Daily Digest

AI Advances, MFA Bypasses, and New Malware Dominate Cybersecurity News

November 6, 2026
7 articles (4 new, 3 updated)
21 min read

Summary

Critical Vulnerabilities and Active Exploitation:

  • Actively Exploited SonicWall MFA Bypass Flaw Added to CISA KEV Catalog: CISA has added CVE-2026-19868, a critical SonicWall SSL-VPN vulnerability that bypasses SAML and MFA, to its Known Exploited Vulnerabilities catalog due to active attacks. Federal agencies must patch by November 20, 2026, and all users of affected SonicWall devices are urged to update immediately.
  • Critical Google Kaniko Flaw Leaks Azure Credentials: A critical vulnerability (CVE-2026-105769) in Google's kaniko tool allows a crafted hostname to redirect Azure access tokens to an attacker-controlled server, potentially leading to full Azure environment compromise. Users should upgrade to kaniko version 1.25.20.

Evolving Threat Landscape and Emerging Dangers:

  • New 'Has' Ransomware and 'LunexLoader' Malware Emerge: Researchers have identified 'Has' ransomware, a new Dharma variant employing double extortion, and 'LunexLoader,' a stealthy, modular malware loader designed for sandbox evasion and multi-stage attacks.
  • Microsoft & Partners Disrupt Major Phishing-as-a-Service Operation: New Phishing-as-a-Service (PhaaS) operations, including SkyW4lker and Mir0Auth, are exploiting Microsoft's device-code authentication flow to bypass MFA and steal access tokens from U.S. Microsoft 365 users, leading to data breaches and BEC.

Industry Trends and Future Outlook:

  • UK NCSC: AI-Powered Ransomware to Hit Critical Infrastructure by 2028: The NCSC predicts AI will accelerate exploitation of existing weaknesses, lowering the barrier for cybercriminals and increasing the speed and scale of attacks. Organizations are advised to adopt AI-powered defenses and automated patching.
  • OpenAI's AI Agent Autonomously Finds and Patches 948 Linux Flaws: OpenAI's AI pipeline successfully discovered, exploited, and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel, demonstrating AI's potential for rapid vulnerability discovery and remediation.
  • European Supermarkets Hit by Coordinated Freezer Cyberattacks: Coordinated cyberattacks on European refrigeration systems have expanded to include France's national blood service via a compromised supplier, highlighting the impact on critical public health infrastructure. Singapore's CSA has issued an advisory on securing OT control systems.

Filter by Category

New Articles (4)

OpenAI's AI Agent Autonomously Finds and Patches 948 Linux Flaws

HIGH

OpenAI AI Pipeline Finds 948 Linux LPE Vulnerabilities

OpenAI has developed an autonomous AI pipeline that discovered, exploited, and generated patches for 948 local privilege escalation (LPE) vulnerabilities in the Linux kernel. The five-stage system, which cost $1.2 million in API credits, highlights the transformative potential of AI for both offensive and defensive cybersecurity operations. The project's success, building on earlier research, demonstrates a dramatic acceleration in vulnerability discovery, with the AI identifying novel exploit techniques and outpacing manual human analysis.

November 6, 2026
6 min read
AIArtificial IntelligenceLinuxVulnerability ResearchLPE +3 more
OpenAI's AI Agent Autonomously Finds and Patches 948 Linux Flaws

CISA Adds Actively Exploited SonicWall MFA Bypass Flaw to KEV Catalog

CRITICAL

CISA Warns of Exploited SonicWall MFA Bypass Flaw

The U.S. CISA has added a critical SonicWall SSL-VPN vulnerability, CVE-2026-19868, to its Known Exploited Vulnerabilities (KEV) catalog, confirming active attacks. The flaw, with a CVSS score of 7.5, allows an attacker with valid credentials for a secondary authentication method to bypass SAML and multi-factor authentication (MFA). Federal agencies are mandated to patch by November 20, 2026, and all organizations using affected SonicWall devices are urged to update immediately.

November 6, 2026
4 min read
CVE-2026-19868SonicWallVPNMFA BypassCISA +3 more
CISA Adds Actively Exploited SonicWall MFA Bypass Flaw to KEV Catalog

New 'Has' Ransomware and 'LunexLoader' Malware Emerge

HIGH

Has Ransomware and LunexLoader Malware Emerge

Researchers have identified two new emerging threats: 'Has' ransomware and the 'LunexLoader' malware. 'Has' is a new variant of the Dharma ransomware family that uses double extortion tactics, encrypting files and threatening to leak exfiltrated data. 'LunexLoader' is a stealthy, modular malware loader delivered via phishing, designed for sandbox evasion and deploying secondary payloads. These threats highlight the continued evolution of ransomware and the sophisticated, multi-stage nature of modern malware attacks.

