Since Anthropic launched its Mythos bug-finding model in April, developers have been uncovering software flaws faster than anyone has been able to fix them. Microsoft patched a record 974 flaws in September, its third record-setting month this year, and Oracle fixed 1,449 in a single month. Now Linus Torvalds says the tide might be turning.

In his weekly kernel update, Torvalds shipped Linux 7.4 rc2 and called it a big release, partly because of “various AI fixes.” The encouraging detail is that Alexei Starovoitov, lead developer on eBPF, reports that fixes in that area are now arriving faster than new bug reports. Torvalds called that lovely if true, but he stressed that most other parts of the kernel haven’t reached that point yet. His advice was to cross your fingers, not hold your breath.

For security teams, a peak in discovery doesn’t mean breathing room. Attackers are increasingly going after flaws that AI has found, and patch volumes are still far beyond what many IT teams are staffed to handle.

https://www.theregister.com/security/2026/11/09/linus-torvalds-sees-signs-ai-prompted-patch-flood-has-peaked/5308345 

Did someone forward you this? Subscribe to this newsletter.

In other cybersecurity news:

Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware. The campaign started about two years ago and initially targeted crypto wallet users, but recently the threat actor switched focus and published malicious repositories for automating scans, security testing, and log analysis. Researchers at cybersecurity company Dr. Web found that more than 2,000 Windows systems have been compromised so far. One malicious repository they found is a fake script advertised as a lightweight solution to parse, clean, and format output from the Fscan network scanner.
https://www.bleepingcomputer.com/news/security/fake-security-tools-on-github-push-backdoors-and-infostealers/

Developers who approve shell commands in Anthropic’s Claude Code may be saving live credentials in a file that ends up on public GitHub, according to new research from security firm Apiiro. By default, Claude Code asks before running most shell commands. If the developer chooses “Yes, and don’t ask again,” the tool saves an allow rule in .claude/settings.local.json inside the project. That rule contains the exact command, word for word.
https://kylesinvestigation.com/2026/11/07/claude-codes-yes-and-dont-ask-again-option-can-leak-passwords-and-api-keys-to-github/

A large-scale watering hole attack associated with Russian hackers has been targeting iOS and Android users visiting compromised sites or fake ones impersonating legitimate portals. The campaign used multiple high-profile websites in the U.S., Ukraine, the Czech Republic, and Bulgaria that delivered the same payload for profiling visitors and their devices. This initial stage allows the attacker to determine the browser version to deploy "platform-specific n-day exploit chains without user interaction."
https://www.bleepingcomputer.com/news/security/hackers-use-n-day-exploits-in-zero-click-attacks-on-ios-android-devices/

Nvidia Corp.'s board is launching an investigation into whether Chief Executive Officer Jensen Huang was targeted by a foreign espionage plot after he admitted to employees that he was unfaithful to his wife.
https://finance.yahoo.com/technology/ai/articles/nvidia-board-probe-spying-case-200611558.html

SonicWall has warned of two vulnerabilities impacting end-of-life Global Management System (GMS) systems that it said will not be patched. Details of the security flaws, which affect SonicWall GMS 9.5.2:

• CVE-2026-109593 (CVSS score: 9.1) - An unauthenticated file read vulnerability that could allow an attacker with network access to read internal GMS files, potentially exposing sensitive information.

• CVE-2026-109594 (CVSS score: 6.8) - A post-authentication SQL injection vulnerability that could allow an authenticated attacker to access or modify information stored in the GMS database under specific conditions.
  https://thehackernews.com/2026/11/sonicwall-wont-patch-eol-gms-flaws-that.html

Students and staff whose CNet IDs were disabled were unable to access platforms requiring their UChicago logins on Saturday. The CS department’s director of techstaff confirmed that no user data had been compromised as a result of the cyberattack.
https://chicagomaroon.com/54546/news/cnet-ids-disabled-following-cyberattack-on-computer-science-department/

Pro-Russian hackers leaked Italian Foreign Minister Antonio Tajani’s personal data onto the dark web, offering bounties for further intelligence on him and his family amid rising European geopolitical tensions. Italian Foreign Minister Antonio Tajani disclosed on 8 November 2026 that pro-Russian cybercriminals had leaked his personal data onto the dark web, explicitly linking the breach to Italy’s steadfast support for Ukraine. Tajani stated on X that ‘for days, cybercriminals have been spreading my personal data on the dark web and seeking other information, in fact exposing me and my family to new threats and intimidation’ [
https://wsnext.com/da64e1e-Cybersecurity-Geopolitics/

Japan launched a multimillion-dollar emergency policy package on Friday (Nov 6) to address a sudden wave of hacking incidents. The country's Prime Minister Sanae Takaichi has vowed to take action after dozens of businesses reported unauthorised access in recent weeks to their systems and potential leaks of client data.
https://www.channelnewsasia.com/asia/japan-cybersecurity-package-hacking-attacks-6531921

On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357, a missing authentication for critical function vulnerability (CWE-306), with a CVSSv3.1 score of 8.8; it allows a local authenticated attacker to escalate privileges. CVE-2026-118527, classified as generation of predictable numbers or identifiers (CWE-340), has an Ivanti-assigned CVSSv3.0 score of 4.3 and, according to CISA's KEV entry, allows a remote authenticated attacker to upload attacker-controlled content to a known location on disk.
https://www.rapid7.com/blog/post/etr-additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-cve-2026-118527/

Singapore Airlines (SIAL.SI), opens new tab said on Tuesday that about 46,000 booking records may have been affected by ​a cybersecurity incident involving Amadeus (AMA.MC), opens new tab, its reservation technology ‌provider.
https://www.reuters.com/world/asia-pacific/singapore-airlines-says-46000-booking-records-affected-by-amadeus-breach-2026-11-04/

A stealthy malware toolkit dubbed ArmorSteal is now infecting Windows machines by posing as trusted software packages. Once installed, it drains credentials, crypto wallets, Discord accounts—and quietly mines Monero in the background.
https://thedailytechfeed.com/armorsteal-malware-masquerades-as-legit-tools-to-steal-crypto-and-credentials/

Attackers using the Anubis ransomware, which is developed by a group Symantec tracks as Hawkmoth, deployed a previously undocumented custom backdoor and an unusually large number of security software-disabling tools in an October 2026 attack on an organization in the U.S.  Hawkmoth runs a ransomware-as-a-service (RaaS) operation that emerged in December 2024 as a rebrand of the Sphinx ransomware. Its payload appears to be largely unchanged from the Sphinx version, with only the branding updated. As Hawkmoth operates an affiliate program, Anubis attacks may be carried out by different groups of affiliates. Attackers using it seem to be particularly tenacious. In a July 2026 Anubis attack documented by Symantec, we noted that the threat actor used four different exfiltration tools (Megasync, WinSCP, Filezilla, S3browser) to steal data from the affected network and that it was unusual to see that many of the same type of tool deployed in a single attack.
https://www.security.com/threat-intelligence/lindnor-new-backdoor-anubis-ransomware

On October 28th, 2026, the WordPress Security Team released WordPress 7.1.4, along with backported security releases for older branches, addressing several security issues, most notably an Unauthenticated Remote Code Execution vulnerability in WordPress core, identified as CVE-2026-119977. The vulnerability affects WordPress core versions 4.7 through 7.1.3 and can be leveraged by unauthenticated attackers to execute code on the server during a core upgrade, which can lead to complete site compromise. Since this is a race condition vulnerability that can only be exploited during the short window while a core upgrade is in progress, successfully exploiting it to achieve remote code execution is difficult in practice. Our records indicate that attackers started targeting this vulnerability on the same day it was disclosed. The Wordfence Firewall has already blocked over 240,000 exploit attempts targeting this vulnerability.
https://www.wordfence.com/blog/2026/11/attackers-actively-probing-for-upgrade-window-rce-vulnerability-in-wordpress-core/

French cooperative bank Crédit Mutuel Arkéa was hit by a cyberattack that let attackers make fraudulent transactions of up to $133 million, forcing it to suspend certain systems. Crédit Mutuel Arkéa is a major French cooperative banking and insurance group headquartered in Brest, Brittany, France. The bank says the attacker used its own account to send transactions to other banking organizations, and that customer assets weren’t affected.
https://securityaffairs.com/202628/cyber-crime/attackers-exploit-third-party-provider-to-raid-french-bank-credit-mutuel-arkea.html

Albert Heijn parent Ahold Delhaize expects its fourth-quarter revenue to be between €200 million and €250 million lower due to the cyberattack that took several of its brands offline for two weeks last month, the company said with its third-quarter results. Ahold Delhaize reported having a strong third quarter, but warned that fourth-quarter profits would be between €75 million and €100 million lower due to the cyberattack.
https://nltimes.nl/2026/11/04/cyberattack-cost-albert-heijn-parent-ahold-delhaize-estimated-eu250-million

USPS inspector general confirmed the mail agency’s social-media surveillance of protests exceeded its legal authority, while key records vanished. What started as a program to track opioids and illegal firearms moving through the mail became something considerably harder to explain. The Postal Inspection Service was operating iCOP (Internet Covert Operations Program) by 2018, using open-source intelligence tools, cryptocurrency analysis, and social-media monitoring to support investigations.
https://www.gadgetreview.com/the-postal-service-built-a-surveillance-program-then-it-lost-the-records

On November 9, 2026—the post date, as no separate compromise date is provided—a leak-site post named Expedia Group, Inc., a hospitality company operating in online travel and consumer loyalty, as a victim. The post describes the incident as data exposure and labels the material “not paid — exposed”; it does not state that systems were encrypted. The attackers claim to hold extensive loyalty and traveler data, including 830 million loyalty-program records across 800 files, with consumer email addresses, member identifiers, point balances, tier information, and booking values. They also describe a traveler-profile table containing approximately 58 million records, an account and credential archive with more than 333 million records, and consumer bureau enrichment feeds comprising approximately 439 million lines. These are claims made in the post and have not been independently verified.
https://www.redpacketsecurity.com/n0n-ransomware-victim-expedia-group-inc/

An Estonian newspaper recently revealed that a British soldier disobeyed a direct order to remove the SIM card from his cellphone before being deployed to a part of Estonia, approximately 90 miles west of the Russian border. As a result of his refusal to engage in this element of operational security (opsec), the soldier, Daniel Barton-Kennedy, had his phone hacked, and nude photos of himself were stolen and used as blackmail against him.
https://arstechnica.com/security/2026/11/british-soldier-ignored-order-to-pull-his-sim-card-then-got-blackmailed/

A leak-site post dated November 7, 2026, names maersk, a transportation company, and claims that approximately 100 GB of data was obtained from a platform used for its contract-logistics operations. No compromise date is provided, so November 7, 2026, is the post date rather than a confirmed date of intrusion. The post describes the incident as a data theft and extortion matter; it does not state that maersk’s systems were encrypted. The claims have not been independently verified.
https://www.redpacketsecurity.com/whitearmor-ransomware-victim-maersk/