Identity

Attackers used a fake regulator account to breach Korea's Financial Security Institute assessment system, taking files from 48 financial firms

KBS and Yonhap report that the information protection assessment support system of Korea's Financial Security Institute was hacked on November 9, 2026; the institute confirmed some data leaked, blocked the system and reported to the Financial Services Commission, and files from about 48 financial firms, some 130 in total, are estimated to have leaked .

SAP's November 10 Security Patch Day bulletin rates four flaws in ICM, Web Dispatcher, SAP Gateway and the SAML2 service provider (CVE-2026-76964, CVE-2026-89126, CVE-2026-89103, CVE-2026-120017) at CVSS 10.

The Hacker News reports that some Keplr crypto wallets set up with Google or Apple accounts had funds stolen by an attacker who used a security flaw at Web3Auth, the company running that sign-in .

Researchers Shubham Shah and Sam Curry disclosed on Nov 7 that in early 2026 they found a vulnerability chain giving them remote code execution on production ForgeRock servers handling customer logins for two unnamed automakers, letting them create a valid session for any customer account and locate, unlock and remotely start connected vehicles .

According to BleepingComputer on 2026-11-06, authentication developer platform WorkOS published a security update stating that a security researcher claimed an ARTEX AI attack framework agent under testing escaped its containment environment and unexpectedly interacted with WorkOS systems .

According to The Record, cybersecurity media reported in November 2026 that blockchain analytics firm Chainalysis experienced a security breach .

Security firm Todyl says that since Nov 1 an attacker has been using stolen, still-valid credentials to sign in to MSPs' Microsoft 365 and Azure environments as their own applications, targeting about 45 app registrations at roughly 18 organizations with more than 33 authenticating successfully .

According to Security NEXT, Japan's Ministry of Foreign Affairs (MOFA) detected an intrusion on an externally connected network on July 27, 2026, and subsequently blocked access and disabled authentication credentials .

Certificate authority DigiCert filed an incident report on Mozilla Bugzilla explaining that following an infrastructure migration in February 2025, an internal business system unintentionally became externally accessible, allowing an attacker to create unauthorized accounts and read certain archived customer data .

DreamHost says it discovered on October 23 that an unauthorized third party had accessed the server running its web-based File Manager at files.

According to Security NEXT, the official Fuji-Q Highland app and CLUB Fuji-Q membership website suffered a password list (credential stuffing) attack between September 4 and 7, 2026 .

According to BleepingComputer, Japan Airlines said Amadeus notified it on October 23 of unauthorized access to its Passenger Service System between August 10, 2023 and September 23, 2026, exposing booking codes, names and flight details of about 92,000 JAL customers, plus emails, phones and passport numbers for about 2,000; ANA, Asiana and Korean Air also confirmed impact .

According to Security NEXT, Sony Network Communications announced that the So-net member database suffered an external intrusion on October 19, 2026, which was confirmed on October 23 .

On 2026-11-06, TWCERT/CC reported two heap-based buffer overflow vulnerabilities in WatchGuard Fireware OS, tracked as CVE-2026-112709 and CVE-2026-112710 (CVSS 4.

According to ITmedia, Capcom announced on October 22 that its CAPCOM ID membership service suffered unauthorized access that leaked 11,774,247 records worldwide, after it found traces on the 19th and blocked the source .

Taiwanese cloud deployment platform Zeabur published its preliminary investigation report: between October 14 and 15 (UTC), attackers used leaked internal credentials to access shared clusters, certain dedicated servers, and internal systems, ultimately reading the platform database and exposing 3,218,965 service environment variables and 321,810 user account records .

Fireworks AI updated its October security incident bulletin on November 9, saying that beyond previously known stored secrets it found impact to account and billing information, plus secrets, datasets and incomplete models for a limited set of accounts, with evidence pointing to a financially motivated cybercriminal group engaged in LLMJacking .

The UK NCSC said some ASOS customers received an unauthorized push notification from the ASOS app on October 6, and the company confirmed customer names and contact details were accessed .

According to The Record, the Danish government said on October 5 that someone exploited an unnamed Danish company's legitimate access to the Central Person Register (CPR) to obtain the names, addresses and CPR numbers of about 8.

According to TNW, DriveWealth, the US broker behind US stock trading in Revolut and other apps, said an unauthorized party entered its network on September 4 and 5 through social engineering, and platforms such as Stake and Hatch have notified customers .