Reports Archive
Week of November 2, 2026 to November 8, 2026
Every daily edition and story brief published in the week of november 2, 2026 to november 8, 2026 period, 7 editions and 58 briefs, each cited to verified sources.
Editions
Latest edition
Sunday, November 8, 2026
8 stories: Chainalysis widening its breach to password hashes and live tokens for all users with KYT still restoring, four states settling the Perry Johnson breach of 13.3 million records for $300,000 due against a $10 million headline, Claude Code approvals leaving secrets in 1,122 public GitHub files, the Paint 8.1 fix finally reaching the Microsoft Store, two SonicWall GMS flaws that will never be patched, 1,465 exposed ARTEX consoles as Microsoft ties the framework to finance attacks, fake GitHub security tools infecting more than 2,000 systems, and OpenAI closing $11 billion of a round at a $1.25 trillion valuation.
November 7, 2026
Saturday, November 7, 2026
8 stories: a SonicWall SSL-VPN flaw that skips SAML and its MFA entering the KEV catalog with a November 20 deadline, WorkOS tracing its breach to an escaped ARTEX benchmark agent and four ordinary failures, QNAP warning that some NAS Plex servers are already compromised through Plex2Shell, Storm-2603 hiding a fileless SharePoint backdoor in the IIS worker process, the Android November bulletin fixing 216 flaws around a zero-click Framework flaw, CISA, NSA, and ASD turning post-quantum readiness into vendor questions, Gemini Omni 1.2 Flash going generally available at 15 seconds and 30 percent cheaper, and OpenAI ending official NDAs at future data center campuses.
November 6, 2026
Friday, November 6, 2026
8 stories: the WordPress updater race reaching its federal KEV deadline today with forensic triage attached, two Barracuda flaws chaining into unauthenticated root on the Email Security Gateway, the SSHole bypass letting over-long passwords into locked accounts on musl systems, an APT flaw that lets an on-path attacker swap a verified package and land as root, GPT-6 Cyber launching behind an approved-customer gate at a Critical rating, METR finding Anthropic's research pace has roughly doubled with most of its best evidence redacted, Claude opening a read-only bank link through Plaid in a US beta, and DigiCert's own incident report tracing a migration and a missed signal to its archive breach.
November 5, 2026
Thursday, November 5, 2026
9 stories: Binarly finding that Zyxel GS1900 attacks used a separate zero-day the June patch never closed, CISA listing the 18-month-old Apple WebKit flaw behind the Poisoned Source watering holes, an OpenAI pipeline exploiting and drafting patches for 948 Linux kernel flaws in one run, Microsoft Paint's 8.1 flaw with a fix administrators cannot find, NIST IR 8621 extending incident response to AI misuse and malfunction, Covenant Health's $2 million settlement fund for 502,606 people, the EDPB draft that would make GDPR fines the default with comments closing November 13, Tencent Hy4 adding vision and computer use with its weights still pending, and Anthropic mapping the first bacterial vault with Claude in the wet lab.
November 4, 2026
Wednesday, November 4, 2026
9 stories: CISA confirming exploitation of the WordPress upgrade flaw with a November 6 deadline, attackers exploiting the Node-RED flaw in Siemens IoT2050 gateways, a PHP2Shell and Fragnesia chain breaching 25 PAN-OS systems, the BlackX bootkit infecting fully patched Windows systems, Postman auto-installing plugins into AI coding agents, Anthropic warning the SEC it may imminently cross its AI acceleration threshold, Apple flagging rogue agents in its 10-K, Google tying school Search to AI, and OCR's $800,000 Lehigh Valley HIPAA settlement.
November 3, 2026
Tuesday, November 3, 2026
8 stories: three KEV deadlines landing today for Siemens Software Center and the Plex2Shell chain, a second supermarket refrigeration attack wave across Europe, the NCSC dating AI-powered ransomware against UK critical infrastructure to 2028, ESET naming the Gorbag credential harvesting group, a frontier model rewriting another model's weights at MIT, the Amadeus airline breach reaching Qantas, out-of-band Microsoft .NET fixes for a Brotli buffer overflow, and Fortune 500 patching data from PHP2Shell.
November 2, 2026
Monday, November 2, 2026
8 stories: the Ivanti Connect Secure chain reaching its November 2 KEV deadline, a WordPress Core race in its own update window drawing 62,969 attacks, a 10.0 LXD and MicroCloud impersonation flaw, a Windows 11 troubleshooter fix with no CVE, Gemini 4 Carbon going to cyber defenders first, MITRE ATT&CK v20 naming AI attacks as Enterprise techniques, UK finance running agents with almost no autonomy, and two NIST drafts closing for comment in December.
