---
title: Live Cybersecurity News Ticker | Codekeeper
description: Stay informed about the latest cybersecurity vulnerabilities, incidents, and security updates with Codekeeper's real-time threat coverage.
canonical_url: https://codekeeper.co/ticker
---

BREAKING

DORA compliance now mandatory for EU financial firms.

[Check readiness](https://codekeeper.co/solutions/dora)

NIS2 enforcement accelerates across member states.

[Stay compliant](https://codekeeper.co/solutions/nis2)

APRA's CPS 230 standard now in effect.

[Get solutions](https://codekeeper.co/solutions/cps230)

Cyber Resilience Act implementation timeline confirmed.

[Prepare now](https://codekeeper.co/solutions/cra)

DORA compliance now mandatory for EU financial firms.

[Check readiness](https://codekeeper.co/solutions/dora)

NIS2 enforcement accelerates across member states.

[Stay compliant](https://codekeeper.co/solutions/nis2)

APRA's CPS 230 standard now in effect.

[Get solutions](https://codekeeper.co/solutions/cps230)

Cyber Resilience Act implementation timeline confirmed.

[Prepare now](https://codekeeper.co/solutions/cra)

DORA compliance now mandatory for EU financial firms.

[Check readiness](https://codekeeper.co/solutions/dora)

NIS2 enforcement accelerates across member states.

[Stay compliant](https://codekeeper.co/solutions/nis2)

APRA's CPS 230 standard now in effect.

[Get solutions](https://codekeeper.co/solutions/cps230)

Cyber Resilience Act implementation timeline confirmed.

[Prepare now](https://codekeeper.co/solutions/cra)

# Ticker feed

Nov 13, 2026

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks)

NEW

[FBI Seizes 900 Webcam Clips Behind North Korea’s Fake-Call Heists](https://codekeeper.co/ticker/fbi-seizes-900-webcam-clips-behind-north-koreas-fake-call-heists)

On November 12, 2026, the US Justice Department said it had taken down cloud servers behind FaceStealer, a North Korean scheme the FBI links to more than $400 million in stolen cryptocurrency over 18 months. Agents also seized more than 900 webcam recordings of victims, the raw material for the con.

Here’s how it runs. An account hijacked from an earlier victim on Telegram, LinkedIn, Slack, or Discord invites a contact into a copycat Zoom, Teams, or Google Meet call. The attackers replay footage of people the target knows, sometimes adding AI deepfakes of crypto figures, then fake an audio glitch whose “fix” installs malware.

Crypto and web3 workers are the main targets, but open-source maintainers are increasingly in the crosshairs, raising supply chain worries. The FBI ties the activity to groups tracked as APT38, BlueNoroff, and Sapphire Sleet, and says some thefts came more than a year after the first infection.

Source: [BBC News](https://www.bbc.com/news/articles/cqdj1ellpd70o)

On November 12, 2026, the US Justice Department said it had taken down cloud servers behind FaceStealer, a North Korean scheme the FBI links to more than $400 million in stolen cryptocurrency over 18 months. Agents also seized more than 900 webcam recordings of victims, the raw material for the con.

Here’s how it runs. An account hijacked from an earlier victim on Telegram, LinkedIn, Slack, or Discord invites a contact into a copycat Zoom, Teams, or Google Meet call. The attackers replay footage of people the target knows, sometimes adding AI deepfakes of crypto figures, then fake an audio glitch whose “fix” installs malware.

Crypto and web3 workers are the main targets, but open-source maintainers are increasingly in the crosshairs, raising supply chain worries. The FBI ties the activity to groups tracked as APT38, BlueNoroff, and Sapphire Sleet, and says some thefts came more than a year after the first infection.

Source: [BBC News](https://www.bbc.com/news/articles/cqdj1ellpd70o)

[![FBI Seizes 900 Webcam Clips Behind North Korea’s Fake-Call Heists](https://codekeeper.co/hubfs/_sized/fbi-seizes-900-webcam-clips-behind-north-koreas-fake-call-heists-800.png)](https://codekeeper.co/ticker/fbi-seizes-900-webcam-clips-behind-north-koreas-fake-call-heists)

Nov 13, 2026

[Vulnerabilities](https://codekeeper.co/ticker/tag/vulnerabilities)

NEW

[Attacker Roots 21 N-central Servers, 19 Already on Latest Hotfix](https://codekeeper.co/ticker/attacker-roots-21-n-central-servers-19-already-on-latest-hotfix)

An attacker took root control of 21 live N-able N-central servers on November 12, 2026, about five hours after researcher Sean Bales published a proof of concept called 4EverAble2Shell. Huntback, which tracked the attacks, says 19 victims were running Hotfix 2 (build 2026.4.1.26), the update N-able released on November 10 to close the earlier Able2Shell flaws.

