Skip to content
Sunday, November 8, 2026Nov 8, 2026
Previous issue

Vol. 1, No. 50Composed Nov 8 · 12:52 UTC

SitRep

Cybersecurity, in perspective.

3 elevated4 stories on the wire

Build what earns its place. Keep your judgment close.

You are reading a previous issue. Go to the latest edition →

The situation

Attackers Used Service Provider Access in Bank Heist

Attackers used Arkéa’s service-provider access in fraudulent transfers; Talos disclosed two Windows Cloud Files driver flaws.

3 sources

BleepingComputer, Cisco Talos Vulnerability Reports, Help Net Security

Crédit Mutuel Arkéa was targeted in a cyberattack enabling fraudulent transactions of up to $133 million. BleepingComputer reports that the attacker used Arkéa’s own account to transact with other banks and convert funds to USDC/USDT, with access coming via a service provider’s platform. Arkéa disclosed on Nov. 4 that the incident was closed and under control, with phishing risk rising and transfers delayed; ZachXBT cited 118 million euros stolen.

Context

BleepingComputer reports that access came via a service provider’s platform and the attacker used Arkéa’s own account to transact with other banks and convert funds to USDC/USDT. Arkéa said the incident was closed and under control, while transfers were delayed and phishing risk was rising.

Zeno Khosla

Skeptical perspective

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

Reports Cite Different Loss Figures; Arkéa Says Incident Is Closed

BleepingComputer reports transactions up to $133 million and cites ZachXBT’s figure of 118 million euros stolen. Arkéa disclosed that the incident was closed and under control.

BleepingComputer

On the wire

  • 0critical
  • 3elevated
  • 1moderate
  • 0low
P1Breach

Service Provider Access Enabled Bank Transfers

Up to $133 million · ZachXBT cited 118 million euros · Funds converted to USDC/USDT

BleepingComputer reports that an attacker used Crédit Mutuel Arkéa’s own account to transact with other banks and convert funds to USDC/USDT, with access coming via a service provider’s platform.1 The cyberattack enabled fraudulent transactions up to $133 million; ZachXBT cited 118 million euros stolen.1 Arkéa disclosed that the incident was closed and under control, with phishing risk rising and transfers delayed.1

Single sourceBleepingComputer

  1. 1BLEEPINGCOMPUTER · Hackers Use Service Provider in 133 Million French Bank Heist

Copy link to “Service Provider Access Enabled Bank Transfers”

P1Exploit

Cloud Files Driver Has Type Confusion Flaw

CVSS 8.8 · Affected versions 10.0.26100.8457 and 10.0.26100.8655

Cisco Talos reports a type-confusion flaw in the Windows Cloud Files Mini Filter Driver via CldiStreamPrepareRequestForMoreProcessing.1 Talos says a crafted Cloud Filter API sequence can cause a kernel crash or potential write primitive on the affected versions; exploitation requires specific provider and dehydrated-placeholder steps.1

Updated Since Nov 7: Talos Reports Windows Cloud Files Type Confusion · CVE-2026-80093 · New: helpnetsecurity.com, bleepingcomputer.com

Timeline

  1. Weekend, Oct 31Talos Publishes Windows Cloud Files Driver Flaw
  2. Nov 7Talos Reports Windows Cloud Files Type Confusion
  3. This edition

Single sourceCisco Talos Vulnerability Reports

CVE-2026-80093: EPSS <0.01 (FIRST)

  1. 1CISCO TALOS VULNERABILITY REPORTS · CVE-2026-80093 Type Confusion in Windows Cloud Files Driver

Copy link to “Cloud Files Driver Has Type Confusion Flaw”

P1Exploit

Cloud Files Driver Has Use-after-free Flaw

CVSS 8.8 · Affected version 10.0.26100.8457

Cisco Talos reports a use-after-free in the Windows Cloud Files Mini Filter Driver via CldiStreamCompleteRequest on version 10.0.26100.8457, enabling privilege escalation.1 Talos says a provider process termination can orphan a timer-list request that triggers a use-after-free path 60 seconds later when the timer walks the global list.1

Updated Since Nov 7: Talos Reports Windows Cloud Files Type Confusion · New: helpnetsecurity.com, bleepingcomputer.com

Timeline

  1. Oct 31Windows Cloud Files Driver Permits Local Privilege Escalation
  2. Nov 6Windows Cloud Files Driver Has Use-after-free
  3. Nov 7Talos Reports Windows Cloud Files Type Confusion
  4. This edition

Single sourceCisco Talos Vulnerability Reports

CVE-2026-58613: EPSS <0.01 (FIRST); CVE-2023-29361: EPSS 0.04 (FIRST)

  1. 1CISCO TALOS VULNERABILITY REPORTS · Microsoft Windows Cloud Files Mini Filter Driver Use-After-Free CVE-2026-58613

Copy link to “Cloud Files Driver Has Use-after-free Flaw”

P2OT

Refrigeration Attacks Hit European Retailers Again

CISA added two Ivanti Connect Secure flaws to KEV · Patch Tuesday fixed 1,400+ vulnerabilities

Help Net Security reports a second wave of refrigeration cyberattacks hit European supermarkets after France, spoiling refrigerated goods.1 The roundup says CISA added two Ivanti Connect Secure flaws to the Known Exploited Vulnerabilities list and Patch Tuesday fixed more than 1,400 vulnerabilities.1

Single sourceHelp Net Security

  1. 1HELP NET SECURITY · Refrigeration Cyberattacks Hit European Retailers Again, Patch Tuesday Forecast

Copy link to “Refrigeration Attacks Hit European Retailers Again”

The wire, last 30 days

This edition has 3 stories rated critical or elevated (P0 or P1); the 23 daily editions from 12 Oct to 7 Nov averaged 3.5. 6 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
8 Nov (this edition)0310
7 Nov0300
6 Nov1310
5 Nov0320
4 Nov2200
3 Nov0310
2 Nov0211
1 Nov0300
31 Oct1210
30 Oct1400
29 Oct1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300
12 Oct2200

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

Also reported

End of the Sunday, November 8, 2026 edition.

Colophon

SitRep · Vol. 1, No. 50

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.