Daily digest,
Ongoing Credential Abuse Campaign Targets MSPs via Microsoft Entra ID (+6 more)
Vulnerabilities
High-Risk Remote Code Execution Vulnerability in Mistral Vibe
Mistral Vibe versions before 2.25.7 contain a remote code execution vulnerability (CVE-2026-122134) that allows attackers to execute commands via malicious Git clean or process filter drivers in a repository. When a crafted repository is opened, the application runs git status at startup, executing commands with user privileges before any trust prompt. Developers and automation operators inspecting untrusted repositories are most at risk, as successful exploitation can expose sensitive data and allow code tampering. The vulnerability has a CVSS score of 8.6, indicating high severity. Users are advised to promptly upgrade to the fixed version and avoid opening untrusted repositories until patched. The vulnerability was disclosed on November 4, 2026, and is currently not reported as.
Vulnerability · 2 sources · score 64 · CVE-2026-122134, Mistral Vibe
Remote Code Execution Vulnerability in Mistral Vibe Disclosed
Mistral Vibe versions prior to 3.0.3 contain a remote code execution vulnerability identified as CVE-2026-122135, published on November 4, 2026. This flaw allows attackers to execute commands by manipulating the gpg.program setting in repository configurations during project context collection. The vulnerability requires user interaction to exploit, as an attacker must persuade a developer to open a crafted repository. The risk is particularly high for developers working with untrusted or externally contributed repositories, as successful exploitation could expose sensitive source code and credentials. Currently, there is no confirmed, but the vulnerability is deemed high risk with a CVSS score of 8.6. Developers are advised to upgrade to the fixed version and avoid opening untrusted repositories until a patch is applied. The urgency of the situation is still being assessed due to the lack of further exploitation data.
Vulnerability · 2 sources · score 63 · CVE-2026-122135
High-Risk Untrusted Path Vulnerability in Mistral Vibe Disclosed
Mistral Vibe versions prior to 2.25.5 on Windows have an untrusted path vulnerability (CVE-2026-122133) that allows attackers to execute malicious code by placing git.exe in a repository root. Attackers can lure users into opening crafted repositories, triggering the execution of the malicious git.exe without any trust prompts. This poses a high risk to Windows developers, especially those using AI-assisted coding tools. Successful exploitation can compromise local work, disrupt workstations, or steal sensitive credentials. The vulnerability requires user interaction to exploit, as developers must open the crafted repository. The risk is heightened for developers accessing unfamiliar repositories from various sources. No active exploitation has been confirmed, and the urgency of addressing this vulnerability is currently unverified. Mitigation strategies include upgrading to the fixed version and reviewing repository contents before opening.
Vulnerability · 2 sources · score 63 · CVE-2026-122133
AWS Firecracker Vulnerability CVE-2026-122192 Exposes Memory to Guest Users
CVE-2026-122192 affects Firecracker versions 0.23.0 to 1.16.1, allowing root users in a guest VM to read or modify the Firecracker process memory under certain conditions. This vulnerability arises when a microVM is restored from a snapshot using the File memory backend, leading to a failure in memory remapping. The issue does not affect AWS services like AWS Lambda. AWS has released patches in versions 1.16.2 and 1.17.0 to mitigate this vulnerability. Operators are advised to upgrade or use alternative memory backends if immediate upgrades are not feasible. The vulnerability was disclosed on November 4, 2026, with a CVSS score of 7.5, indicating a high severity level. The research was conducted by Coinspect, who coordinated with AWS on the disclosure.
Vulnerability · 2 sources · score 57 · CVE-2026-122192
Breaches
French Bank Cyberattack Results in Estimated $133 Million Theft
Crédit Mutuel Arkéa, a major French banking institution, confirmed it suffered a cyberattack that allowed hackers to execute fraudulent transactions, with losses estimated at $133 million. The attackers compromised a supplier's platform to gain access to the bank's systems, enabling them to transfer funds to other banks. The stolen funds were reportedly converted into cryptocurrencies, with some assets frozen during recovery efforts. The bank stated that customer accounts were not affected, and it emphasized that the incident would not threaten its financial stability. The investigation into the attack's origin and methods is ongoing, with law enforcement involved. ZachXBT, a blockchain investigator, first reported the incident, noting that the attack spanned several days and involved significant withdrawals from cryptocurrency exchanges.
Vulnerability · 5 sources · score 52
Threat actors and malware
Ongoing Credential Abuse Campaign Targets MSPs via Microsoft Entra ID
Since November 1, 2026, a cyber campaign has been exploiting stolen application credentials to access Microsoft Entra ID and Azure DevOps environments of managed service providers (MSPs) and their clients. The threat actor has successfully authenticated to at least 33 out of 45 targeted app registrations across 18 organizations, accessing 27 organizations, including clients in various sectors such as government and energy. The attack method involves using valid application credentials to bypass multi-factor authentication (MFA) and Conditional Access policies, allowing the attacker to operate as a trusted application. As of November 3, the actor has downloaded 81 files and accessed approximately 2,300 mailbox items. The activity is ongoing, with researchers actively monitoring and investigating the situation. The attack is attributed to a single operator using a virtual private server, with activity traced back to an IP address in Poland. No Microsoft vulnerabilities are involved, and the stolen credentials appear to have been harvested prior to the attack.
APT · 4 sources · score 72 · Storm-0940, M365 Service Principal Credential Abuse Campaign
Cyberattacks Disrupt Supermarket Refrigeration Across Europe
In late October and early November 2026, coordinated cyberattacks targeted supermarket refrigeration systems in at least nine European countries, including France, Sweden, and Belgium. Attackers remotely set refrigeration units to 50°C (122°F), leading to significant food spoilage. The first wave occurred between October 11-12, impacting hundreds of French supermarkets, followed by a second wave on November 2, affecting stores in multiple countries. The refrigeration controllers involved were primarily manufactured by Danfoss, and while the number of exposed devices on the internet has increased, credible observations of these devices have decreased. No group has claimed responsibility for the attacks, and the method of intrusion remains unconfirmed. The incidents have raised concerns about vulnerabilities in food supply chains, particularly regarding the potential for ransom demands and the economic impact on grocery prices.
Supply Chain · 2 sources · score 54
New on leak sites
64 victims listed on ransomware leak sites by 16 groups in the 24 hours before this issue. The most active:
Also moving
- Vulnerabilities: Buffer overflow
- Malware: AIDS Trojan, AW Manager, Blaster 2.0, Boinc, CharityEngine
- APT groups: APT29, Cozy Bear
- Campaigns: Boycott Ride
- CVEs: CVE-2021-38003, CVE-2024-27834, CVE-2024-4671, CVE-2024-5274, CVE-2025-14174
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.