The chain pairs Apache Axis bug CVE-2026-90436 (CVSS 9.8, Critical) with a local root escalation. N-able and Bales say it only works on on-premises servers with the non-default Legacy API switched on. The payload was a Monero miner held to half the CPU cores, and the operator’s public mining pool listed every victim: nine in the US, four each in South Africa and Canada, and the rest in the UK, Germany, France, and Sweden.

N-able had no patch as of November 13. On-premises admins should disable Legacy API, upgrade Agents and Probes, and search logs for POSTs to /dms/services/ServerUI naming jline.internal.TerminalLineSettings. Huntback says any hit should be treated as a full compromise.

Source: [The Hacker News](https://thehackernews.com/2026/11/hackers-exploit-n-central-flaws-to.html)

An attacker took root control of 21 live N-able N-central servers on November 12, 2026, about five hours after researcher Sean Bales published a proof of concept called 4EverAble2Shell. Huntback, which tracked the attacks, says 19 victims were running Hotfix 2 (build 2026.4.1.26), the update N-able released on November 10 to close the earlier Able2Shell flaws.

The chain pairs Apache Axis bug CVE-2026-90436 (CVSS 9.8, Critical) with a local root escalation. N-able and Bales say it only works on on-premises servers with the non-default Legacy API switched on. The payload was a Monero miner held to half the CPU cores, and the operator’s public mining pool listed every victim: nine in the US, four each in South Africa and Canada, and the rest in the UK, Germany, France, and Sweden.

N-able had no patch as of November 13. On-premises admins should disable Legacy API, upgrade Agents and Probes, and search logs for POSTs to /dms/services/ServerUI naming jline.internal.TerminalLineSettings. Huntback says any hit should be treated as a full compromise.

Source: [The Hacker News](https://thehackernews.com/2026/11/hackers-exploit-n-central-flaws-to.html)

[![Attacker Roots 21 N-central Servers, 19 Already on Latest Hotfix](https://codekeeper.co/hubfs/_sized/attacker-roots-21-n-central-servers-19-already-on-latest-hotfix-800.png)](https://codekeeper.co/ticker/attacker-roots-21-n-central-servers-19-already-on-latest-hotfix)

Nov 13, 2026

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks)

NEW

[Hijacked GitHub Accounts Plant a CI Secret Stealer, Then Wipe Logs](https://codekeeper.co/ticker/hijacked-github-accounts-plant-a-ci-secret-stealer-then-wipe-logs)

Since November 10, 2026, an attacker with stolen tokens for 4,837 GitHub accounts has probed more than 60,000 repositories for write access, then pushed a credential stealer wherever it could. Aikido Security, which named the campaign wfx-loot, says the payload exfiltrated secrets from more than 1,800 repositories. No GitHub bug was used, just valid developer and bot tokens.

The cleanup sets it apart. Within about a minute, the attacker reverted each commit and deleted the workflow run and its logs. The script takes Actions secrets, runner memory, and cloud and AI service keys, and tries to stay in AWS and Azure accounts after rotation. Automated publishing also carried it into a Packagist package and Go modules.

From about 05:30 UTC on November 12, new copies sent stolen data only to Telegram, so blocking known IP addresses stopped working. Anyone who finds a “docs: dependency audit notes” pull request should treat every reachable secret as stolen, rotate it, revoke the account’s tokens, and remove any cloud persistence the stealer added.

Source: [SecurityWeek](https://www.securityweek.com/attacker-targets-60000-github-repositories-in-credential-theft-campaign/)

Since November 10, 2026, an attacker with stolen tokens for 4,837 GitHub accounts has probed more than 60,000 repositories for write access, then pushed a credential stealer wherever it could. Aikido Security, which named the campaign wfx-loot, says the payload exfiltrated secrets from more than 1,800 repositories. No GitHub bug was used, just valid developer and bot tokens.

