Skip to content
Friday, November 6, 2026Nov 6, 2026
Previous issue

Vol. 1, No. 48Composed Nov 6 · 16:52 UTC

SitRep

Cybersecurity, in perspective.

4 elevated5 stories on the wire

Scale amplifies mistakes; attention prevents catastrophe.
— Marcus Andreelius
ⓘMarcus Andreelius is a fictional AI editorial voice. This reflection is original editorial prose, not a quotation.

You are reading a previous issue. Go to the latest edition →

The situation

Chainalysis Reports Exposure of User Credentials

Chainalysis reports exposed credentials and tokens; updates cover an OpenSSH bypass, a Windows driver flaw, Cisco vulnerabilities and DigiCert data.

4 sources

The Hacker News, SecurityWeek, Cisco Talos Vulnerability Reports, Cisco PSIRT Security Advisories

Chainalysis says an ongoing agentic cyber attack exposed names, usernames, password hashes and live tokens for all users. Access to Reactor and Data Solutions was removed; KYT UI/API, other screening products and the login page were taken offline. Impacted accounts were locked, and password resets may not be possible immediately.

Context

The Hacker News reports that an on-path attack exposed a subset of customer passwords. Chainalysis says restoration efforts and credential rotation are planned; password resets may not be possible immediately.

The move

One thing to do today

Epictim Draper

  1. Update OpenSSH to 10.6p2 or disable password logins on affected systems.

On the wire

  • 0critical
  • 4elevated
  • 1moderate
  • 0low
P1Breach

Chainalysis Reports Exposure of User Credentials

All users · password hashes and live tokens · Reactor and Data Solutions access removed

Chainalysis reports an ongoing agentic cyber attack that exposed names, usernames, password hashes and live tokens for all users.1 Access to Reactor and Data Solutions was removed, while KYT UI/API, other screening products and the login page were taken offline; impacted accounts were locked.1 An on-path attack exposed a subset of customer passwords, and Chainalysis says password resets may not be possible immediately.1

  1. 1THE HACKER NEWS · Chainalysis Breach Forces Shutdown of Core Services

Copy link to “Chainalysis Reports Exposure of User Credentials”

P1Exploit

OpenSSH Releases Emergency Sshole Patches

CVE-2026-123158 · musl libc systems with PAM disabled · OpenSSH 10.6p2

OpenSSH released emergency patches for the high-severity SSHole authentication bypass (CVE-2026-123158), which affects sshd on musl libc systems with PAM disabled.1 The flaw allows login with any password of 257–1,024 characters, with exploit paths relying on specific account and hash configurations.1

CVE-2026-123158: CVSS 8.1, EPSS <0.01 (FIRST)

  1. 1SECURITYWEEK · OpenSSH Patch for SSHole Authentication Bypass (CVE-2026-123158)

Copy link to “OpenSSH Releases Emergency Sshole Patches”

P1Exploit

Talos Details Cloud Files Driver Type Confusion

CVE-2026-80093 · Cloud Files Mini Filter Driver · potentially gains a write primitive

Cisco Talos reports a type confusion vulnerability in the Windows Cloud Files Mini Filter Driver (CldiStreamPrepareRequestForMoreProcessing), tracked as CVE-2026-80093.1 An attacker can trigger the issue through Cloud Filter API calls to crash the kernel and potentially gain a write primitive, after registering a provider and dehydrated placeholder and abusing CfAbortOperation.1

Updated Since Nov 1: NetamLoader Injects[.]NET Assemblies on Windows 10 · New: msrc.microsoft.com, cve.org, helpnetsecurity.com

Timeline

  1. Weekend, Oct 31Talos Publishes Windows Cloud Files Driver Flaw
  2. Nov 1NetamLoader Injects[.]NET Assemblies on Windows 10
  3. This edition

CVE-2026-80093: EPSS <0.01 (FIRST)

  1. 1CISCO TALOS VULNERABILITY REPORTS · Microsoft Windows Cloud Files Driver Type Confusion Vulnerability

Copy link to “Talos Details Cloud Files Driver Type Confusion”

P2Exploit

Cisco Warns of PHP Flaws Affecting Select Products

CVE-2026-109618 · CVE-2026-109619 · PHP Foundation fixes · Cisco fixes deployed or planned

Cisco warns that PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 affect select products; the PHP Foundation released critical fixes addressing two remote code execution flaws.1 Cisco lists URWB, Expressway, Duo Access Gateway and ISE Portal Builder among vulnerable products, with fixes deployed or planned, and says some products are confirmed not vulnerable.1

Updated Since Oct 30: PHP2SHELL Attacks Achieve Root on Palo Alto Firewalls · CVE-2026-109618, CVE-2026-109619 · New: recordedfuture.com, github.com

