This week’s cybersecurity landscape combined rapidly weaponized vulnerabilities, attacks on legacy and third-party systems, AI-related security risks, and breaches exposing credentials, identity documents, and financial data. Active exploitation of a SonicWall flaw demonstrated the urgency of patching, while incidents involving Maersk, Railway, DigiCert, Chainalysis, and Crédit Mutuel Arkéa highlighted the consequences of third-party and overlooked infrastructure.
Major Threats & Vulnerabilities
Active Exploitation and Accelerating Attack Timelines
SonicWall SSLVPN authentication bypass: CISA confirmed active exploitation of CVE-2026-19868 by adding it to the Known Exploited Vulnerabilities catalog. Attackers possessing valid alternative credentials can exploit the vulnerability to bypass SAML authentication and multifactor authentication, potentially gaining access to internal networks. Organizations should identify affected appliances, apply available remediation immediately, review authentication logs, rotate potentially exposed credentials, and investigate suspicious VPN sessions.
Public exploits are weaponized within minutes: CrowdStrike observed attackers exploiting a vulnerability only 35 minutes after public proof-of-concept code appeared. Furthermore, 91% of observed vulnerabilities with public PoCs were attacked within 48 hours. Security teams should monitor proof-of-concept disclosures, prioritize internet-facing systems, accelerate emergency patching, and use compensating controls when fixes cannot be deployed quickly.
Critical Enterprise and Application Vulnerabilities
SAP patches maximum-severity flaws: SAP addressed four vulnerabilities carrying CVSS scores of 10.0. The flaws affected code execution, authentication, impersonation, and unauthorized actions. No exploitation had been reported at publication time, but their maximum severity warrants rapid patch deployment, verification, exposure assessment, and monitoring for suspicious activity.
Zoom Workplace for Windows flaws: Two Zoom Windows vulnerabilities could allow unauthenticated network attackers to escalate privileges. Both require user interaction, and no exploitation had been reported. Administrators should deploy and verify the update across managed endpoints, confirm that vulnerable versions have been removed, and monitor systems for unusual privilege changes.
Chrome fixes 213 vulnerabilities: Google’s latest Chrome security update addressed 213 vulnerabilities, including seven critical and 77 high-severity flaws. Some could enable malicious code execution, although no active exploitation was reported. Organizations should enforce browser updates, verify version compliance, and prioritize systems used to access sensitive applications.
Samsung addresses Android and Galaxy flaws: November updates fixed multiple Android and Samsung Galaxy vulnerabilities, including a critical Android issue that could permit remote code execution without user interaction. Availability and exposure differ by device model and region, so administrators should inventory mobile devices, check patch availability, and confirm successful installation.
iOS sandbox bypass threatens cryptocurrency data: Researchers found an iOS flaw that could expose application files and cryptocurrency wallet secrets to malicious applications. A proof of concept is available, but exploitation in the wild had not been confirmed. Users should limit installations to trusted applications, keep devices updated, review application behavior, and avoid storing unprotected wallet secrets on potentially exposed devices.
GhostMap can force Android crash loops: The GhostMap Android vulnerability allows a malicious application to repeatedly crash a device without permissions or execution. Recovery could require a factory reset, potentially causing data loss, and Google has not committed to a fix. Users should avoid untrusted applications, maintain recoverable backups, and apply future platform or vendor updates when available.
Systemic Software and AI Security Risks
UK government code contained more than 100 flaws: A researcher discovered over 100 vulnerabilities in UK government software, along with an exposed Microsoft Entra ID credential and excessive SharePoint and OneDrive access. The reported problems have been fixed. The findings reinforce the need for credential scanning, least-privilege access, code review, dependency analysis, and continuous testing of public-sector software.
Critical flaws remain widespread among AI suppliers: Black Kite found that 34.2% of AI companies had critical unpatched vulnerabilities. Another 9.8% had vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog. Enterprises should evaluate AI suppliers before integration, continuously monitor their security posture, and establish remediation and access-revocation procedures.
Indirect prompt injection becomes a commercial criminal service: Threat actors are advertising indirect prompt injection tools for approximately $150 per month. These services embed malicious instructions in seemingly ordinary content, potentially causing AI agents to expose data or perform unauthorized actions before a user even reads the material. Defenses should treat external content as untrusted, limit agent permissions, require human approval for sensitive actions, and enforce authorization outside the AI model.
