Step Security reproduced CVE-2026-123158 on an Alpine VM and container: vulnerable OpenSSH on musl without PAM can accept an overlong password for an eligible passwordless account after a failed attempt. Upgrade to OpenSSH 10.6p2 or patched Alpine packages.
🔗 https://cyber.hendryadrian.com/article/16811/cve-2026-123158-lab-tests-validate-openssh-password-bypass-conditions-on-musl

Analysis of AbeAgent.exe found a signed modular RAT that can clone Chrome and Edge profiles for hidden-browser control and steal browser data, including Chrome cookies via an App-Bound Encryption bypass. Operators sent no commands during sandboxing; delivery is unknown.
🔗 https://cyber.hendryadrian.com/article/16814/analysis-finds-signed-abe-office-rat-built-to-steal-browser-data-via-hidden-browsers

Socket analyzed malicious RubyGem strutil-core 1.0.1, whose install hook runs a worm that steals credentials, spreads across package registries and poisons AI coding tools. Sandbox and code analysis found no confirmed victims or downstream infections.
🔗 https://cyber.hendryadrian.com/article/16813/malicious-rubygem-strutil-core-1-0-1-delivers-credential-stealing-worm

Unit 42 describes reported attacks that set European refrigeration units to defrost, affecting supermarkets and medical facilities. It also found over 5,000 internet-exposed devices from manufacturers named in a CERT-FR advisory; exposure does not establish that devices
🔗 https://cyber.hendryadrian.com/article/16826/unit-42-details-reported-attacks-on-european-refrigeration-systems

Varonis Threat Labs presents NotC2, a proof-of-concept using SQS, Lambda, SNS and Amazon Bedrock for post-compromise AWS command and control, detailing its permissions, cloud-log detection signals and defensive controls.
🔗 https://cyber.hendryadrian.com/article/16847/varonis-demonstrates-notc2-ai-powered-c2-framework-built-on-aws

Censys’ 2026 report estimates about 134,000 internet-exposed ICS hosts globally, up 4% since 2024. It identifies mobile-network hosting, expanded attack surfaces, weak configurations, and network concentration as factors sustaining exposure.
🔗 https://cyber.hendryadrian.com/article/16887/censys-report-finds-persistent-exposure-of-internet-facing-ics

Apiiro found secrets in 1,122 public copies of Claude Code’s settings.local.json. Researchers did not test whether most remain valid; one notified company confirmed its key was live. Git history and forks can retain the files.
🔗 https://cyber.hendryadrian.com/article/16914/apiiro-finds-secrets-in-1-122-public-claude-code-settings-files

A Telegram-based investigation maps Dark Storm Team’s account and channel changes, claimed attacks, DDoS services and group relationships. It cautions that availability checks do not prove attacks and that some affiliations remain unclear.
🔗 https://cyber.hendryadrian.com/article/17037/investigation-traces-dark-storm-team-s-operations-ddos-services-and-alliances

Crédit Mutuel Arkéa says an attacker reached its network through a service provider’s platform and used the bank’s account for fraudulent transfers. ZachXBT estimated losses at $133 million, but the bank did not confirm that figure.
🔗 https://cyber.hendryadrian.com/article/17043/french-bank-reports-service-provider-attack-133m-loss-estimate-unconfirmed

CTM360 says it identified 1,000+ incidents in fake gift-card campaigns impersonating major brands. The portals use deceptive verification loops to drive surveys, app installs and paid subscriptions; CTM360 says no rewards were delivered in tested flows.
🔗 https://cyber.hendryadrian.com/article/17044/ctm360-details-fake-gift-card-scams-that-monetize-users-through-affiliate-offers

Microsoft says Storm-3358 used ARTEX in attacks on financial organizations, combining web application exploitation, web shells, compromised credentials and RATs. The report includes detection guidance, hunting queries and IOCs.
🔗 https://cyber.hendryadrian.com/article/17137/microsoft-reports-storm-3358-using-artex-to-target-financial-organizations

Metasploit Framework 6.5.9 adds exploit modules for unauthenticated RCE in Citrix NetScaler and Cisco Secure Email Gateway, GitLab CI/CD RCE, Flowise account takeover, OpenBullet2 flaws, and LoongArch64 payload support.
🔗 https://cyber.hendryadrian.com/article/17177/metasploit-framework-6-5-9-adds-rce-modules-for-network-devices-gitlab-and-more

Hexastrike reconstructs a Qilin intrusion at a German company, detailing S5PIVOT, a Python-based SOCKS5 backconnect proxy, credential-led access, evidence of cloud exfiltration and encryption, and defensive lessons. The total data transferred remains unknown.
🔗 https://cyber.hendryadrian.com/article/17349/hexastrike-details-s5pivot-proxy-in-qilin-ransomware-intrusion

Brava Security emerged from stealth with a $15 million seed round. The startup says its platform simulates attacker behavior, analyzes security telemetry for gaps, and rewrites SIEM detections.
🔗 https://cyber.hendryadrian.com/article/17459/brava-security-raises-15-million-for-ai-powered-attack-simulation-platform

Iris Ohyama says unauthorized access to a third-party cloud service may have exposed personal information of up to 7.7 million Iris Plaza customers. The company suspended affected services; no misuse or financial loss had been reported as of November 5.
🔗 https://cyber.hendryadrian.com/article/17631/iris-ohyama-says-cloud-intrusion-may-have-exposed-data-of-7-7-million-people

A researcher found South Korea’s NCSC domain still listed two nameservers on expired aegis-k[.]com. The registry referral was fixed, but the agency’s zone still lists them and lacks DNSSEC; the article reports no evidence of abuse.
🔗 https://cyber.hendryadrian.com/article/17698/expired-nameserver-domain-exposed-south-korea-s-cyber-agency-to-dns-hijacking-risk

Apiiro found 2,539 secrets across 1,994 public repositories containing Claude Code settings files, including historical commits and forks. It did not test whether the credentials worked; one contacted organization confirmed its key was live.
🔗 https://cyber.hendryadrian.com/article/17697/apiiro-finds-2-539-secrets-in-public-repositories-containing-claude-code-settings