. Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America
6. AI company Fireworks says hackers stole data, billing info during October breaches
7. Fireworks AI Breach Widens to Expose Customer Billing Data and Incomplete Model Weights
8. Trump picks Palantir cybersecurity executive to lead CISA
9. Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor
10. N-able takes its remote access service offline after researcher publishes dozens of zero-day bugs
11. Researcher bypassed Meta smart glasses’ safeguards to run her own code
12. Ransomware recovery is now a client retention metric
13. New Falcon Cloud Security Innovations Secure the Cloud AI Runs On
14. Italy Minister’s Personal Data Leaked on Dark Web
15. iOS Sandbox Escape Is Public, and Apple Hasn’t Confirmed a Fix
16. Cybercriminals are increasingly infecting regular people with spyware
17. How Adversaries Are Turning the Vulnerability Ecosystem Against Defenders
18. Binance warns of iOS flaw that could leak crypto wallet secrets
19. Akamai Functions: The Business Case for Edge Native Serverless
20. MEXC Faces US Restrictions Over Alleged Sanctions Evasion and Cybercrime
21. Apple iMessage Group Chat Privacy Flaw iOS 27.2.1
22. Secure 5 Work Devices for 3 Years With This $59.99 VPN
23. Cold Chain Attack: Unpatched Danfoss Controllers Exploited
24. PuppyGraph adds AI schema builder and MCP support to help ease enterprise agent adoption
25. Tracing Dangerous Python Code Paths With rce-path