Security News
N0n expands to 66 victims — 735 million patient records claimed
Following the Expedia breach, N0n has posted 66 total victims. The disclosed entry 159 Solutions, a US specialty pharma data analytics company, holds a 735-million-row patient claims warehouse. Additional pending victims include two payment card network operators, a fintech platform matching Cash App, mass retail, UK department store/bed/automotive retail, insurance, wealth management, and telehealth. (BleepingComputer)
France attributes supermarket fridge attacks to Iran's IRGC
France officially blamed the IRGC's Shahid Kaveh cyber unit for October attacks on refrigeration controllers across 700+ stores — spoiling food and sparking 15 fires. The same unit previously attacked US water utility ICS. (BleepingComputer · The Record)
SSHole (CVE-2026-123158) actively exploited by botnets
OpenSSH authentication bypass is now being exploited by botnets and crypto miners; more sophisticated actors expected to follow. Patch immediately. (BleepingComputer · SecurityWeek)
Chrome patches 8th zero-day of 2026 — use-after-free in XML
High-severity UAF in Chrome's XML component, reported anonymously November 6th and already exploited in the wild. Update Chrome now. (SecurityWeek)
N-able takes N-central cloud offline after 30+ zero-days published
Security researcher publicly disclosed 30+ vulnerabilities including full system takeover exploits. N-able pulled hosted environments and urged on-premises customers to shut down. (BleepingComputer)
Qubole supply chain attack via AWS IAM
Attackers compromised Qubole's IAM credentials and used cross-account roles to access customer AWS environments, stealing data from S3 buckets. (The Register · Sentra)
Claude 'Office Party' flaw exploited to run code on Linux
Attackers exploit a flaw in Claude's document-processing tool to plant temporary files and execute malicious code on Linux hosts. (Dark Reading)
Nvidia: Commerce Dept inquiry halted; FBI confirmed investigating Huang
NYT reports a Commerce Dept probe of a Singaporean chip-smuggling suspect was halted after Nvidia intervention. Trump confirmed FBI is investigating Huang's connection to the alleged Chinese spy. (Slashdot)
DeepMind AI agents cut cost of RSA-1024 attacks
Google DeepMind researchers used AI agents to find cheaper ways to factor RSA-1024 keys and forge signatures. Already deprecated; migrate legacy systems now. (SecurityWeek)
CISA Known Exploited Vulnerabilities
No new KEV entries in the last 48 hours.
Ransomware Activity
100 victims · 20 groups in the last 48 hours.
N0n (66 victims)
⚠️ 159 Solutions (US, pharma analytics — 735M patient records); Expedia Group (US, travel — ongoing); two payment card network operators (US); fintech/Cash App match (US); mass retail/warehouse clubs (US); 🇬🇧 online department store retail (UK, pending); 🇬🇧 bed retail (UK, pending); 🇬🇧 automotive & cycling retail (UK, pending); virtual addiction telehealth (US); medical supplies (US); audience measurement (US); and 50+ further unnamed companies across US, Canada, France, Netherlands, Ireland, Italy, Saudi Arabia, South Africa, Denmark, Hong Kong — all pending exposure.
⚠️ BYOD (2)
⚠️ Texas Health and Human Services Commission (US, government/healthcare — Medicaid, public health, social services); ⚠️ Vanderbilt University (US, education — 1M+ SSNs, full domain controller access, research data).
⚠️ VORTEX (14+, via threat feed)
⚠️ Scripps Health (US, hospital — PHI, patient records); ⚠️ El Camino Health (US, hospital — 350GB, PHI); ⚠️ SimonMed (US, radiology); ⚠️ KARL STORZ (DE, medical devices — 500GB); ⚠️ Arthrex (US, medical devices — 700GB); ⚠️ Pyramid Healthcare (IN, medical equipment); Alexion/AstraZeneca rare diseases (2.13TB); Solenis (US, chemical — 1.65TB); Andersen Construction (US — 200GB+); AIR Communities (US, real estate); Bozzuto (US, real estate); StorageMart (US, real estate); Samtec (US, electronics); CRESA.
⚠️ Scarlettgroup (1)
⚠️ Rochester Regional Health / rrh.org (US, hospital system).
Rhysida (1)
M.C.S. Steel Public Company (🇹🇭 Thailand, manufacturing — 4.2TB, includes Japanese contractor pipeline data).
HYFLOCK (1)
Cameroon Ministry of Defence (🇨🇲 Cameroon, government/military — 6M records including 1.35M personnel records, 1M audit logs).
SilentRansomGroup (2)
Wilentz, Goldman & Spitzer (US, law firm); B... W... (redacted, timer active).
Global Secret Group (2)
Ornico (🇿🇦 South Africa, media — 216GB); Heartland Honda (🇺🇸 US, automotive — 144GB).
Metaencryptor (2)
Greentech Renewables (🇺🇸 US, energy); JH Technology (🇰🇷 South Korea, technology).
Deadlock (6)
Fidex (🇲🇽 Mexico); NoseTea (🇺🇸 US); Coopebis (🇨🇷 Costa Rica); Trinity Custom Homes (🇺🇸 US); Chonlatee (🇹🇭 Thailand); Kadick (🇺🇸 US).
LockBit5 (2)
⚠️ Sun Clinical Laboratories (🇺🇸 US, healthcare); yatra.com (🇮🇳 India, travel).
Other groups
Krybit: UNIC Technology (🇹🇭 Thailand), tasteofasia.com.hk (🇭🇰 HK), Citicpacific (🇭🇰 HK), niclibya.com (🇱🇾 Libya), sumoteks.com. | Aoqin: Irwin Automotive (🇺🇸 US), Fortox Security Group (🇨🇴 Colombia). | PixelLeaks: Italian IT provider (24,000 mailboxes published). | Anubis: Cuomo LLC (🇺🇸 US, legal — 658GB). | Barracuda: ADG Blatt (🇩🇪 Germany). | Panzer: Grupa ABS (🇵🇱 Poland). | Eclipse: La'ala Al Kuwait Real Estate (🇰🇼 Kuwait). | Aurora: Johnson Development Corp. | Everstake: carrollins.com (🇺🇸 US, insurance). | Morpheus: JTK Solutions (🇺🇸 US).