Maersk says an unauthorised party accessed and extracted data from a local legacy system inherited through an earlier acquisition. Its investigation so far strongly suggests that no sensitive information was disclosed. The company reports no impact on other systems, customer integrations such as APIs and EDI, or shipment booking. BleepingComputer reports that a group calling itself WhiteArmor is demanding $5 million. This remains an unverified claim: Maersk has not confirmed an extortion demand or disclosed what data was taken. Two other incidents involved information held by service providers rather than the affected organisations themselves. Railway says AI provider keys stored by customers on its platform were stolen in an October breach and used to generate an estimated $740,000 in unauthorised charges. It has promised to cover those costs where AI providers refuse refunds. Notion says a breach at its AI infrastructure provider, Fireworks AI, exposed AI chat transcripts in a small number of workspaces.

Remote management platforms faced attacks on two fronts. N-able released hotfixes for its N-central remote monitoring and management platform after zero-day vulnerabilities were publicly disclosed over the weekend, forcing the company to take vulnerable hosted environments offline. SecurityWeek reports that seven CVEs were fixed following the publication of 33 alleged zero-days. ConnectWise is investigating an active campaign in which compromised ScreenConnect environments are being used to deploy rogue remote-access clients to customer devices. The activity has affected managed service providers and dozens of organisations. The available reports do not explain how the ScreenConnect environments were compromised.

CloudSEK's investigation of an exposed Silent Lynx server provides an unusually detailed record of an espionage operation. Using credentials belonging to a single railway employee, the operator accessed Tajikistan's government document platform and collected thousands of documents routed through the Ministry of Defence. The operator also held domain-level access to Tajikistan's railway network until at least 10 October. An autonomous agent built on the open-source Hermes framework, running mostly on DeepSeek models, handled reconnaissance, collection and cleanup. Destructive commands could be executed without confirmation. The agent attempted to remove shell histories and logs but missed the directory that was subsequently left exposed. Separately, attackers are hosting self-managed instances of the open-source AntiFox penetration-testing platform on Alibaba Cloud, using it to steal AWS credentials and move laterally. The Silent Lynx evidence documents an autonomous agent carrying out operational intrusion tasks, while the AntiFox activity shows attackers repurposing a tool designed for authorised security testing.

CISA added six vulnerabilities to its Known Exploited Vulnerabilities Catalogue based on evidence of active exploitation. The flaws affect Cisco BroadWorks, Barracuda Networks products including Email Security Gateway, Openwave Messaging Webtop Media Transcoder, Microsoft Outlook and Google Chromium. They include an XML external entity flaw, OS command injection, an authentication bypass and a Chromium use-after-free bug.

Maersk disclosed an IT security incident involving unauthorised access and data extraction from a local legacy system inherited through a previous acquisition. The company said its findings so far strongly suggest no sensitive data was disclosed, and the incident is isolated to that system. Maersk reported no impact on other systems, customer and partner integrations, or shipment booking operations, while its investigation continues.

eMudhra revoked eight RSA-4096 subordinate CA certificates on 7 November, in addition to eight ECDSA P-384 certificates revoked on 18 October after their truncated private keys proved recoverable. The RSA keys were intact, but a custom Python script handled them in host memory, so eMudhra cannot show compliance with its certification practice statement. The company has stopped issuance from the affected hierarchies and is exiting the public TLS business.

Microsoft researchers showed that editing fewer than ten rarely used neurons in an open-weight model can plant a backdoor without retraining. When a chosen trigger string appears, the model outputs an attacker's command, which the agent then runs with its own permissions. On Nemotron-Terminal-8B, seven edited neurons produced the command in at least 98.8% of triggered test sessions, while the attacker needs write access to the model's weights.

Threat actors are deploying the open source GSocket tool on compromised Linux web servers, where it connects outbound to a shared public relay network. Because no attacker-owned IP address or domain is involved, and the tool runs independently of the exploited application, access persists after the original vulnerability is patched. Devices with GSocket-related detections rose 356.2% between March and August 2026, mostly on PHP and cPanel hosting.

A critical race condition in the assign_headers() function of Apache HTTP Server's HTTP/2 module, tracked as CVE-2026-119618, lets unauthenticated remote attackers corrupt heap memory and execute arbitrary code with web server privileges. The flaw affects versions 2.4.55 through 2.4.70 and is fixed in 2.4.71. No public exploit or in-the-wild exploitation had been reported at the time of publication.

An exposed server belonging to the Silent Lynx espionage group held tooling and stolen data from intrusions into Tajikistan's railway network, a government document platform and Uzbekistan's Smart Forestry system. The operator used a self-hosted AI agent running DeepSeek models for reconnaissance, data collection and log cleanup. Phishing lures impersonating Turkmenistan Railways were also found, alongside indicators suggesting a Kazakhstan nexus.