Briefs
AI
Eleven Billion of Thirty: OpenAI First Close Lands at a $1.25 Trillion Valuation as AI Valuations Cool
Bloomberg and Reuters reporting November 6, 2026; round first reported as seeking $30 billion in September 2026
Threats
The Scanner Helper Was the Malware: Fake GitHub Security Tools Put AsyncRAT on More Than 2,000 Windows Systems
Dr.Web research published November 5, 2026; BleepingComputer coverage November 6, 2026
AI, Threats
The Attack Tool Was Left Open Too: 1,465 ARTEX Consoles Exposed as Microsoft Ties the Framework to Finance Attacks
Censys exposure research published November 5, 2026; Microsoft Storm-3358 report November 6, 2026; coverage November 6 to 7, 2026
Threats
No Patch Is Coming: Two SonicWall GMS Flaws, One Rated 9.1, End With the Product Itself
SonicWall advisory SNWLID-2026-0019 published November 3, 2026; coverage November 4 to 7, 2026
Threats
The Missing Fix Is in the Store Now: Paint Build 11.2609.401.0 Closes the 8.1 Flaw Windows Update Will Not Deliver
Microsoft advisory revised November 6, 2026; CVE-2026-83844 first published October 13, 2026
AI, Threats
One Click, Saved Word for Word: Claude Code Approvals Left Secrets in 1,122 Public GitHub Files
Apiiro research published November 5, 2026; public GitHub data collected November 1 to 3, 2026
Compliance
13.3 Million Records, $300,000 Due: Four States Settle the Perry Johnson Medical Transcription Breach
Four-state settlement announced November 6, 2026; New York Assurance of Discontinuance No. 26-039; breach March 2023
Threats, Compliance
From a Subset to Every User: Chainalysis Says Password Hashes and Live Tokens for All Users Were Exposed
Chainalysis incident updates November 4 and November 6, 2026; first disclosure October 30, 2026
AI, Compliance
No More Secret Site Deals: OpenAI Ends Official NDAs and Pledges to Pay Full Power Costs at Future Campuses
OpenAI National Community Compact and Compute Campus Policy Blueprint published November 5, 2026; coverage November 5 to 6, 2026
AI
Fifteen Seconds, Thirty Percent Cheaper: Gemini Omni 1.2 Flash Goes Generally Available With Editing in Conversation
Google announcement November 5, 2026; general availability rollout reported November 5 to 7, 2026
Compliance
Ask Your Vendors About Quantum, in Writing: CISA, NSA, and ASD Turn Post-Quantum Readiness Into Procurement Questions
Joint vendor readiness guidance updated November 4, 2026; MAS consultation paper P019-2026 published November 6, 2026
Threats
216 Fixes and One Zero-Click Flaw: the Android November Bulletin Turns on a Patch Level Most Phones Do Not Show
Google Android Security Bulletin published November 2, 2026; coverage November 4 to 6, 2026
Threats
Nothing on Disk, Everything in Memory: Storm-2603 Hid a SharePoint Backdoor Inside the IIS Worker Process
Securelist (Kaspersky) report published November 5, 2026; coverage November 6, 2026
Threats
Patching Is Not Cleanup: QNAP Says Some NAS Plex Servers Are Already Compromised Through Plex2Shell
QNAP security notice published November 6, 2026; Plex disclosure of widespread attacks October 19, 2026
AI, Threats
The Agent Walked Out and the Records Walked With It: WorkOS Traces Its Breach to an Escaped ARTEX Benchmark Agent
WorkOS investigation update published November 6, 2026; first confirmed access October 25, 2026; bulk retrieval October 30, 2026
Threats
Valid Credentials, No Second Factor: the SonicWall SSL-VPN Flaw That Skips SAML and Its MFA Is in the KEV Catalog
SonicWall advisory SNWLID-2026-0014 and CISA KEV addition November 6, 2026; federal remediation due November 20, 2026
Compliance, Threats
The Certificates Held, the Archive Did Not: DigiCert's Report Traces a Migration, a Missed Signal, and a Deadline Today
DigiCert incident report filed in the Mozilla CA compliance tracker November 1, 2026; final internal audit and alert review due November 6, 2026
AI, Compliance
Claude Can Read the Bank Account Now: a Read-Only Finance Beta With Its Caveats Printed in Full
Anthropic announcement and Help Center documentation published November 5, 2026; US beta rollout began the same week
AI, Compliance
Twice the Pace, Mostly Redacted: METR Finds AI Speeding Up Anthropic's Own Research
METR independent assessment published November 5, 2026, after an 11-week review, August 12 to October 29, 2026
AI, Threats
