The Signal
Must Know
Cloud · Theregister Security
What happened
Unknown attackers used compromised Qubole AWS IAM credentials to access customer AWS environments, steal secrets and other sensitive data from S3, and abuse Qubole’s cross-account IAM trust relationship. [1]
Wiz described the activity as a broad, opportunistic supply-chain campaign affecting multiple customer environments, although it did not disclose the number affected. [1]
Why it matters
Researchers said active trust policies left after Qubole deprecation enabled attackers to assume integration roles, enumerate resources, harvest secrets and siphon data. [1]
A deprecated integration relationship is part of the exposure boundary here, not merely a credential-access issue. [1]
AI & Agents · Arstechnica Security
What happened
Researchers report active exploitation of the critical *sshole vulnerability, which arises from interaction between OpenSSH and the musl library and can affect Linux systems meeting additional requirements. [2]
On affected systems, the vulnerability can provide unauthenticated access to high-privilege accounts within seconds. [2]
Why it matters
Greynoise said its Southeast Asian honeypots were attacked by a group it tracks as GT10, describing the activity as mature intrusions. [2]
Assessment should distinguish systems meeting the stated additional requirements from Linux systems generally. [2]
Vulnerability · Tenable Blog
What happened
U.S. agencies urged critical-infrastructure organizations to secure industrial refrigeration and cold-chain monitoring systems after reported attacks involving French blood banks and European supermarkets. [3]
The agencies said attackers are targeting refrigeration controllers through unpatched vulnerabilities, misconfigurations, and weak or hard-coded passwords, then using remote access to manipulate temperatures and spoil food, blood, or other products. [3]
Why it matters
The agencies said temperature changes could damage refrigerated products and trigger fire hazards, creating risks for healthcare, food and agriculture, chemicals, and transportation operations. [3]
The potential safety effects place this in a different operational risk category from ordinary information exposure. [3]
AI & Agents · Theregister Security
What happened
Anthropic is extending access to its Mythos bug-finding model through Cisco and IBM security products rather than allowing end users to use the model directly. [4]
Cisco’s AI Defense red-teaming tools will be able to call Mythos to test customers’ AI models, agents, applications, and related setups; Cisco says the capability will be included under existing licenses at no additional cost. [4]
Why it matters
Anthropic initially restricted Mythos to vetted organizations testing codebases and has expanded access through controlled programs because the model could help attackers exploit software flaws if misused. [4]
Its delivery model makes access governance central to how this security-testing capability is operationalized. [4]
Also Worth Knowing
Identity · Malwarebytes Labs
What happened
Perry Johnson & Associates and four related companies agreed to pay $300,000 and implement security reforms after a breach exposed personal and medical information associated with more than 13.3 million people, including about 4.2 million New Yorkers. [5]
Exploitation · The Hacker News
What happened
CISA added four security flaws affecting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. [6]
Incident · Cyberscoop
What happened
ESET reported discovering a modular Turla toolset, dubbed “Turla’s Cereal,” in November 2025; it chains legitimate functions across Microsoft Exchange, Windows, and .NET assemblies. [7]