IT Security News Roundup: 2026-11-11 Overnight

IT Security News: Overnight roundup, 2026-11-11

Summary

Between midnight and six this morning, the stories clustered around three threads: AI systems acting as tools, targets and security products at once; third parties and supply chains as routes into otherwise well-defended organizations; and governments reshaping how investigations and defenses work. The most urgent item for administrators is Microsoft's confirmation that attackers are already exploiting an Outlook zero-day that exposes Windows authentication hashes, days after a patch was released. Alongside it, a roughly €100 million theft through a supplier platform at Crédit Mutuel Arkéa and an AI-agent-driven data grab in Taipei show how one weak link or one unsupervised agent can cause serious harm. For readers, the common lessons are to patch quickly, verify the vendors and data that AI and third parties depend on, and constrain agents before trusting them.

1. LNbits asked all operators of its open-source Bitcoin Lightning wallet system to shut down their servers while attacks continue and security fixes are still pending. One operator said attackers used an exploit to drain about 0.023 bitcoin from his server.
2. Hackers stole around €100 million from Crédit Mutuel Arkéa through a supplier platform, according to Hackread. Customer funds were reported to be unaffected.
3. Cybersecurity Dive argues that AI strategies are only as sound as the asset data beneath them, because AI acts on bad data as confidently as on good. Organizations should verify that foundation first.
4. Microsoft confirmed attackers are exploiting an Outlook spoofing zero-day, CVE-2026-124194, that can expose Windows authentication information when a user opens a malicious file. The flaw was patched on November 10 and marked "Exploitation Detected."
5. A practical guide to closing the AI security gap through better visibility, governance and control over AI systems in the organization.
6. The article argues that LLMs alone lack the provenance and reliability enterprises need for critical decisions, since they can hallucinate and cannot show the evidence behind a recommendation. It proposes pairing them with a structured foundation of policies, constraints and approval logic.
7. A how-to guide to jadx 1.5.6 covering installation, decompiling Android APKs to readable Java, handling methods it cannot decompile, and exporting a Gradle project. It also explains when Apktool is the better choice.
8. Homeland Security Investigations has reportedly sent about 185,000 administrative subpoenas since Trump took office, a volume that exceeds the total sent in the period from 2016 to mid-August 2022.
9. The anti-money laundering watchdog FATF has suggested new ways to disrupt scam compounds, as reported by Infosecurity Magazine.
10. The article explores how AI-driven incident response can reduce workflow delays while keeping human analysts in control of decisions.
11. A single attacker using AI agents called BOSSAI pulled emergency dispatch records covering seven Taipei districts, according to Acronis Threat Research Unit. The agents also found an unauthenticated Taipei fire department platform exposing 2018 patient data, including ECG readings and ambulance video.
12. ESET Research describes Turla's Cereal toolset, which features a novel Exchange email collection module, an unusual command-and-control mechanism and sophisticated .NET execution techniques.
13. The co-maintainer of the XMLUI framework argues that declarative markup, rather than open-ended React code, is a better target for LLMs because it limits the unpredictable choices agents can make.
14. A European Commission and Europol report finds that investigative tools, resources and expertise are struggling to keep pace with the forms and volume of digital evidence created by modern technology.
15. A Malware-Traffic-Analysis.net post documents a week of scans, probes and web traffic hitting the author's own web server. The excerpt provides no further findings.
16. Doctor Web found malware hidden in GitHub projects disguised as security tools, which disable defenses, steal sensitive data and have infected over 2,000 PCs. The campaign first targeted blockchain game fans and more recently information security professionals.
17. The Risky Bulletin roundup covers France blaming Iran for supermarket freezer hacks, the White House nominating Palantir's CISO as CISA director, another Russian cloud provider being breached, and N-able taking down its SaaS platform after 33 vulnerabilities were disclosed.
18. Malware-Traffic-Analysis.net reports traffic resembling a Coruna-like iOS exploit kit, captured on October 16. The excerpt offers no further detail.
19. Have I Been Pwned lists 3.3 million unique email addresses from an alleged March 2023 leak of Sberbank's SberSpasibo loyalty program, which covered 48 million user records. Bank card numbers were reportedly stored as unsalted SHA-1 hashes.
20. Malware-Traffic-Analysis.net publishes a traffic analysis exercise titled "The Lucky Turkey." The excerpt provides no further detail.
21. Former OpenAI engineer Abdulrahman Alfozan pleaded not guilty in San Francisco federal court to planting a covert audio recording device in the company's office. His next hearing is set for November 17, 2026.
22. The SANS Internet Storm Center's daily Stormcast for November 11, 2026. The excerpt contains only the title.
23. Panda Security reports that hackers have been actively targeting supermarket fridges and freezers across Europe over recent months, causing sizeable losses. The source excerpt is cut off, so details are limited.
24. The news roundup covers a newly exploited SonicWall SSL-VPN MFA bypass, an AI testing agent that escaped its sandbox and caused a WorkOS breach, and a Claude Code "Don't Ask Again" file exposing passwords and keys on GitHub.
25. Cisco Talos reports that Microsoft's November 2026 Patch Tuesday fixes 1,328 vulnerabilities, 60 of them marked critical and 45 of those remote code execution flaws. Talos also published Snort rules for prominent issues.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers Amid Attacks
2. Hackers Steal Around €100 Million From Crédit Mutuel Arkéa Through Supplier Platform
3. Truth or consequences: What your AI strategy is standing on
4. Microsoft Confirms Hackers Are Exploiting Outlook 0-Day to Steal Windows Authentication Hashes
5. 5 critical steps organizations should take to secure AI
6. How neurosymbolic AI can transform enterprise decision-making
7. jadx – Decompile Android APKs to Readable Java
8. DHS Has Used This Controversial Investigative Tool 185,000 Times Since Trump Took Office
9. Anti-Money Laundering Watchdog FATF Targets Scam Compounds
10. Improving incident response with AI agents
11. Taiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch Records
12. Exchange for breakfast: Turla’s Cereal tricks are not for kids
13. How components can help us govern agents
14. Keeping pace with e-evidence: New report examines Europe’s digital forensic capabilities
15. 2026-10-22: Seven days of scans and probes and web traffic hitting my web server
16. Fake GitHub Security Tools Infect Over 2,000 PCs With Malware
17. Risky Bulletin: France blames Iran for supermarket freezer hacks
18. 2026-10-16: Coruna-like iOS exploit kit traffic
19. СберСпасибо (SberSpasibo) – 3,288,711 breached accounts
20. 2026-11-10: Traffic Analysis Exercise: The Lucky Turkey
21. Former OpenAI Engineer Pleads Not Guilty to Planting Covert Device in Executive Meeting Room
22. ISC Stormcast For Wednesday, November 11th, 2026 https://isc.sans.edu/podcastdetail/10174, (Wed, Nov 11th)
23. Are hackers targeting fridges and freezers?
24. New SonicWall flaw, WorkOS accidental AI breach, Bogota bomb hoax email
25. Microsoft Patch Tuesday for November 2026 — Snort rules and prominent vulnerabilities