Today’s theme: the internet is turning into a giant evidence-free courtroom. Extortion crews file “claims” without receipts, and defenders still have to treat them like an emergency filing.

Today's Top 5

1. 830M Expedia rows claimed: The N0n leak-site post alleges a massive loyalty-program dataset and cloud access, but it still ships with the classic problem: no proof. Your third parties will ask you anyway. Source
2. CWP web server backdoor: A trojanized Control Web Panel web server can execute attacker commands and suppress access logs, which is the kind of “quiet root” that makes IR timelines feel fictional. Source
3. SSHole scans turn real: ISC honeypots are now seeing exploitation-looking traffic for CVE-2026-123158, including the telltale long all-“A” passwords starting Nov 5. This is moving fast. Source
4. 1,122 Claude settings files leak: Apiiro’s count shows real secrets in public repos via Claude Code permission files. The uncomfortable part is how many scanners miss “passwords inside commands.” Source
5. Twitter “BYOD” claim weirdness: A low-profile group claims Twitter on a leak site, but the listing reportedly includes no samples or volume. Expect phishing to do the real damage here. Source

Why today matters: Three different “trust surfaces” are cracking at once: leak sites (unverified but loud), control planes (CWP backdoor that erases the paper trail), and developer tooling (agent approval files turning into credential diaries). CISOs should be nervous about response time and evidence quality, because attackers are optimizing for confusion, not just encryption.

XERJ Corpus Hub: Working the SSHole rush? An AI agent loading chronicle-detection-rules could draft Chronicle detections for suspicious SSH auth patterns (oversized password attempts, repeated failures from new ASNs), then hand your SOC a deployable rule pack in minutes. More at hub.xerj.org.

Okay, now the part where we separate “claim” from “blast radius.”

Data Breaches

1. Expedia ransomware claim by N0n (unverified): Leak-site monitors recorded N0n naming Expedia Group on Nov 9, 2026, alleging a huge data exposure and cloud access, but with no public proof artifacts. Treat as a supplier and brand-impersonation risk until corroborated. Source: CyPro
2. Twitter ransomware claim by BYOD (unverified): A leak-site post dated Nov 8, 2026 purports to name Twitter, but reportedly includes no samples, no file lists, and no stated volume. The near-term risk is scams and fake “leak download” lures. Source: Yazoul
3. Cuomo LLC listed by Anubis (law firm, leak-site claim): Leak-site trackers show Anubis posting Cuomo LLC on Nov 9, 2026. No victim-side confirmation yet, but if you are a client, start watching for credential reuse and document-theft extortion. Source: Ransom-DB
4. bpcm.com listed by INC Ransom (unverified): Monitoring services captured an INC Ransom listing for bpcm.com dated Nov 8, 2026. If this is in your vendor stack, ask now what systems they host and what tokens they can issue. Source: Apexward Pulse

Security Research

1. CWPdoor backdoor in Control Web Panel web server: Researchers describe a backdoored cwpsrv binary that executes attacker commands delivered via custom headers and avoids access logs, requiring prior root access to install. Hunting guidance includes checking for ngx_http_integrity_helper and header strings. Source: BleepingComputer
2. SSHole exploitation attempts observed in honeypots: SANS ISC reports an increase in long-password SSH attempts, with what it considers first “real” SSHole-style attempts starting Nov 5, 2026. This gives defenders a concrete timeline and IP concentration to prioritize. Source: SANS ISC
3. GreyNoise tracking confirms SSHole activity: GreyNoise is tracking scanning and exploitation attempts for CVE-2026-123158 and reports confirmed successful exploitation observed in its grid. If you run musl-based OpenSSH builds, assume opportunistic exploitation is already in motion. Source: GreyNoise
4. Claude Code “don’t ask again” secrets exposure: Apiiro’s analysis (as summarized and cross-checked by third parties) shows real secrets in public repos inside .claude/settings.local.json, with a non-trivial miss rate for common secret scanners when the secret is embedded in a shell command line. Source: LATENT
5. OpenAI announces GPT-6 Cyber claims and findings: The Hacker News reports OpenAI launched GPT-6 Cyber, citing discovery of Firefox vulnerabilities and a critical Brotli issue (CVE-2026-111497). For defenders, this is less about the model and more about compressed timelines from “bug” to “weaponized.” Source: The Hacker News

Top CVEs

1. CVE-2026-123158: A flaw in OpenSSH when compiled against musl libc without PAM can enable authentication bypass with a specially sized password. If you run Alpine or similar stacks, validate your OpenSSH build and patch guidance now. Source
2. CVE-2026-19868: SonicWall SonicOS SSL-VPN issue that can allow bypass of MFA under certain multi-auth configurations, and it is tracked as exploited. If SonicOS is in your remote access path, treat this as “patch now, confirm later.” Source
3. CVE-2026-88771: One of the Citrix NetScaler ADC/Gateway vulnerabilities added to CISA KEV as exploited. For most shops, this is the classic: patch, then do compromise assessment, not the other way around. Source
4. CVE-2026-88772: Another Citrix NetScaler ADC/Gateway vulnerability added to KEV as exploited. If you have multiple appliances, verify you did not patch some tiers and forget the “internal” ones. Source
5. CVE-2026-111497: A critical vulnerability in Brotli referenced in recent reporting about AI-assisted discovery. If you embed Brotli via browsers, Node, or bundled libraries, inventory what actually ships in your builds. Source

Podcasts & Talks

1. SANS Stormcast (Nov 9, 2026): This episode stitches together what your SOC will actually see first, SSHole scans in honeypots, plus notes on SonicWall SSL-VPN MFA bypass and Claude Code secret leakage patterns. Listen for quick triage ideas. Listen: SANS ISC

Final Words

Leak sites are becoming a parallel disclosure channel, and it is not designed to be fair, accurate, or complete. Pair that with stealthy control-plane persistence like CWPdoor and “helpful” agent tooling that quietly persists credentials, and you get a threat model where evidence arrives late, or never arrives at all.

This week, do three things:

• Audit musl-based SSH footprints and patch or mitigate CVE-2026-123158, then add a temporary detection for anomalously long password attempts on SSH.
• Hunt for CWPdoor on any Control Web Panel servers by checking for ngx_http_integrity_helper and the X-Ngx-Integrity strings in cwpsrv, then rotate every credential those panels touched.
• Run an org-wide code search for .claude/settings.local.json and .claude/settings.json, rotate anything you find, and add pre-commit checks so “passwords in commands” fail the build.

Your turn: If the Expedia leak-site claim was aimed at your brand tomorrow, do you have a written playbook for “unverified claim” comms, or do you improvise it under pressure? Hit reply with your one-sentence answer, or drop a comment on the web version. I read every reply.

Know someone whose travel brand, loyalty program, or identity team will get pulled into the Expedia 830M-row rumor mill this week? Forward them this issue so they can pre-brief comms and vendor management, before the first panicked screenshot lands. For everyone else: subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!