Daily Cyber Threat Brief — November 6, 2026: DigiCert breach exposed customer identity documents

Incident timeline

Date	Development
February 4, 2025	A DigiCert server migration mistakenly exposes an internal business system to the internet; the system had previously been reachable only over VPN.
June 2026	DigiCert discovers unauthorized accounts on the exposed system, and receives a report through its managed security research program warning that outsiders can create accounts on it.
June 27 – July 2, 2026	An unauthorized account accesses archived DigiCert customer information in read-only mode; DigiCert deploys fixes to the authorization flaw on July 2.
September 27, 2026	Four JavaScript files on Level Infinite's content delivery network are modified to inject malicious code into the NIKKE PC game launcher, according to researcher MotherSphere.
October 19, 2026	A further DigiCert investigation confirms that archived customer data was accessed; the company concludes the event must be reported as a breach.
October 2026	Attackers compromise refrigeration controllers at an estimated 250 to 350 French supermarkets, remotely activating defrost functions and raising temperatures.
November 1–2, 2026	A second wave of refrigeration attacks hits more than 115 stores across six European countries; attackers also alter cold-room controls at three French blood service sites overnight.
November 3, 2026	France's blood service confirms its incident; OpenSSH is told of the musl authentication bypass later fixed in 10.6p2.
November 4, 2026	Level Infinite issues a fixed NIKKE PC launcher client; BleepingComputer reports the Google Calendar phishing campaign that hijacks live sessions and bypasses MFA.
November 5, 2026	DigiCert's breach becomes public; OpenSSH releases 10.6p2; the FBI, CISA, HHS, USDA, and DOT issue a joint advisory warning that industrial refrigeration and cold-chain systems are under attack.

1. DigiCert breach exposed customer identity documents

DigiCert is warning customers that it suffered a data breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to customer information and identity documents. The certificate authority says the breach affected a small portion of its archived customer data, including names, business email addresses, phone numbers, and business addresses — and for some people, personal identification documents such as driver's licenses, passports, and utility bills submitted during certificate validation.

An incident report DigiCert filed on Mozilla's Bugzilla platform explains the chain: a February 2025 server migration left an internal business system reachable from the internet instead of only over VPN, and the system carried a self-registration feature intended for other applications, letting outsiders create accounts. Although those accounts were not assigned to any application, an authorization flaw allowed them to read archived customer information. DigiCert first spotted the unauthorized accounts in June 2026 but concluded they could not reach customer data because they belonged to no application; a report from its managed security research program then warned that external users could create accounts on the system. Fixes were deployed, but the company did not realize archived data had been accessed until a further investigation confirmed it on October 19. DigiCert says the account had read-only access and could not modify records, approve certificate validations, or issue certificates. It has disabled self-registration, restricted the system, and added access controls. Customer notifications have begun; BleepingComputer reports DigiCert has not answered how many people were impacted.

Investigation notes

The four-month gap between the June discovery and the October confirmation is the part that matters most. DigiCert treated the problem as an account-creation issue because the rogue accounts were unassigned — a reasonable-sounding assumption that turned out to be wrong, since the authorization flaw let them read archived data anyway. That is a reminder that "no application assigned" is not the same as "no access." The other gap is the missing victim count: DigiCert has not disclosed how many customers were affected, and its report says only that summary figures can be shared with browser root programs on request. Affected customers should watch for the notification, treat any identity documents submitted to DigiCert as potentially exposed, and consider the usual identity-theft precautions. The reassurance that stands up is narrow but real: certificate issuance was not touched, so issued certificates do not need to be reissued.

2. FBI and CISA warn refrigeration systems are under attack

The FBI and CISA, together with the U.S. Departments of Health and Human Services, Agriculture, and Transportation, have warned that hackers are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide, potentially causing food spoilage, equipment damage, and fire hazards. The joint advisory, published November 5, urges critical infrastructure operators to secure vulnerable refrigeration controllers used in healthcare, food production, chemical facilities, and transportation. Attackers are exploiting weaknesses in unpatched or internet-accessible electronic temperature controllers and commercial refrigeration management systems, forcing units into continuous heating and defrost cycles.

