Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction

thehackernews.com Nov 5, 2026

Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction

Curated by Shubham · TechCapsules · Nov 5, 2026

AI-summarised brief · reviewed before publication

Cybersecurity researchers exposed a vulnerability that lets attackers bypass OpenAI’s ChatGPT Lockdown Mode, enabling silent data theft, phishing, and malware delivery. The flaw originates from HTML previews in code blocks that render within nested sandboxed frames. Attackers can escape the sandbox via pop‑ups, gaining unrestricted access to chat content and the user’s session. OpenAI patched the issue on September 18, 2026, but the discovery underscores that AI security hinges on the broader application environment.

💡 Why It Matters

· The breach shows that even robust AI safeguards can be undermined by peripheral features, forcing organizations to scrutinize the entire software stack when deploying AI tools.

Capsules Cybersecurity

Read full article on thehackernews.com

OpenAI released a new cybersecurity model. Is that enough?

Max Justicz, CTO of Charge Robotics, used OpenAI’s GPT‑5.6 Sol to uncover a severe vulnerability in Ubuntu’s code that could let attackers seize control of servers. The flaw, identified in two hours, was reported to the Debian Project, which promptly issued a patch. OpenAI announced a new cybersecurity‑focused model, ChatGPT Cyber, for its Daybreak Red program, noting it found 948 Linux kernel issues and 81 novel Firefox bugs. The company also pledged a $1 billion initiative to support critical‑infrastructure security researchers.

💡 The rapid discovery demonstrates how accessible AI can accelerate both defensive patching and potential exploitation, tightening the race between security teams and attackers.

thehackernews.com · Nov 5

OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth…

A critical vulnerability in OpenSSH allows attackers to log into password‑less accounts on Alpine Linux servers that use the default openssh‑server package without PAM. By supplying a password between 257 and 1,024 bytes, an attacker who knows a valid username can bypass authentication whenever password logins are enabled and at least one other account on the system has a password. The flaw stems from how sshd interacts with musl, Alpine’s C library, and affects only musl‑based builds that lack PAM. OpenSSH released version 10.6p2 to block the exploit, and Alpine issued patched packages for releases back to 3.16. Administrators are urged to disable PasswordAuthentication or update immediately; no active exploits have been reported.

💡 Exploiting the bug grants immediate root‑level access on vulnerable cloud images, turning otherwise secure key‑only accounts into open doors.

9to5mac.com · Nov 5

Security Bite: The record $6.3B Binance heist started with a fake Homebrew…

Last week, hackers stole $6.3 billion from Binance wallets, the largest financial heist ever. Binance froze nearly $3 billion, but the breach still dominated headlines. Security researcher Christopher Lopez and others suspect the attack began on a Mac, echoing the $1.5 billion Bybit theft that also started on a developer’s Mac. Mac users, especially DevOps and crypto professionals, have faced increasing malware and social‑engineering attacks, raising concerns about platform security.

💡 The incident underscores how even high‑profile exchanges remain vulnerable to sophisticated, platform‑specific attacks, prompting a reevaluation of security practices across the crypto ecosystem.

thehackernews.com · Nov 5

5 Active Cyber Threats That Put US Enterprises at Risk in October…

In October 2026, U.S. enterprises faced five active cyber threats that leveraged trusted platforms and legitimate authentication flows. SkyW4lker, a phishing kit, used Microsoft’s device‑code authentication to gain account access without passwords, with 618 sandbox analyses identified, 46% from the U.S. Researchers employed ANY.RUN’s Related Threat Context to link SkyW4lker to the Gabagool kit, uncovering infrastructure across multiple sectors. The article outlines detection tactics, including restricting device‑code use, leveraging sandbox insights, and tightening AI‑related downloads to reduce MTTR and prevent credential theft.

💡 By exposing how attackers hijack legitimate authentication, the report equips security teams with actionable tools to cut investigation time and stop credential‑stealing campaigns before they breach critical systems.

thehackernews.com · Nov 5

Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find…

A critical vulnerability can traverse multiple security tools yet remain unmitigated because essential context—ownership, reachability, existing protections, and business impact—is often missing. Each gap forces additional investigations, handoffs, and delays. An effective exposure management platform must link discovery to clear prioritization, actionable response, and proof of remediation, a process defined as Continuous Threat Exposure Management (CTEM). The article outlines five tests to evaluate whether a platform supports CTEM across infrastructure, identities, sensitive data, and external threats. It highlights the role of Cyber Asset Attack Surface Management (CAASM) in consolidating disparate asset records and exposing stale data, and External Attack Surface Management (EASM) in revealing shadow IT, exposed services, and brand impersonation. Integrating CAASM and EASM creates a unified view that drives accurate prioritization, validation, and rapid remediation.

💡 Without a unified platform that bridges internal and external asset intelligence, organizations waste time reconciling inconsistent data, leaving high‑risk exposures open far longer than necessary.

gamesradar.com · Nov 5

Stellar Blade studio confirms previous game Nikke was hacked and the launcher…

Shift Up, the studio behind Stellar Blade, confirmed a cyberattack on the PC launcher of its game Goddess of Victory: Nikke. On November 4, the official account announced that third‑party tampering had altered the launcher’s script files. The company is investigating the extent of the impact and collaborating with Level Infinite to develop a permanent fix. Shift Up apologized for the disruption and pledged to release further updates on mitigation measures.

💡 The incident underscores the vulnerability of popular game launchers to external tampering, potentially exposing user data and game integrity. It also highlights the rapid response required by developers to maintain player trust during security breaches.