Stay Safe OnlineDaily cyber news

Today's briefing

Friday 6 November 2026

Crypto-tracing firm Chainalysis says password hashes and live tokens for all its users were exposed and takes key services offline, ransomware knocks out Queens Public Library systems, researchers show Barracuda email gateways can be taken over with no login, plus a critical Rails upload flaw, a stealthy Linux panel backdoor, a US warning on fridge hacks, MSP Entra app-credential abuse and an Anubis ransomware toolkit.

9 stories

Chainalysis says password hashes and live tokens for all users were exposed, and takes monitoring tools offline
Image: The Record
Breach

Chainalysis says password hashes and live tokens for all users were exposed, and takes monitoring tools offline

Blockchain analytics firm Chainalysis, whose customers include law enforcement and national security agencies, said Wednesday night that names, usernames, password hashes and live tokens for all its users were exposed to an attacker. That is a sharp step up from its 30 October disclosure, when it said only profile details such as emails and role labels had been seen and that credentials had not. It also reported an on-path attack that exposed some customer passwords, suspected unauthorised access to some Know Your Transaction accounts, and took KYT, address screening and its login page offline while it investigated what it called an ongoing multifront cyberattack. The company still says it has no evidence that investigation graphs or attribution data were accessed or changed.

Why it matters: A firm that helps police and banks follow stolen crypto is a high-value target, and live tokens can let someone into accounts without a password. Chainalysis customers should use the company's official login page once it is restored, reset passwords, rotate API keys, and treat unexpected password-reset emails as suspicious.

Sources
Ransomware attack knocks out Wi-Fi, computers and check-out systems at Queens Public Library
Image: The Record
Ransomware

Ransomware attack knocks out Wi-Fi, computers and check-out systems at Queens Public Library

The Queens Public Library in New York, with 66 branches serving about 2.3 million people, confirmed a ransomware attack on Wednesday that encrypted systems and took down on-site computers, check-out and return machines, Wi-Fi, digital media services and its mobile app. Branches stay open, though some programmes may be affected, and the library says it is working with law enforcement and cybersecurity experts. No gang had claimed the attack as of Thursday evening.

Why it matters: Public libraries hold a lot of local residents' data and run services people rely on daily. It is another reminder that ransomware is not only a corporate problem, and that offline backups and a tested recovery plan matter for civic services too.

Sources
Researchers show two Barracuda email-gateway flaws can be chained for root access with no login
Image: The Hacker News
Vulnerability

Researchers show two Barracuda email-gateway flaws can be chained for root access with no login

Security firm watchTowr has published a technical walkthrough of two Barracuda Email Security Gateway bugs that Barracuda patched on Monday. CVE-2026-116606 is an authorisation bypass that lets someone who has not logged in restore a crafted backup and change global settings; CVE-2026-111560 is a command injection that normally needs an admin account. Together they give root on the appliance with no login. Mandiant rates the bypass 9.3 and the injection 8.6. The Email Security Gateway fix is version 9.4.0.030 or later. Neither flaw is in CISA's known-exploited list yet, and there are no public reports of attacks.

Why it matters: Email security appliances sit in a privileged place on the network and have been targeted before. Patch now, keep automatic updates on, and limit the admin interface to trusted internal networks.

Sources
Critical Rails flaw lets attackers write server files through crafted ImageMagick uploads
Image: The Hacker News
Vulnerability

Critical Rails flaw lets attackers write server files through crafted ImageMagick uploads

Ruby on Rails fixed a critical Active Storage bug, rated 9.8, that can let an unauthenticated attacker write arbitrary files on the server by uploading a crafted image when the app uses ImageMagick. On apps that store uploads with the Disk service, the same path can also read secrets the app process can reach, including secret_key_base and credentials. Fixed releases are 8.1.4.1 and 8.0.5.2; they ship an ImageMagick policy that blocks dangerous coders such as MSL. Rails says one attack chain was reported and does not claim it is the only one. No public exploitation has been confirmed.

Why it matters: Many Rails apps accept uploads from the public internet. Upgrade to the fixed releases, confirm the new ImageMagick policy is loaded, and if you use the Disk service rotate secret_key_base and every other secret the app can read.

