Daily digest,
Multiple Vulnerabilities in IBM API Connect Disclosed (+7 more)
Vulnerabilities
Multiple Vulnerabilities in IBM API Connect Disclosed
IBM has disclosed several vulnerabilities in its API Connect product, with CVE-2026-17409 rated as. The vulnerabilities include broken object-level authorization and improper handling of case sensitivity, allowing remote authenticated attackers to access sensitive information and execute unauthorized operations. CVE-2026-17405 and CVE-2026-17365 also pose significant risks, with CVSS scores of 8.8 and 8.5, respectively. The flaws could lead to exposure of keystore information and server-side request forgery. IBM has published patches for these vulnerabilities today, urging users to update their systems immediately. The affected systems include various versions of IBM API Connect, which are widely used in enterprise environments. Security professionals are advised to assess their exposure and apply the necessary updates as soon as possible.
Vulnerability · 2 sources · score 78 · CVE-2026-105002, CVE-2026-17129, CVE-2026-17365, CVE-2026-17405, CVE-2026-17408
CISA Adds Two Vulnerabilities to KEV Catalog Amid Active Exploitation
CISA has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. CVE-2026-19868, a high-severity flaw in SonicWall SonicOS SSLVPN, was added on November 6, 2026, due to evidence of active exploitation. This vulnerability allows attackers to exploit single-factor authentication weaknesses, posing significant risks to federal agencies. Additionally, CVE-2024-27834, an improper-authentication flaw affecting Apple systems, was added on November 4, 2026, and has a remediation deadline of November 18 for Federal Civilian Executive Branch (FCEB) agencies under BOD 26-04. CISA encourages all organizations to prioritize remediation of vulnerabilities listed in the KEV Catalog. The vulnerabilities are linked to ongoing exploitation campaigns, highlighting the urgency for organizations to address these issues promptly.
Vulnerability · 2 sources · score 70 · CVE-2024-27834, CVE-2025-43529, CVE-2026-19868, SonicWall SonicOS Sslvpn Use Of Single-factor Authentication Vulnerability
Breaches
Keplr Wallet Users Urged to Transfer Assets After Web3Auth Key Compromise
Keplr Wallet has suspended Google and Apple login functionalities following unauthorized cryptocurrency transfers reported by users on November 7, 2026. The incident is attributed to a vulnerability in Web3Auth, the third-party authentication provider, which compromised private keys for accounts created through social logins. Approximately 20% of these accounts may be affected, with initial loss estimates exceeding $700,000. Users are advised to stop depositing new funds and transfer assets to accounts created via mnemonic phrases or hardware wallets. Keplr and Web3Auth are currently investigating the breach and working on asset recovery measures. No confirmed figures on the total losses or affected accounts have been released yet. Users are cautioned against phishing attempts and advised to rely only on official communications from Keplr and Web3Auth.
Breach · 2 sources · score 65
Italian Foreign Minister's Data Leaked by Pro-Russian Hackers
Italian Foreign Minister Antonio Tajani reported that hackers leaked his personal data on the dark web, exposing him and his family to threats. The attacks, attributed to pro-Russian hackers, coincide with Italy's support for Ukraine. Tajani stated that the hackers have been seeking further personal information and are willing to pay for it. Prime Minister Giorgia Meloni expressed solidarity with Tajani and condemned the actions of the hackers. The hacker group NoName057(16) is believed to be involved, targeting multiple individuals in Italy and beyond. The Italian government is taking steps to address the situation and enhance cybersecurity measures.
Breach · 2 sources · score 63
Cyberattack on TUM Compromises User Data and Shuts Down Key Systems
On November 6, 2026, the Technical University of Munich (TUM) reported a cyberattack that compromised the myTUM portal, leading to the theft of passwords, names, addresses, and dates of birth of all registered users. Attackers gained access through the legacy myTUM system and used stolen credentials from a TUMonline system administrator to target the campus management system, TUMonline. The university has since taken TUMonline offline and blocked affected accounts. Investigations are ongoing, but initial assessments suggest that no further data, such as grades or admission applications, was accessed. TUM has reported the incident to the Bavarian data protection commissioner and filed a criminal complaint. Users are advised to change their passwords and enable multi-factor authentication once available. The attack is believed to have started around November 2, although this has not been confirmed.
Breach · 2 sources · score 56
Claude Code Exposes Secrets in Public GitHub Repositories
Research by Apiiro revealed that Claude Code, an AI coding assistant, has inadvertently saved sensitive information such as passwords and API keys in a hidden file (.claude/settings.local.json) within public GitHub repositories. This issue affects 1,122 copies of the file across 1,994 repositories, with at least 2,539 real secrets identified, including database passwords and cloud keys. The problem arises when users select 'Yes, and don't ask again' while executing commands, causing the assistant to save the command verbatim, including any secrets. The file is not marked as private, leading to its inclusion in commits. Apiiro's findings indicate that 63 organizations, primarily software companies, are impacted, with one organization confirming that its key was live. The researchers recommend rotating all exposed secrets and cleaning up the repositories, as older versions of the file remain in git history. As of November 7, 2026, the secrets are still present in the repositories.
Other Threats · 2 sources · score 56
Mirae Asset Securities Data Breach Exposes Info of 39,000 Customers and Employees
Mirae Asset Securities reported a data breach affecting approximately 39,000 individuals, including 3,800 customers and over 35,000 employees and contractors. The unauthorized access occurred on November 2 and 3, targeting the company's mobile web phone authentication login service and internal systems. Leaked data includes account numbers, names, employee ID numbers, email addresses, mobile phone numbers, and passwords. The firm has since blocked the affected access routes and activated its emergency response system. The incident has been reported to regulatory bodies including the Financial Services Commission and the Financial Supervisory Service. This breach follows similar incidents involving Mirae Asset's sister companies, highlighting a troubling trend in the financial sector. Over 470,000 personal data records have been leaked from 37 companies in the sector in recent weeks, with an estimated 1 billion won stolen.
Breach · 2 sources · score 52
Also worth knowing
Binance Hack Leads to ENA Market Turmoil
The Binance hack on October 29, 2026, resulted in the theft of 18,270.2 BTC and significant selling pressure on Ethena (ENA), which dropped 3.8% as a result. Hackers converted $175 million in stolen altcoins into approximately 2,300 BTC, complicating tracing efforts through over 20,000 wallets. Ethena's market decline was exacerbated by ongoing token unlocks, with 217.5 million ENA reportedly stolen and sold, contributing to a supply overhang. Analysts express concerns about ENA's valuation outpacing its fundamentals, particularly regarding its USDe synthetic dollar product. The situation remains fluid as the market reacts to the fallout from the hack and ongoing token releases.
Other Threats · 2 sources · score 54
New on leak sites
43 victims listed on ransomware leak sites by 9 groups in the 24 hours before this issue. The most active:
Also moving
- CVEs: CVE-2025-20700, CVE-2025-20701, CVE-2025-20702, CVE-2026-19868, CVE-2015-6585
- APT groups: Lazarus Group, APT28, Belarusian Cyberpartisans, Belarusian Cyber Partisans, Crafty Falcon
- Vulnerabilities: Airoha RACE Vulnerabilities
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.