Nitori says an attacker accessed its network from mid-October until November 6, 2026, and may have exposed up to 37.62 million customer records. Passwords and credit card information were not exposed, the company says.
🔗 https://cyber.hendryadrian.com/article/18794/nitori-says-hackers-may-have-exposed-37-62-million-customer-records

KB5131096 brings November 2026 security fixes and bug fixes to eligible Windows 10 systems, including stricter PowerShell script-signature validation. The fixes address 1,235 vulnerabilities across Microsoft products, including an actively exploited Outlook zero-day.
🔗 https://cyber.hendryadrian.com/article/18795/microsoft-releases-windows-10-kb5131096-extended-security-update

Wiz reports an attacker used compromised Qubole IAM credentials to access dozens of customers’ AWS environments and download S3 data. Sentra confirmed millions of files stolen from one customer; the initial compromise method and total victim count remain unspecified.
🔗 https://cyber.hendryadrian.com/article/18796/compromised-qubole-aws-credentials-used-to-access-customer-environments

Microsoft’s November 2026 updates address 1,235 flaws, including an actively exploited Outlook zero-day that can expose NTLM authentication hashes when a user opens a specially crafted message file.
🔗 https://cyber.hendryadrian.com/article/18797/microsoft-s-november-2026-patch-tuesday-fixes-1-235-flaws-including-exploited-outlook-zero-day

Microsoft's November 2026 Windows 11 updates address hundreds of vulnerabilities and bugs. They also expand memory integrity protection on eligible devices and introduce Cloud rebuild, among other changes.
🔗 https://cyber.hendryadrian.com/article/18798/microsoft-releases-november-2026-windows-11-patch-tuesday-updates

Microsoft’s November update lists 1,094 CVEs. One flaw, an Outlook spoofing vulnerability, was under active attack; none were publicly known before release. The article also highlights severe Windows Search and LDAP flaws.
🔗 https://cyber.hendryadrian.com/article/18800/microsoft-patches-1-094-vulnerabilities-in-november-2026-update

Vanderbilt University is responding to a ransomware incident claimed by BYOD; the group says it obtained more than 1 million Social Security numbers. Some university services were restored, while others remained restricted.
🔗 https://cyber.hendryadrian.com/article/18801/vanderbilt-responds-to-ransomware-attack-claimed-by-byod

France attributed October attacks on supermarket refrigeration systems and small hydroelectric equipment to an IRGC-linked unit. C4 cited reconnaissance, shared infrastructure and other technical evidence; French authorities are investigating.
🔗 https://cyber.hendryadrian.com/article/18802/france-attributes-supermarket-cyberattacks-to-iran-linked-unit

ENISA’s biennial report finds the EU’s cybersecurity posture has improved, but threats remain substantial and capabilities uneven. It recommends stronger cross-border coordination, crisis capacity, critical-infrastructure resilience, supply-chain risk management and upk
🔗 https://cyber.hendryadrian.com/article/18807/enisa-report-finds-eu-cybersecurity-posture-improving-amid-persistent-threats

CYFIRMA’s May–October 2026 review assesses identity theft, infostealers, cloud extortion and AI-enabled fraud as key ANZ finance risks. It records four ransomware listings; underground claims remain unverified, and confirmed Australian exploitation names no finance-vict
🔗 https://cyber.hendryadrian.com/article/18809/cyfirma-maps-may-october-2026-cyber-threats-to-anz-financial-sector

An analysis of Earth Sirrush indicators found 283 email-connected domains, six domains likely registered maliciously, and 95 potential victim IPs communicating with 11 IP indicators. The article cautions that some flagged entities may prove harmless.
🔗 https://cyber.hendryadrian.com/article/18822/earth-sirrush-ioc-analysis-finds-283-email-linked-domains-and-95-potential-victim-ips

Microsoft addressed 1,093 vulnerabilities, including 63 critical flaws and an actively exploited Outlook spoofing zero-day (CVE-2026-124194). The roundup highlights priority Exchange, SharePoint, Outlook, Windows Search and LDAP flaws and urges prompt patching.
🔗 https://cyber.hendryadrian.com/article/18828/microsoft-s-november-patch-tuesday-addresses-1-093-vulnerabilities-including-an-actively-exploited-z

Multiple threat actors have repurposed the open-source AI penetration-testing framework Artex. Reported campaigns include credential attacks and downstream cloud compromises; its creator removed the original repository, but forks remain.
🔗 https://cyber.hendryadrian.com/article/18829/threat-actors-repurpose-ai-pen-testing-tool-artex-for-automated-attacks

F-Secure’s AI Harms Taxonomy maps 26 consumer harms across five relationship types and 19 intermediary layers, with 24 defenses. It highlights hidden malicious instructions and the shared responsibility of device, AI and service providers.
🔗 https://cyber.hendryadrian.com/article/18830/f-secure-maps-26-ai-related-consumer-harms-and-where-to-defend-against-them

Checkmarx appointed Kobi Sivilya as CISO and CIO, overseeing corporate security, IT and business applications. He previously held security and IT leadership roles at Outbrain and Fireblocks.
🔗 https://cyber.hendryadrian.com/article/18831/checkmarx-names-kobi-sivilya-ciso-and-cio

Cloud Range announced a free 28-question assessment to help organizations identify OT incident-response readiness gaps across seven areas, including asset visibility, IT/OT coordination, response, recovery, and validation.
🔗 https://cyber.hendryadrian.com/article/18832/cloud-range-launches-28-question-ot-cyber-readiness-assessment

Apiiro found 2,539 credentials across nearly 2,000 public GitHub repositories and linked some exposures to Claude Code saving approved commands with secrets in a project settings file. Anthropic says it is exploring safeguards.
🔗 https://cyber.hendryadrian.com/article/18835/apiiro-finds-thousands-of-secrets-exposed-in-public-github-repositories

Recorded Future identified about 261,700 suspected DoppelCart domains. Its analysis found a hosting shift, shared payment-routing configurations and evidence of Medusa storefront use; the shops impersonate retailers to collect payment data, with about 40% still active.
🔗 https://cyber.hendryadrian.com/article/18837/recorded-future-identifies-261-700-suspected-doppelcart-domains

Insikt Group details GhostFrame, an ESXi post-exploitation framework observed in TAG-218 activity overlapping with Settra ransomware. It requires root access and can persist, control VMs, harvest credentials, and pivot through networks.
🔗 https://cyber.hendryadrian.com/article/18838/researchers-detail-ghostframe-esxi-implant-linked-to-settra-activity

A scan of 36 Electron apps found many still trust certificates made with recoverable eMudhra keys; some also install unsigned updates. No attacks have been reported, and the scan warns its list may contain misattributions.
🔗 https://cyber.hendryadrian.com/article/18834/many-electron-apps-still-trust-compromised-emudhra-certificate-keys

Wiz says it completed an internal assessment against ISMAP controls and engaged a registered audit firm, with an external assessment planned for early 2027. Wiz is not currently ISMAP-listed.
🔗 https://cyber.hendryadrian.com/article/18833/wiz-plans-ismap-external-assessment-for-early-2027