GPT-6 Cyber identifies large numbers of flaws: OpenAI’s security-focused GPT-6 Cyber model found 81 previously unknown high-severity Firefox vulnerabilities and developed exploits for Linux kernel flaws. The results illustrate how AI can accelerate defensive discovery while also increasing pressure on vulnerability-management and coordinated-disclosure processes.
Fraud and Consumer-Facing Threats
Holiday fraud targets retailers and shoppers: Researchers reported increasing refund scams, gift card fraud, retailer impersonation, and compromised ecommerce access. These schemes can lead to direct financial losses and customer data theft. Retailers should monitor account changes and abnormal refunds, while consumers should independently verify offers and payment requests, use secure payment methods, and avoid suspicious links.
Industry News
Major Data Breaches and Extortion Incidents
Maersk breach traced to inherited technology: Attackers compromised an inherited Maersk legacy IT system and stole data. WhiteArmor claims to have taken approximately 100GB and is demanding $5 million. Organizations should inventory inherited systems, audit credentials associated with older infrastructure, test segmentation, and ensure legacy assets receive appropriate monitoring and security ownership.
Vanderbilt investigates alleged ransomware theft: The BYOD ransomware group claims it stole more than one million Social Security numbers from Vanderbilt University, along with other sensitive information. Vanderbilt has not confirmed the claim, and several services remain restricted during the investigation. Potentially affected organizations and users should monitor for identity fraud, suspicious account activity, and follow-on phishing attempts.
SEGA vendor incident exposes subscriber data: A breach at newsletter provider ARARA exposed approximately 2.2 million email addresses associated with SEGA. The wider incident affected more than 81 million addresses, while over 92,000 SEGA records contained additional subscriber information. The incident demonstrates how marketing and communications providers can become significant sources of third-party data exposure.
Philippine tax agency investigates a claimed leak: The Bureau of Internal Revenue is investigating allegations that approximately 10 million Philippine taxpayer records were exposed. The information could help criminals produce convincing fraudulent tax notices aimed at accountants and finance teams. Organizations should independently verify tax-related requests and warn staff about targeted phishing and payment fraud.
DigiCert archive exposed identity documents: Attackers accessed DigiCert customer data, passports, and driver’s licenses through an internal archive that remained publicly accessible for more than 16 months following a 2025 infrastructure migration. The incident underscores the importance of post-migration exposure testing, data-retention controls, asset discovery, and validation that retired repositories are no longer accessible.
Chainalysis breach creates account and compliance risks: Exposed Chainalysis data included password hashes and active tokens, creating the possibility of unauthorized account access. The resulting shutdown also disrupted cryptocurrency-screening services and could create compliance gaps. Affected organizations should revoke tokens, reset credentials, review access logs, and activate continuity procedures for compliance screening.
API, Vendor, and Supply Chain Compromises
Railway credential theft generates $740,000 in charges: Attackers stole customer API credentials from Railway and generated approximately $740,000 in fraudulent AI charges. Up to 100,000 workspaces may have been affected. API keys should be managed as privileged credentials, stored securely, rotated when exposed, and protected with usage monitoring, spending limits, and abnormal-consumption alerts.
Crédit Mutuel Arkéa loses €118 million: Attackers exploited a supplier platform to steal approximately €118 million from the French bank’s own account. Customer accounts were unaffected, but the theft demonstrates the financial danger of compromised third-party access. Banks and other enterprises should restrict supplier permissions, require strong authentication, monitor transactions, and retain the ability to revoke vendor access quickly.
Blood bank refrigeration systems manipulated: Attackers compromised a third-party refrigeration provider and changed temperature and defrosting settings at three French blood bank facilities. Monitoring detected the alterations before plasma was damaged. The incident shows why operational technology environments need segmented vendor access, configuration monitoring, alerting, and tested procedures for switching to manual or alternative operations.
Leadership and Government Developments
Nvidia CEO resigns: Nvidia co-founder Jensen Huang resigned amid scrutiny of his personal conduct and allegations involving a suspected Chinese intelligence operative. The development highlights the need for executive information-sharing rules, access restrictions, foreign-intelligence-threat training, and clear procedures for reporting and investigating sensitive contacts.
