November 8, 2026

Security consequence is clearest where access failures were followed by financial fraud or blackmail. The other selected reports are more directly useful as boundaries for credential-handling and SSH-monitoring decisions. [1][2][3][4]

What happened

Crédit Mutuel Arkéa said attackers accessed it through a service provider’s platform and used the bank’s own account to execute fraudulent transactions through other banking organizations. [1]

Reported losses ranged from around €100 million to as much as €118 million ($133 million), but Arkéa did not confirm the reported figure and validated only the order of magnitude. [1]

Why it matters

The attack reportedly converted funds into cryptocurrency; a report said the lack of public disclosure allowed approximately $30 million to be laundered by November 3, potentially limiting authorities’ ability to freeze it. [1]

What happened

An Estonian newspaper reported that British soldier Daniel Barton-Kennedy refused an order to remove his cellphone SIM card before deployment to part of Estonia about 90 miles west of the Russian border. [2]

The report states that Barton-Kennedy’s phone was hacked, nude photos were stolen, and the images were used to blackmail him. [2]

Why it matters

The refusal was described as a failure to follow an element of operational security, followed by phone compromise and blackmail. [2]

What happened

Passwords and API keys entered into commands approved in Claude Code were found in public GitHub repositories, making them readable to anyone. [3]

Selecting “Yes, and don't ask again” can cause Claude Code to save an approved command verbatim, including a secret, in a project settings file. [3]

Why it matters

Approval workflows can become a repository-exposure concern when project settings preserve commands containing credentials. [3]

What happened

The honeypots use Cowrie to collect SSH data and are seeing increased attempts to exploit the “sshole” vulnerability, identified as CVE-2026-123158. [4]

The source reports that longer passwords are highly unusual and are not used for the usual password brute-forcing it observes. [4]

Why it matters

The observation is useful for SSH monitoring, but it does not establish exploitation success or a broader prevalence rate. [4]