The Fine Print

The shape of the day

The biggest story today is Maersk. A shipping giant confirmed a breach in a legacy logistics system, and an extortion group is claiming 100GB and demanding $5M — while the ships keep sailing. That split, between the operation and the data around the operation, runs through most of today. Five breaches where the data sat with someone else. Four stories where a legitimate tool was the way in. A patch cycle with a 9.8, a zero-day with no patch at all, and a chip flaw that needs a restart, not just a patch. An AI ledger that keeps growing on both sides of the line. And a policy shelf that is, slowly, catching up.

The breach wave, and the vendor in the middle

Maersk confirmed unauthorized access and data extraction from a legacy LF Logistics system — the unit it acquired in 2022. WhiteArmor claims around 100GB, including driver records and alleged plaintext passwords, and is demanding $5M. Operations are largely unaffected. The breach didn’t stop the ships; it took the data around the ships. And the legacy system is the detail that matters. Acquisitions bring systems with them, and the systems bring their own history. The acquired system is the one nobody re-architected, and the attacker found it first.

Notion disclosed that chat transcripts from under 1% of workspaces were exposed through its AI vendor, Fireworks AI. The exposed data came mostly from the Insights feature. Notion has disabled Insights and stopped using Fireworks for open-weight models, and the advice is to rotate any credentials pasted into those chats. Pasted credentials live in the transcript long after the conversation ends. The vendor breach is Notion’s breach for the customers whose data was in it, because the contract boundary doesn’t follow the data.

Baker Tilly is notifying clients that personal information was compromised in a breach at a third-party platform. The firm learned of it on September 6 and finished its review on October 28. A Texas filing puts the count at 10,456 Texans affected. Seven weeks from learning to notification, and the notification is still the beginning for the clients whose data was in the platform. The third party holds the data. The firm holds the relationship. The notification lands on the firm either way.

Raksul, the Japanese online printing service, found unauthorized access to its print-data submission system on November 8. Personal data in print files and invoices may have leaked. Card data, login IDs, and passwords are confirmed not affected. Print data is the kind of thing nobody models as sensitive until it’s in someone else’s hands. The invoice is a document, and the document is data.

A Latvian telecom, CSC Telecom, left a ClickHouse database exposed with more than 125 million SMS messages inside — including messages for Swedbank, SEB, and airBaltic customers. It was discovered on September 28 and closed on October 27. No intrusion, no agent, no exploit. A misconfiguration, open for a month, holding other companies’ customer messages. This is a different incident from the AI-agent telecom attack that was in the news last week. Same sector, different failure. The database was simply reachable, and the misconfiguration is the breach.

The timelines are the other pattern. Baker Tilly learned on September 6 and notified after seven weeks. The CSC database was open for a month before anyone closed it. Yesterday’s Nitori story sat inside for three weeks before detection. The breach is fast. The knowing is slow, and the slow part is the part the customer feels.

The through-line across all five is the same: the data lives with someone else. An acquired legacy system. An AI vendor. A third-party platform. A print service. A telecom’s database. The breach is theirs. The notification, the rotation, the customer conversation — those are yours, and they arrive on your timeline whether you caused the breach or not.

The tools are the attack surface now

Huntress is tracking a campaign abusing cloud-hosted ScreenConnect to deploy rogue clients and the SCKit malware toolkit — persistent access, cookie theft, lateral movement. Around six MSPs, 288 endpoints, 48 organizations. The way in was a third-party extension for ScreenConnect, using a blank-key flaw in the RMM+ extension. ConnectWise disabled five extensions in roughly 400 environments. The MSP is the multiplier. One compromised remote-access tool reaches every customer the MSP touches, and the tool is the trust.

Arctic Wolf linked the AntiFox AI pentesting platform — a fork of ARTEX — to attacks deploying ASPX webshells on IIS applications and pivoting into AWS production secrets. The tool is open source and built for red-teaming. The fork is what the attackers run, and the fork doesn’t ask who you are. The AI red-team tool writes the webshell faster than the defender reads the alert, and the speed is the point.

