Here are today’s top cybersecurity stories for Friday, November 6, 2026.
Hackers Hide Linux Backdoor in Control Web Panel Server to Run Commands Without Logs
QiAnXin’s XLab found cwpdoor, a modified build of cwpsrv, the web server in Control Web Panel. It runs commands sent in requests with a valid timestamp and signature in headers starting with X-Ngx-Integrity, and those requests never reach access logs. The installer targets cwpsrv 1.15.10 and 1.24.0 and needs root access. XLab has not found how attackers gain root. The Hacker News
OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Authentication on Alpine Linux
A password of 257 to 1,024 bytes lets an attacker log in to accounts with no password on Alpine servers where sshd runs without PAM. Özgün Kültekin of Wakefield reported the flaw, which stems from how musl handles a failed crypt() call. OpenSSH 10.6p2 fixes it, and Alpine published fixed packages back to release 3.16. No CVE is assigned and no attacks are reported. The Hacker News
Three Charged in AI Impersonation Scheme Tied to $129 Million in Thefts
Prosecutors in the Southern District of New York charged Jacob Soall, Sharon Hazan, and Guy Sheetrit with wire fraud, aggravated identity theft, and money laundering. The indictment says the group used AI to mimic CEO voices and sometimes images, then sent employees to a fake attorney who ordered wire transfers. Victims include hospital systems in Missouri and California, a Rhode Island bank, and a UK fintech company. SecurityWeek
Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns
Kela found more than 300 fake domains active since May 2026, including 248 impersonating 189 US financial institutions. First-time visitors see a branded login page, while repeat visitors see a “This account has been suspended” notice. The campaign targets business banking and treasury logins, and new lookalikes of JPMorgan, Citi, BMO, and Santander appeared in the final week of Kela’s count. SecurityWeek
Chainalysis Breach Exposes All Users’ Credentials, Forces Shutdown of Key Services
Chainalysis now says names, usernames, password hashes, and live tokens for all users were exposed. The company took its KYT interface and API, address screening products, and login page offline, and removed access to Reactor and Data Solutions. Chainalysis reports no evidence of access to investigation data or manipulation of attribution data. The Hacker News
Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content
Starting with iOS, iPadOS, macOS, and visionOS 27.3, Apple will check items shared through “Anyone with the Link” for harmful content. A support document says sharing this way disables end-to-end encryption, even with Advanced Data Protection turned on. Apple reserves the right to remove content, act against the Apple Account, and involve law enforcement if necessary. The Hacker News
CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access
India’s CERT-In says an AI-assisted actor it tracks as Crafty Falcon targets banking, financial services, and insurance firms and crypto exchanges with tools including ARTEX, PentAGI, Cairn, and CyberStrikeAI. Separately, researcher Badbyte found a backdoored ARTEX Docker image with a hidden verifyCaptcha() function running commands as root. Sixty-two consoles served the backdoored build between November 2 and 4. The Hacker News
Apache OFBiz Fixes Pre-Authentication Remote Code Execution Flaw
Apache OFBiz 24.09.08 addresses 46 security flaws. They include CVE-2026-68524, a pre-authentication remote code execution bug, and CVE-2026-109928, an authentication flaw allowing full account takeover. The Hacker News
DigiCert Reports Unauthorized Access to Identity Validation System
DigiCert disclosed unauthorized access to a business system holding identity validation data. The company says certificate operations were not affected. The Hacker News
Docker Sandboxes Flaw Lets AI Agents Reach Files Outside Their Sandbox
CVE-2026-103916 is a symbolic link flaw in Docker Sandboxes. It let AI agents read files outside the sandbox boundary. Docker fixed the flaw in version 0.51.0. The Hacker News
Google Cloud Adds $250,000 Reward for Root-in-Cloud Flaws
Google expanded its Cloud Vulnerability Reward Program with a new top tier of $250,000 for high-impact architectural flaws it calls Root-in-Cloud. The tier targets weaknesses in the cloud platform itself. The Hacker News
Stay tuned for today’s in-depth analysis posts.