The cleanup sets it apart. Within about a minute, the attacker reverted each commit and deleted the workflow run and its logs. The script takes Actions secrets, runner memory, and cloud and AI service keys, and tries to stay in AWS and Azure accounts after rotation. Automated publishing also carried it into a Packagist package and Go modules.

From about 05:30 UTC on November 12, new copies sent stolen data only to Telegram, so blocking known IP addresses stopped working. Anyone who finds a “docs: dependency audit notes” pull request should treat every reachable secret as stolen, rotate it, revoke the account’s tokens, and remove any cloud persistence the stealer added.

Source: [SecurityWeek](https://www.securityweek.com/attacker-targets-60000-github-repositories-in-credential-theft-campaign/)

[![Hijacked GitHub Accounts Plant a CI Secret Stealer, Then Wipe Logs](https://codekeeper.co/hubfs/_sized/hijacked-github-accounts-plant-a-ci-secret-stealer-then-wipe-logs-800.png)](https://codekeeper.co/ticker/hijacked-github-accounts-plant-a-ci-secret-stealer-then-wipe-logs)

Nov 13, 2026

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks)

NEW

[One Toolmaker May Be Arming Three China-Nexus Espionage Campaigns](https://codekeeper.co/ticker/one-toolmaker-may-be-arming-three-china-nexus-espionage-campaigns)

On November 10, 2026, Check Point Research tied three espionage campaigns against several dozen high-profile organizations in Latin America, Asia, and Europe to one malware toolkit, the Sparrow framework. It calls the possible developer and supplier CopperDragon, which may equip several China-nexus groups, including FamousSparrow, Earth Estries, TropicTrooper, and UAT-9244.

The craftiest, SilentDelivery, has run since early 2026. It plants script on government, shipping, and IT and research sites its targets visit, swaps the page for a fake Chrome certificate error, and pushes a “Certificate Fix” installer that drops the new SquadC backdoor or a SparrowDoor variant. Once a victim is infected, the fake warning stops appearing.

OceanGate got into Asian government and critical infrastructure networks through exposed Linux servers. DarkWire targeted at least three major Latin American telecoms, though its tie to CopperDragon rests on infrastructure, not code. There’s no patch to apply: Check Point published indicators, and Windows admins can check for a Run key value named WindowsUpdateAssist.

Source: [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/chinese-malware-tied-three-hacking/)

On November 10, 2026, Check Point Research tied three espionage campaigns against several dozen high-profile organizations in Latin America, Asia, and Europe to one malware toolkit, the Sparrow framework. It calls the possible developer and supplier CopperDragon, which may equip several China-nexus groups, including FamousSparrow, Earth Estries, TropicTrooper, and UAT-9244.

The craftiest, SilentDelivery, has run since early 2026. It plants script on government, shipping, and IT and research sites its targets visit, swaps the page for a fake Chrome certificate error, and pushes a “Certificate Fix” installer that drops the new SquadC backdoor or a SparrowDoor variant. Once a victim is infected, the fake warning stops appearing.

OceanGate got into Asian government and critical infrastructure networks through exposed Linux servers. DarkWire targeted at least three major Latin American telecoms, though its tie to CopperDragon rests on infrastructure, not code. There’s no patch to apply: Check Point published indicators, and Windows admins can check for a Run key value named WindowsUpdateAssist.

Source: [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/chinese-malware-tied-three-hacking/)

[![One Toolmaker May Be Arming Three China-Nexus Espionage Campaigns](https://codekeeper.co/hubfs/_sized/one-toolmaker-may-be-arming-three-china-nexus-espionage-campaigns-800.png)](https://codekeeper.co/ticker/one-toolmaker-may-be-arming-three-china-nexus-espionage-campaigns)

Nov 13, 2026

[Vulnerabilities](https://codekeeper.co/ticker/tag/vulnerabilities)

NEW

[Two Planted Pings Can Knock Out a Freshly Elected MongoDB Primary](https://codekeeper.co/ticker/two-planted-pings-can-knock-out-a-freshly-elected-mongodb-primary)

On November 10, 2026, MongoDB shipped fixes for CVE-2026-118383, a use-after-free in its server’s replication code scored CVSS 9.5 (Critical) under CVSS 4.0. Only replica set members are exposed, including shard and config server members of sharded clusters. Standalone mongod instances are safe. MongoDB spotted the bug internally and reports no known exploitation attempts.

