IT Security News Roundup: 2026-11-10 Evening

IT Security News: Evening roundup, 2026-11-10

Summary

The evening window was dominated by financial and infrastructure threats rather than a single headline: a $133M heist at a French bank, a breach at Chainalysis, and an OpenSSH flaw being exploited within hours. Several stories share a supply-chain or trusted-third-party thread, from the bank's unnamed provider to Barracuda's gateway and the SonicWall VPN bypass. Microsoft's roughly 1,100-patch Tuesday drop and fresh CISA catalog additions add pressure on defenders to prioritise patching this week. Beyond the technical items, the roundup also covers state-linked espionage, AI-driven risks in policing and agent tooling, and the policy push around sovereign data. Together they show why patch speed, vendor-risk management and credential hygiene matter right now.

1. The SANS Internet Storm Center's daily Stormcast for November 9 was published, offering its routine overview of recent threat activity and current InfoCON status, which was green. The post itself contains no detailed findings beyond the podcast listing.
2. Risky Bulletin reports that pro-Kremlin hacktivists have doxed EU politicians and law enforcement personnel. The same bulletin notes a deepfake gang arrested on US charges, a SonicWall zero-day patch, and in-the-wild exploitation of the SSHole flaw.
3. Huawei claims to have produced a PC built entirely from Chinese components. The Register's roundup also flags Japan declaring an information security emergency and Apple's large Mac sale to Philippine schools.
4. Crédit Mutuel Arkéa lost about $133M after attackers entered through an unnamed third-party provider and moved funds from the bank's own accounts into USDC and USDT. Investigators say delays let millions be laundered before disclosure. Chainalysis separately reported a breach exposing customer usernames, password hashes and live tokens.
5. Europol's Operational Taskforce GRIMM arrested five suspects in Spain, Morocco and France, including fugitives on the EU Most Wanted list. They are accused of ordering and coordinating violence-as-a-service from abroad, rather than carrying out attacks themselves.
6. Amazon Web Services renewed its ProcessUnity Global Risk Exchange assessment, a validated report that helps customers conduct cloud supplier due diligence and strengthen third-party cyber risk management.
7. Microsoft's November Patch Tuesday fixed nearly 1,100 vulnerabilities across Windows and supported software, including 63 critical flaws and a zero-day in Outlook. Updates from Adobe, Apple, Google and Mozilla arrived the same week.
8. Amazon is positioning its Ring home security drone and a business patrol robot as "proactive protection" for homes and premises. The Register's coverage frames the product as a new step in consumer surveillance hardware.
9. Risky Business's sponsored interview with Airlock Digital covers ASD's shift from the Essential Eight to the broader Essentials framework. The change is less prescriptive and asks organisations to apply more judgement.
10. F-Secure has published a taxonomy of 26 ways AI can harm consumers, tracing how harm moves from misleading chatbot answers to compromised autonomous agents. It also maps where defences can intervene.
11. Researchers argue that predictive policing systems trained on historical arrest data absorb existing bias and repeat it at scale. Sarah Brayne's LAPD study describes a feedback loop, and NYU's AI Now Institute found that nine of 13 US jurisdictions trained systems on records from biased or unlawful policing.
12. CyberScoop reports bipartisan US support for turning the country's quantum research lead into domestic manufacturing and supply chains. Lawmakers worry that industrial capacity will not keep pace with demand.
13. CISA added flaws in IBM, SignalWire FreeSwitch, OpenSSH and GPUStack to its Known Exploited Vulnerabilities catalog, signalling confirmed exploitation and a need for prompt remediation by affected organisations.
14. SonicWall patched CVE-2026-19868, a CVSS 7.1 SonicOS flaw that can let attackers with valid alternative credentials bypass SAML and its MFA requirement on the SSL VPN. CISA added it to the KEV catalog, with federal agencies required to fix it by November 20. No workarounds exist.
