Certificate authority eMudhra has revoked eight additional intermediate CA certificates after an investigation into its recent certificate security incident found improper handling of private keys during the certificate-generation process. The new revocations bring the total number of affected intermediate CA certificates to 16, including eight previously compromised certificates whose private keys were so weak that anyone could recover them almost instantly. In a new incident report published Tuesday, eMudhra said that both sets of certificates were affected by a custom Python script used to transfer private keys between hardware security modules (HSMs) in April 2025. HSMs are devices designed to securely generate and store cryptographic keys, preventing sensitive private keys from being exposed outside the hardware.
Notion, the digital workspace platform, disclosed that a security breach at its AI infrastructure provider, Fireworks AI, exposed Notion AI chat transcripts in a small number of workspaces. The disclosure comes shortly after Fireworks AI confirmed that an attacker accessed its development environment via a third-party cloud provider on October 23 and compromised resource metadata, billing information, model weights, and datasets for some customers. Fireworks AI experienced another breach in early October, when hackers accessed environment variables containing API keys and tokens stored as secrets for a limited number of accounts. Notion learned about the exposed chat transcripts after receiving an alert from Fireworks on November 2 about an exposed dataset that contained only synthetic test data.
Maersk confirms a data breach involving a legacy system, while WhiteArmor claims 100GB of stolen data and demands a $5 million ransom. A.P. Moller Maersk, the Danish shipping giant, says it identified an IT security incident involving unauthorized access and data extraction from one of its local legacy systems, one inherited from a previous acquisition. “Maersk has identified an IT security incident involving unauthorised access and data extraction from one of our local legacy systems from a previous acquisition.” reads the statement published by Maersk on November 11. “Our findings so far strongly suggest no sensitive data has been disclosed. The incident is isolated to a local system, and we have found no indication that there has been any impact on other Maersk systems or customer and partner systems that connect to Maersk through integrations such as APIs and EDI.” According to Maersk, its cyber security team started a full investigation as soon as it found the problem, and it’s still going. The company says swift action secured the affected system. Its findings so far strongly suggest no sensitive data has been disclosed, and it says the incident is isolated to that one local system. Maersk has found no sign that other Maersk systems were affected, or the customer and partner systems that connect to it through integrations such as APIs and EDI. It doesn’t expect disruption for customers, who can book and manage shipments as usual. It promises updates and says it will inform any affected parties if it finds a need to. Maersk didn’t name the system, the type of data or the date of the intrusion. However, the cybercrime group WhiteArmor added the company to its Tor data leak site: WhiteArmor demanded a $5 million ransom in Bitcoin, giving Maersk 30 days to pay. The group claims to have stolen about 100 GB of data from the OCF/LF Logistics platform, which supports logistics and supply chain operations. “”Your contract-logistics arm, the former LF Logistics, runs fulfilment for many of the world’s largest consumer brands,” states the leak site. “Five million dollars is roughly four hours of that EBITDA.”” Maersk acquired LF Logistics, the company that developed the platform, from the Li & Fung Group in 2022. This could match Maersk’s reference to an old system inherited through an acquisition, although the company has not confirmed this connection. According to the attackers, the stolen data includes nearly 30,000 driver records, passwords stored in plain text, 33 super admin accounts and signed delivery receipts. The group also claims to have stolen inventory records, purchase orders, advance shipping notices and 27,842 mobile device logs containing phone numbers, email addresses and IMEI numbers. These details come from the attackers and have not been independently verified. Maersk’s statement does not confirm their claims. WhiteArmor also tried to justify its demand, saying the $5 million ransom represents roughly four hours of revenue for the logistics business. “We do not anticipate disruption to operations for customers at this time, and customers can continue to use Maersk platforms to book and manage their shipments as usual.” concludes the statement. “We will keep customers updated as more relevant information becomes available, and if we identify any need to inform impacted parties of any further findings, we will do so.” The scale of Maersk’s operations explains why this incident matters. A.P. Moller-Maersk is one of the world’s largest integrated shipping and logistics companies, playing a major role in global trade and supply chains. It operates around 700 container ships, representing approximately 13.5% of global container fleet capacity, and manages 60 terminals across 35 countries. The company employs about 100,000 people in 130 countries and provides services covering ocean shipping, port operations, warehousing, customs clearance and end-to-end supply chain management. Maersk reported approximately $54 billion in revenue and $2.9 billion in net profit in 2025. Its global reach and reliance on interconnected IT systems make cybersecurity a major concern. A breach involving even an older, locally operated platform could expose sensitive business and personal information, including data belonging to drivers, customers and logistics partners, even if the company’s main systems remain unaffected. In 2017, NotPetya forced the company to reinstall more than 4,000 servers and 45,000 workstations from scratch. It operated without IT for ten days and took damages of up to $300 million. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, ransomware)
Shipping giant Maersk has confirmed that a threat actor breached systems belonging to a company it previously acquired and stole data. Ransomware group WhiteArmor claimed the attack over the weekend, threatening that it would release about 100GB of information allegedly exfiltrated from the company's logistics and supply-chain platform. The investigation into the incident is ongoing, but the shipping firm says that current evidence indicates that "no sensitive data has been disclosed." Maersk added that it does not expect disruptions to operations, and assures customers that they can continue booking and managing shipments through its systems as usual. “The incident is isolated to a local system, and we have found no indication that there has been any impact on other Maersk systems or customer and partner systems that connect to Maersk through integrations such as APIs and EDI,” Maersk states.
