Cybersecurity Briefing – Friday, Nov 6, 2026

ransomware.live and HookPhish list Omni as a victim of a group called Redact. The listing has almost no detail: it shows “Data exfiltrated 456,430” with no unit, and it does not say what data was taken. Omni's home page showed no incident notice when checked, and I found no company statement. Dallas headquarters comes from Wikipedia; Omni's own About page would not open. Attack method and guest impact are unknown.

ransomware.live →    HookPhish →

The N0n group's listing claims 46,013 typed customer chat messages, 9,305 named customer email addresses, search analytics and a staff directory, marked “NOT PAID — EXPOSED.” The listing does not mention payment data. Breachsense places the company in Texas and warns that claims come from threat actors and are not verified. The Container Store's site showed no incident notice on the page checked, and I found no company statement.

ransomware.live →    Breachsense →

Included because it was not in earlier briefings. The investment banking firm told the Texas Attorney General that at least 286 Texans were affected. Listed data includes names, addresses, Social Security numbers, financial account and card numbers, and birth dates. Attack type, actor and national total are not stated. This comes from a law firm's claim page summarizing the AG listing; I could not open the listing itself.

Claim Depot →

The library says a ransomware gang encrypted its systems. On-site computers, check-out and return machines, Wi-Fi, the website, the mobile app, digital media and renewals are down. Buildings remain open. The system serves 2.3 million residents. No gang had claimed it as of Thursday evening, and the library has not said whether patron or staff data was accessed. No restoration date is given.

The Record →    DysruptionHub →

The genetic testing company detected the intrusion Nov 2, then temporarily suspended testing operations and order management and reset certain credentials. It says most systems are back to normal. Whether patient records were accessed is still under investigation. Myriad does not currently expect a material adverse effect, and it filed under Item 8.01 rather than Item 1.05. Attack type, actor and patient counts are undisclosed.

SEC →

TransCore, which runs the system and its security for DelDOT, took ezpassde.com offline after its security systems detected activity indicating a potential threat. DelDOT is evaluating security before restoring service. The state has not confirmed an attack or any data access, and it gave no restoration time. I found no report of other TransCore customers being affected.

State of Delaware →

The blockchain analysis firm's Nov 4 update says names, usernames, password hashes and live tokens for all users were exposed, replacing its earlier narrower account. An on-path attack separately exposed a subset of customer passwords. Some KYT accounts appear to have been accessed. Reactor and Data Solutions access was removed, and KYT and its login page were taken offline. Chainalysis reports no evidence that investigations data was accessed or attribution data manipulated. The actor is unidentified, the user count is undisclosed, and I could not confirm whether KYT restoration has started.

Action: Chainalysis customers should reset passwords and rotate API keys as the company requires.

Chainalysis →    The Record →

The three are charged in the Southern District of New York with wire fraud, aggravated identity theft and money laundering. Prosecutors allege they impersonated CEOs by email and AI voice and video, then attorneys, targeting thousands of companies and stealing about $129 million. AP describes hospital systems in Missouri and California, a Rhode Island bank, a UK fintech, a Massachusetts mutual fund company and a Florida pet food company, without naming them in the coverage I read. No Texas victim is mentioned. The docket was sealed as of Thursday evening, and all conduct is alleged.

Action: Require call-back verification on a known number for payment or wire changes, even after a live video call.

SecurityWeek (AP) →

New to this briefing. Amadeus says it found a vulnerability in a travel booking display environment; airlines say attackers used login credentials assigned to a system account. Data handled from August 2023 to September 2026 is involved, and Qantas says Amadeus told it the issue was contained in September. Reported counts: Japan Airlines about 90,000 to 92,000 customers, All Nippon Airways 37,800, Cathay Pacific about 53,000 and Singapore Airlines 46,000. Korean Air, Asiana, Malaysia Airlines and Qantas gave no totals. Passport details were exposed for smaller subsets at Japan Airlines (about 2,000) and ANA (about 1,700). Amadeus reports no evidence that payment data was accessed and will not give a total victim count. No actor is named, and no Texas carrier is named.

