Keeping cyber threats on ice.

Federal agencies warn of cyberattacks on industrial refrigeration systems. Healthcare cybersecurity could get a post-midterm boost. Chainalysis exposes customer credentials, and DigiCert discloses a breach. OpenAI's latest model learns to respect boundaries. D-Link warns of unpatched switch vulnerabilities. The EU accuses TikTok of leading users down harmful rabbit holes, while tech giants challenge California's child safety law. Federal prosecutors charge three suspects in a $129 million AI-powered impersonation scheme. Our guest is Greg Notch, CTO of Expel, sharing thoughts on how pacing AI won't stop the bad actors. Meta's AI feeding frenzy gets put on a diet.

Today is Friday November 6th 2026. I’m Dave Bittner. And this is your CyberWire Intel Briefing.

The Feds warn of ongoing cyberattacks targeting industrial refrigeration. 

Five U.S. government agencies are warning of ongoing cyberattacks targeting industrial refrigeration and cold chain monitoring systems worldwide. CISA, the FBI, and the departments of Health and Human Services, Agriculture, and Transportation say attackers are targeting temperature controllers used in grocery stores, cold storage facilities, and refrigerated transportation.

Attackers may exploit authentication bypass vulnerabilities, code injection flaws, and weak security configurations to remotely manipulate refrigeration settings. They could force equipment into continuous heating or defrost cycles, potentially spoiling food and medicine, damaging equipment, creating fire hazards, and putting consumers at risk. Attackers could also prevent operators from seeing accurate temperature readings.

The agencies urge organizations to remove refrigeration controllers from the public internet, segment operational technology networks, strengthen authentication, patch vulnerable devices, and monitor for suspicious activity. They also recommend establishing safe temperature limits and alerts.

The warning highlights how cyberattacks against relatively simple industrial controllers can have serious physical consequences.

Post-midterms, healthcare cybersecurity could see renewed attention. 

With Democrats poised to control both chambers of Congress in January, healthcare cybersecurity, AI safety, and health data privacy could receive renewed attention. Experts expect bipartisan interest in strengthening security standards and helping rural hospitals defend against cyberattacks, but disagreements over funding and regulatory costs could complicate legislation.

The Trump administration's deregulatory agenda presents another obstacle. A sweeping overhaul of the HIPAA Security Rule, proposed under President Biden, remains uncertain, with final action delayed until at least July 2027.

Lawmakers may also scrutinize AI use in healthcare and sensitive health information collected by apps and chatbots operating outside HIPAA protections.

Industry experts warn that healthcare organizations shouldn't wait for Washington to act. Cyberattacks continue threatening patient safety, clinical operations, and sensitive data, regardless of who's running Congress.

Chainalysis says all customers suffered breach exposure. 

Blockchain intelligence firm Chainalysis says attackers exposed usernames, password hashes, and live authentication tokens for all customers, expanding an earlier breach disclosure involving customer identity information. The company attributes the intrusion to attackers using AI-driven techniques and an on-path attack. Chainalysis has taken several products and its login portal offline while strengthening security. Customers will be required to reset passwords and rotate API keys. The company says it has found no evidence that attackers accessed investigative data or manipulated its blockchain attribution records.

DigiCert discloses a data breach. 

DigiCert has disclosed a data breach exposing business customers’ contact information and, in some cases, identity documents. The incident began when an internal archiving system was inadvertently exposed to the internet. Attackers exploited a self-registration feature lacking multifactor authentication to access archived records between June 27 and July 2. DigiCert discovered the data exposure in October and has since strengthened security controls. The company says its certificate issuance systems were unaffected. It has not disclosed how many customers were impacted.

OpenAI says their latest model is better at respecting boundaries. 

OpenAI has unveiled GPT-6 Cyber, a new security model rated Critical for cybersecurity capabilities under the company's Preparedness Framework. The model significantly outperformed its predecessor in exploitation benchmarks while demonstrating improved adherence to authorized testing boundaries. In Linux kernel research, it reproduced more than 1,700 vulnerabilities and developed working privilege escalation exploits for 948. It also identified 81 high-severity Firefox vulnerabilities, with Mozilla already rolling out patches. OpenAI says it has reported 304 critical issues to maintainers. New safeguards monitor authorized activity and restrict assistance with attacks on critical infrastructure. Dragos helped evaluate protections for industrial systems. Access is initially limited to approved customers participating in OpenAI's Daybreak Red program, with broader availability planned for authorized security researchers.

D-Link warns of multiple vulnerabilities in its managed switches. 