Datadog Security Labs showed on November 11 that a client with no credentials can send two ping commands carrying a readConcern.afterOpTime value, and turning on authentication won’t block them. They lie dormant until that member wins an election while behind on replication, which an attacker can’t force. Cleanup then runs twice, and version 8.0.34 crashed in testing. MongoDB warns code execution is possible in some conditions, though Datadog didn’t achieve it.

Patched releases are 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35, and 4.4.32. The 8.2 branch, out of support since July 31, 2026, gets no fix, and a public proof of concept reports 8.2.12 still shows the bug in a lab using a test-only setting. Atlas clusters update during maintenance. Self-hosted teams should upgrade every member and restrict network access until then.

Source: [The Hacker News](https://thehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html)

On November 10, 2026, MongoDB shipped fixes for CVE-2026-118383, a use-after-free in its server’s replication code scored CVSS 9.5 (Critical) under CVSS 4.0. Only replica set members are exposed, including shard and config server members of sharded clusters. Standalone mongod instances are safe. MongoDB spotted the bug internally and reports no known exploitation attempts.

Datadog Security Labs showed on November 11 that a client with no credentials can send two ping commands carrying a readConcern.afterOpTime value, and turning on authentication won’t block them. They lie dormant until that member wins an election while behind on replication, which an attacker can’t force. Cleanup then runs twice, and version 8.0.34 crashed in testing. MongoDB warns code execution is possible in some conditions, though Datadog didn’t achieve it.

Patched releases are 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35, and 4.4.32. The 8.2 branch, out of support since July 31, 2026, gets no fix, and a public proof of concept reports 8.2.12 still shows the bug in a lab using a test-only setting. Atlas clusters update during maintenance. Self-hosted teams should upgrade every member and restrict network access until then.

Source: [The Hacker News](https://thehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html)

[![Two Planted Pings Can Knock Out a Freshly Elected MongoDB Primary](https://codekeeper.co/hubfs/_sized/two-planted-pings-can-knock-out-a-freshly-elected-mongodb-primary-800.png)](https://codekeeper.co/ticker/two-planted-pings-can-knock-out-a-freshly-elected-mongodb-primary)

Nov 13, 2026

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks)

NEW

[Hacker Defaces Victoria’s Exam Board Site Mid-Exams, Claims Leaks](https://codekeeper.co/ticker/hacker-defaces-victorias-exam-board-site-mid-exams-claims-leaks)

Around 6 p.m. on November 11, 2026, someone calling themselves “DaggerElite” swapped the homepage of the Victorian Curriculum and Assessment Authority (VCAA) for a profanity-filled message. It boasted that this year’s VCE papers had been lifted from a printing contractor’s servers and sold to “hundreds of students” statewide.

The VCAA calls those claims “fabricated” and says it has found no sign any exam was accessed. It says the intrusion was confined to its public website, which a third party hosts and which holds no private data, and its printers report no unauthorized access. Go Ahead Lawyers, the firm whose email the hacker said carried the papers, suspects its address was spoofed.

The site stayed offline on November 12 and students lost access to study materials, while Victoria Police’s Cybercrime Squad is investigating. Exams continue as planned through November 18, with 24 papers left, and students are being told not to deal with anyone offering to sell them.

Source: [The Guardian](https://www.theguardian.com/australia-news/2026/nov/12/vce-exams-hack-year-12-papers-vcaa-victorian-curriculum-and-assessment-authority)

Around 6 p.m. on November 11, 2026, someone calling themselves “DaggerElite” swapped the homepage of the Victorian Curriculum and Assessment Authority (VCAA) for a profanity-filled message. It boasted that this year’s VCE papers had been lifted from a printing contractor’s servers and sold to “hundreds of students” statewide.

The VCAA calls those claims “fabricated” and says it has found no sign any exam was accessed. It says the intrusion was confined to its public website, which a third party hosts and which holds no private data, and its printers report no unauthorized access. Go Ahead Lawyers, the firm whose email the hacker said carried the papers, suspects its address was spoofed.

The site stayed offline on November 12 and students lost access to study materials, while Victoria Police’s Cybercrime Squad is investigating. Exams continue as planned through November 18, with 24 papers left, and students are being told not to deal with anyone offering to sell them.