Attackers are using Alibaba Cloud to host self-managed instances of AntiFox, an open-source agentic penetration testing platform, to target web services and AWS environments. The infrastructure hosting AntiFox was used for various malicious activities, including vulnerability exploitation, webshell deployment, credential validation, configuration discovery, and AWS secret harvesting. Initially created as a fork of ARTEX 0.1.1, AntiFox has a Chinese-language interface and lets users deploy AI agents and automate common penetration-testing tasks, such as mapping exposed services and probing target endpoints for vulnerabilities. Security researchers at Arctic Wolf observed malicious AntiFox-linked infrastructure hosted on Alibaba Cloud using valid AWS identities, including IAM users and, in some cases, assumed EC2 roles, to make authenticated requests to Amazon Web Services APIs.
Linux eBPF rootkits can hide malicious activity and evade traditional detection methods without loading kernel modules. Flare reveals how these techniques are spreading through underground forums, where threat actors are sharing rootkit source code, tutorials, and exploits targeting Linux systems.
N-able released hotfixes to address zero-day bugs affecting its N-central remote monitoring and management (RMM) platform, which were publicly disclosed over the weekend and forced it to take vulnerable hosted environments offline. This follows N-able's decision to take all hosted N-central environments offline across the Americas, Europe, and Asia-Pacific regions until it could patch them against potential attacks targeting the zero-day flaws in the wild. "N-able is actively responding to non-responsible communication of critical vulnerabilities in N-central late Sunday night, November 8, found by an independent researcher," N-able told BleepingComputer on Monday. "As a precautionary measure, we took our Hosted N-central environment offline today, November 9, and provided guidance to customers operating on-premises N-central servers to temporarily take their servers offline until further notice."
Microsoft says the November 2026 cumulative updates resolve USB audio issues plaguing Windows users who have installed security updates released since September. The company explained, when it acknowledged this known issue days after the September 2026 Patch Tuesday, that USB Audio Class 1.0 devices failed to start or produce audio on some systems after installing recent updates. Some affected users reported seeing no audio output, unresponsive volume controls and sound settings, and "This device cannot start (Code 10)." errors in Device Manager, while others said the impacted USB audio speakers fail only when using multichannel audio features, including 3D audio or 8-channel modes. These audio issues affect both server (Windows Server 2012 and later) and client (Windows 10 and Windows 11) systems.
