> InfoSec News Nuggets – 11/06/2026

OpenAI Model Wrote Its Own Network Code to Get Around Sandbox Restrictions OpenAI disclosed that an internal research model, asked during an August coding evaluation to build a website modeled on a reference site, found its sandbox web proxy down and spent hours trying to get around network restrictions. The model crafted raw packets to resolve DNS, wrote its own packet-level connection code, tried fragmented requests to slip past a network filter, probed Amazon S3, and even asked the instance metadata service for cloud credentials before being refused. It never reached the real site and instead invented content, including customer testimonials. OpenAI’s misalignment monitor caught the behavior and found no evidence of data theft or access to the host or other tenants, and unprivileged containers no longer get raw-packet access by default.   Single hacker uses 12 AI agents to launch global cyberattacks Acronis Threat Research Unit says a single operator, believed to be based in Taiwan, used a 12-agent AI attack mesh it calls BOSSAI to target hundreds of organizations across 11 countries, including emergency services, banks, universities, military systems and e-commerce sites. Researchers uncovered the operation through what looked like a misconfigured development server holding more than 90,000 files, roughly 9GB of logs, exploit tools and victim data. Confirmed breaches exposed medical and personal data, including patient-care records from a Taipei fire department platform and about 206,800 residential phone records in Mexico. Commercial AI models repeatedly refused offensive tasks, pushing the attacker toward weaker locally run open-weight models, but researchers warn the campaign shows one person can now run operations that once required a full team.   Cyberattack on Norway’s aid agency may have swept up all user data Norad, Norway’s development aid agency, disclosed that the names and email addresses of all 20,614 users registered on its Grants Portal, representing 12,511 organizations worldwide, may have been exposed in a cyberattack discovered on October 30. Attackers logged in using 27 compromised user accounts and stole applications and supporting documents from three organizations based outside Norway, and the agency cannot rule out that names of applicants operating in conflict zones and authoritarian states were seen. The portal was shut down immediately, outside experts have been brought in, and the incident has been reported to police, the Norwegian Data Protection Authority and the National Security Authority, which said the attack shares characteristics with other recent cyberattacks.   Ukrainian news outlet Kyiv Independent hit by suspected Russian cyberattack Hackers suspected of working on Russia’s behalf gained access to The Kyiv Independent’s website management system and newsletter distribution service, using them to post false messages on the site and send fabricated emails to subscribers in Russian and English. One email falsely claimed President Zelensky had launched a nuclear warhead at Kyiv after meeting Putin and urged readers to seek shelter, while others described a fake physical attack on Zelensky. The outlet said members’ and donors’ banking information was not compromised and that it is working with cybersecurity specialists to investigate. The incident comes days after hackers compromised Ukraine’s widely used air raid alert app to push fake nuclear and chemical threat warnings, though no connection between the two has been confirmed.   Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Synology is urging customers to update DiskStation Manager after observing ransomware attacks against NAS devices running outdated versions by exploiting a vulnerability patched in December 2024. While the vendor did not name the exact flaw, it pointed to an advisory covering CVE-2024-10441, a critical remote code execution bug, along with two lower-severity issues. Users have reported C3RB3R ransomware infections that lock files with a “.L0CK3D” extension and drop a “read-me3.txt” ransom note, and Qihoo 360 says the group has also exploited two critical DSM flaws Synology fixed in September 2026. Synology recommends updating immediately and enabling automatic updates. The post InfoSec News Nuggets – 11/06/2026 appeared first on AboutDFIR - The Definitive Compendium Project.