Daily Cybersecurity News – November 8, 2026

What happened

Apiiro reported that passwords, API keys, and other secrets developers typed into approved shell commands in Anthropic's Claude Code are sitting in plain text inside 1,122 public copies of the .claude/settings.local.json file on GitHub.

When a user chooses "Yes, and don't ask again," Claude Code writes an exact allow rule for that command into the project settings file. Exact commands that contain secrets preserve them. The researchers counted 1,379 distinct secrets across the files, including hundreds of database passwords, SSH logins, cloud tokens, and AWS keys. At least one notified organization confirmed its key was still live. Claude Code adds the file only to a local git excludes list, not the project's .gitignore, so commits (often by Claude itself as co-author) and forks leave the secrets in history.

Who is affected

Developers and organizations using Claude Code who have ever approved exact commands containing secrets and whose repositories (or forks) are public. Apiiro found the sensitive files across 63 organizations, mostly software companies of varying sizes, inside roughly 1,100 traced repositories out of more than 100,000 copies of the settings file.

Anyone who can browse public GitHub can read the exposed values; older commits and forks keep the data even after the current file is deleted.

Why it matters

Public credential dumps give attackers immediate access to databases, cloud accounts, package registries, and servers without needing to phish or brute-force. Because the secrets live in git history, simple file deletion does not stop the leak.

Builders integrating AI coding assistants must treat auto-saved command history as a new secret surface. One live key already confirmed shows real blast radius beyond theoretical exposure.

How it could have been prevented

Rotate every password, token, and key that has ever appeared in any version of .claude/settings.local.json first. Then purge the file and its history from the repository and all forks, add the path to the project .gitignore, and avoid approving exact commands that embed secrets. Prefer patterns or environment-variable references instead of inline credentials.

What happened

In October 2026 the financially motivated Cambodia-based cluster Microsoft tracks as Storm-3358 began using the agentic AI offensive framework ARTEX against financial organizations, expanding beyond its usual Southeast Asia focus to include some large global banks.

ARTEX agents automate internet-facing scans, exploit flaws such as anonymous file upload and server-side request forgery (SSRF), drop open-source RATs (WISP, vshell, AdaptixC2), deploy web shells, steal credentials, perform password spraying and brute force, abuse APIs, dump databases, and move laterally at machine speed using tools like netcat and curl.

Who is affected

Primarily financial institutions in Southeast Asia plus a smaller number of large financial organizations worldwide. Any internet-exposed web applications, cloud identities, or systems reachable by the same scanning and exploitation patterns used by Storm-3358 are in scope.

Why it matters

Agentic AI frameworks let attackers chain reconnaissance, exploitation, persistence, and exfiltration far faster than traditional manual or scripted campaigns. Finance remains a high-value target for credential theft and fraudulent transfers.

Operators must assume automated agents will probe every public service and abuse any weak authentication or SSRF path within minutes of discovery.

How it could have been prevented

Patch internet-facing web apps against upload and SSRF flaws, enforce strong MFA and least-privilege on all identities, monitor for anomalous RAT downloads and web-shell activity, restrict outbound tools such as curl/netcat where possible, and apply Microsoft Defender detections and the hunting queries published for ARTEX-related indicators. Rotate credentials suspected of compromise immediately.

What happened

At OWASP Global AppSec USA, researcher Pavan Reddy demonstrated that malicious instructions can be embedded in images and still drive large language models to produce harmful output, bypassing text-only safety filters.

One technique (FigStep) places a short prompt such as numbered steps for a phishing email inside a simple image; a benign text request to "complete the steps" succeeds 60-80% of the time on many open-weight models. A second method hides low-contrast text under another image; anamorphic resizing used by many LLMs later boosts contrast and reveals the payload. Commercial models such as ChatGPT and Claude already screen image text more effectively.

Who is affected

Any application or service that accepts user-uploaded images and feeds them to an LLM for summarization, OCR, or multimodal reasoning without intermediate image-content inspection. Open-weight and less-guarded models are currently more susceptible than major commercial offerings.

Why it matters

Images are often treated as a trusted side channel while text is filtered. Successful image-based prompt injection can turn an LLM into an accomplice for phishing content generation, data exfiltration instructions, or other policy-violating behavior.

Builders of multimodal AI products must treat every image path as an untrusted input surface equal to raw text.

How it could have been prevented

Run OCR and content inspection on every image before it reaches the model. Prefer anti-aliasing resizing over pure anamorphic downscaling so hidden text is blurred away. Log both the original upload and the pre-processed pixels the model actually sees. Combine filters, contrast checks, and output monitoring; tune the combination until attack success approaches zero.

What happened

SonicWall patched CVE-2026-19868, an authentication-enforcement flaw in the SonicOS SSL VPN service. An attacker who already holds valid credentials for an alternate login method can bypass SAML authentication controls and any SAML-enforced multi-factor authentication.

The vulnerability carries a CVSS score of 7.5 (High) and was added to CISA's Known Exploited Vulnerabilities catalog on 6 November 2026, confirming active exploitation. It is one of seven issues fixed in the same advisory; the other six are not marked as exploited. No public details on the attacks have been released.

Who is affected

Organizations running SonicWall Gen7 TZ, NSa, NSsp or NSv firewalls on SonicOS 7.3.3-7015 or older, and Gen8 TZ, NSa or NSv firewalls on SonicOS 8.2.2-8015 or older, when SAML-based SSL VPN login is enabled. Federal agencies face a Binding Operational Directive deadline of 20 November 2026.

Why it matters

SSL VPNs are high-value entry points. Bypassing SAML and MFA lets an attacker with lower-privilege credentials reach the internal network as if fully authenticated, enabling further compromise, data theft, or ransomware.

Active exploitation plus a short federal remediation window means operators cannot treat this as a routine patch cycle.

How it could have been prevented

Upgrade immediately to SonicOS 7.3.4-7013 or 8.2.3-8015 (or later). There are no workarounds. Confirm SAML SSL VPN configurations after the upgrade and monitor authentication logs for anomalous alternate-method logins.

What happened

French cooperative bank Crédit Mutuel Arkéa suffered a cyberattack in which attackers reached its network through a service provider's platform and used the bank's own account to initiate fraudulent transactions totaling up to roughly 118 million euros ($133 million). Funds were converted into USDC and USDT stablecoins.

Blockchain investigator ZachXBT first flagged large unauthorized withdrawals; the bank publicly confirmed the incident on 4 November 2026, stating it is now closed and under control. Customer assets were not touched; only the institution's own account was abused, causing temporary delays in some transfers. The bank ruled out its Fortuneo subsidiary as the entry vector.

Who is affected

Crédit Mutuel Arkéa (more than 5.8 million members, 211.5 billion euros in assets) and the unnamed service provider whose platform provided the initial access. End customers experienced only processing delays and elevated phishing risk; their balances remained intact.

Why it matters

Even when customer funds are safe, a nine-figure loss via a trusted third party demonstrates how supply-chain access can turn into direct financial theft and rapid crypto laundering.

Banks and their vendors must treat service-provider connections as high-privilege paths that require continuous monitoring, least privilege, and rapid kill-switches. Delayed public disclosure also gave attackers extra time to move funds.

How it could have been prevented

Enforce strict network segmentation and least-privilege access for all service-provider connections, require out-of-band confirmation for large internal transfers, monitor for anomalous use of institutional accounts, and maintain rapid incident response playbooks that include crypto-exchange freezes and law-enforcement coordination. Rotate any credentials or tokens that may have been exposed through the provider.