November 8, 2026

What happened

Crédit Mutuel Arkéa said attackers accessed it through a service provider’s platform and used the bank’s own account to execute fraudulent transactions through other banking organizations. [1] [2] [3]

Reported losses ranged from around €100 million to as much as €118 million ($133 million), but Arkéa did not confirm the reported figure and validated only the order of magnitude. [4] [5] [6] [7]

Arkéa said the incident was contained and under control, customer assets were unaffected, some transfers were delayed, and operations were gradually resuming after verification and enhanced security measures. [10] [11] [12]

The bank described the incident as a sophisticated attack, ruled out internal human error, and said it was working with law enforcement to identify the attackers and determine how the breach occurred. [13] [14]

The Paris prosecutor’s cybercrime unit opened an investigation after Arkéa filed a complaint, with France’s cybercrime police leading the probe. [15]

Why it matters

The attack reportedly converted funds into cryptocurrency; a report said the lack of public disclosure allowed approximately $30 million to be laundered by November 3, potentially limiting authorities’ ability to freeze it. [3] [8] [9]

Known limitations

The attacker remains unidentified; ZachXBT assessed it as highly unlikely to be Lazarus Group based on laundering indicators, while Arkéa did not confirm the reported loss amount. [6] [7] [16]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   French Bank Crédit Mutuel Arkéa says hackers exploited a service provider to steal up to $133 million using the bank’s own account.

2. [2]

   The bank says the attacker used its own account to send transactions to other banking organizations, and that customer assets weren’t affected.

3. [3]

   Attackers reportedly accessed the bank through a service provider’s platform, not Fortuneo, and used Arkéa’s own account to move funds through other banks and convert them into cryptocurrency.

4. [4]

   “French lender Credit Mutuel Arkea said on Thursday hackers had stolen around €100 million ($112.61 million) in a cyber heist and it was working to try to recover the money, in a rare case of cybercriminals successfully stealing from a mainstream bank.” Reuters states .

5. [5]

   He said the attacker may have stolen up to 118 million euros ($133 million) and withdrawn it as the USDC and USDT stablecoins.

6. [6]

   Arkéa did not confirm ZachXBT’s reported figure but acknowledged significant losses and said some funds were blocked.

7. [7]

   When the FAQ asked whether 118 million euros had been stolen, Arkéa wouldn’t give a number: We do not confirm this information and can only validate the order of magnitude.

8. [8]

   “Over the past 24 hours the illicit actor has been aggressively swapping USDC for ETH, transferring to instant exchanges (WellWallet, Kyrrex, etc), converting to XMR via Wagyu, and bridging across multiple chains.” ZachXBT wrote .

9. [9]

   According to BleepingComputer , the expert pointed out that the lack of public disclosure allowed attackers to launder $30 million by November 3, potentially preventing EU authorities from freezing the funds.

10. [10]

    Arkéa disclosed the incident on November 4, saying it was contained, customer assets were unaffected and some transfers had been delayed.

11. [11]

    “Upon detecting this attack, and in accordance with standard procedures, the Group contacted the relevant regulatory and supervisory authorities to inform them of the situation.” “This incident is now closed and fully under control.

12. [12]

    Operations are gradually resuming this morning, following thorough verification by the Group and its subsidiaries and the implementation of enhanced security measures.” Crédit Mutuel Arkéa says customer assets were unaffected, although some transfers were delayed.

13. [13]

    Its teams are assessing the incident and strengthening security measures, with further updates expected.

14. [14]

    The bank ruled out internal human error, described the incident as a sophisticated attack and is working with law enforcement to identify the attackers and establish how the breach occurred.

15. [15]

    The Paris prosecutor’s cybercrime unit opened an investigation after receiving a complaint from Crédit Mutuel Arkéa, with France’s cybercrime police leading the probe.

16. [16]

    “While the illicit actor remains unidentified, I can say with a high degree of confidence it is NOT Lazarus Group based on multiple laundering indicators.” The attacker remains unidentified, but ZachXBT believes it is highly unlikely to be Lazarus Group , based on money-laundering patterns.