Sources
Hackers backdoor Linux hosting panels with a trojanized Control Web Panel web server
Image: BleepingComputer
Threat

Hackers backdoor Linux hosting panels with a trojanized Control Web Panel web server

Researchers at QiAnXin's XLab say a new Linux malware called CWPdoor is spread by replacing cwpsrv, the web server behind the Control Web Panel hosting admin interface, with a trojanized copy. More than 340,000 CWP instances have been seen on the public internet in the past month. The backdoor stays quiet until it gets a specially signed HTTP request, then runs encrypted commands and hides the request from access logs. A sample appeared on VirusTotal with zero detections alongside the older Ebury backdoor, which the researchers say points to real victims already in the wild.

Why it matters: Anyone running CWP should check for the integrity helper socket, unexpected cwpsrv helper processes and X-Ngx-Integrity strings in the binary. If you find a compromise, replace the binary from a trusted source, upgrade, rotate control-panel passwords and hunt for other malware.

Sources
US agencies warn critical infrastructure to lock down cooling systems after European fridge hacks
Image: The Record
Policy

US agencies warn critical infrastructure to lock down cooling systems after European fridge hacks

CISA, the FBI and partner agencies told operators in healthcare, transport, food and chemicals to harden internet-connected cooling and refrigeration after remote attacks raised temperatures at hundreds of European shops and, earlier this week, at three French blood-storage sites. The advisory says attackers can change settings and force continuous heating or defrost cycles on unpatched or internet-exposed controllers, spoiling stock and damaging equipment. It urges strong authentication, updates, removing unnecessary remote access and securing what remains.

Why it matters: The fridge attacks have moved from food to medical supplies. Any organisation with remote temperature control should treat those controllers like other industrial systems: off the open internet, patched where possible, and behind strong access controls.

Sources
Attacker uses stolen Microsoft Entra app secrets to walk through MSPs into customer tenants
Image: Cybersecurity Dive
Threat

Attacker uses stolen Microsoft Entra app secrets to walk through MSPs into customer tenants

Security firm Todyl says that since 1 November one operator has been signing into managed service providers' Microsoft 365 and Azure environments as their own applications, using stolen Entra ID client secrets that are still valid. About 45 app registrations at roughly 18 organisations were tried, more than 33 signed in successfully, and the actor reached 27 organisations including downstream clients in government, energy, food, transport and construction. It ran Graph searches across about 25 tenants, downloaded 81 files and accessed around 2,279 mailbox items. No Microsoft product flaw is involved; the credentials themselves were enough.

Why it matters: App identities skip MFA and often bypass user-focused Conditional Access. MSPs and anyone with multi-tenant apps should hunt for the reported source IP, remove and rotate app secrets, check Key Vault and Partner Center access, and prefer managed identities or federation over long-lived client secrets.

Sources
Anubis ransomware crew used a new Lindnor backdoor and a pile of driver exploits against a US organisation
Image: Symantec
Ransomware

Anubis ransomware crew used a new Lindnor backdoor and a pile of driver exploits against a US organisation

Symantec says attackers linked to the Anubis ransomware operation hit a US organisation in October with a previously unseen custom backdoor, Backdoor.Lindnor, planted on two Microsoft SQL Server hosts under names that looked like Chrome and VMware files. Within about an hour they dropped at least 13 tools aimed at killing security software, including five known vulnerable drivers for kernel access, plus AnyDesk set up to keep working in Safe Mode. The encryption payload was blocked and no files were encrypted. Anubis has claimed about 96 victims in the past year, just over half in the US.

Why it matters: Custom backdoors and Safe Mode remote access show ransomware crews arriving ready to fight endpoint tools. Keeping drivers blocked via Microsoft's vulnerable-driver list, watching for unexpected remote-access installs and catching early lateral movement still stop many of these jobs before encryption.

Sources
rsync 3.5.2 fixes a flaw that lets a connecting client grind a public sync server's CPU to a halt
Image: Help Net Security
Vulnerability

rsync 3.5.2 fixes a flaw that lets a connecting client grind a public sync server's CPU to a halt

The maintainers of rsync, the widely used file-sync tool, released version 3.5.2 to fix CVE-2026-119741. A malicious client can send colliding checksums that force the server to keep computing expensive strong checksums that never match, exhausting CPU. Every version through 3.5.1 is affected, and on a public daemon module no account is needed. VulnCheck scores it 8.7 on CVSS 4.0 for availability only. The release also adds options to lower a transfer's CPU and disk priority.

Why it matters: Anyone running a public rsync daemon, such as a software mirror, should upgrade to 3.5.2. Private backup servers are less exposed but still benefit from the fix and the new priority controls.

Sources