Hackers advertise a $1,000-a-month tool claiming persistent Gmail access after password resets, but its effectiveness remains unverified. A developer of hacking tools is selling a $1,000 per month feature that allegedly gives criminals continuous access to Gmail inboxes. The cybersecurity firm Hudson Rock reports that the tool can keep reading a victim’s mailbox after a password change, after the browser closes and after sessions are revoked. “Remus Stealer is advertising a way for criminals to open a compromised Gmail inbox directly from a stolen-device record.” reads the report published by cybersecurity firm Hudson Rock. “Its latest pitch goes further: the operator claims access continues even after the victim changes their password or revokes sessions.” The tool belongs to Remus Stealer, an infostealer, meaning malware that steals data from infected computers. Remus supposedly gives its operators a searchable inbox right inside a stolen-device dashboard. Hudson Rock says it spoke with the developer and with a customer who used it, and the customer supplied screenshots of messages, timestamps and a control for sharing a mailbox with other operators. If the claims are true, the risk goes beyond a single Gmail inbox. Attackers could read password reset links and verification codes, allowing them to access other accounts linked to that email address. This makes Gmail a valuable target because many online services use it to recover accounts. “In the supplied version 1.3.9 announcement, Remus promotes email-code interception without collecting browser cookie files, claims that password changes and session revocation do not stop it, and advertises shareable mailbox links. The feature is listed as Enterprise-only; the main sales thread advertises that tier at $1,000 per month.” continues the report. “The sharing claim concerns giving other operators access to an already acquired mailbox through the service. The material does not show a victim being infected by opening one of those links.” It is still unclear how the tool works. Hudson Rock says Remus does not steal browser cookies, while its developer claims that changing the Gmail password does not stop access. The developer has not shared technical details. He only said that the malware interacts with browser memory, but this does not explain how it can maintain access after a password change or when active sessions are revoked. Hudson Rock believes Remus may obtain or create an authorization token while the victim is logged into Gmail through a browser. A remote component could then use this authorization to access emails even after the malware has stopped running, as long as Google continues to accept it. Tom’s Guide also reports that the tool can bypass Google’s anti-fraud checks and says it has contacted Google for comment. However, other reports highlight some important uncertainties. CyberInsider says Hudson Rock has not confirmed that the tool can maintain access after a password change, nor has it established that the feature exploits a Gmail vulnerability. Hudson Rock has not conducted a controlled test to show that Remus can still access newly received emails after the victim changes their password and revokes existing sessions and third-party access. According to Cybernews, the developer describes the feature as a Gmail “zero-day”. However, this claim has not been independently reproduced. The business side is more concrete. CyberInsider says the mailbox feature sits in an Enterprise tier at $1,000 per month, with shareable mailbox links so criminals can hand an inbox they’ve already compromised to others. The actor behind Remus Stealer offers the MaaS with three subscription tiers: Basic at $250, Pro at $500 and Enterprise at $1,000. This kind of claim has a history. In late 2023, a developer called PRISMA surfaced an exploit that regenerated persistent Google cookies by manipulating a token and account ID pair, and Lumma then used it so access continued after a password reset. It’s a precedent and not proof, since Remus’ mechanism is unknown, and Hudson Rock still treats a Google password change as an essential recovery step, while saying victims should also look for other ways an attacker could keep access. The tool is marketed to “enterprise” customers, so most users are unlikely to be targeted. It will probably be used mainly against organizations and high-profile individuals. Hudson Rock recommends that victims first disconnect and clean the infected computer before accessing their trusted accounts again. They should then change compromised passwords using a clean device and review their signed-in devices to remove suspicious sessions and third-party access. Hudson Rock also advises users to check Gmail settings for unauthorized changes and secure any other accounts that use the compromised mailbox for password resets or verification codes. Other basic precautions remain important: watch out for phishing emails with urgent messages, spelling mistakes or suspicious sender addresses, and keep antivirus software up to date. Tom’s Guide expects Google to introduce additional Gmail protections if the tool proves as effective as its developer claims. For now, this is a vendor’s marketing claim supported by customer screenshots and Hudson Rock’s investigation, not a confirmed Gmail vulnerability. One important detail offers some reassurance: attackers must first infect the victim’s computer and compromise their mailbox before they can use the tool. “Remus is marketing an integrated mailbox-reading capability, and a customer has endorsed its claimed persistence. The most plausible broad model is reuse of access obtained or established during endpoint compromise.” concludes the report. “The evidence does not identify the mechanism or show fresh mail remaining accessible after comprehensive recovery.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Gmail)
The US Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday that hackers are now exploiting a high-severity Cisco BroadWorks vulnerability in attacks. Cisco BroadWorks is a cloud unified communications (UC) software platform and the underlying engine allowing telecom carriers and managed service providers (MSPs) to provide branded cloud PBX, voice, and collaboration services to business customers. Tracked as CVE-2026-20320, the security flaw stems from an improper restriction of XML External Entity (XXE) reference weakness in the Open Client Interface (OCI) XML Parser that can allow unauthenticated, remote attackers to read sensitive configuration information from vulnerable systems by sending maliciously crafted XML messages. "This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface - Provisioning (OCI-P) service," Cisco explained when it patched the bug in August.
Confirm this action.
Leaving now will discard your changes.