November 9, 2026

What happened

Elastic Security Threat Command reported that attackers used stolen credentials to log in an average of eight minutes after infection across 27 confirmed infostealer cases. [1]

Researchers documented misuse of AI applications to execute commands and digitally signed remote-monitoring tools to maintain access. [2]

Why it matters

The source characterizes an internet-connected agent that holds credentials as a new attack surface, whether misconfigured or abused. [3]

Known limitations

The supplied spans do not identify the affected systems, the infection-to-login range, or any mitigation guidance. [1] [2] [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Attackers used stolen credentials to log in an average of eight minutes after infection across 27 confirmed infostealer cases, according to a report from Elastic Security Threat Command.

2. [2]

   Researchers also documented misuse of AI applications to execute commands and digitally signed remote monitoring tools to maintain access.

3. [3]

   “An agent that holds credentials and can reach the internet is a new attack surface, whether it’s misconfigured or abused.

4. [4]

   When an attacker is behind it, its activity … More → The post An average of 8 minutes is all hackers need to log in with stolen credentials appeared first on Help Net Security .

Read the original article →

What happened

Barracuda’s report says businesses seeking outsourced cybersecurity want MSPs that can help them recover from attacks, manage AI risks, and explain security problems’ operational meaning. [1]

Among surveyed organizations, 66% already outsource security services to an MSP, while 29% are considering or evaluating providers. [2]

The supplied excerpt identifies recovery as a weak spot and says companies seeking an MSP doubt their ability to spot cyberattacks. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Businesses looking to outsource cybersecurity want providers that can help them recover from attacks, manage AI risks, and explain what security problems mean for their operations, according to Barracuda What MSP Customers Need Next report.

2. [2]

   What MSP customers need next (Source: Barracuda Networks) 66% of surveyed organizations already outsource security services to a managed service provider (MSP), while another 29% are considering or evaluating providers.

3. [3]

   Recovery remains a weak spot Organizations considering an MSP are … More → The post Companies seeking an MSP doubt their ability to spot cyberattacks appeared first on Help Net Security .

Read the original article →

What happened

Wirken is described as an open-source gateway positioned between messaging applications and AI agents. [1]

The gateway assumes an agent could be turned against its owner and limits what a compromised agent can access. [2]

The article states that Wirken connects Signal, WhatsApp, and Telegram, but the supplied text is truncated after this list. [5]

Why it matters

The source describes an agent that can read chats and email, hold account keys, and run commands as capable of affecting sensitive resources. [3]

A hidden instruction in a message or shared document is described as potentially prompting the agent to leak a secret or rewrite files. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Wirken is an open-source gateway that sits between messaging apps and AI agents.

2. [2]

   It assumes any agent can be turned against its owner and limits what a compromised one can reach.

3. [3]

   Take an agent that reads your chats and email, holds the keys to your accounts and can run commands.

4. [4]

   One hidden instruction in a message or a shared document could talk it into leaking a secret or rewriting files.

5. [5]

   Wirken connects Signal, WhatsApp, Telegram, … More → The post Wirken: Open-source AI agent gateway appeared first on Help Net Security .

Read the original article →

What happened

U.S. government agencies warned that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems globally, seeking service disruption, fire hazards, and inventory loss. [1] [2]

The agencies said actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating. [3]

Why it matters

The reported targeting could affect refrigeration operations through service disruption, fire hazards, and loss of inventory. [2] [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   U.S.

2. [2]

   government agencies have warned that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems globally with an aim to cause service disruptions, fire hazards, and loss of inventory.

3. [3]

   "The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating

Read the original article →

What happened

An OpenAI engineer arrested and charged over allegedly planting a covert audio-recording device in the company’s office pleaded not guilty. [1]

Reports cited by the source identify the engineer as Saudi national Abdulrahman Alfozan and state that he entered the plea in San Francisco federal court on Friday. [2]

The next hearing is scheduled for November 17, 2026. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The OpenAI engineer who was arrested and charged last month for planting a covert audio recording device in the company's office has pleaded not guilty.

2. [2]

   According to reports from Bloomberg and CNBC, Saudi national Abdulrahman Alfozan made an appearance in San Francisco federal court on Friday, where he entered the plea.

3. [3]

   His next hearing is scheduled for November 17, 2026.

Read the original article →

What happened

Acronis Threat Research Unit researchers said a single attacker using AI agents obtained emergency dispatch records covering seven Taipei districts. [1]

The agents found a Taipei fire department platform that exposed patient data from 2018, including ECG readings and ambulance video footage, without requiring a login. [2]

Known limitations

The researchers expressed high confidence that the attacker was a single person. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A single attacker using AI agents pulled emergency dispatch records covering seven Taipei districts, researchers at Acronis's Threat Research Unit said last week.

2. [2]

   The agents also found a Taipei fire department platform exposing patient data from 2018, including ECG readings and ambulance video footage, without a login.

3. [3]

   The researchers are highly confident that the attacker is a single person

Read the original article →

What happened

LNbits, an open-source Bitcoin Lightning wallet system, said operators should shut down their servers amid a wave of attacks. [1]

The project said several security fixes were pending release and asked operators to exercise caution until they were available. [2]

Why it matters

One operator reported that newly created accounts exploited a vulnerability to withdraw 2,285,545 satoshis—about 0.023 bitcoin—from the operator’s server before the account activity could be stopped. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Everyone running LNbits, a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday.

2. [2]

   It has several security fixes to release and asked operators to be careful until they are out.

3. [3]

   One operator said new accounts used an exploit to withdraw 2,285,545 satoshis, about 0.023 bitcoin, from his server before he could

Read the original article →

What happened

Some users who set up a Keplr crypto wallet through Google or Apple sign-in had funds stolen by an attacker. [1]

Keplr uses Web3Auth to provide Google and Apple sign-in, and both companies said the attacker reached wallets by exploiting a security flaw at Web3Auth. [2] [3]

Web3Auth used the attacker’s route to empty other at-risk wallets before the source text ends. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker.

2. [2]

   Keplr uses a company called Web3Auth to run that Google and Apple sign-in.

3. [3]

   The attacker used a security flaw at that company to reach the wallets, both companies said late last week.

4. [4]

   Web3Auth then used the attacker's own route to empty other at-risk wallets before the attacker

Read the original article →