Hackers stole DreamHost customer files and inboxes during months-long attack

techcrunch.com Nov 4, 2026

Hackers stole DreamHost customer files and inboxes during months-long attack

Curated by Shubham · TechCapsules · Nov 4, 2026

AI-summarised brief · reviewed before publication

DreamHost disclosed a months‑long cyberattack that began in August, during which hackers accessed customer emails, credentials, and session tokens via an unspecified vulnerability in its file manager. The breach was revealed after a multi‑day outage that forced password resets. DreamHost confirmed that less than 10% of its 400,000 paying customers were affected, but did not provide a precise figure. The company stated the vulnerability was unrelated to recent PHP software flaws and is still investigating why the intrusion went undetected for weeks.

💡 Why It Matters

· The incident underscores the growing risk of session‑token theft, enabling attackers to impersonate users without passwords.
· It also highlights the need for web hosts to monitor and patch file‑management systems promptly to protect customer data.

Capsules Cybersecurity

Read full article on techcrunch.com

IonQ Completes $1.15B Acquisition of Elisity to Integrate Zero Trust with Quantum…

Trapped‑ion quantum computing company IonQ completed a $1.15 billion all‑stock acquisition of cybersecurity firm Elisity, Inc. The deal includes an earnout of up to $150 million tied to revenue milestones through January 2028. Elisity’s identity‑based network microsegmentation software will be paired with IonQ’s post‑quantum cryptography and quantum key distribution roadmap, giving IonQ immediate access to corporate IT security budgets. The transaction follows IonQ’s recent purchase of SkyWater Technology, expanding its revenue base beyond scientific computing.

💡 By merging quantum‑safe encryption with proven zero‑trust software, IonQ positions itself to meet upcoming federal post‑quantum compliance mandates and capture a growing enterprise security market.

thehackernews.com · Nov 4

SonicWall Won’t Patch EoL GMS Flaws That Could Expose Files, Alter Database…

SonicWall announced that it will not issue patches for two security vulnerabilities affecting its end‑of‑life Global Management System (GMS) versions 9.5.2 and earlier. The company stated that because the product is EoL, no remediation will be released and urged users to upgrade to the SonicWall Network Security Manager (NSM). The decision follows a recent critical SSRF flaw (CVE‑2026‑102255) that has been actively exploited, with over 2,500 attack attempts recorded since October 9, 2026.

💡 The lack of fixes leaves existing GMS deployments exposed to known exploits, forcing organizations to migrate or face heightened risk of unauthorized internal access.

thehackernews.com · Nov 4

Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and…

A critical flaw in Debian and Ubuntu’s APT package manager (CVE‑2026‑109518) lets attackers swap verified packages with malicious ones when APT retries failed downloads. The vulnerability, active from Debian 12 and Ubuntu 22.04 onward, allows code to run as root. Debian and Ubuntu have released patched APT versions, with Ubuntu Pro users of older releases also receiving updates. The flaw is exploitable via compromised mirrors or proxies and affects all distributions built on Debian and Ubuntu.

💡 The flaw exposes the core software supply chain, enabling attackers to gain root access on any system that relies on APT’s default retry logic. This threatens the integrity of the entire Debian/Ubuntu ecosystem and any derivatives that depend on it.

thehackernews.com · Nov 4

China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor

A China‑aligned threat actor, SlippyNunchucks, hijacked DNS requests in the Sogou Input Method to deploy the DarkVigil backdoor, targeting Chinese‑speaking users across Asia and Europe. The attack began July 1, 2026, exploiting insecure HTTP traffic to serve malicious configurations that download additional payloads via SGTool.exe. ESET identified the operation as a distinct intrusion set, noting its use of a modular .NET framework and DMTP for command‑and‑control. Tencent patched the vulnerability (CVE‑2026‑120422) on October 29, 2026, switching to HTTPS.

💡 The incident demonstrates how nation‑state actors can weaponize widely used language tools to conduct covert surveillance, bypassing traditional security measures. It underscores the need for secure communication protocols in everyday applications.

thehackernews.com · Nov 3

Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access

Barracuda disclosed two critical vulnerabilities that, when combined, enable attackers to bypass authorization and gain root access on affected devices. The pre‑authentication bypass (CVE‑2026‑116606, CVSS 9.3) targets the Email Security Gateway, while the command injection flaw (CVE‑2026‑111560, CVSS 8.6) affects several Barracuda products. Exploitation requires access to the administrative interface, and the attack chain can elevate privileges to root. Barracuda urges customers to patch promptly and avoid exposing admin interfaces to the internet.

💡 The chained flaws expose a rare privilege‑escalation route that could compromise entire security infrastructures, underscoring the urgency of timely patching and secure configuration.

thehackernews.com · Nov 3

Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to…

Binance disclosed that a $6.43 billion theft from its platform resulted from a coordinated, multi‑stage attack that began with a trojanized Homebrew installer used by a Wallet DevOps engineer in June 2026. The malware installed a malicious AI tool, exposing internal credentials. In September, attackers posed as a recruiter on a job‑hunting site, conducted fake interviews with a second engineer, and delivered a poisoned code repository that compromised his workstation. By October, the threat actors leveraged the compromised machines and an internal AI tool to hijack a container deployment token, gain control of additional engineers, and access the wallet‑signing service, enabling unauthorized transactions. Binance has since rebuilt the affected wallet system, hardened device and AI controls, and expanded AI‑driven anomaly detection.

💡 The breach shows how social‑engineering via fake recruitment can infiltrate even highly secured crypto exchanges, turning internal developer tools into a conduit for massive fund loss.