15. Microsoft's November Patch Tuesday lists 1,094 CVEs, with 726 in Windows and 174 in Office, plus fixes for SQL Server and Exchange. It is the second consecutive month to exceed 1,000 fixes, according to CyberScoop.
16. SANS honeypot data shows a rise in attempts to exploit the newly disclosed SSHole OpenSSH vulnerability (CVE-2026-123158). The honeypots only capture the first 255 characters of passwords, so the data is limited in scope.
17. FireMon expert Dan Rheault argues that autonomous AI agents need network access controls, least privilege and containment testing, rather than relying on instructions alone. eSecurityPlanet carried the advice.
18. Barracuda patched CVE-2026-116606 and CVE-2026-111560, which watchTowr showed can be chained to run commands as root on Email Security Gateway appliances without logging in. Mandiant scored them 9.3 and 8.6.
19. A US Army member was arrested in the UK on suspicion of spying for Russia. The Metropolitan Police said the arrest was made by counterterrorism officers working with the FBI and the US military.
20. Mullvad has closed its free public encrypted DNS service, which offered DNS over HTTPS and DNS over TLS. Users are advised to move to Quad9 or another resolver.
21. Researchers at Dark Reading say the open-source Artex AI pen-testing framework, along with 45 similar tools, is being repurposed by attackers to run credential attacks and cloud breaches at machine speed.
22. Researchers found that 35,000 Grok Build coding-agent apps were publicly exposed, leaking confidential information, some of it belonging to SpaceX. The problem highlights how AI coding tools can expose secrets by default.
23. Bogotá authorities are investigating whether a health network's email account was accessed without permission or spoofed in a bomb threat sent to Rome's Fiumicino Airport. The threat is part of a wave of email bomb hoaxes disrupting European airports.
24. Microsoft's Patch Tuesday listed 1,093 bugs, the second month in a row above 1,000, with an exploited Outlook vulnerability drawing most of the attention, according to The Record.
25. Reserve Bank of India Governor Sanjay Malhotra argued that sovereign data centres are essential to protect critical financial information. The remarks followed the inauguration of the RBI's new Bhubaneswar data centre, which will support NEFT, RTGS and UPI settlement.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. ISC Stormcast For Monday, November 9th, 2026 https://isc.sans.edu/podcastdetail/10170, (Mon, Nov 9th)
2. Risky Bulletin: Pro-Kremlin hacktivists dox EU politicians, law enforcement
3. Huawei says it’s made a 100 percent Chinese PC
4. French bank loses $133M in cyber heist, Chainalysis breach exposes every customer login, Attackers exploit OpenSSH flaw
5. Ordering violence from abroad: five suspects arrested in Spain, Morocco, and France
6. AWS refreshes ProcessUnity Global Risk Exchange assessment to enhance customer’s third-party due diligence
7. Microsoft Fixes Nearly 1,100 Security Vulnerabilities
8. Ring robots ready to patrol paranoids’ pads
9. Sponsored: The evolution of ASD's Essential Eight
10. F-Secure Identifies 26 Ways AI Can Harm Consumers, and Where to Stop Them
11. AI in Policing Risks Amplifying Racial Bias, Researchers Warn
12. The US wants its quantum lead to turn into factories and supply chains
13. U.S. CISA adds IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack flaws to its Known Exploited Vulnerabilities catalog
14. SonicWall Patches Exploited VPN Authentication Flaw
15. Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday
16. Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)
17. AI Agent Security Requires More Than Instructions, FireMon Expert Warns
18. Barracuda Patches Two Security Flaws That Could Let Attackers Take Over Email Security Gateways
19. US Army member arrested in UK over allegations of spying for Russia
20. Mullvad shuts down its public encrypted DNS service: switch to Quad9 or another resolver now
21. Artex: The AI Pen-Test Tool Hackers Turned Into a Weapon
22. Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI
23. Bogotá Investigates Possible Health Agency Email Compromise Linked to European Airport Bomb Hoax
24. Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row
25. Data Sovereignty Is Essential for India's Digital Infrastructure, Says RBI Governor