Japan commits funding to AI-focused cybersecurity: Japan announced a $63 million plan to counter AI-enabled cyberattacks. The initiative includes an AI team for vulnerability testing and attack simulations, as well as expanded threat intelligence, incident response, and assistance for affected organizations.
Security Tips & Best Practices
Defend Against Deepfake Impersonation
Organizations can reduce the risk of deepfake impersonation by combining verification procedures, identity controls, monitoring, and employee awareness.
- Verify sensitive requests through trusted channels.
- Require independent approvals and phishing-resistant multifactor authentication.
- Use detection tools and monitor attempts to impersonate executives.
- Train employees to recognize and report suspected deepfakes.
- Track incidents, verification failures, and response times.
Secure Human-Written and AI-Generated Code
Development teams should apply the same rigorous controls to human and machine output because AI-generated code can still contain serious security weaknesses.
- Use DevSecOps tools to scan code and identify insecure third-party dependencies.
- Validate application inputs, store credentials in secure vaults, and enforce least privilege.
- Require security-focused code reviews and automated tests before deployment.
- Track pre-deployment security pass rates and critical vulnerability remediation times.
Control Unauthorized AI Activity
As AI agents gain access to enterprise data and actions, organizations should strengthen their governance and defenses against unauthorized AI activity.
- Establish clear AI governance and ownership.
- Limit agent permissions and approved destinations.
- Require human approval for sensitive actions.
- Treat external content as untrusted data and enforce authorization outside the AI model.
- Monitor agent activity and test prompt injection defenses.
- Review permissions, destinations, and approvals for sensitive AI workflows.
Protect Shoppers and Retail Operations
Consumers and businesses can reduce exposure to holiday shopping fraud through stronger account security and independent verification.
- Shop on trusted websites, verify suspicious offers, and enable multifactor authentication.
- Use secure payment methods, enable transaction alerts, and buy gift cards from reputable sources.
- Avoid suspicious links and watch for phishing, impersonation, and deepfake promotions.
- Independently verify unexpected payment requests, account changes, and refund notifications.
Continuously Assess Third-Party Risk
Supply chain incidents this week show that vendor oversight cannot end after onboarding.
- Use third-party risk management tools to evaluate vendor security and continuously monitor changing risks.
- Enforce least-privilege access and multifactor authentication for vendors.
- Segment critical systems to reduce exposure from compromised suppliers.
- Monitor vendor activity for suspicious changes.
- Create procedures to revoke access and maintain operations during a vendor breach.
- Track vendor risk scores, access violations, and remediation times.
Tools & Resources
Simplify compliance — get ready-to-use security policies to help protect your business without the cost or complexity of an enterprise, all for under $100.
AI-Assisted Security Testing
GPT-6 Cyber’s discovery of 81 previously unknown high-severity Firefox flaws and its development of exploits for 948 Linux kernel vulnerabilities demonstrate the expanding role of AI-assisted vulnerability research. Security teams evaluating these capabilities should pair automated discovery with human validation, controlled testing, coordinated disclosure, and strong safeguards around exploit generation.
Secure Development and Credential Management
DevSecOps scanners, automated tests, dependency-analysis platforms, and secure credential vaults remain central resources for reducing flaws in both human-written and AI-generated software. These controls should be integrated into deployment pipelines and measured through security pass rates and remediation times.
Third-Party and AI Governance Resources
Third-party risk management platforms can help organizations continuously assess suppliers, monitor risk scores, identify access violations, and track remediation. For AI systems, permission reviews, destination allowlists, prompt injection testing, external authorization controls, and human approval workflows provide a practical framework for constraining agent behavior.
Detection, Monitoring, and Continuity Controls
Deepfake detection tools, executive impersonation monitoring, API usage analytics, spending alerts, token and credential monitoring, and operational technology configuration alerts all featured prominently this week. These resources are most effective when paired with rehearsed response procedures, rapid access revocation, segmented infrastructure, reliable backups, and plans for maintaining essential operations during supplier outages or breaches.
If you want to see more from our Newsletter Archive please click here.