Cybersecurity Briefing – Tuesday, Nov 10, 2026

The BYOD gang added “Texas HHSC” to its leak site on Nov 9 (16:50 UTC). It claims data on “2 Million Texas Citizens” covering Medicaid, SNAP, TANF, disaster assistance and banking information, and references an earlier ~94k-record employee-related leak. Unconfirmed: HHSC has not publicly confirmed or denied an attack; no data samples were reported; attack vector unknown. Gizmodo says it asked the agency for comment. Same group hit Vanderbilt the same day (below).

Action: HHSC partners and agencies exchanging data with HHSC: watch for phishing using benefits themes and for an official HHSC statement.

Ransomware.live →    DataBreach.com →

Vanderbilt confirmed an “active cybersecurity incident” affecting university devices, systems and cloud services and told users to shut down devices and leave campus Wi-Fi. Ransom “README” files appeared and files were reportedly rewritten with a “.byod” extension. BYOD claims full domain-controller takeover and “over 1 million SSNs” plus student and employee records. Unconfirmed: data theft and volume; no samples published. Vanderbilt Health says its systems have not been impacted.

DataBreach.com →    Gizmodo →

Attackers accessed internal systems in January 2026 and copied files Jan 18–Feb 8. Data includes names, driver's license and government ID numbers, dates of birth, hearing/medical and health insurance information; SSNs and financial data for some. A filing with the Texas Attorney General lists 1,332,826 people nationwide (Texas count not stated in the coverage). Attack type and actor not disclosed.

SecurityWeek →

An unnamed cloud provider hosting Fireworks AI R&D machines was breached Oct 23; on Oct 24 the intruder reached Fireworks development machines and ran an unauthorized workload. Exposed: resource metadata, billing addresses and invoice/payment history, and partial model weights and datasets for some customers (no card numbers stored). Follows an early-October theft of customer API keys/secrets tied to an LLMjacking group. Unit 42 is investigating; customer count and actor unconfirmed.

BleepingComputer →

France formally blamed IRGC unit Shahid Kaveh (aka CyberAv3ngers) for October attacks on refrigeration systems at ~700 French grocery stores, butchers, a slaughterhouse and food-processing plants, causing extensive food losses and at least 15 fires. ANSSI also saw the actors target Schneider Electric equipment at several small hydroelectric sites. Report CERTFR-2026-CTI-009 names three individuals; France summoned Iran's ambassador, will seek EU sanctions, and requested arrest warrants. A second wave in early November reportedly hit at least 11 European countries; not covered by the report.

Action: US operators of internet-exposed refrigeration/HVAC controllers and Schneider Electric equipment: confirm they are not reachable from the internet and change default credentials.

The Record →

The SEC confirmed user account data from its digital platforms may have leaked, possibly via malware or third-party access to users' devices, after group Deep Web Konek flagged it. Exposed for individual accounts: name, username, email, mobile, date of birth, gender, address and TIN. SEC says no passwords or company records were involved. Number affected not released; entry point unconfirmed.

Philstar →

SEGA said a breach at Japanese email vendor ARARA exposed 2.2 million newsletter subscriber emails plus 92,300 records still being analyzed. ARARA says 77 million addresses from ~380 corporate clients were exposed via a web server vulnerability; other named victims include MOS Burger (7.5M), Shochiku Multiplex Theatres (3.3M), TKC (2.3M) and IIJmio (~1M). Attackers also sent 7M+ phishing emails impersonating card companies. Actor not named.

BleepingComputer →

CISA added four actively exploited flaws: OpenSSH CVE-2026-123158 (password-auth bypass on musl-based Linux without PAM, e.g. Alpine; fixed in portable 10.6p2), IBM Aspera Faspex CVE-2026-123218 (incorrect authorization, CVSS 9.8, 5.0.0–5.0.19; fix 5.0.19 PL1), GPUStack CVE-2026-102895 (improper authentication; fixed 2.2.0+), and SignalWire FreeSWITCH CVE-2026-116779 (code injection; fixed 1.11.3+ per secondary reports). Exploitation victims not publicly named.

Action: Patch by Nov 12; prioritize internet-facing Alpine/musl SSH hosts and Faspex servers.

Tech Insider →

High-severity use-after-free in Chrome's XML parser; Google says an exploit exists in the wild (eighth Chrome zero-day this year). Fixed in 157.0.8103.50/.51 (Windows/macOS) and 157.0.8103.50 (Linux). No victims or actor disclosed.

Action: Push Chrome 157.0.8103.50+ and Chromium-based browsers as updates land.

BleepingComputer →

SAP's November patches fix 35 flaws including four rated 10.0: ICM2SHELL (CVE-2026-76964, CVE-2026-89126; unauthenticated RCE in NetWeaver ABAP ICM and Web Dispatcher), PROXYGATE (CVE-2026-89103, SAP Gateway pre-auth RCE), and CVE-2026-120017 (missing authentication, NetWeaver SAML2 SP). Not reported exploited yet, but CISA has flagged 14 SAP flaws as exploited since 2021.

Action: Apply SAP November 2026 security notes on internet-exposed NetWeaver and Web Dispatcher first.

BleepingComputer →

1. Ransomware.live – Texas HHSC (BYOD)
2. DataBreach.com – Vanderbilt / BYOD
3. Gizmodo – Vanderbilt data theft claim
4. SecurityWeek – Amplifon Americas breach
5. BleepingComputer – Fireworks AI breach
6. The Record – France blames Iran for fridge attacks
7. Philstar – Philippine SEC data breach
8. BleepingComputer – SEGA newsletter breach
9. Tech Insider – CISA KEV four flaws
10. BleepingComputer – Chrome zero-day
11. BleepingComputer – SAP November patches