OSINT / CyberSec report 11.10.2026 00:18

1. FBI arrested the co-founder of a Canadian cybersecurity firm linked to the ShinyHunters hacking group, which breached the FBI jobs portal and stole data on thousands of agents (KrebsOnSecurity).

2. FBI Director Kash Patel announced the arrest of another suspected ShinyHunters co-conspirator involved in the FBI jobs portal breach, with no charges made public yet (The Hacker News).

3. Germany arrested a Russian national, a suspected core member of the Qilin ransomware group, after extradition from Japan (BleepingComputer).

4. The US State Department offered a 10 million dollar bounty for Zhang Yu, a Chinese national accused of being a key figure in the state-sponsored Hafnium hacking group (Bitdefender).

5. Attackers are actively exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances, CVE-2026-102255, patched three days ago (BleepingComputer).

6. Researchers published a working pre-authentication remote code execution exploit for AnyDesk Linux, giving root access; the flaw was patched in version 8.0.3 without a CVE (The Hacker News).

7. Threat actors exploited two unpatched AhsayCBS backup utility flaws to deploy web shells and XMRig cryptocurrency miners on affected devices (The Hacker News).

8. CISA added five flaws to its Known Exploited Vulnerabilities catalog, including CVE-2015-3306, following abuse by China-linked Flax Typhoon, with a deadline for federal agencies (The Hacker News).

9. The FBI and DoJ seized seven domains and disrupted Flax Typhoon tools used in intrusions targeting US critical infrastructure (The Hacker News).

10. FBI said China-linked hackers from Integrity Technology Group stole emails from government and law enforcement agencies in Southeast Asia, running a portal for third-party access (The Hacker News).

11. A credential-theft campaign compromised two open-source maintainer accounts, pushing malicious GitHub Actions workflows into over 340 repositories (The Hacker News).

12. Hackers abused Google Ads and Bing redirects to push fake Claude installers delivering ClickFix attacks (BleepingComputer).

13. A new variant of the DarkSword iOS exploit kit, P7 DarkSword, adds crypto wallet data theft and two-way C2 communication (The Hacker News).

14. Russia-aligned threat actor UAC-0099 targeted Ukrainian government personnel with a new .NET infostealer and RAT named ASHVEIN (The Hacker News).

15. A campaign using the ARTEX AI pentesting tool targeted South Korean financial firms, resulting in data exfiltration (The Hacker News).

16. Biosensor firm iRhythm began notifying states of a data breach impacting hundreds of thousands of people (The Record).

17. A Ukrainian-Russian dual citizen pleaded guilty to running a network of 15,000 money mules that laundered millions for cybercriminals (BleepingComputer).

18. Citrix patched a critical NetScaler ADC and Gateway flaw, CVE-2026-107406, that could enable remote code execution in SAML deployments (The Hacker News).