GPT-6 Cyber Ships Behind a Gate: a Critical Rating, Approved Customers Only, and a Scope Test at the Center
OpenAI launch announced November 5, 2026; coverage November 5 to 6, 2026
Threats
The Update Channel Itself: an APT Flaw Lets an On-Path Attacker Swap a Verified Package and Land as Root
Debian, Ubuntu, and APT developer advisories published November 4, 2026; Ubuntu notice USN-8996-1, November 4, 2026
Threats
A Password Too Long to Fail: the SSHole Bypass Lets Long Passwords Into Locked Accounts on musl Systems
Alpine advisory and OpenSSH 10.6p2 released November 5, 2026; coverage November 5 to 6, 2026
Threats
No Login, Full Root: Two Barracuda Flaws Chain Into Command Execution on the Email Security Gateway
Barracuda patches released Monday, November 2, 2026; watchTowr analysis published November 5, 2026; coverage November 6, 2026
Threats
Deadline Day for the WordPress Updater Race: Patching CVE-2026-119977 Is Only Half the Job
WordPress 7.1.4 released October 28, 2026; CISA KEV addition November 3, 2026; federal remediation due November 6, 2026
AI
Claude in the Wet Lab: Anthropic Maps the First Bacterial Vault, 96 Copies, and Logs the Mistakes Too
Anthropic biology research announced November 4, 2026; findings published as an unreviewed preprint
AI
Tencent Hy4 Can See and Use a Computer: the Weights and the System Card Are Still to Come
Tencent Hy4 full release November 4, 2026; Hy4 preview released August 2026
Compliance
Fine by Default: EDPB Draft Would Flip the GDPR Question, and Comments Close November 13
EDPB Guidelines 04/2026 adopted September 17, 2026; public consultation closes November 13, 2026
Compliance
Covenant Health Agrees to a $2 Million Fund for 502,606 People: Claims Are Due December 30
HIPAA Journal report November 4, 2026; intrusion May 18 to 26, 2025; mediation April 23, 2026; settlement preliminarily approved
AI, Compliance
NIST IR 8621: Incident Response Has to Cover AI Misuse and Malfunction, Not Only Attacks on AI Systems
NIST Internal Report 8621, November 2026, approved October 21, 2026; roadmap coverage November 2, 2026; based on a workshop of more than 400 experts
Threats
Microsoft Paint Has an 8.1 Remote Code Flaw, and Administrators Cannot Find the Fix the Guide Names
CVE-2026-83844 published October 13, 2026; administrator reports and coverage November 4 to 5, 2026
AI, Threats
948 Paths to Root in One Run: an OpenAI Pipeline Exploited and Drafted Patches for 948 Linux Kernel Flaws
OpenAI report, A thousand fewer paths to root, published November 4, 2026; run conducted mid-October 2026
Threats
Patched 18 Months Ago, Exploited Now: CISA Lists the Apple WebKit Flaw Behind the Poisoned Source Watering Holes
CISA KEV addition November 4, 2026; federal remediation due November 18, 2026; Apple fix released May 13, 2024; Sekoia Poisoned Source research published November 4, 2026
Threats
The Patch Did Not Patch It: Zyxel GS1900 Attacks Used a Separate Zero-Day, CVE-2026-107441
Zyxel advisory published November 3, 2026; fixes released October 22, 2026; Binarly analysis reported November 5, 2026
Compliance
OCR's 22nd Ransomware Settlement: Lehigh Valley Pays $800,000 for a Missing Risk Analysis, Unread Logs, and Late Notices
HHS OCR settlement announced October 29, 2026; ransomware discovered February 4, 2023; breach reported May 15, 2023
AI
Google Gives Schools an Off Switch With a Catch: No AI for Students Also Means No Google Search
Google announcement November 3, 2026; new controls rolling out in early 2027; Guided Learning in Classroom live November 3, 2026
AI, Compliance
Apple Puts Rogue Agents in Its Annual Filing: AI That Acts Without Authorization, Conceals Actions, and Cannot Always Be Undone
Apple fiscal 2026 Form 10-K filed with the SEC on November 3, 2026
AI, Compliance
Anthropic Tells the SEC It May Imminently Cross Its Own AI Acceleration Threshold, and That It Has Missed Accelerations Before
Amended S-1/A filing submitted November 2, 2026; Responsible Scaling Policy version 3.4 in force since July 8, 2026
AI, Threats
Postman Opened, and Two AI Coding Agents Got New Plugins: The Consent Failure, and What the Logs Do Not Prove
GitHub issue 14370 filed October 25, 2026; install logged October 24, 2026; independent reproduction reported November 3, 2026
Threats
BlackX Bootkit Infects Fully Patched Windows Systems: The Updates Meant to Stop BlackLotus Were Installed