The warning follows the wave of attacks on European refrigeration systems that began in October, when hackers compromised controllers at an estimated 250 to 350 French supermarkets, remotely activating defrost functions and raising temperatures. A second wave reported in November affected more than 115 stores across six European countries, with some systems shutting down entirely and others raising temperatures to as high as 50°C (122°F). On November 3, the French Blood Establishment confirmed that a cybersecurity incident affecting a refrigeration equipment provider had altered temperature and defrost settings at three facilities used to store blood products; staff intervened before any blood products or samples were compromised. The agencies named Danfoss AK-SM and AK-SC controllers and Copeland and Dixell xweb controllers among the equipment known to be affected, and warned the attacks could also be used to bypass authentication or inject code. Shodan currently shows about 8,450 internet-exposed Danfoss interfaces, with France holding the largest share at roughly 1,420. No group has claimed responsibility, and U.S. agencies have not attributed the attacks; some security researchers have pointed to Iran, but that attribution is unconfirmed.

Investigation notes

This advisory turns a European incident wave into a standing warning for U.S. operators, and the exposure numbers explain why: thousands of refrigeration controllers remain reachable from the internet, many of them running on contractor-managed remote monitoring stacks rather than the victim's own network. The blood service case shows the stakes beyond spoiled food — temperature-controlled storage holds vaccines, medicines, and laboratory specimens as well. The agencies' advice is the same set of basics that would have stopped most of this wave: take controllers off the public internet, change default passwords, use strong authentication, patch firmware, and retire unsupported devices. Operators should also check whether a third-party contractor's remote access reaches their controllers, since that was the path into the French blood service.

3. OpenSSH flaw let attackers log into password-disabled Linux accounts

A newly disclosed flaw involving OpenSSH and the musl C library, dubbed "*sshole" by the researcher who found it, allows attackers to log into certain Alpine Linux and other musl-based Linux accounts configured to block password authentication, simply by entering an oversized password. The flaw affects OpenSSH servers on Linux distributions that use musl, including Alpine Linux, OpenWrt, Buildroot, and Yocto, under certain authentication configurations. It was discovered by independent security researcher Özgün Kültekin and fixed in OpenSSH 10.6p2, released November 5.

The flaw has existed since 2016 and stems from the interaction of two behaviours. Linux accounts can be configured to prevent password logins by replacing their password hash with an asterisk in /etc/shadow — but a 2016 OpenSSH patch for the username-enumeration flaw CVE-2016-6210 changed the server to hash the supplied password even for accounts with no usable hash, so response times would not leak valid usernames. On musl-based systems, the crypt() function returns an asterisk when hashing fails, which happens for passwords longer than 256 bytes — so an attacker submitting a password of 257 to 1,024 characters gets an asterisk back, OpenSSH compares it with the account's stored asterisk, and the login succeeds. Exploitation requires a musl-based system without PAM, password authentication enabled, one asterisk-locked account, and another account with a real password hash. It does not bypass accounts that have valid password hashes, and glibc systems such as Debian, Ubuntu, and Fedora are not affected. No exploitation in the wild has been reported.

Investigation notes

The dangerous detail here is the blast radius on Alpine: its openssh-server package does not use PAM by default, its root account is asterisk-locked, and its AWS and Azure images ship an alpine user with passwordless doas — so a successful login to a locked account on those images can mean root. Alpine administrators should update OpenSSH with apk upgrade openssh, or disable SSH password authentication and review logs for unexpected accepted password logins. The broader lesson is a familiar one in security engineering: a 2016 fix for one information leak created a logic flaw that lay dormant for a decade until a second component's failure mode — musl's crypt() returning "*" — lined up with it. Both behaviours were individually defensible; together they opened locked accounts.

4. NIKKE game launcher hacked to spread remote-access, data-stealing malware

The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game's PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data. The team said in a notice on X that it had identified an issue indicating the PC launcher's script files may have been tampered with by a third party, and issued a client fix on November 4 at 02:30 (UTC+9). The game, developed by South Korea's Shift Up and published by Level Infinite, has reported more than 45 million downloads since its 2022 launch.

