ARTEX Exposes Secrets, WorkOS AI Breach, Qubole AWS Breach

This week’s cyber stories show attackers getting in through trust that organizations had already granted, whether to a vendor, a cloud integration, a code platform, or an AI tool. AI-driven offensive frameworks also moved from theory into real intrusions, and governments went on the record about a large sabotage campaign against food infrastructure.

Agentic AI tool ARTEX goes from leaked secret to cloud data in five minutes!

Microsoft Threat Intelligence reported on 5 November that attackers are using an agentic AI framework called ARTEX to search public GitHub for exposed credentials. In one case, an agent found OAuth application secrets, signed in as a service principal, and pulled data from Azure Key Vault within about five minutes. Read the coverage

WorkOS breach shows AI-assisted intrusion into a sales application!

Developer identity platform WorkOS said it detected unauthorized access to an internal sales application on 30 October and described the cause in a bulletin dated 2 November. The attackers used an AI-assisted offensive framework to automate reconnaissance and exploitation. Exposed data included business contact details, account histories, and summaries of sales calls and customer Slack conversations, though WorkOS reported no access to production data. Read the report

Qubole’s trusted AWS access turned into a customer breach!

Researchers at Wiz reported that attackers used credentials tied to data platform Qubole’s own AWS account to assume integration roles in customer environments between 14 and 26 October. The attackers pulled secrets from Secrets Manager, Lambda, and SSM, then downloaded S3 data. Customers were told to remove unused vendor roles, restrict trust policies, and rotate any exposed secrets. Read the report

French bank Crédit Mutuel Arkéa loses funds through a service provider!

Crédit Mutuel Arkéa confirmed on 4 November that attackers reached it through an unnamed service provider’s platform and used the bank’s own account to send fraudulent transfers. Blockchain investigator ZachXBT estimated the losses at about $133 million, which the bank said was the right order of magnitude. The bank stated that customer assets were unaffected. Read the report

France blames Iran’s Revolutionary Guards for supermarket fridge sabotage!

On 9 November, France’s foreign minister formally attributed the October attacks on supermarket refrigeration to Iran’s Revolutionary Guards. Paris has opened a judicial investigation and requested international arrest warrants for members of the Shahid Kaveh unit, and the Iranian ambassador was summoned. Iran has denied the claims. Read the report

US agencies warn that refrigeration controllers are under attack!

CISA, the FBI, and several US federal departments issued a joint advisory on 5 November about attacks on industrial refrigeration and cold-chain monitoring systems. Attackers can remotely alter settings and push cold storage into continuous heating or defrost. The agencies recommend taking these controllers off the internet, isolating them on dedicated OT networks, and keeping offline backups. Read the advisory coverage

GhostAction supply chain campaign keeps spreading through GitHub!

Socket reported on 9 November that a new wave of the GhostAction campaign has compromised more than 500 GitHub accounts. The attackers used them to plant a credential-stealing workflow file in tens of thousands of repositories, targeting cloud, AI, and publishing keys. Some affected repositories belong to large organizations. Read the report

Ethersphere packages hijacked to steal crypto wallet keys!

OX Security reported on 9 November that attackers used a suspected compromised developer key to inject malicious code into the @ethersphere/bee-js npm package and the swarm-desktop GitHub repository. The malware targeted crypto wallet keys and deployed cross-platform backdoors. The npm package was reverted to a clean version. Read the analysis

N-able takes N-central offline after a zero-day dump!

N-able took its hosted N-central platform offline on 9 November and asked on-premises customers to shut down their servers. The move followed a researcher’s public release of more than 30 alleged zero-days, called Able2Shell, with proof-of-concept code. N-able said it had seen no confirmed exploitation in customer environments but was working on a hotfix. Read the report

“SSHole” OpenSSH bug lets attackers log in to passwordless accounts!

OpenSSH released version 10.6p2 on 5 November to fix CVE-2026-123158, an authentication bypass on musl-based Linux systems without PAM, including Alpine Linux. The flaw let attackers log in with long passwords to accounts that should have none, and the fix requires restarting sshd. Admins who cannot patch right away were advised to disable password logins. Read the report

GPUStack flaw added to CISA’s exploited vulnerabilities list!

CISA added CVE-2026-102895 to its Known Exploited Vulnerabilities catalog on 9 November, with a federal patch deadline of 12 November. The flaw in the AI GPU cluster manager lets requests from the loopback address gain admin rights. Attackers used it to create backends that open reverse shells. Users should upgrade to version 2.2.0 or later and rotate any secrets the platform stored. Read the report

Linux kernel TCP flaw sparks suspected internet-wide scanning!

Canonical raised the priority of CVE-2026-98432, a kernel use-after-free in IPv4 TCP handling, to Critical on 3 November. Researcher Marcus Hutchins reported probing of port 443 over MPTCP beginning 2 November, which he believes is aimed at this flaw. His earlier scan found about 2.1 million servers reachable over MPTCP. Read the report

ModSecurity WAF bypass exploit goes public without a patch!

HKCERT warned on 9 November that proof-of-concept code is public for CVE-2026-104269, a ModSecurity upload bypass. The flaw lets a file that looks like a JPG reach a Go, Python, Node.js, or Java app as a PHP script, which can lead to remote code execution if the file is in a web-accessible folder. The advisory lists no fixed release yet. Read the report

Alongside these emerging threats, strong email security practices remain essential for protecting organizational domains. Properly configured DMARC, DKIM, and SPF records help prevent email spoofing, reduce phishing risks, and strengthen domain-level protection against email-based attacks.