Chainalysis Breach Exposes Live Tokens; OpenSSH Login Flaw
Friday, November 6, 2026 · 8 min
Chainalysis says its breach exposed password hashes and live tokens across its user base, raising the stakes for customers in law enforcement and finance. Separately, an OpenSSH authentication flaw and DigiCert’s customer-document exposure put access controls under scrutiny.
Listen
Show notes
Chainalysis says its breach exposed password hashes and live tokens across its user base, raising the stakes for customers in law enforcement and finance. Separately, an OpenSSH authentication flaw and DigiCert’s customer-document exposure put access controls under scrutiny.
In this episode
- Chainalysis warns all users hit in cyber breach involving ‘agentic’ techniques | The Record from Recorded Future News — The Record from Recorded Future News
“In its latest update, posted Wednesday night, the company said it had discovered “certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor.””
- OpenSSH flaw lets attackers log into password-disabled Linux accounts — BleepingComputer
“A newly disclosed flaw involving OpenSSH and musl, dubbed "*sshole," allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication simply by entering an oversized password. The flaw only affects OpenSSH servers…”
- Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560) — watchTowr Labs
Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560) # Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560) Author - Sina Kheirkhah (@SinSinology) Published 5 Nov 2026 Yes, that's right! Today we're at the aquarium. Welcome…
- DigiCert data breach exposes customer information, identity documents — BleepingComputer
“DigiCert warns it suffered a data breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to customer information and identity documents. The certificate authority says the breach affected a small portion of…”
- Nearly 1.5 million exposed secrets targeted in new revocation program — BleepingComputer
“Truffle Security has launched the Secrets Revocation Program, a free initiative that helps API key issuers revoke 1.4 million publicly exposed secrets that remain valid. Since 2022, the company has discovered secrets embedded in public repositories, packages, container images,…”