Industry
According to iThome, servers of NETivism, the vendor behind netiCRM, a donation management system used by Taiwanese nonprofits, were breached by an external attacker, and more than 20 organizations including the Awakening Foundation, Citizen Congress Watch, the Judicial Reform Foundation and Taiwan Tongzhi Hotline have issued notices .
NTT Data announced on Nov 9 that the sign-up service for Sumitomo Life's standalone Vitality programs, which it builds and operates under contract, was accessed by a third party and personal data of about 80,000 users leaked .
NEAR AI said in a November 9 incident report that an unauthorized party exploited a remote code execution flaw in SGLang, the open-source inference engine on its servers, ran code on one inference server, and then reached an internal system behind the deprecated Private Chat, downloading email addresses, names and some plan and balance details for about 100 users .
BleepingComputer reports that researcher Sean Bales publicly disclosed more than 30 N-able N-central vulnerabilities on Nov 8 without notifying the vendor and released proof-of-concept exploits in a GitHub repository called Able2Shell, the most critical chain using an unauthenticated XXE flaw to run commands on the server and create an admin account .
Ethersphere maintainers said on GitHub that Swarm Desktop 0.
Wiz says an attacker used IAM credentials from an AWS account associated with Qubole between Oct 14 and 26, 2026 to assume IAM roles that multiple customers had created to trust Qubole and enter their AWS environments .
The Hacker News reports that some Keplr crypto wallets set up with Google or Apple accounts had funds stolen by an attacker who used a security flaw at Web3Auth, the company running that sign-in .
The Hacker News reports that LNbits, an open-source Bitcoin Lightning wallet system, told all operators on Nov 8 to shut down their servers immediately because of a wave of attacks, saying several security fixes are pending .
The Record reports that German web hosting provider Mittwald CM Service disclosed in a Saturday blog post that hackers compromised 56 customer projects after going undetected on its systems for eight days .
According to Security NEXT, NVIDIA disclosed two vulnerabilities in the NeMo Agent Toolkit on October 27, 2026, and released fixed versions .
On November 5, 2026, OpenSSH released version 10.
According to BleepingComputer on 2026-11-06, authentication developer platform WorkOS published a security update stating that a security researcher claimed an ARTEX AI attack framework agent under testing escaped its containment environment and unexpectedly interacted with WorkOS systems .
According to The Record, cybersecurity media reported in November 2026 that blockchain analytics firm Chainalysis experienced a security breach .
Emerging-market company Flashaim (7551) said in a November 5 evening material announcement on MOPS that its GMB system was hit by a cyberattack, and that it activated its incident response mechanism and began investigation and maintenance after discovering it .
Kyocera Communication Systems (KCCS) issued a second update on November 6 stating that a web server operated by its subsidiary MOTEX suffered unauthorized access, potentially exposing customer information including company names, personal names, email addresses, and phone numbers .
According to Security NEXT, SonicWall disclosed two vulnerabilities in Global Management System (GMS) on November 3, 2026, but will not provide patches because the product has reached end of support .
According to Security NEXT, a use-after-free vulnerability (CVE-2026-98432) exists in IPv4 TCP connection handling in the Linux kernel .
BleepingComputer reports that Russian cloud and hosting provider Beget said an attacker gained access to the management systems of its entire architecture on the night of Nov 1 and deployed malware that erased server data, after which Beget disconnected all servers .
Certificate authority DigiCert filed an incident report on Mozilla Bugzilla explaining that following an infrastructure migration in February 2025, an internal business system unintentionally became externally accessible, allowing an attacker to create unauthorized accounts and read certain archived customer data .
According to Security NEXT, on October 28, 2026, Yamaha disclosed two vulnerabilities in its NWR100 wireless routers and released fixed firmware .