Aikido found a credential-stealing campaign running through GitHub, called wfx-loot: 4,837 hijacked accounts planted probe pull requests across 61,764 repositories, and the stealer ran in more than 1,806 of them. The hijacked accounts are the distribution. The pull request is the delivery. The CI runner is the execution environment, and it holds the secrets. The campaign only needed the accounts nobody noticed were taken over. The account you stopped using is the account the attacker uses.

Microsoft reports multiple actors planting GSocket on Linux servers for persistent post-exploitation access — a legitimate open-source tool, repurposed. Detections are up 356% from March to August 2026. The persistence survives patching, which is the part that changes the remediation. Patching the vulnerability doesn’t remove the tool. A legitimate tool, used illegitimately, is the hardest thing to block, because the signature is the tool itself.

The through-line here is that every one of these is a legitimate tool. A remote-access platform. A red-team framework. A GitHub account. A remote-access utility. The attack is the tool doing exactly what it was built to do, for someone else. The defense isn’t a signature for the tool — it’s knowing who is allowed to use it, and noticing when someone else does.

The patch race, and the ones with no patch

Red Hat Quay has a critical flaw, CVE-2026-123710, CVSS 9.8: an unauthenticated attacker can install a trusted signing key through service-key rotation, then read and write private container images. The attacker’s key never expires. The signing key is the trust anchor for the whole registry. An attacker who can install one owns the provenance of every image, and the key that never expires is the persistence.

Google’s Chrome update, build 157.0.8103.78/.79, fixes 83 security flaws, including five critical use-after-free issues — in ServiceWorker, CSS, Layout, Skia, and Accessibility. No exploitation reported. This is a different build from the one that fixed the exploited XML zero-day earlier in the month. Same major version, new flaws, same update cadence. Five critical use-after-free flaws in one release, and the browser is the application everyone runs all day. Two Chrome builds in a week is the cadence now — one for the exploited zero-day, one for the next 83 flaws. The browser updates itself, which is the only reason the volume is survivable. The update is automatic. The restart is the part that still needs a person.

PTC patched a critical deserialization flaw in Windchill and FlexPLM, CVE-2026-126325 — CVSS 9.2, remote code execution. Patches landed November 11. Product lifecycle management holds the designs, and the deserialization flaw holds the door. The PLM system is the crown jewels for a manufacturer, and it patches like the crown jewels.

Node.js shipped its November 11 release — 22.23.5, 24.22.3, 26.13.1 — fixing 16 flaws, including HTTP/2 server crashes and heap-disclosure bugs. A different flaw set from the Brotli RCE fixed in October. The HTTP/2 crash is a denial of service. The heap disclosure is a data leak. Both are in the runtime, not a dependency, and the runtime is the dependency.

Google Cloud is warning about three Transient Scheduler Attacks on AMD Turin and Zen 5 — TSA-SQ, TSA-L1, and a new TSA-Fill, CVE-2026-0004 — that can leak data across processes in VMs. The fix is a guest OS patch plus a stop-and-start. The side channel crosses the VM boundary, which is the boundary the whole cloud model rests on. The patch is the easy part. The restart is the part that takes the scheduling.

A public proof of concept dropped on November 10 for SignDrop — an unpatched Windows privilege escalation abusing CLFS .cnpf authentication to reach SYSTEM. No CVE, no patch as of November 11. CLFS keeps producing privilege escalations. The PoC is public. The patch isn’t. The window is open.

The through-line is the volume — 83 flaws, 16 flaws, a 9.8 — and the exception. SignDrop has a public proof of concept and no patch, and Turin needs a restart, not just a patch. The patch count is the headline most days. Today the exception is the story: the flaw you can’t patch yet, and the patch you can’t apply without stopping the machine.

The AI ledger

VulnCheck audited Anthropic’s Project Glasswing — the program where AI finds vulnerabilities in open-source software — over seven months: 37,966 findings, only 217 fixed. Since September: 11,813 new findings, 15 fixes. The finding rate and the fixing rate aren’t in the same conversation. The AI found the flaws. The maintainers didn’t fix them. The gap between finding and fixing is the actual vulnerability now, because finding the flaw was the easy part. The fix was always the work.

