Here are today’s top cybersecurity stories for Monday, November 9, 2026.
CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation
CISA added CVE-2026-19868, an SSL-VPN authentication enforcement flaw in SonicOS, to its Known Exploited Vulnerabilities catalog. A user with valid credentials for an alternate login method bypasses SAML controls, including SAML-enforced MFA. SonicWall investigated a report of possible exploitation and shared no details. Federal civilian agencies must patch by November 20, 2026. The Hacker News
Hackers Compromise Ethersphere’s bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware
Attackers abused Ethersphere’s release automation to publish bee-js 13.3.0 on npm and Swarm Desktop 0.56.2 on GitHub. Both versions steal the node wallet key and password and install a backdoor. The npm version stayed live for about 75 minutes. Socket, SafeDep, and Pluto Security analyzed the incident, and no theft of funds was reported. The Hacker News
Hackers Exploit Qubole’s Trusted AWS Access to Breach Customer Accounts and Steal Data
Between October 14 and October 26, an attacker used credentials for Qubole’s own AWS account to assume IAM roles in multiple customer accounts. The attacker searched Lambda variables, Secrets Manager, and SSM Parameter Store for credentials and copied S3 data. Wiz published the analysis. Neither Qubole nor its owner Idera had issued a public statement at the time of reporting. The Hacker News
Taiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch Records
Acronis Threat Research Unit tied a single attacker to a mesh of AI agents run against hundreds of organizations in at least 11 countries. The agents pulled dispatch records for seven Taipei districts and about 206,800 home phone records in Mexico. The attacker relied on locally run open models with safety training removed. The agents succeeded mostly against poorly protected systems. The Hacker News
Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety
A flaw in Web3Auth’s infrastructure exposed Keplr wallets created with Google or Apple sign-in. Web3Auth moved funds from more than 44,000 wallets, worth over $6.01 million per Bitquery, into recovery wallets. GoPlus puts confirmed theft at a minimum of about $1 million. Neither company has explained how the flaw worked. The Hacker News
Google DeepMind’s AI Agents Make 1024-Bit RSA Keys Cheaper to Attack
DeepMind researchers, working with UC San Diego and Inria, report AI agents found two ways to cut the cost of attacking 1024-bit RSA. One re-run of a signature forgery attack dropped CPU time from 1,380 to 391 core-years. The findings do not affect keys of 2048 bits or longer. SecurityWeek
Binance Denies Data Breach After Alleged ShinyHunters Claims
A threat actor using the ShinyHunters name offered records of 335 million Binance users for sale on a new underground forum and demanded $900,000. Binance said it found no evidence of a breach and called the claim likely a scam. The actor is believed to be impersonating the extortion gang. BleepingComputer
Amplifon Americas Data Breach Impacts 1.3 Million
Attackers copied files from Amplifon Americas systems between January 18 and February 8, 2026. A Texas Attorney General filing counts 1,332,826 affected people. Exposed data includes names, birth dates, government ID numbers, health information, and insurance details. SecurityWeek
Iris Plaza Breach Potentially Exposes Data of 7.7 Million Customers
Attackers breached an external cloud service used by Iris Plaza, the Japanese shopping platform run by Iris Ohyama. The company found the incident on October 28 and took the platform offline. The exposure covers 5.8 million members and 1.9 million non-members. SecurityWeek
Italy’s Meloni Blames Pro-Russian Hackers for Leak of Foreign Minister’s Data on the Dark Web
Foreign Minister Antonio Tajani said his personal data was posted on the dark web and he faced threats and intimidation. Prime Minister Giorgia Meloni blamed pro-Russian hackers. Tajani did not say which data leaked or who is responsible. SecurityWeek
Stay tuned for today’s in-depth analysis posts.
