IT Security News Roundup: 2026-11-11 Evening

IT Security News: Evening roundup, 2026-11-11

Summary

Several of today's stories share a common thread: attackers going after the trusted infrastructure that other organizations depend on, whether that's a reservation platform, a certificate authority, a remote access service, or a third-party AI provider. The Amadeus breach spread across airlines, a public iOS sandbox escape puts crypto wallets at risk, and government bodies from the US to Italy and Australia are dealing with leaks, hijacked accounts, and personnel decisions. For readers, the lesson is that a single vendor's weakness can reach far beyond its own customers, so it is worth checking which third-party platforms your organization relies on and how quickly they can be cut off or patched.

1. Japan Airlines warned about 92,000 customers after hackers accessed their data through Amadeus, the reservation platform used across the airline industry. About 2,000 customers also had passport and frequent-flyer numbers exposed, and affiliate Japan Transocean Air was hit too. JAL says its own systems were not touched.
2. President Trump has nominated Michael LoSapio, a Palantir security executive, to lead the US cyber defense agency CISA. The agency has been without a permanent leader for the entire second term and is short on staff, and the Senate confirmation process could be difficult.
3. N-able took its remote access service offline after a researcher published dozens of zero-day vulnerabilities. The company also told self-hosted customers to shut down their own servers, citing a critical security incident and the risk of attacks.
4. Hackers defaced the website of Victoria's curriculum and assessment authority in Australia and claimed to have sold this year's Year 12 exam papers to students. The hacker reportedly marked the papers for identification, which casts doubt on the claim.
5. The Blind Eagle threat group is running a campaign across Latin America that uses fake court and prosecutor notices in Spanish and Portuguese to deliver a remote access trojan related to AsyncRAT and DCRat.
6. Attackers exploited two patched AhsayCBS flaws, CVE-2026-105133 and CVE-2026-105134, to bypass authentication and run commands. They then deployed a Python backdoor designed to evade sandbox analysis. Huntress observed the activity in early October.
7. Certificate authority eMudhra has revoked eight more intermediate CA certificates after an investigation found that private keys were improperly handled during certificate generation. The revocations follow an earlier certificate security incident at the company.
8. Darktrace-style analysis is not in the source, so this entry instead covers the source's framing: a Dark Reading piece argues that the ability to recover quickly from a disruption is becoming a competitive advantage as AI-driven threats grow. It offers an overview rather than a specific incident.
9. Binance warned users about a public iOS sandbox escape that lets one app read the files of other apps, potentially exposing seed phrases, private keys and login credentials. No attacks have been reported, and Apple has not confirmed a fix.
10. Meta smart glasses were the target of a researcher who bypassed a safeguard meant to block unauthorized software, showing that running custom code on the device is possible, though it was not easy.
11. A post on Falcon Cloud Security innovations from CrowdStrike describes new capabilities aimed at securing the cloud infrastructure that AI workloads run on. The source offers only a teaser, so the specific features are not described here.
12. Italy's Foreign Minister Antonio Tajani said his personal data was sold on the dark web, exposing him and his family to intimidation. Prime Minister Giorgia Meloni blamed pro-Russian hackers, though Tajani did not name the attackers.
13. Arctic Wolf observed attackers using AntiFox, an open-source Chinese-language agentic penetration testing platform, to breach IIS servers and steal AWS credentials. Some intrusions ran through Alibaba Cloud systems hosting AntiFox interfaces.
14. A post titled "How Adversaries Are Turning the Vulnerability Ecosystem Against Defenders" is listed, but the source contains only a link and no text, so its specific claims cannot be summarized here.
15. The US Treasury's FinCEN has designated the Seychelles-based exchange MEXC as a primary money laundering concern, which would bar US financial institutions from processing transfers to and from it. The agency estimates about $16 billion in suspicious transactions between May 2021 and May 2026, including Russian and Iranian sanctions-related activity.
16. Akamai promotes its Functions platform, which runs WebAssembly code at the edge with no cold starts and no idle capacity fees, as a way to reduce latency and cloud costs. It is a vendor product pitch rather than a security incident.
17. PuppyGraph released version 1.0 of its graph query engine with an AI-assisted schema builder and MCP integrations. The update lets AI agents query enterprise data through predefined graph schemas and validates agent-generated queries against those schemas.
18. Fireworks AI disclosed a second breach, with customer data exposure growing. The company blamed a cloud provider and LLMJacking attackers, who abuse stolen credentials to run AI models at the victim's expense.
19. CrowdStrike announced enterprise browser security as part of its Falcon platform, bringing browser protection into the same console as its other endpoint and cloud tools. The source is a brief announcement with little detail.
20. The weekly cyber briefing for November 10 highlights Apple fixing nine pairing flaws and a public iOS sandbox escape that puts crypto wallets at risk. It is a roundup that points readers to the sandbox issue covered elsewhere in this list.
21. Apple issued emergency updates, including iOS 27.2.1 and iPadOS 27.2.1, to fix a privacy flaw affecting group chats in iMessage. The source is brief and does not describe the flaw's technical details.
22. TechRepublic is promoting VPN Unlimited, which encrypts traffic on up to five devices under a strict zero-log policy for three years at $59.99. It is a commercial offer rather than a news event.
23. Sekoia's threat intelligence team analyzed attacks on exposed Danfoss controllers in European supermarkets, which disrupted cold-chain refrigeration systems. Honeypot data links the activity to an Iran-linked unit.
24. Amazon disclosed CVE-2026-100307, a missing authorization flaw in the external management API of mcp-gateway-registry versions 1.0.9 through 1.24.7. An authenticated user could assign themselves the registry administrator scope and gain control over every registered gateway asset.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Japan Airlines Passengers Caught in Amadeus Reservation System Breach
2. Trump taps Palantir security chief to run battered US cyber defense agency
3. N-able takes its remote access service offline after researcher publishes dozens of zero-day bugs
4. AU: Hacker claims to have sold stolen exams to students — but marked them for identification purposes?
5. Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America
6. Trump picks Palantir cybersecurity executive to lead CISA
7. Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor
8. eMudhra revokes 8 more CA certificates after private key mishap
9. AI Raises the Stakes for Cyber Resilience
10. iOS Sandbox Escape Is Public, and Apple Hasn’t Confirmed a Fix
11. Researcher bypassed Meta smart glasses’ safeguards to run her own code
12. New Falcon Cloud Security Innovations Secure the Cloud AI Runs On
13. Italy Minister’s Personal Data Leaked on Dark Web
14. AI Pentest Tool AntiFox Abused To Steal AWS Credentials
15. How Adversaries Are Turning the Vulnerability Ecosystem Against Defenders
16. MEXC Faces US Restrictions Over Alleged Sanctions Evasion and Cybercrime
17. Akamai Functions: The Business Case for Edge Native Serverless
18. PuppyGraph adds AI schema builder and MCP support to help ease enterprise agent adoption
19. Fireworks AI gets burned twice as customer data exposure widens
20. CrowdStrike Brings Enterprise Browser Security to the Falcon Platform
21. CYBER BRIEFING | NOVEMBER 10, 2026
22. Apple iMessage Group Chat Privacy Flaw iOS 27.2.1
23. Secure 5 Work Devices for 3 Years With This $59.99 VPN
24. Cold Chain Attack: Unpatched Danfoss Controllers Exploited
25. CVE-2026-100307 – Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator