Cyber news for businesses, Saturday 14 November 2026
Wolfcore is a UK-based offensive security firm working with businesses worldwide.
Hijacked developer logins pushed a secret stealer into thousands of GitHub repositories
From 10 November, attackers used stolen logins for 4,837 GitHub accounts to plant a stealer in code pipelines. It grabs cloud and AI keys and can leave backdoors that survive a password change, according to Safeguard’s write-up of Aikido, SafeDep and Endor Labs research. If you use GitHub Actions, search for pull requests titled “docs: dependency audit notes”, revoke tokens first, then rotate secrets (see also secret rotation). Full checklist.
Old stolen passwords were reportedly linked to school bomb-threat emails
Hudson Rock found two university email accounts tied to the threats in infostealer records, with exposed passwords. It says this does not prove the passwords were still valid or used, per Cybernews. Check your staff emails against breach lists, and end active sessions when you reset a password. Related: why a password reset is not enough after an infostealer.
Maersk confirms data theft from a legacy system it inherited
Maersk says attackers accessed an old system from an acquired business and that its findings suggest no sensitive data was disclosed. A ransomware group has claimed the attack and demanded $5 million. That claim is unverified, per Cybernews. List every system you inherited or forgot, and retire or isolate it.
OpenSSH “SSHole” flaw is now on CISA’s exploited list (follow-up, 9 November)
CISA added CVE-2026-123158 after exploitation attempts began on 6 November. GreyNoise reports attackers trying to read root SSH keys, per The Hacker News. Update OpenSSH to the fixed version from your vendor or distribution, and review authorized_keys files.
Synology NAS ransomware hits devices running old software (follow-up, 3 November)
Synology says attackers are exploiting a flaw patched in December 2024 to encrypt data and demand ransom, per The Hacker News. Update DSM, switch on automatic updates and keep an offline backup.
If stolen logins worry you, Breachy, our breach exposure monitoring, shows what is already out there: Breachy