Skip to content
Friday, November 6, 2026Nov 6, 2026
Previous issue

Vol. 1, No. 48Composed Nov 6 · 20:53 UTC

SitRep

Cybersecurity, in perspective.

1 critical · 2 elevated4 stories on the wire

Build what earns its place. Keep your judgment close.

You are reading a previous issue. Go to the latest edition →

The situation

Chainalysis Reports Exposure and Service Disruptions

Chainalysis reports exposed credentials and tokens for all users; several services were taken offline and impacted accounts were locked.

4 sources

The Hacker News, SecurityWeek, Cisco PSIRT Security Advisories, Cisco Talos Vulnerability Reports

Chainalysis says an ongoing agentic cyber attack exposed names, usernames, password hashes and live tokens for all users. Access to Reactor and Data Solutions was removed; KYT UI/API and other screening products and the login page were taken offline. An on-path attack exposed a subset of customer passwords, and impacted accounts were locked; password resets may not be possible immediately.

Context

Chainalysis says restoration efforts and credential rotation are planned. Separately, OpenSSH released emergency patches for SSHole, a high-severity authentication bypass affecting sshd on musl libc systems with PAM disabled; exploit paths rely on specific account and hash configurations.

“Separately, OpenSSH says SSHole affects sshd on musl libc systems with PAM disabled, and exploit paths rely on specific account and hash configurations.”
From Senecowitz · Analysis

On the wire

  • 1critical
  • 2elevated
  • 1moderate
  • 0low
P0Breach

Chainalysis Reports Breach Exposing User Credentials

Names, usernames, password hashes and live tokens

Chainalysis says an ongoing agentic cyber attack exposed names, usernames, password hashes and live tokens for all users.1 Access to Reactor and Data Solutions was removed; KYT UI/API, other screening products and the login page were taken offline, and impacted accounts were locked.1 An on-path attack exposed a subset of customer passwords, and password resets may not be possible immediately.1

  1. 1THE HACKER NEWS · Chainalysis Breach Forces Shutdown of Core Services

Copy link to “Chainalysis Reports Breach Exposing User Credentials”

P1Patch

Cisco Warns of PHP Flaws Affecting Select Products

CVE-2026-109618 · CVE-2026-109619

Cisco warns that two PHP vulnerabilities affect select products; the PHP Foundation released critical fixes addressing two remote-code-execution flaws.1 Cisco lists URWB, Expressway, Duo Access Gateway and ISE Portal Builder among vulnerable products, with fixes deployed or planned; some products are confirmed not vulnerable.1 Cisco says administrative authentication is required for one attack vector.1

Updated Since Oct 30: PHP2SHELL Attacks Achieve Root on Palo Alto Firewalls · CVE-2026-109618, CVE-2026-109619 · New: recordedfuture.com, github.com

Timeline

  1. Oct 21Critical PHP RCEs CVE-2026-109618 and CVE-2026-109619 — 22.6M Exposed Instances
  2. Oct 22Patch and Hunt for PHP2SHELL RCE (CVE-2026-109618/CVE-2026-109619)
  3. Weekend, Oct 24AWS Publishes WAF Mitigations for PHP2SHELL
  4. Oct 29PAN-OS Management Interfaces Face Active PHP RCE
  5. Oct 30PHP2SHELL Attacks Achieve Root on Palo Alto Firewalls
  6. This edition

Added to CISA KEV on 26 Oct 2026 (CVE-2026-109618, CVE-2026-109619) · CVE-2026-109618: CVSS 9.2, EPSS 1.00 (FIRST); CVE-2026-109619: CVSS 9.2, EPSS 1.00 (FIRST)

  1. 1CISCO PSIRT SECURITY ADVISORIES · Vulnerabilities in PHP Affecting Cisco Products (October 2026)

Copy link to “Cisco Warns of PHP Flaws Affecting Select Products”

P1Exploit

OpenSSH Patches Sshole Authentication Bypass

CVE-2026-123158 · OpenSSH 10.6p2

OpenSSH released emergency patches for SSHole, a high-severity authentication bypass affecting sshd on musl libc systems with PAM disabled.1 The flaw allows login with any password of 257–1,024 characters.1 Exploit paths rely on specific account and hash configurations.1

CVE-2026-123158: CVSS 8.1, EPSS <0.01 (FIRST)

  1. 1SECURITYWEEK · OpenSSH Patch for SSHole Authentication Bypass (CVE-2026-123158)

Copy link to “OpenSSH Patches Sshole Authentication Bypass”

