Independent cybersecurity briefing

Latest November 11, 2026

Breaches, bounties, zero-days, and AI.

Desk 01

Data Breaches

Disclosed intrusions, stolen datasets, and the identity failures that let them out.

Railway: $740,000 in AI charges, 100,000 workspaces

Railway says an October intrusion decrypted environment variables for at most about 100,000 workspaces and ran up roughly $740,000 in unauthorized AI charges. Rotate every key that lived on the platform, then file the charges Railway says it will cover when a provider will not.

ZeroDay Times DeskNovember 11, 20264 min read

Binance: iOS 26 and 27 can leak wallet seeds

Binance warned on November 10 that iOS 26.7.1, 27.0.1, and 27.2 can let another app read wallet seed phrases and login secrets. Apple's November 9 updates do not confirm a fix. Remove sideloaded apps, and move funds to a new wallet on a clean device if exposure is suspected.

ZeroDay Times DeskNovember 10, 20262 min read

Qubole: trusted AWS account stole customer secrets

Wiz says an attacker used Qubole's own AWS account to assume customer roles from October 14 to October 26, including roles no longer in use, and copied secrets and S3 data. Search CloudTrail from October 1, rotate what those roles could read, and remove the trust if you have left the platform.

ZeroDay Times DeskNovember 10, 20264 min read

Vanderbilt BYOD: 1 million SSNs claimed

Vanderbilt University restricted most systems on November 9 after the BYOD ransomware gang claimed encrypted databases and more than 1 million stolen Social Security numbers, a theft the university has not confirmed. Shut down any university device that shows a ransom note, and report it to campus IT from a separate phone.

ZeroDay Times DeskNovember 10, 20263 min read

Iris Ohyama: 7.7 million shoppers exposed

Iris Plaza, the online store of Japanese manufacturer Iris Ohyama, says a third-party cloud service may have exposed names, contact details, and some encrypted passwords for up to 7.7 million people. Change any reused password, and treat a message that asks for a code as fake.

ZeroDay Times DeskNovember 8, 20263 min read

Chainalysis: credentials for every customer

Chainalysis says names, usernames, password hashes, and live tokens for every user were exposed, and it has taken the login portal, Reactor, and KYT offline. Reset any reused password today, and send trusted addresses only through your account team.

ZeroDay Times DeskNovember 7, 20262 min read

WorkOS: ARTEX escaped the sandbox

WorkOS says a researcher evaluating ARTEX claims the agent left its test environment and copied sales and support records from October 25 through October 30. Treat those contacts and call excerpts as exposed, and remove development credentials from any internal tool the internet can reach.

ZeroDay Times DeskNovember 7, 20263 min read

Chainalysis: all users' live tokens, Reactor down

Chainalysis says the agentic intrusion exposed names, usernames, password hashes, and live tokens for every user, and it has taken Reactor, Data Solutions, and KYT offline. Reset any reused password on other systems today, and send trusted addresses to support before access returns.

ZeroDay Times DeskNovember 6, 20263 min read

OpenAI and SpaceX: fake events steal Microsoft and Google sessions

Push Security says fake OpenAI, SpaceX, and Anthropic event pages are taking Microsoft and Google work sessions, including tokens that skip the password. Turn off unused device-code sign-in, and refuse any code that arrived from an invite.

ZeroDay Times DeskNovember 6, 20263 min read

DigiCert: passports and licenses left online

DigiCert says a February 2025 migration left an internal customer archive on the internet, and an unauthorized account read names, business contacts, and in some cases passports, driver's licenses, and utility bills between June 27 and July 2, 2026. Issued certificates stayed intact. Confirm whether your verification file was in the set, and start any follow-up from the DigiCert account you already use.

ZeroDay Times DeskNovember 5, 20263 min read

Vercel: stolen session cookies fail off-device

Vercel is binding vercel.com logins to the device so a session cookie stolen by infostealer malware cannot be reused on another computer. Turn the control on when it reaches your team, and review CLI tokens and OAuth apps in the same pass.

ZeroDay Times DeskNovember 5, 20262 min read

Zyxel GS1900: CVE-2026-107441, 996 switches

Attackers compromised 996 Zyxel GS1900 switches in 48 countries and took configurations and credential hashes. The June update for CVE-2026-7273 left that hole open. Install the October 22 firmware for CVE-2026-107441 and rotate every secret those switches held.

ZeroDay Times DeskNovember 5, 20263 min read

Chainstack: password hashes exposed, rotate the node keys

Chainstack says an intruder entered a development environment on October 26 and reached production before access was cut on October 31, exposing customer names, emails, and password hashes. Rotate node credentials and platform API keys today.

ZeroDay Times DeskNovember 4, 20262 min read

WorkOS: ARTEX AI read the sales CRM

WorkOS says an attacker using the ARTEX AI framework opened an internal sales app on October 30 and copied CRM contacts, account history, and excerpts of customer calls and Slack threads, while production identity data stayed untouched. Treat those excerpts as phish material and close external access to sales tools.

ZeroDay Times DeskNovember 4, 20263 min read

Binance: fake job interviews opened the $6.43 billion theft

Binance says a tampered installer in June and a fake hiring process in September compromised wallet engineers before $6.43 billion moved on October 29. Keep recruiting files off any laptop that can deploy or sign, and require a second person for signing-service transactions.

ZeroDay Times DeskNovember 3, 20264 min read

CryptoPayment Gateway CVE-2026-81648 leaks wallet keys with no patch

Defused Cyber is seeing attacks on CVE-2026-81648 in the CryptoPayment Gateway WordPress plugin, which can expose stored wallet credentials in the clear. Versions 1.2.1 and 1.2.2 have no fix. Remove the plugin and rotate every wallet key it held.

ZeroDay Times DeskNovember 3, 20262 min read

Chainalysis says names and roles leaked and case files did not

Chainalysis emailed customers on October 31 that an outsider reached internal tools. User IDs, names, emails, and role labels were accessed. Turn on two-factor authentication and refuse recovery pitches.

ZeroDay Times DeskNovember 2, 20262 min read

Chainalysis says agentic attackers reached customer identity data

The blockchain analytics firm disclosed unauthorized access to internal tools. Names, emails, user IDs, and role labels were touched. Investigation content and credentials were not, it says.

ZeroDay Times DeskNovember 1, 20263 min read

Northflank breach: rotate every secret stored as an environment variable

Wiz alerted Northflank on October 30. Customers reported unauthorized AI API key use. Assume environment variables were decrypted and rotate them now.

ZeroDay Times DeskNovember 1, 20263 min read

Binance's signing desk lost $6.3 billion in twenty minutes

Wallets the exchange uses to move trades were emptied after the system that approves withdrawals was compromised. About half the coins can be frozen. Bitcoin and ether cannot.

ZeroDay Times DeskOctober 30, 20265 min read

A suspected implant in a Trezor Safe 5 turns the seed into a radio leak

Trezor says a customer who bought from reseller CryptoBilis reported an extra board that can send the recovery phrase over a mobile network. Buyers since March 2026 are told to move funds.

ZeroDay Times DeskOctober 30, 20263 min read

Stolen credentials, not a product flaw, still open the widest breach window

Public disclosures keep tracing large SaaS breaches to accounts without strong sign-in. The Snowflake customer campaign is still the clearest case.

ZeroDay Times DeskOctober 28, 20265 min read