Source: [The Guardian](https://www.theguardian.com/australia-news/2026/nov/12/vce-exams-hack-year-12-papers-vcaa-victorian-curriculum-and-assessment-authority)

[![Hacker Defaces Victoria’s Exam Board Site Mid-Exams, Claims Leaks](https://codekeeper.co/hubfs/_sized/hacker-defaces-victorias-exam-board-site-mid-exams-claims-leaks-800.png)](https://codekeeper.co/ticker/hacker-defaces-victorias-exam-board-site-mid-exams-claims-leaks)

Nov 11, 2026

[Ransomware](https://codekeeper.co/ticker/tag/ransomware)

NEW

[Settra-Linked GhostFrame Kit Pulls Windows Passwords From ESXi](https://codekeeper.co/ticker/settra-linked-ghostframe-kit-pulls-windows-passwords-from-esxi)

On November 10, 2026, Recorded Future’s Insikt Group detailed GhostFrame, a new control panel and implant for VMware ESXi hypervisors. TAG-218, a group whose activity overlaps with Settra ransomware, uses it. GhostFrame exploits no bug, so operators need root on the host first. One panel can then switch off, snapshot, or remotely view the host’s VMs.

Its credential theft stands out. A module called sdkmon is built to capture later ESXi logins, and the bundled open-source VMkatz can pull NTLM hashes, Kerberos tickets, and NTDS.dit data from VM memory snapshots and disks, with no malware inside Windows guests. The implant also kills the ESXi firewall and execInstalledOnly about every five seconds, undoing admin fixes.

From late August to October 2026, TAG-218 servers targeted mostly SonicWall, Palo Alto Networks, and Fortinet VPN devices in the US and Europe, and four of the targeted organizations later appeared on Settra’s leak site. Insikt says other financially motivated groups will highly likely pick up GhostFrame or similar tools, and advises locking down ESXi management access, checking /etc/rc.local.d/local.sh, and flagging hosts that fire six near-simultaneous connections at one address.

Source: [Cybersecurity News](https://cybersecuritynews.com/ghostframe-malware-hijack-vmware-esxi/)

On November 10, 2026, Recorded Future’s Insikt Group detailed GhostFrame, a new control panel and implant for VMware ESXi hypervisors. TAG-218, a group whose activity overlaps with Settra ransomware, uses it. GhostFrame exploits no bug, so operators need root on the host first. One panel can then switch off, snapshot, or remotely view the host’s VMs.

Its credential theft stands out. A module called sdkmon is built to capture later ESXi logins, and the bundled open-source VMkatz can pull NTLM hashes, Kerberos tickets, and NTDS.dit data from VM memory snapshots and disks, with no malware inside Windows guests. The implant also kills the ESXi firewall and execInstalledOnly about every five seconds, undoing admin fixes.

From late August to October 2026, TAG-218 servers targeted mostly SonicWall, Palo Alto Networks, and Fortinet VPN devices in the US and Europe, and four of the targeted organizations later appeared on Settra’s leak site. Insikt says other financially motivated groups will highly likely pick up GhostFrame or similar tools, and advises locking down ESXi management access, checking /etc/rc.local.d/local.sh, and flagging hosts that fire six near-simultaneous connections at one address.

Source: [Cybersecurity News](https://cybersecuritynews.com/ghostframe-malware-hijack-vmware-esxi/)

[![Settra-Linked GhostFrame Kit Pulls Windows Passwords From ESXi](https://codekeeper.co/hubfs/_sized/settra-linked-ghostframe-kit-pulls-windows-passwords-from-esxi-800.png)](https://codekeeper.co/ticker/settra-linked-ghostframe-kit-pulls-windows-passwords-from-esxi)

Nov 11, 2026

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks)

NEW

[Forgotten Qubole Integrations Gave a Hacker Keys to Company Clouds](https://codekeeper.co/ticker/forgotten-qubole-integrations-gave-a-hacker-keys-to-company-clouds)

From October 14 to October 26, 2026, an unidentified attacker used compromised IAM credentials from an AWS account tied to big-data platform Qubole to get inside more than a dozen organizations’ cloud environments. Many had quit Qubole long before but never deleted the roles that let its account in. Each request carried the right External ID, so AWS took the intruder for Qubole.