D-Link is warning of multiple unpatched vulnerabilities affecting its DGS-3130 series managed switches. The flaws involve authentication, access controls, and information handling in the D-Link Discovery Protocol. Attackers with network access could potentially steal sensitive information, modify configurations, change credentials, or disrupt services. D-Link hasn't assigned public CVE identifiers and is investigating whether other products are affected. Until firmware updates are available, administrators should disable the discovery protocol, restrict management access, remove unnecessary SNMP community strings, and monitor for suspicious configuration changes or unexpected resets.

The EU accuses TikTok of taking users down harmful rabbit holes, while US companies sue California over a law designed to protect children 15 and younger from addictive social media features.

The European Commission is accusing TikTok of violating the Digital Services Act by allowing its recommendation algorithm to draw users into potentially harmful content rabbit holes. Regulators say the platform repeatedly serves videos about sadness, self-harm, and body image, potentially damaging the mental health of young and vulnerable users. Investigators analyzed roughly 20,000 videos and concluded that TikTok's existing safeguards are ineffective. They want recommendations based more on users' explicit preferences rather than engagement signals like viewing time. The case marks an unprecedented challenge to the engagement-driven business model of a major social media platform. TikTok disputes the findings, calling them fundamentally inaccurate. The conclusions remain preliminary, and the company can challenge the evidence. If violations are confirmed, TikTok could face fines reaching 6% of its annual global revenue. European officials say they're also examining similar recommendation practices on other platforms.

Meta, TikTok, and Google are suing California to block a new law designed to protect children 15 and younger from addictive social media features. Assembly Bill 1709, scheduled to take effect January 1, prohibits platform designs the state considers psychologically exploitative. The companies filed separate federal lawsuits arguing the law violates First Amendment protections and conflicts with Section 230, which limits platforms' liability for user-generated content. They also contend that parents, rather than the government, should determine appropriate online safeguards for children. California Attorney General Rob Bonta says the state will defend the legislation. Governor Gavin Newsom signed the measure in September, citing concerns about technology's impact on children. Google warns the law could undermine existing tools designed to deliver age-appropriate content.

Federal prosecutors charged three people with using AI to impersonate corporate executives. 

Federal prosecutors have charged three people with using AI-generated impersonations of corporate executives and attorneys to allegedly steal approximately $129 million. Jacob Soall, Sharon Hazan, and Guy Sheetrit are accused of targeting thousands of companies worldwide over more than 18 months. According to the indictment, the defendants contacted accounting departments posing as CEOs requesting confidential financial transactions. They then used AI to impersonate executives during phone or video calls before directing employees to supposed attorneys, also impersonated by the conspirators. Victims were instructed to wire money to international bank accounts, with proceeds converted into cryptocurrency to conceal their origins. The defendants face charges including wire fraud, aggravated identity theft, and money laundering. The alleged victims include hospitals, financial institutions, and other businesses.

 

Coming up after the break, I speak with Greg Notch, CTO of Expel, about how pacing AI won't stop the bad actors.

 

And, that was Expel's CTO Greg Notch. 

Meta's AI feeding frenzy gets put on a diet. 

Meta has hit the brakes on a controversial plan to expand its rights to use content from business customers’ websites. The proposed commercial terms would have allowed Meta to collect material from linked domains and web pages, potentially including news articles, to train its AI products. Journalists and publishers objected to having their work swept into Meta’s training pipeline without explicit permission. Meta initially delayed the changes from October 30 to November 20, then paused them indefinitely. A Norwegian court issued a temporary injunction against the terms, while British regulators announced plans to investigate. Meta had already softened some language, removing explicit references to AI training. For now, existing terms remain in place. Apparently, even in the age of artificial intelligence, permission is still a thing.

And that’s the CyberWire.

For links to all of today’s stories, check out our Daily Briefing at the cyberwire dot com.

 

Research Saturday has Matt Poto from Huntress talking about their work on "Grand Theft Auto VI Hype Leads to Malware."

On Sunday, catch T-Minus: Space-Cyber Briefing where host Maria Varmazis sits down with ⁠Vito Askins⁠, founder of ⁠Green Until Integration Consulting⁠, to discuss risk accumulation and operational readiness.  

And that’s the CyberWire Daily, brought to you by N2K CyberWire.

We’d love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com

N2K’s lead producer is Liz Stokes. We’re mixed by  Tré Hester, with original music by and sound design Elliott Peltzman. Our contributing host is Maria Varmazis. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. And I’m Dave Bittner. Thanks for listening.