P2Exploit

Windows Cloud Files Driver Has Use-after-free Flaw

cldflt.sys · CVSS 8.8

Cisco Talos reports a use-after-free vulnerability in the Microsoft Windows Cloud Files Mini Filter Driver (cldflt.sys) via CldiStreamCompleteRequest; a crafted Cloud Filter API sequence can escalate privileges.1 The reported affected component is Windows Cloud Files Mini Filter Driver version 10.0.26100.8457; Cisco Talos gives the flaw a CVSS v3.1 score of 8.8.1

Updated Since Nov 1: NetamLoader Injects[.]NET Assemblies on Windows 10 · New: msrc.microsoft.com, cve.org, helpnetsecurity.com

Timeline

  1. Oct 31Windows Cloud Files Driver Permits Local Privilege Escalation
  2. Nov 1NetamLoader Injects[.]NET Assemblies on Windows 10
  3. This edition

CVE-2026-58613: EPSS <0.01 (FIRST); CVE-2023-29361: EPSS 0.04 (FIRST)

  1. 1CISCO TALOS VULNERABILITY REPORTS · Microsoft Windows Cloud Files Mini Filter Driver Use-After-Free Vulnerability

Copy link to “Windows Cloud Files Driver Has Use-after-free Flaw”

Known exploited

Added 6 Nov1 vulnerability added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-19868SonicWall SonicOS SSLVPN6 Nov20 Nov

Source: CISA KEV catalogue, version 2026.11.10 (released 10 Nov 2026; read by SitRep 10 Nov 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

The wire, last 30 days

This edition has 3 stories rated critical or elevated (P0 or P1); the 23 daily editions from 8 Oct to 5 Nov averaged 3.6. 6 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
6 Nov (this edition)1210
5 Nov0320
4 Nov2200
3 Nov0310
2 Nov0211
1 Nov0300
31 Oct1210
30 Oct1400
29 Oct1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300
12 Oct2200
9 Oct1310
8 Oct2300

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

GPT-6 Cyber Finds Firefox Flaws and Linux Bugs

GPT-6 Cyber discovers 81 Firefox flaws and exploits 948 Linux kernel flaws; identifies 2,308 potential Linux flaws, reproduces 1,724, and develops 948 local privilege escalation exploits. In ExploitGym, it shows 48.5% exploit success vs 32.1% for GPT-5.6 Cyber. OpenAI categorizes it as Critical, with access limited to Daybreak Red, which plans broader rollout.

5 reports

Attacks on Europe’s Refrigeration Systems Hit France, Spread

October 11–12, 2026 saw the first wave targeting about 700 French supermarkets. November 1–2, 2026 expanded to at least 10 more European countries and 100–115 locations. Attackers raised refrigeration temperatures to 50°C (122°F), causing spoilage and some fires. French medical-refrigeration systems were reportedly affected. Over 5,000 devices exposed on the Internet were identified.

5 reports

Activists Breach Microsoft Data Center Construction Site Amid Protests

More than 100 activists breached a Microsoft AI data center construction site in Amsterdam as protests spread across 16 countries. Stop Dirty Data Centers organized actions, including calls to pause large-scale construction. Pure Data Centers, backed by Oaktree, plans to invest more than $1 billion. Additional demonstrations targeted Dublin, Warsaw, and a Danish Microsoft data center.

5 reports

Exploited WordPress Flaw Fix Can Expose Sites During Update

WordPress flaw CVE-2026-119977 allows code execution during update if an attacker accesses the temporary wp-content/upgrade copy. A fix exists in WordPress 7.1.4 and older branches to 4.7, but updates may briefly expose installers. CISA added the flaw to known exploited vulnerabilities; blocking wp-content/upgrade and updating manually can mitigate risk.

2 reports

DigiCert Data Breach Impacts Business Customer Information

Hackers created an internal self-registration account on DigiCert’s archived data system, which lacked MFA and exposed names, emails, phone numbers, and business addresses. The data resided on a network segment moved in February 2025, and the unauthorized read-only access occurred between June 27 and July 2.

2 reports

Residential Proxies Found on White House Network

Layer3 Intel reports six IPs on AS2650 used by 28 residential proxy services between Oct 5 and Nov 3, exiting via the White House network 236 times. Activity clustered 5 p.m.–midnight ET, suggesting a person with a proxy-enabled device. Traffic stems from Windows 11 machines using InfaticaSDK; Infatica claims access to over 45 million addresses.

2 reports

Big Tech Sues California Over Age Gates and Autoplay

Google, Meta, and TikTok sue California over AB 1709, challenging restrictions on under-16 users, including autoplay and personalized feeds. The law would require age verification and remove restricted features or delete accounts; defendants argue the rules infringe free speech and parental decision-making. California says features may harm engagement and raise privacy concerns with age checks.

2 reports

Also reported

End of the Friday, November 6, 2026 edition.

Colophon

SitRep · Vol. 1, No. 48

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.