Read the original article →

What happened

The honeypots use Cowrie to collect SSH data and are seeing increased attempts to exploit the “sshole” vulnerability, identified as CVE-2026-123158. [1] [2]

The source reports that longer passwords are highly unusual and are not used for the usual password brute-forcing it observes. [5]

Known limitations

The source characterizes its data on these exploitation attempts as limited. [3]

The honeypots collect only the first 255 characters of SSH passwords, so observations involving longer passwords are not fully captured. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Our honeypots use "Cowrie" to collect SSH data.

2. [2]

   With the emergence of the "sshole" vulnerability last week, we are now seeing an increase in attempts to exploit the vulnerability.

3. [3]

   Our data is a bit limited in this respect.

4. [4]

   Our honeypots collect only the first 255 characters of SSH passwords.

5. [5]

   Longer passwords are highly unusual and not used for the usual password brute-forcing we observe.

Read the original article →

What happened

Brenner Base Tunnel SE confirmed that unauthorized people accessed some company data; Everest claimed it stole 812 GB, but that volume has not been independently verified. [1] [2] [3] [4]

BBT SE reportedly said operations were unaffected, the involved systems were isolated, and outside forensic experts and authorities were investigating. [5] [6]

Why it matters

Drawings, surveys and site procedures could reduce an attacker’s reconnaissance and support impersonation of the project in fraudulent requests, but the source describes these as scenarios rather than observed effects. [7] [8] [9]

The source reports no evidence that attackers accessed industrial systems or altered tunnel-control functions, and says BBT SE has not confirmed system encryption. [10] [11] [12] [13]

The tunnel is not expected to open before 2034, and older drawings may describe designs that have since changed; the source therefore says claims that ransomware could stop the tunnel lack factual support. [14] [15]

Known limitations

Key unresolved questions are which files were stolen, how recent and relevant they are, and who might still be able to use them. [16]

Whether NIS2 applies to a project company still under construction depends on its activities and the applicable national legislation. [17]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Brenner Base Tunnel SE confirms a breach and Everest claims 812 GB.

2. [2]

   Brenner Base Tunnel (BBT) SE, the company building the Brenner Base Tunnel between Italy and Austria, has confirmed that unauthorized people accessed some of its data.

3. [3]

   The extortion group Everest claims it took 812 GB of files.

4. [4]

   Nobody has verified that, and a criminal bragging about file sizes isn’t an audited source.

5. [5]

   The intrusion reportedly dates to mid-October, Everest’s claim to 17 October, and the Austrian press broke the story on 6 November.

6. [6]

   On 7 November BBT SE told ANSA that operations are unaffected, the systems involved are isolated, and outside forensic experts and the authorities are on the case.

7. [7]

   If real and current, drawings, surveys and site procedures would save an attacker a lot of reconnaissance.

8. [8]

   Together they could show how the infrastructure fits together, and fraudsters could borrow project names to fool contractors.

9. [9]

   Those are scenarios, not sightings.

10. [10]

    Knowing how a tunnel is built does not mean being able to control it.

11. [11]

    Sabotage requires access to operational systems and weaknesses that attackers can exploit.

12. [12]

    So far, there is no evidence that attackers accessed industrial systems or tampered with the tunnel’s control functions.

13. [13]

    BBT SE has not confirmed any encryption of its systems either.

14. [14]

    The tunnel won’t open before 2034, at a projected cost of about €11.7 billion, so older drawings may describe a design that has since changed.

15. [15]

    Claims that ransomware could stop the tunnel therefore have no factual support.

16. [16]

    There are three key questions that need clear answers: which files were actually stolen, how recent and relevant they are, and who might still be able to use them.

17. [17]

    Whether NIS2 applies to a project company that is still under construction depends on its activities and the relevant national legislation.

Read the original article →

What happened

Huawei launched the Qingyun HM650 desktop PC, which it says uses only parts made in China, including its own Kirin X90 processor; the machine runs an enterprise version of HarmonyOS. [1] [2] [3]

A Chinese government agency has reportedly signed up for 600 Qingyun HM650 machines, amid a government order for agencies to move from Wintel PCs to local alternatives. [6] [7]

Why it matters

The source characterizes the PC’s debut as potentially negative for Intel, AMD, and Qualcomm, while noting that China’s government is a major buyer and exclusion from its procurement opportunities could matter commercially. [8] [9]

Known limitations

Although Huawei reportedly claims Chinese companies manufactured all components, it remains unclear whether every component uses Chinese designs, because non-Chinese companies operate factories in China. [4] [5]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Huawei claims it’s built a desktop PC that uses only parts made in CHina.