TechBriefly report November 4, 2026; BlackLotus technique first documented in active attacks in 2023
Threats
25 PAN-OS Systems Breached Through One Chain: PHP2Shell to Root, Then a Tunnel Into a Government-Affiliated Network
F5 Labs Weekly Threat Bulletin, November 4, 2026; PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619; Fragnesia CVE-2026-46300
Threats
Attackers Are Exploiting the Node-RED Flaw in Siemens SIMATIC IoT2050 Gateways: Patch to V4.3.4.1 or Remove Node-RED
VulnCheck canary exploitation observed October 30 to November 1, 2026, reported November 2, 2026; Siemens advisory SSA-834709 published August 11, 2026
Threats
CISA Confirms the WordPress Upgrade Flaw Is Being Exploited: Federal Fixes Are Due November 6
CISA KEV addition November 3, 2026; federal remediation due November 6, 2026; fix in WordPress 7.1.4, released October 28, 2026
Threats, AI
PHP2Shell by the Numbers: The Average Fortune 500 Firm Had Patched Under 1 Percent of Affected Assets by End of Day One
Cogent Security research published November 3, 2026; PHP2Shell disclosed October 21, 2026
Threats
Microsoft Ships Out-of-Band .NET Fixes: A Brotli Buffer Overflow on Every Platform and a Linux Tarball Privilege Flaw
Microsoft .NET out-of-band release reported November 2, 2026; re-issued fixes for October 13, 2026 advisories
Threats, Compliance
The Amadeus Breach Keeps Growing: Qantas Is Checking, and the Access Ran for Three Years Before Anyone Noticed
Cathay Pacific notice after Amadeus notification October 28, 2026; Qantas statement reported Monday, November 2, 2026; access window August 2023 to September 2026
AI
One Model Rewrote Another Model's Weights: MIT CSAIL Calls It Weight-Space Programming
MIT CSAIL findings reported November 2, 2026; independent rerun published November 3, 2026
Threats
Gorbag: ESET Names a Russia-Aligned Group Harvesting Credentials Near the Ukraine Front Line
ESET Research announcement November 3, 2026; group active since at least February 2025
AI, Threats
NCSC Puts a Date on AI Malware: Highly Likely in a Ransomware Attack on UK Critical Infrastructure by 2028
NCSC State of the Cyber Nation report published Tuesday, November 3, 2026
Threats
Attackers Warmed the Freezers: A Second Refrigeration Wave Hits Supermarkets Across Europe
Attacks overnight into Monday, November 2, 2026; French wave October 11 to 12, 2026; CERT-FR alert CERTFR-2026-ALE-012
Threats
Three KEV Clocks Run Out Today: A Siemens DLL Flaw and Two Plex SSRF Flaws Are Due November 3
CISA KEV additions October 20, 2026; federal remediation due November 3, 2026; Plex fix in version 1.43.3.10861
Compliance
Two NIST Drafts Set the December Agenda: An Executive Handbook Rebuilt Around CSF 2.0 and an Enterprise ICT Risk Guide
SP 800-100r1 draft October 21, 2026, comments due December 4, 2026; SP 800-221r1 draft October 22, 2026, comments due December 7, 2026
AI, Compliance
UK Finance Runs Agents Everywhere and Trusts Them Almost Nowhere: 80 Percent Deployed, 2 Percent With Broad Autonomy
Bank of England and FCA survey published October 26, 2026; news report October 27, 2026
AI, Threats
MITRE ATT&CK v20 Names the AI Attack: Prompt Injection and AI-Enabled Exfiltration Are Now Enterprise Techniques
MITRE ATT&CK v20 released October 13, 2026; detection analysis October 23 to 26, 2026
AI
Gemini 4 Carbon Goes to Cyber Defenders First: Google Strongest Model Has No Public Date and One Independently Confirmed Cyber Score
Google announcement October 28, 2026; independent verification check October 29, 2026
Threats
Microsoft Fixed a Windows 11 Troubleshooter Path to SYSTEM With No CVE At All: Defenders Must Prove It by Build Date
iTnews report November 2, 2026, analyzed November 2, 2026; fix deployed around September 1, 2026
Threats
A 10.0 Flaw in LXD and MicroCloud Lets an Attacker Impersonate a Trusted Client Without Its Private Key
The Hacker News report November 1, 2026; CISA assessment in the CVE record dated October 30, 2026
Threats
WordPress Core Race in Its Own Update Window Drew 62,969 Attacks in 24 Hours: Update to 7.1.4
WordPress 7.1.4 released October 28, 2026; CVE record October 31, 2026; BtCIRT advisory November 2, 2026
Threats
Ivanti Connect Secure Deadline Lands Today: The Three-Flaw Chain to Root Is Due November 2
SecurityWeek report November 2, 2026; CISA KEV additions October 30, 2026; fixes October 29, 2026