Recorded Future’s Insikt Group tracked 103 AI-linked incidents between July 2025 and July 2026 — credential theft through compromised AI tool packages like LiteLLM and Namastex.ai, and Shai-Hulud expanding into Claude Code. The AI coding assistant holds your credentials, your keys, your repository access. The package that compromises it inherits all of it. The assistant is the new privileged user, and the package is the new supply chain.

Darktrace demonstrated, in lab conditions, turning Claude Code into a remote-controlled implant using stolen API keys and Claude’s memory stores. The traffic blends into api.anthropic.com. Not seen in the wild, and no vulnerability in the platform itself. The API key is the identity. The memory store is the persistence. The implant is the agent you already trusted. The lab demo is the warning. The wild is the question.

Check Point linked three China-nexus clusters — SilentDelivery, OceanGate, DarkWire — through a shared framework called Sparrow, pointing to a suspected common malware supplier, “CopperDragon”. Three clusters, one framework, one supplier. The attribution question shifts from who the cluster is to who sells to all of them. The shared framework is the fingerprint. The supplier is the story.

FortiGuard published PapRAT, a new Bitter APT backdoor in C++ and Rust, hitting South Asian targets through LNK files, ftp.exe, VHDX disk images, and WebDAV chains. The delivery chain is the tradecraft — four different mechanisms, all leading to the same backdoor. The variety is the evasion. The backdoor is new. The delivery chains are the part worth studying.

The through-line is that the AI ledger grows on both sides. AI finds the flaws faster than anyone fixes them. AI tools are the new target, holding the keys the attacker wants. And the old APTs keep doing the same work with new frameworks — a shared supplier, a new backdoor, the same delivery chains. The technology changes. The economics don’t.

The policy shelf and the rebuild

ENISA’s 2026 State of Cybersecurity report puts the EU Cybersecurity Index at 71.53 out of 100. Supply-chain management scores 89.91. CSIRT maturity sits at 54.76 — and it’s uneven across member states. The posture is improving. The response capability isn’t keeping up, and the gap between the two is where the incidents live. The index is the average. The unevenness is the risk.

The August 12 national security memorandum set up a program, run through the National Cyber Director’s office, to vet private companies for government-directed surveillance and effects operations against foreign cyber-enabled criminal organizations. The framework is real. The question is the boundary — what a vetted company can do, under whose direction, with what oversight. Private capability, government direction. The line between the two is the policy.

Microsoft’s Entra Hard Deletion Protection is in preview: once enabled, a deleted identity can’t be permanently erased for seven days. The protection itself is irreversible once turned on. Seven days to recover the identity you deleted by mistake — or the one someone deleted on purpose. The deletion is the attack. The seven days are the recovery.

Commvault announced Recovery Studio at SHIFT 2026 — runbook-driven rebuilding of entire applications, not just data restoration. AgentRecover now extends to Microsoft Foundry and AWS Bedrock AgentCore, with Databricks, Nvidia, and Zscaler partnerships. The shift is from restoring the data to rebuilding the application. The recovery is the product now, not the backup. The backup restores the files. The rebuild restores the business.

The through-line on the policy shelf is scaffolding: measurement, authorization, recovery. An index that says where the response capability lags. A program that draws the line on who can act. A seven-day window on the identity you can’t afford to lose. A rebuild runbook for the application, not just its data. The institutions are building around the same problems the breaches keep naming.

The close

The day’s shape is the shape of the work itself. Know where the data sits, because it rarely sits with you. Know what the tools can do for someone else, because the tool doesn’t know who it’s working for. Patch the volume, and watch the exception — the flaw with a public proof of concept and no patch, the patch that needs a restart. Fix what the AI found, and guard the AI that holds your keys. And build the recovery before you need it, because the recovery is the only part of the incident you get to write in advance.

The volume won’t slow down. The AI will find more flaws than anyone fixes, the tools will keep working for whoever runs them, and the data will keep sitting with someone else. The work is the same work it has always been — know the exposure, fix the fixable, and be ready for the rest.