Daily digest,
Vulnerability in OpenEMR Enables Remote Code Execution (+6 more)
Vulnerabilities
Vulnerability in OpenEMR Enables Remote Code Execution
A vulnerability (CVE-2026-124450) has been identified in OpenEMR versions prior to 8.3.0, specifically within the fax/sms module. The flaw involves broken access control and path traversal through an unvalidated file_path parameter. This allows authenticated low-privilege users to read sensitive files, such as sqlconf.php, which contains database credentials. Consequently, attackers can write arbitrary files as the web user, leading to potential remote code execution. The CVE was published on November 8, 2026, with a CVSS score of 9.3, indicating a severity level. Users of OpenEMR are urged to update to version 8.3.0 or later to mitigate this risk. There is currently no indication of in the wild.
Vulnerability · 2 sources · score 78 · CVE-2026-124450, Broken Access Control, Path Traversal
Critical Integer Overflow Vulnerability in imgproxy (CVE-2026-123614)
imgproxy versions 4.0.0 through 4.0.15 are affected by an integer overflow vulnerability in the ICO loader, which can lead to a heap buffer overflow. This flaw allows unauthenticated remote attackers to upload a crafted ICO image, potentially crashing the imgproxy process or executing arbitrary code with the application's privileges. A patch has been released in version 4.0.16, and users are urged to upgrade immediately. Currently, there is no evidence of public proof-of-concept or confirmed exploitation in the wild. The CVSS score for this vulnerability is 9.8, indicating a critical severity level. Network-level controls are recommended to restrict ICO image uploads to trusted sources.
Vulnerability · 2 sources · score 70 · CVE-2026-123614
Ransomware
Ransomware Attack Targets Grupa ABS in Poland
On November 9, 2026, Grupa ABS, a Poland-based environmental services company, was reportedly targeted by the PANZER ransomware group. The attack allegedly resulted in the encryption of 895,002 files and the theft of approximately 30 GB of data. The company's domains were reported down, indicating a significant operational impact. However, no specific details about the nature or sensitivity of the stolen data were provided. The articles caution that claims regarding the attack remain unverified and should be treated as unconfirmed until further evidence is available. No ransom amount or financial demands have been disclosed. The incident highlights ongoing concerns regarding ransomware threats to businesses, particularly in the environmental sector.
Ransomware · 2 sources · score 51 · Panzer
Breaches
Large Data Breaches Hit Retail and Corporate Sectors in Japan and Korea
In recent months, the retail sector in Korea has faced a series of personal data breaches, with over 3 million records compromised. SSG.com reported a breach on November 4, 2026, due to an API vulnerability, affecting customer names and IDs. Other companies like Gmarket and Halys have also reported similar incidents, with a total of approximately 3.83 million records leaked. Meanwhile, in Japan, around 260 million personal information records have been exposed since April 2026, with a significant surge in breaches reported in October. The Personal Information Protection Commission noted 2,094 incidents, with many attributed to AI-assisted hacking. The situation highlights vulnerabilities in both internal systems and third-party services, leading to increased security investments by affected companies.
Breach · 2 sources · score 70
York University Reports Data Theft in Cybersecurity Incident
York University announced a cybersecurity incident involving unauthorized access to personal data from online forms, discovered on October 25, 2026. The breach affected information submitted between 2007 and October 2026, including student identification numbers, academic histories, and financial details. The university is notifying directly affected individuals and has begun an investigation with external experts. No evidence has been found indicating that the unauthorized actor accessed other systems beyond the affected websites. York University is offering two years of free credit monitoring and identity theft protection to those impacted. The incident has been reported to law enforcement and the Information and Privacy Commissioner of Ontario. The university urges affected individuals to monitor their financial accounts for suspicious activity.
Breach · 2 sources · score 56
Iris Ohyama Data Breach Affects 7.7 Million Customers
Iris Ohyama disclosed a data breach involving its Iris Plaza online shopping platform, potentially exposing personal information of 7.7 million individuals. The breach was linked to unauthorized access to a third-party cloud service, discovered on October 28, 2026. Affected individuals include approximately 5.8 million registered members and 1.9 million non-members. The compromised data may include names, addresses, phone numbers, email addresses, gender, dates of birth, and encrypted passwords, while credit card information was not stored in the affected service. The company suspended the Iris Plaza site and related systems immediately after the breach was detected and reported the incident to Japan's Personal Information Protection Commission and local police on October 29. As of November 5, there have been no reports of misuse or financial loss related to the exposed information. The investigation is ongoing, and the company has not yet identified the attacker or the method of access.
Breach · 3 sources · score 52
Threat actors and malware
Viral ChatGPT Prompt Poses Phishing Risk for Crypto Users
On November 7, 2026, a viral prompt on social media urged users to ask ChatGPT to fill an empty room with personal data it knows about them. This prompt reveals stored user data, which can be exploited by attackers for phishing campaigns targeting cryptocurrency holders. The risk arises as users share the generated images publicly, potentially exposing sensitive information such as wallet details and trading habits. OpenAI has not issued a formal security bulletin regarding this specific prompt, and the full extent of the exposed data remains unclear. Attackers can leverage this information for credential-stuffing and wallet-drain attacks if they gain access to a user's ChatGPT session. The prompt does not exploit OpenAI's servers but reveals data retained in the model's memory. As the trend spreads, variations of the prompt have emerged, increasing the potential for misuse. Users are advised to review their memory settings before sharing any generated content.
Phishing · 3 sources · score 52
New on leak sites
17 victims listed on ransomware leak sites by 9 groups in the 24 hours before this issue. The most active:
Also moving
- Campaigns: Be Ready, Be Prepared, Black Sky Event, Dawn Of Yemen Operation, Deepfake Detection Challenge
- CVEs: CVE-2024-1234, CVE-2021-44228, CVE-2025-55182, CVE-2026-111497, CVE-2026-119346
- Vulnerabilities: Path Traversal, Broken Access Control, Cross-site request forgery, Forged Checkpoint Block Body Vulnerability, GHSA-673q-mjm6-r5xr
- Ransomware groups: Akira, hyflock, Panzer, Promptlock
- APT groups: Belarusian Cyberpartisans, GRU, Lazarus Hacking Group, Silent Crow
- Malware: Pegasus, PromptSpy, React2Shell
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.