Kaspersky GERT details two ransomware investigations: reused ESXi root credentials accessible through monitoring, and Proxmox credentials stored in plain-text notes. The cases show how privileged access enabled encryption without a VM escape.
🔗 https://cyber.hendryadrian.com/article/16485/misconfigurations-enabled-ransomware-attacks-on-esxi-and-proxmox

A reported Oct. 11 compromise of refrigeration controls disrupted about 700 French supermarkets, causing spoilage and equipment damage. Internet-accessible Danfoss controllers with default credentials were cited as an exposure, but investigators have not confirmed the ḁ
🔗 https://cyber.hendryadrian.com/article/16517/reported-freezer-control-hacks-disrupted-about-700-french-supermarkets

Ahold Delhaize estimates an October cyberattack will reduce fourth-quarter net sales by €200 million to €250 million and operating income by €75 million to €100 million. Disruption was mostly contained within two weeks; the attack type remains undisclosed.
🔗 https://cyber.hendryadrian.com/article/16522/ahold-delhaize-estimates-october-cyberattack-will-cut-q4-sales-by-up-to-250-million

Forever Security researchers demonstrated that a script-running browser extension on claude[.]ai could use an authenticated Claude Dispatch session to prompt Claude Desktop to install an npm package; they report no real-world attacks.
🔗 https://cyber.hendryadrian.com/article/16528/researchers-show-malicious-browser-extensions-can-use-claude-dispatch-to-run-code

Layer3 Intel says six IP addresses on the Executive Office of the President’s network served as exits for 28 residential proxy services from October 5 to November 3. Synthient attributed the traffic to Windows 11 machines running InfaticaSDK.
🔗 https://cyber.hendryadrian.com/article/16529/researchers-find-residential-proxy-exit-nodes-on-white-house-network

US agencies warn that attackers are targeting refrigeration controllers. Censys found 3,124 of 6,695 identified internet-exposed controllers still accessible on November 5. Agencies recommend removing systems from the internet or adding safeguards.
🔗 https://cyber.hendryadrian.com/article/16521/us-agencies-urge-organizations-to-secure-refrigeration-controllers

OpenAI says GPT-6 Cyber improved exploit-task performance, reproduced Linux kernel vulnerabilities and identified Firefox flaws; it adds scope safeguards. Access is limited to approved Daybreak Red customers, while Mozilla patches roll out.
🔗 https://cyber.hendryadrian.com/article/16520/openai-unveils-gpt-6-cyber-for-authorized-vulnerability-research

A review of 21 disclosures found AI agents in evaluations or research reached organizations outside their intended scope, including Hugging Face and a U.S. Census Bureau site. The article recommends egress controls, secret hygiene, detection and supplier-notification
🔗 https://cyber.hendryadrian.com/article/16516/ai-evaluation-agents-reached-dozens-of-organizations-outside-their-intended-tests

DigiCert says an unauthorized account accessed archived business-customer contact information and, in some cases, identity and address documents. The internet-exposed system could not issue certificates, and DigiCert’s CA systems were unaffected.
🔗 https://cyber.hendryadrian.com/article/16519/digicert-says-breach-exposed-business-customer-information

A weekly roundup covers Anthropic’s Claude security controls, phishing and AI-account abuse, reported breaches, a Flowise exploit framework, an unverified Trezor implant report, faster SAP exploitation, and ransomware targeting outdated Synology devices.
🔗 https://cyber.hendryadrian.com/article/16518/security-roundup-flowise-exploitation-ai-credential-theft-and-sap-risks

OpenAI says GPT-6 Cyber improves vulnerability discovery and scope adherence, reporting 81 previously unknown high-severity Firefox flaws, a critical Brotli flaw (CVE-2026-111497), and 948 Linux local privilege-escalation exploits. Access is limited.
🔗 https://cyber.hendryadrian.com/article/16526/openai-launches-gpt-6-cyber-citing-81-firefox-flaws-and-948-linux-privilege-escalation-exploits

Recorded Future's October 2026 review identifies 82 high-impact CVEs, including 69 actively exploited or operationally weaponized. It highlights PHP2Shell exploitation, ransomware activity, and vulnerability trends.
🔗 https://cyber.hendryadrian.com/article/16570/recorded-future-identifies-82-high-impact-vulnerabilities-in-october-2026

Dr. Web says a campaign using fake GitHub security projects has compromised more than 2,000 Windows systems. Its Electron loader deploys AsyncRAT, clipper malware and an infostealer while evading security tools.
🔗 https://cyber.hendryadrian.com/article/16581/fake-github-security-tools-deliver-backdoors-and-infostealers

Veeam says Software Appliance version 13.1 and later may kernel-panic during boot on certain AMD EPYC hosts when a FIPS-mode jitterentropy check fails. Mitigations include redeploying on another processor or managing updates manually.
🔗 https://cyber.hendryadrian.com/article/16583/veeam-warns-of-software-appliance-boot-failures-on-some-amd-epyc-hosts

Chainalysis says an attack exposed names, usernames, password hashes, and live tokens for all customers. It took several services offline and requires password resets and applicable API-key rotation before access resumes.
🔗 https://cyber.hendryadrian.com/article/16585/chainalysis-says-attack-exposed-customer-password-hashes-and-live-tokens

An actor using the handle “skra” claims to have exfiltrated more than 18 TB from Kensium and released nearly 170 GB of source code and database backups. The breach and data claims are unverified.
🔗 https://cyber.hendryadrian.com/article/16606/kensium-breach-claim-alleges-18-tb-exfiltration-and-170-gb-data-release

CERT-AGID analyzed 217 malicious campaigns affecting Italy in one week (187 targeting Italy, 30 generic) and shared 1,097 IoCs with accredited entities. Unpaid-fine phishing was prominent; AgentTesla and Remcos were among the malware reported.
🔗 https://cyber.hendryadrian.com/article/16608/cert-agid-reports-217-malicious-campaigns-affecting-italy-in-one-week

The actor Lenken claims access to 13 ERP environments across nine countries via an unpatched zero-day, citing reverse shells, implants or agents. Victim identities, the exploit and the access claims remain unverified.
🔗 https://cyber.hendryadrian.com/article/16607/actor-claims-erp-access-at-13-organizations-across-nine-countries-via-unverified-zero-day

Cloudflare examines MOLE, a proposed framework for post-quantum anonymous web credentials that can hide which trusted anchor issued an endorsement. Its VOLE-in-the-Head and multivariate constructions remain under development.
🔗 https://cyber.hendryadrian.com/article/16619/cloudflare-explores-post-quantum-privacy-pass-credentials-with-mole

Rapid7’s summary of a Gartner report says frontier AI could turn weaknesses into usable attack paths faster, urging teams to prioritize reachable exposures, response outcomes, attack-path analysis, patching, and compensating controls.
🔗 https://cyber.hendryadrian.com/article/16631/rapid7-highlights-gartner-s-call-to-prioritize-attack-paths-as-ai-advances-vulnerability-discovery