According to a report on GitHub by independent security researcher MotherSphere, four JavaScript files hosted on Level Infinite's official content delivery network were modified on September 27, 2026 to inject malicious code that downloaded additional code from attacker-controlled domains whenever players opened the launcher. BleepingComputer examined two of the modified files and confirmed they contained an obfuscated loader designed to retrieve and execute code from insightjs[.]com, falling back to insightjs[.]org. The downloaded code used the launcher's own functionality to fetch a LuaJIT payload called insight.bundle, which installed a remote-access agent referred to as K2F — able to run commands, browse and download files, capture screenshots, and collect NIKKE account credentials and browser-stored data. The malware could also install a Windows DLL, platform_experience_helper.dll, that remained active after the launcher closed; BleepingComputer found strings in a sample indicating it could steal cryptocurrency wallet data from browser extensions including MetaMask, Phantom, and Coinbase Wallet. Level Infinite has not disclosed how many players were affected, how the attackers got in, or what data was taken, and says its investigation into the scope of the impact continues.

Investigation notes

The exposure window ran about five weeks, from the September 27 tampering until the November 4 fix, and players needed to do nothing wrong — simply opening a trusted launcher was enough. That is the supply-chain lesson: the attack lived in the publisher's own CDN, not in a phishing link or a fake download. One tainted script was reported to persist after fixes began, so players should update to the fixed client before playing again and run a full system scan; anyone who finds signs of compromise should reinstall Windows and change credentials from a clean device. The unconfirmed part is the theft itself: the wallet-stealing capability is established from code analysis, but whether any wallets were actually drained has not been confirmed.

5. Google Calendar phishing campaign hijacked live sessions, bypassing MFA

A phishing operation has been harvesting live Google sessions from corporate users since mid-August 2026, using Google Calendar invitations as lures and a live reverse proxy that relays passwords and multi-factor authentication prompts to the real Google sign-in page in real time. Material Security, which identified the campaign and calls its disruption effort Operation CloudFire, says the attacker runs a proxy in front of Google's genuine sign-in page, so victims enter a password, receive a real prompt, and approve it — all while the operator watches the session. Captured sessions could expose Gmail, Drive, and connected application permissions. The framework behind the pages, called Nyasher, has been publicly documented since February 2026.

The lures arrive as Google Calendar invitations, sometimes delivered by BCC and often sent from an organization the recipient has already corresponded with, with pretexts such as voicemail notices, requests for proposals, court summonses, and missed payments. Material reports that over one month of the campaign it blocked 68,676 campaign messages, analyzed 2,112 unique malicious URLs, and took down 897 domains, with 8,570 compromised sender addresses across 6,354 root domains — figures drawn only from customers who agreed to share data, so the true totals are higher. The lure themes have since shifted from calendar invites to Google Drive file and document share invites, and the operator has built an unfinished Microsoft 365 branch that is not yet active.

Investigation notes

Note the sourcing here: the campaign figures come from Material Security's own reporting, published as sponsored content on BleepingComputer — treat the numbers as the vendor's claims from its own customer telemetry, not independently measured totals. The technique is the part that stands on its own: adversary-in-the-middle phishing defeats MFA by relaying the real prompts, so the defence is not "more MFA" but phishing-resistant authentication — passkeys and device-bound sessions — plus Workspace audit-log review for sessions that appear from unexpected locations or devices. The campaign also shows how trust in a familiar sender and a familiar Google address does the attacker's work: the invites came from accounts the operator already controlled, so reputation checks passed.

Sources

• BleepingComputer — DigiCert data breach exposes customer information, identity documents
• BleepingComputer — FBI, CISA warn of cyberattacks targeting refrigeration systems
• BleepingComputer — OpenSSH flaw lets attackers log into password-disabled Linux accounts
• BleepingComputer — NIKKE PC game launcher hacked to spread remote access, data-stealing malware
• BleepingComputer — Google Calendar phishing campaign hijacks sessions, bypasses MFA
• Material Security — Reputation Says It's Fine: How Calendar Invites and a Live MFA Proxy Steal Google Sessions