Timeline

  1. Oct 21Critical PHP RCEs CVE-2026-109618 and CVE-2026-109619 — 22.6M Exposed Instances
  2. Oct 22Patch and Hunt for PHP2SHELL RCE (CVE-2026-109618/CVE-2026-109619)
  3. Weekend, Oct 24AWS Publishes WAF Mitigations for PHP2SHELL
  4. Oct 29PAN-OS Management Interfaces Face Active PHP RCE
  5. Oct 30PHP2SHELL Attacks Achieve Root on Palo Alto Firewalls
  6. This edition

Added to CISA KEV on 26 Oct 2026 (CVE-2026-109618, CVE-2026-109619) · CVE-2026-109618: CVSS 9.2, EPSS 1.00 (FIRST); CVE-2026-109619: CVSS 9.2, EPSS 1.00 (FIRST)

  1. 1CISCO PSIRT SECURITY ADVISORIES · Vulnerabilities in PHP Affecting Cisco Products (October 2026)

Copy link to “Cisco Warns of PHP Flaws Affecting Select Products”

P1Breach

DigiCert Reports Business Customer Data Exposure

Archived system lacked MFA · names, emails, phone numbers and business addresses

Hackers created an internal self-registration account on DigiCert’s archived data system, which lacked MFA and exposed business customer names, emails, phone numbers and addresses through unauthorized read-only access.1 The unauthorized access occurred between June 27 and July 2; DigiCert blocked the account on July 2, began a broader investigation in October, and initiated monitoring and password resets in mid-October.1

  1. 1SECURITYWEEK · DigiCert Data Breach Impacts Business Customer Information

Copy link to “DigiCert Reports Business Customer Data Exposure”

Known exploited

Added 6 Nov1 vulnerability added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-19868SonicWall SonicOS SSLVPN6 Nov20 Nov

Source: CISA KEV catalogue, version 2026.11.10 (released 10 Nov 2026; read by SitRep 10 Nov 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

The wire, last 30 days

This edition has 4 stories rated critical or elevated (P0 or P1); the 23 daily editions from 8 Oct to 5 Nov averaged 3.6. 6 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
6 Nov (this edition)0410
5 Nov0320
4 Nov2200
3 Nov0310
2 Nov0211
1 Nov0300
31 Oct1210
30 Oct1400
29 Oct1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300
12 Oct2200
9 Oct1310
8 Oct2300

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

GPT-6 Cyber Finds Firefox Flaws and Linux Bugs

GPT-6 Cyber discovers 81 Firefox flaws and exploits 948 Linux kernel flaws; identifies 2,308 potential Linux flaws, reproduces 1,724, and develops 948 local privilege escalation exploits. In ExploitGym, it shows 48.5% exploit success vs 32.1% for GPT-5.6 Cyber. OpenAI categorizes it as Critical, with access limited to Daybreak Red, which plans broader rollout.

5 reports

Attacks on Europe’s Refrigeration Systems Hit France, Spread

October 11–12, 2026 saw the first wave targeting about 700 French supermarkets. November 1–2, 2026 expanded to at least 10 more European countries and 100–115 locations. Attackers raised refrigeration temperatures to 50°C (122°F), causing spoilage and some fires. French medical-refrigeration systems were reportedly affected. Over 5,000 devices exposed on the Internet were identified.

5 reports

Activists Breach Microsoft Data Center Construction Site Amid Protests

More than 100 activists breached a Microsoft AI data center construction site in Amsterdam as protests spread across 16 countries. Stop Dirty Data Centers organized actions, including calls to pause large-scale construction. Pure Data Centers, backed by Oaktree, plans to invest more than $1 billion. Additional demonstrations targeted Dublin, Warsaw, and a Danish Microsoft data center.

5 reports

Exploited WordPress Flaw Fix Can Expose Sites During Update

WordPress flaw CVE-2026-119977 allows code execution during update if an attacker accesses the temporary wp-content/upgrade copy. A fix exists in WordPress 7.1.4 and older branches to 4.7, but updates may briefly expose installers. CISA added the flaw to known exploited vulnerabilities; blocking wp-content/upgrade and updating manually can mitigate risk.

2 reports

Residential Proxies Found on White House Network

Layer3 Intel reports six IPs on AS2650 used by 28 residential proxy services between Oct 5 and Nov 3, exiting via the White House network 236 times. Activity clustered 5 p.m.–midnight ET, suggesting a person with a proxy-enabled device. Traffic stems from Windows 11 machines using InfaticaSDK; Infatica claims access to over 45 million addresses.

2 reports

Big Tech Sues California Over Age Gates and Autoplay

Google, Meta, and TikTok sue California over AB 1709, challenging restrictions on under-16 users, including autoplay and personalized feeds. The law would require age verification and remove restricted features or delete accounts; defendants argue the rules infringe free speech and parental decision-making. California says features may harm engagement and raise privacy concerns with age checks.

2 reports

Also reported

End of the Friday, November 6, 2026 edition.

Colophon

SitRep · Vol. 1, No. 48

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.