Sentra, which spotted the campaign, says the attacker read about 100 passwords and keys in seven minutes from Secrets Manager, SSM Parameter Store, and Lambda settings. TruffleHog then tested stolen AWS, Entra ID, and Okta credentials, and some S3 buckets were downloaded whole. How the attacker got Qubole’s credentials hasn’t been disclosed, and Qubole hasn’t issued a statement or fix.

Wiz, which disclosed the findings with Sentra and Mandiant on November 9, tells organizations that integrated with Qubole to search CloudTrail from October 1 for role assumptions by account 805246085872 from non-AWS addresses, rotate anything an affected role could read, and revoke its sessions. Unused vendor roles should go; Wiz says a source-IP condition alone would have blocked every role assumption it saw.

Source: [SecurityWeek](https://www.securityweek.com/over-a-dozen-organizations-hit-in-qubole-supply-chain-attack/)

From October 14 to October 26, 2026, an unidentified attacker used compromised IAM credentials from an AWS account tied to big-data platform Qubole to get inside more than a dozen organizations’ cloud environments. Many had quit Qubole long before but never deleted the roles that let its account in. Each request carried the right External ID, so AWS took the intruder for Qubole.

Sentra, which spotted the campaign, says the attacker read about 100 passwords and keys in seven minutes from Secrets Manager, SSM Parameter Store, and Lambda settings. TruffleHog then tested stolen AWS, Entra ID, and Okta credentials, and some S3 buckets were downloaded whole. How the attacker got Qubole’s credentials hasn’t been disclosed, and Qubole hasn’t issued a statement or fix.

Wiz, which disclosed the findings with Sentra and Mandiant on November 9, tells organizations that integrated with Qubole to search CloudTrail from October 1 for role assumptions by account 805246085872 from non-AWS addresses, rotate anything an affected role could read, and revoke its sessions. Unused vendor roles should go; Wiz says a source-IP condition alone would have blocked every role assumption it saw.

Source: [SecurityWeek](https://www.securityweek.com/over-a-dozen-organizations-hit-in-qubole-supply-chain-attack/)

[![Forgotten Qubole Integrations Gave a Hacker Keys to Company Clouds](https://codekeeper.co/hubfs/_sized/forgotten-qubole-integrations-gave-a-hacker-keys-to-company-clouds-800.png)](https://codekeeper.co/ticker/forgotten-qubole-integrations-gave-a-hacker-keys-to-company-clouds)

Nov 10, 2026

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks)

NEW

[France Ties Supermarket Fridge Hacks to Iran’s Revolutionary Guard](https://codekeeper.co/ticker/france-ties-supermarket-fridge-hacks-to-irans-revolutionary-guard)

French investigators have tied October’s sabotage of supermarket refrigeration to Shahid Kaveh, an offensive hacking unit in the cyber arm of Iran’s Islamic Revolutionary Guard Corps. An official report and the Paris prosecutor’s office said on November 9, 2026, that intruders reset defrost settings on controllers at about 700 sites from October 11 to 12, ruining stock and starting at least 15 fires.

Carrefour, Leclerc, Intermarché, and other chains were hit, along with small butchers and a slaughterhouse. Prosecutors say the attackers entered through the controllers’ web interfaces and muted the temperature alarms. Investigators found Farsi in the attack infrastructure and IP addresses traced to Iran, and linked the same operation to tampering, with moderate effects, at small hydroelectric plants.

Paris prosecutors are seeking international arrest warrants for the unit’s leader and two deputies. France summoned Iran’s ambassador on November 10 and will push for European sanctions, and Iran has not responded. No official has yet tied the later fridge attacks in Belgium, Luxembourg, and Sweden, or the one on French blood banks, to the same group.

Source: [CBS News](https://www.cbsnews.com/news/france-iran-behind-refrigerator-freezer-hack-cyberattack/)

French investigators have tied October’s sabotage of supermarket refrigeration to Shahid Kaveh, an offensive hacking unit in the cyber arm of Iran’s Islamic Revolutionary Guard Corps. An official report and the Paris prosecutor’s office said on November 9, 2026, that intruders reset defrost settings on controllers at about 700 sites from October 11 to 12, ruining stock and starting at least 15 fires.