November 6, 2026
5 min read
RansomwareHasDharmaLunexLoaderMalware +2 more
New 'Has' Ransomware and 'LunexLoader' Malware Emerge

Critical Google Kaniko Flaw (CVE-2026-105769) Leaks Azure Credentials

CRITICAL

Critical Kaniko Flaw Leaks Azure Credentials

A critical vulnerability, CVE-2026-105769, with a CVSS score of 9.3, has been discovered in Google's popular open-source kaniko tool. The flaw allows a maliciously crafted, lookalike registry hostname to trick kaniko into sending the build's Azure access token to an attacker-controlled server. This could lead to the complete compromise of an organization's Azure environment. All users of kaniko are urged to upgrade to the patched version 1.25.20 immediately.

November 6, 2026
4 min read
CVE-2026-105769kanikoGoogleAzureVulnerability +3 more
Critical Google Kaniko Flaw (CVE-2026-105769) Leaks Azure Credentials

Updated Articles (3)

UK NCSC: AI-Powered Ransomware to Hit Critical Infrastructure by 2028

HIGH

UK NCSC Warns of AI Ransomware Threat to Critical Infrastructure

Update:

The NCSC report further clarifies that AI's primary threat lies in automating and accelerating the exploitation of 'long-tolerated' weaknesses, such as end-of-life systems, delayed patching, and insecure configurations. The availability of open-source AI tools is expected to lower the barrier to entry for less sophisticated criminals, making advanced tactics more widespread. To counter this, organizations are urged to adopt AI-powered defense mechanisms, including automated patching (referencing D3FEND's Software Update) and AI/ML-driven security tools, as reactive security postures will be overwhelmed by the speed and scale of AI-driven attacks.

November 4, 2026
Updated: November 6, 2026
4 min read
NCSCUKCritical InfrastructureAIRansomware +3 more
UK NCSC: AI-Powered Ransomware to Hit Critical Infrastructure by 2028

Microsoft & Partners Disrupt Major Phishing-as-a-Service Operation

HIGH

Microsoft & Health-ISAC Disrupt Chinese PhaaS Marketplace

Update:

New Phishing-as-a-Service (PhaaS) operations, including SkyW4lker and Mir0Auth, are actively exploiting Microsoft's device-code authentication flow to bypass MFA and steal access tokens from U.S. Microsoft 365 users. These campaigns, detailed in new reports, leverage malicious links and PDFs to trick users into authorizing attacker-controlled sessions, leading to severe impacts like data breaches and business email compromise. The attacks highlight the persistent threat of device-code phishing despite previous takedowns, with new technical details on the attack chain and hunting hints for detection.

October 17, 2026
Updated: November 6, 2026
4 min read
PhaaStakedowncybercrimephishing kitdevice-code phishing
Microsoft & Partners Disrupt Major Phishing-as-a-Service Operation

European Supermarkets Hit by Coordinated Freezer Cyberattacks

HIGH

Cyberattacks on Freezers Hit Supermarkets Across Europe

Update:

New information reveals that the coordinated cyberattacks on European refrigeration systems also impacted facilities of France's national blood service, reportedly via a compromised supplier. This significantly broadens the incident's scope to critical public health infrastructure, raising the severity. In response, Singapore's Cyber Security Agency (CSA) issued an advisory on November 6, 2026, urging organizations to secure remotely accessible OT control systems, highlighting increased global concern.

November 4, 2026
Updated: November 6, 2026
5 min read
ICSSCADABMSCyberattackRetail +3 more
European Supermarkets Hit by Coordinated Freezer Cyberattacks

📢 Share This Publication

Help others stay informed about cybersecurity threats

📅 Daily Edition

Curated and deduplicated every day from dozens of trusted sources — giving you one clean, consolidated view of what matters in cybersecurity.

🔢 Deduplication Applied

Related stories are merged into a single evolving article rather than repeated as separate entries — cutting through noise so you only read what's new.

🔗 Full Articles Linked

Every entry links to its full enriched article — complete with MITRE ATT&CK mappings, extracted IOCs, and actionable detection and mitigation guidance.