Information Age →    The Record →    teiss →

Norway's development aid agency says names and email addresses of 20,614 registered users from 12,511 organizations were taken, plus applications and documents from three organizations based outside Norway. The intrusion was discovered Oct 30 and the portal is closed. Norad cannot rule out that attackers saw applicants in conflict zones and authoritarian states. It does not know who is responsible. The Norwegian National Security Authority says the attack shares characteristics with other recent attacks, without naming them.

Help Net Security →

Deep Web Konek and BetterGov.PH list reportedly affected systems: DICT and its Alagad system, the Presidential Commission on Good Government, Eastern Visayas State University, the Vice President's scheduling system, the Department of Labor and Employment's Public Employment Service Office, and the Philippine Air Force clearance system. Bataan's internal government website, the Philippine Nurses Association, Alliance Graduate School and Luzviminda Construction and Development Corp. were reportedly defaced. DeathNoteHackers claimed the Vice President system incident. The National Privacy Commission said Nov 6 it had received no breach notifications and that reports alone do not establish a breach. BetterGov.PH says no link to the Nov 5 Million Mask March is established. No counts were given.

NewsBytes.PH →

CISA's own pages would not open during this run. CISA's KEV data feed read at version 2026.11.04 shows no addition after Apple CVE-2024-27834 (added Nov 4), so a Nov 5 addition could be missing. Zyxel CVE-2026-107441 was still not in KEV in that feed.

The pre-auth flaw allows code execution during a core upgrade window through predictable staging paths. Wordfence reports thousands of blocked attempts per day; those are attempts, not confirmed compromises. No victims are named.

Action: Finish WordPress updates today, including sites managed by vendors.

CISA KEV feed →    The Hacker News →

An attacker needs a password between 257 and 1,024 bytes long to get past key-only accounts. OpenSSH 10.6p2 fixes it, and Alpine patched 3.21.10, 3.22.8, 3.23.8 and 3.24.4. Other musl-based systems such as OpenWrt, Buildroot and Yocto should be checked. Dropbear is not affected. This is not confirmed as exploited.

Action: Run apk upgrade -U -a and restart sshd, or set PasswordAuthentication no until patched.

The Hacker News →

QiAnXin XLab says a rebuilt cwpsrv binary is triggered by requests with headers beginning X-Ngx-Integrity, and that real victims exist. Victims and the infection count are not disclosed. Installation needs root, and how attackers get it is unknown. The backdoor file had zero of 63 VirusTotal detections, and researchers also found Ebury and an OpenSSH backdoor in a related archive.

Action: CWP operators should check cwpsrv integrity and look for X-Ngx-Integrity headers in logs.

The Hacker News →

This is an unauthenticated file read in Global Management System, which reached end of life in October 2025. CVE-2026-109594 is a medium-severity SQL injection in the same product. SecurityWeek reports no fix is coming. I saw no report of exploitation.

Action: Retire GMS, or remove it from internet exposure now.

SecurityWeek →

1. ransomware.live – Omni Hotels & Resorts listing
2. HookPhish – Omni Hotels claim
3. ransomware.live – The Container Store listing
4. Breachsense – The Container Store
5. Claim Depot – The Vant Group
6. The Record – Queens Public Library
7. DysruptionHub – Queens Public Library services
8. SEC – Myriad Genetics 8-K
9. State of Delaware – Delaware E-ZPass website offline
10. Chainalysis – security incident updates
11. The Record – Chainalysis
12. SecurityWeek (AP) – AI impersonation charges
13. Information Age – Qantas and Amadeus
14. The Record – Asian airlines and Amadeus
15. teiss – Qantas data exposure
16. Help Net Security – Norad Grants Portal
17. NewsBytes.PH – NPC checks Nov 5 attack reports
18. CISA KEV feed – KEV catalog data
19. The Hacker News – WordPress CVE-2026-119977
20. The Hacker News – OpenSSH Alpine fix
21. The Hacker News – cwpdoor
22. SecurityWeek – Cisco, WatchGuard, SonicWall GMS