Carrefour, Leclerc, Intermarché, and other chains were hit, along with small butchers and a slaughterhouse. Prosecutors say the attackers entered through the controllers’ web interfaces and muted the temperature alarms. Investigators found Farsi in the attack infrastructure and IP addresses traced to Iran, and linked the same operation to tampering, with moderate effects, at small hydroelectric plants.

Paris prosecutors are seeking international arrest warrants for the unit’s leader and two deputies. France summoned Iran’s ambassador on November 10 and will push for European sanctions, and Iran has not responded. No official has yet tied the later fridge attacks in Belgium, Luxembourg, and Sweden, or the one on French blood banks, to the same group.

Source: [CBS News](https://www.cbsnews.com/news/france-iran-behind-refrigerator-freezer-hack-cyberattack/)

[![France Ties Supermarket Fridge Hacks to Iran’s Revolutionary Guard](https://codekeeper.co/hubfs/_sized/france-ties-supermarket-fridge-hacks-to-irans-revolutionary-guard-800.png)](https://codekeeper.co/ticker/france-ties-supermarket-fridge-hacks-to-irans-revolutionary-guard)

Nov 10, 2026

[Vulnerabilities](https://codekeeper.co/ticker/tag/vulnerabilities)

NEW

[Feds Order Fast Fixes as Hackers Abuse OpenSSH’s SSHole Bug](https://codekeeper.co/ticker/feds-order-fast-fixes-as-hackers-abuse-opensshs-sshole-bug)

Hackers are already abusing SSHole, an OpenSSH login bypass on Linux tracked as CVE-2026-123158. On Monday, CISA put it on its list of flaws known to be exploited, along with bugs in GPUStack, SignalWire FreeSwitch and IBM Aspera Faspex.

GreyNoise spotted its first SSHole attack on November 7. Across 18 attack chains, intruders hunted for password hashes and root SSH keys, then tried slipping their own keys into authorized_keys to keep access. One crew dropped TAC Agent, a Python remote-control tool. watchTowr links other activity to botnets and crypto miners.

US federal agencies must patch by November 12.

Source: [The Hacker News](https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html)

Hackers are already abusing SSHole, an OpenSSH login bypass on Linux tracked as CVE-2026-123158. On Monday, CISA put it on its list of flaws known to be exploited, along with bugs in GPUStack, SignalWire FreeSwitch and IBM Aspera Faspex.

GreyNoise spotted its first SSHole attack on November 7. Across 18 attack chains, intruders hunted for password hashes and root SSH keys, then tried slipping their own keys into authorized_keys to keep access. One crew dropped TAC Agent, a Python remote-control tool. watchTowr links other activity to botnets and crypto miners.

US federal agencies must patch by November 12.

Source: [The Hacker News](https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html)

[![Feds Order Fast Fixes as Hackers Abuse OpenSSH’s SSHole Bug](https://codekeeper.co/hubfs/_sized/feds-order-fast-fixes-as-hackers-abuse-opensshs-sshole-bug-800.jpg)](https://codekeeper.co/ticker/feds-order-fast-fixes-as-hackers-abuse-opensshs-sshole-bug)

![ck-logo-nav-desktop](https://codekeeper.co/hubfs/Codekeeper%202025/Logo/ck-logo-nav-desktop.svg)

Software Escrow 101

Learn how software escrow helps you mitigate software risk and build strong cyber resilience.

![guide-ebook-introduction-to-software-escrow](https://codekeeper.co/hubfs/_sized/codekeeper-site/resources/ebooks/guide-ebook-introduction-to-software-escrow-2000.png)

Download the free guide

### Download "Introduction to Software Escrow: A Guide" for free!

*E-book available only in English

### Trending Now

1

[Top 5 software escrow agents in 2026: Who should protect your software?](https://codekeeper.co/articles/top-software-escrow-agents)

2

[Builder.ai collapse: Why you need AI escrow in 2026](https://codekeeper.co/articles/builderai-collapse-why-you-need-software-escrow)

3

[Software escrow vs. source code escrow: What's the difference?](https://codekeeper.co/articles/software-escrow-vs-source-code-escrow)

4

[Software escrow release conditions: A practical guide](https://codekeeper.co/articles/managing-software-escrow-release-conditions)

5

[A beginner's guide to ISO certification](https://codekeeper.co/articles/beginners-guide-to-iso-certification)

### Know what's next in cyber resilience

Join our newsletter for weekly insights on cyber risk and regulatory compliance shifts.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .