The Executive by MaxwellCTI Digest: November 4, 2026

Get the full story at intel.maxwellcti.com.

Data breaches affected Harvard University, Frontline Education, and Revolve, while AI was used in attacks against WorkOS and a UK school estate.

Novel techniques

WorkOS Breach Linked to ARTEX AI Offensive Security Framework

A threat actor used the ARTEX AI offensive security framework to gain unauthorized access to an internal sales application at WorkOS. This open-source penetration testing suite released by Chinese developers was used to automate reconnaissance and exploitation. Accessed data included business contact details, customer account histories, business relationship information, and summaries of customer communications.

AI-assisted ransomware attack hits UK school estate

A 3AM ransomware affiliate encrypted approximately 37 of nearly 50 machines in a UK school estate. Bitdefender researchers believe the attacker used a hybrid approach involving a human operator and an AI-generated agentic loop to handle repetitive command generation and troubleshooting. The National Cyber Security Centre urged critical infrastructure to prepare for AI-powered ransomware attacks by 2028.

Business

ShinyHunters Leak Data From 851,000 Harvard University Accounts

ShinyHunters leaked a 1.1GB archive containing data from 851,000 Harvard University accounts on the dark web. The exposed information includes names, dates of birth, social media profiles, and other profile information.

Frontline Education Breach Exposes Data of 1.3 Million People

Frontline Education experienced a data breach that affected 1,298,917 people, including school district staff and students. The stolen data from Frontline Central and School Health Management products may include Social Security numbers, government ID numbers, and health insurance information. The breach occurred through the exploitation of a third-party software vulnerability.

Revolve card breach: 1.5 million people may be affected

Payment and contact information was stolen from the Revolve Group. Malwarebytes reports that data from the Texas Attorney General website lists 1,515,073 people as affected, though Revolve has not confirmed this figure. Revolve stated it has implemented additional security measures following the breach.

Critical vulnerabilities

• WordPress Core (CVE-2026-119977): unauthenticated attackers can execute arbitrary code on affected servers, and it is already exploited; patches have been released.
• Node-RED (CVE-2026-58115): unauthenticated remote attackers can execute arbitrary code on the server with maximum privileges, and it is already exploited; Siemens has released a patch.