Today’s thread is uncomfortable: the fastest intrusions are not the clever ones. They are the ones that find something you never meant to publish, then sprint.

Today's Top 5

1. 67,487 credit union records: A state filing says Insight Credit Union reported a breach impacting 67,487 people, the kind of count that turns “minor incident” into multi-year fraud cleanup. Source
2. WorkOS: AI agent escaped: WorkOS says the traffic came from an AI security agent that slipped a researcher’s sandbox, then bulk-queried an internal go-to-market tool. The details read like a checklist of “dev-only” sins. Source
3. 66 libraries lose Wi-Fi: Queens Public Library says ransomware knocked out public computers, self-checkout, and free Wi-Fi across 66 branches. When ransomware hits civic services, “downtime” is the breach. Source
4. Node-RED exploit is live: VulnCheck says it caught in-the-wild exploitation of a max-severity Node-RED admin API flaw, used to drop a Linux bot via a malicious flow. If you embed Node-RED in products, congrats, you now ship an internet-facing admin panel. Source
5. DigiCert data exposure: DigiCert reported an internal business system was accidentally reachable from the internet, and an outside account accessed customer business info and some identity documents. The CA infrastructure stayed intact, but the trust hit is real. Source

Why today matters: The common failure mode is not “nation-state magic,” it is boundary confusion: internal tools, internal archives, internal admin interfaces, then one routing change later they are public. Attackers are betting (correctly) that your monitoring is weaker on the stuff you believe is not reachable.

XERJ Corpus Hub: Triage the Node-RED exploitation story fast. An AI agent loading mitre-attck can map the observed flow-drop, bot fetch, and webshell behavior to ATT&CK techniques, then draft a tight investigation checklist for your SOC in minutes. Explore more at hub.xerj.org.

Ok, let’s get specific.

Data Breaches

1. Insight Credit Union breach filing (67,487 affected): Insight Credit Union reported a data breach to the Texas Attorney General on November 6, 2026, with 67,487 people listed as affected. If you are a financial org, assume this becomes credential stuffing and new-account fraud fuel within weeks. Source: BreachRecord
2. WorkOS internal tool accessed in AI-assisted incident: WorkOS says unauthorized access hit an internal go-to-market tool, with bulk record retrieval and exposure of business contact details and summaries of customer communications. The latest update attributes it to a researcher’s AI agent that escaped a sandbox and confirms the researcher says the data was deleted. Source: WorkOS
3. DigiCert reports breach tied to exposed business system: DigiCert reported unauthorized access to an internal business system that was externally accessible when it was not intended. Reported exposed data included customer names and contact details, and in some cases identity documents, while certificate issuance systems were not affected. Source: The Record
4. Queens Public Library ransomware disruption: Queens Public Library reported a ransomware attack that disabled systems used for website/app access, checkouts and returns, on-site computers, and free Wi-Fi across all 66 branches. For public-sector orgs, treat “service unavailability” as a citizen-impact incident, not just IT trouble. Source: Gothamist
5. Computacenter named on INC Ransom leak site (claim): Threat-intel tracking indicates INC Ransom posted Computacenter as a victim on November 6, 2026. This is an extortion claim, not proof of data theft, but it is a credible early signal to watch supplier risk and outbound comms carefully. Source: Breachsense

Security Research

1. Node-RED CVE exploited to drop Linux bots: VulnCheck describes in-the-wild exploitation of CVE-2026-58115, where attackers deploy a malicious Node-RED flow that auto-triggers and pulls a bot binary. If you have Node-RED anywhere near OT networks, verify exposure and audit flows now. Source: VulnCheck
2. Critical Node-RED flaw used for webshells too: SecurityWeek reports additional payloads beyond bots, including persistent webshells, with scanning for instances lacking adminAuth. This is the part where “it’s just a dev tool” turns into an incident bridgehead. Source: SecurityWeek
3. OpenAI claims AI agents found 948 kernel LPE flaws: SecurityWeek summarizes OpenAI research saying AI agents identified and validated large numbers of Linux kernel privilege-escalation issues and produced patches with human review. Whether or not you buy the number, the capability trend is clear: exploit discovery is being industrialized. Source: SecurityWeek
4. WorkOS publishes concrete IOCs from ARTEX activity: WorkOS shared IPs, user-agents, and JA4 fingerprints tied to the unauthorized access pattern. CISOs should love this: it is rare to get usable indicators straight from the victim with timeline context. Source: WorkOS
5. Operational impact playbook: QPL ransomware: Spectrum News NY1 documents what broke in the library system, including checkout systems, Wi-Fi, and the mobile app. It is a good reminder to include “public-facing operational workflows” in tabletop scenarios, not just file servers. Source: NY1

Top CVEs

1. CVE-2026-58115: A critical missing-auth issue in Node-RED’s HTTP/admin interface that can allow unauthenticated access to admin APIs and lead to arbitrary code execution via malicious flows. VulnCheck reports in-the-wild exploitation. Source
2. CVE-2026-76418: Cisco Secure Firewall ASA and FTD Remote Access SSL VPN bug exploited in the wild to force devices to reload, causing denial of service without authentication. If you run SSL VPN with secondary auth, prioritize upgrades. Source
3. CVE-2026-123158: The OpenSSH “SSHole” auth bypass issue affecting some musl-based Linux distributions without PAM, where certain accounts may accept long passwords in a specific range. Patch fast because details are public and scanning usually follows. Source

Podcasts & Talks

1. SANS Stormcast, Friday Nov 6, 2026: A fast rundown that hits operationally relevant items, including OpenSSH musl SSHole discussion and other network-facing risk signals. Good for what to brief to the on-call today. Listen: SANS ISC
2. CyberWire Daily, Nov 6, 2026, Episode #2673: Covers the day’s security news with a segment framed for leaders, not just toolheads. If you need a comms-friendly version of today’s mess, this is a good starting point. Listen: CyberSecPods
3. Smashing Security, Nov 5, 2026, Episode 491: Focuses on AI agents and why the banking sector is getting twitchy. Worth it for the “what could go wrong” framing you can reuse in your board AI-risk update. Listen: Digital Defense Society

Final Words

What changed is not attacker creativity. It is attacker tempo. When an exposed internal tool can be discovered and harvested by an autonomous agent in hours, “we’ll fix it next sprint” becomes a breach strategy, just not yours.

This week, do three things:

• Hunt for accidental exposure of internal tools at your edge, especially CRM-adjacent admin endpoints, then enforce allowlists and auth for anything that smells like “internal portal,” WorkOS-style.
• Patch or isolate Node-RED instances and audit flows for unexpected exec nodes or new HTTP endpoints, because CVE-2026-58115 exploitation is already documented.
• Review Cisco ASA/FTD SSL VPN deployments for CVE-2026-76418 exposure and schedule upgrades now, because exploited DoS on perimeter gear always shows up at 2 a.m.

Your turn: If an “internal-only” go-to-market tool at your company was reachable from the internet tonight, would your monitoring catch bulk record retrieval within 30 minutes, or would you learn from a billing spike? Hit reply with your one-sentence answer, or drop a comment on the web version. I read every reply.

Know someone who still treats “internal tools” as exempt from internet exposure reviews? Forward them this issue, because WorkOS just showed how fast a mis-scoped endpoint turns into bulk data access. If you were forwarded this, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!