The Executive by MaxwellCTI Digest: November 5, 2026

Get the full story at intel.maxwellcti.com.

OpenAI detailed an AI pipeline that identified 948 Linux vulnerabilities, while Crédit Mutuel Arkéa confirmed a cyber heist resulting in an estimated theft of over $133 million.

Novel techniques

OpenAI AI Pipeline Creates 948 Linux Root Escalation Exploits

OpenAI detailed an agentic AI pipeline using an upcoming cyber-focused model that identified and patched 948 local privilege escalation vulnerabilities in a commonly used Linux distribution. OpenAI stated the agents used at least 10 novel Linux exploitation techniques, including two new persistent elastic objects, two new page grooming techniques, five new data-only techniques, and one arbitrary type confusion technique. OpenAI stated that for the near and medium term, having a low-privileged account on an operating system that is not up-to-date on patches should be considered functionally equivalent to root access for a well-resourced threat actor.

Business

French bank confirms cyber heist, hackers suspected to have stolen an estimated $133 million

Attackers compromised an unnamed supplier to gain access to Crédit Mutuel Arkéa and transferred funds to other institutions, resulting in an estimated theft of over $133 million. The bank stated that customer accounts and assets were not impacted.

Critical vulnerabilities

• Apple operating systems (CVE-2024-27834): attackers can bypass Pointer Authentication and it is already exploited; Apple has released a patch.
• SonicWall GMS (CVE-2026-102255, CVE-2026-109593, CVE-2026-109594): attackers can read internal files, modify database information, and CVE-2026-102255 is exploited; SonicWall will not patch the product. (story)
• Zyxel GS1900 switches (CVE-2026-107441): unauthenticated attackers can execute operating system commands with root privileges, and it is exploited; Zyxel has released security updates. (story)
• Google Android (CVE-2026-58868, CVE-2026-58876, CVE-2026-58882, CVE-2026-58936): attackers can run code or cause a denial of service, and they are not exploited; Google has released a patch.
• Barracuda Email Security Gateway (CVE-2023-2868, CVE-2026-111560, CVE-2026-116606): attackers can obtain root access, and CVE-2023-2868 was exploited; Barracuda has released patches.
• Ruby on Rails Active Storage (CVE-2026-66066): unauthenticated attackers can exploit a flaw, and the Rails project has released fixes.