2. [2]

   The company launched the Qingyun HM650 last week and said it uses Huawei’s own Kirin X90 processor, a ten-core 20-thread machine with a clock speed of 2.3 GHz.

3. [3]

   The machine runs a newly developed enterprise version of HarmonyOS, the OS Huawei developed to end its dependence on Android and which it intends to run on most of the devices it makes.

4. [4]

   While Huawei has reportedly claimed local companies manufactured 100 percent of the components in the machine, it is unclear if all those components use Chinese designs.

5. [5]

   The Register mentions that uncertainty as many non-Chinese companies continue to operate factories in China.

6. [6]

   A single Chinese government agency has reportedly signed up for 600 of the machines.

7. [7]

   That’s not an indication this machine is a curiosity, because Beijing has ordered all government entities to shift from Wintel boxes to local alternatives.

8. [8]

   Even if Huawei is using some parts that aren’t entirely Chinese, the debut of the Qingyun HM650 is bad news for Intel, AMD, and Qualcomm, as all are suffering as the PC market shrinks due to the rising cost of memory.

9. [9]

   China’s government is an enormous buyer, and losing the chance to bid for its business is unlikely to be helpful.

Read the original article →

What happened

Linux kernel developer Linus Torvalds described Linux 7.4-rc2 as a major release partly because it included “various AI fixes,” after code was omitted from rc1. [1] [2] [3]

The article reports that AI-assisted bug finding has coincided with unusually large patch volumes, including Microsoft addressing 974 flaws in September and Oracle addressing 1,449 flaws in one month. [3] [4] [5]

Torvalds reported Alexei Starovoitov’s claim that, at least in eBPF, fixes were arriving faster than new reports; Torvalds said most other kernel areas had not reached that point. [7] [8] [9]

Why it matters

The article says the patch volume exceeds what IT teams are prepared to handle, while attackers are increasingly targeting flaws found by AI. [6]

Interpretation: If the reported eBPF trend extends to other kernel areas, the volume of fixes developers and users must handle could have peaked; the source presents this as a possibility, not an established outcome. [7] [9] [11]

Known limitations

Torvalds presented the possible improvement cautiously, saying it might indicate the tide was turning and warning readers not to assume the change was imminent. [9] [10]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Writing in his weekly kernel update post, the Linux kernel dev leader delivered Linux 7.4 rc2 – the second rough cut of the next kernel – which he rated as a big release for two reasons.

2. [2]

   One is that he left some code out of rc1, because he was busy and because it was already the largest such release in the history of the kernel.

3. [3]

   The other is what Torvalds described as “various AI fixes.” Such fixes are necessary because ever since Anthropic launched its Mythos bug-finding model in April, developers have been able to find more software flaws than was previously possible.

4. [4]

   Microsoft, for example, addressed a record 974 flaws in September – its third record fixing spree this year after it whacked 622 flaws in July and 206 in June.

5. [5]

   Oracle addressed 1,449 flaws in a single month.

6. [6]

   That’s many more patches than IT teams are set up to handle, yet they must find ways to deal with bugs more quickly because attackers are increasingly targeting flaws found by AI.

7. [7]

   “This time around Alexei claims that on the bpf side at least the fixes are now coming in faster than the new reports, and that sounds lovely if true,” he wrote.

8. [8]

   That’s a reference to Alexei Starovoitov, co-creator and lead dev on the Extended Berkeley Packet Filter (eBPF), the project that makes it possible to run sandboxed programs within the Linux kernel.

9. [9]

   “I think most other areas haven't reached that point yet, but it's at least a sign that we _may_ be starting to see the tide starting to turn,” he added.

10. [10]

    “Don't hold your breath, but maybe cross your fingers we'll be getting there in the not entirely distant future.” If Torvalds is correct, that’s welcome news.

11. [11]

    If AI soon stops finding flaws in other parts of the kernel beyond eBPF, perhaps the deluge of fixes developers and users alike will need to handle has peaked.

Read the original article →