--- title: "ARTEX Exposes Secrets, WorkOS AI Breach, Qubole AWS Breach | AutoSPF" description: "Explore the latest cybersecurity threats, including ARTEX AI attacks, WorkOS and Qubole breaches, supply chain compromises, and critical vulnerabilities." image: "https://autospf.com/og/blog/artex-exposes-secrets-workos-ai-breach-qubole-aws-breach.png" canonical: "https://autospf.com/blog/artex-exposes-secrets-workos-ai-breach-qubole-aws-breach/" --- Quick Answer This week’s cybersecurity news highlights AI-powered attacks, cloud data breaches, supply chain compromises, exploited software vulnerabilities, and critical infrastructure threats. Organizations should strengthen access controls, patch systems, and improve email security to reduce risks. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fartex-exposes-secrets-workos-ai-breach-qubole-aws-breach%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=ARTEX%20Exposes%20Secrets%2C%20WorkOS%20AI%20Breach%2C%20Qubole%20AWS%20Breach&url=https%3A%2F%2Fautospf.com%2Fblog%2Fartex-exposes-secrets-workos-ai-breach-qubole-aws-breach%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fartex-exposes-secrets-workos-ai-breach-qubole-aws-breach%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Fartex-exposes-secrets-workos-ai-breach-qubole-aws-breach%2F&title=ARTEX%20Exposes%20Secrets%2C%20WorkOS%20AI%20Breach%2C%20Qubole%20AWS%20Breach "Share on Reddit") [ ](mailto:?subject=ARTEX%20Exposes%20Secrets%2C%20WorkOS%20AI%20Breach%2C%20Qubole%20AWS%20Breach&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Fartex-exposes-secrets-workos-ai-breach-qubole-aws-breach%2F "Share via Email") ![AI Cybersecurity and Supply Chain Breaches](https://media.mailhop.org/autospf/spf-lookup-6499-1794393701673.jpg) This week’s cyber stories show attackers getting in through trust that organizations had already granted, whether to a vendor, a cloud integration, a code platform, or an AI tool. **AI-driven offensive frameworks** also moved from theory into real intrusions, and governments went on the record about a large sabotage campaign against food infrastructure. ## Agentic AI tool ARTEX goes from leaked secret to cloud data in five minutes! **Microsoft Threat Intelligence reported** on 5 November that attackers are using an agentic AI framework called ARTEX to search public GitHub for exposed credentials. In one case, an agent found OAuth application secrets, signed in as a service principal, and pulled data from [Azure Key Vault within about five minutes](https://gbhackers.com/azure-key-vault-secrets/). [Read the coverage](https://cybersecuritynews.com/artex-ai-azure-key-vault-secrets/) ## WorkOS breach shows AI-assisted intrusion into a sales application! Developer identity platform WorkOS said it detected unauthorized access to an **internal sales application** on 30 October and described the cause in a bulletin dated 2 November. _The attackers used an AI-assisted offensive framework to automate reconnaissance and exploitation._ Exposed data included business contact details, account histories, and summaries of sales calls and customer Slack conversations, though [WorkOS reported](https://www.securityweek.com/ai-linked-breaches-mount-as-workos-northflank-trigger-dev-disclose-hacks/) no access to production data. [Read the report](https://gbhackers.com/hackers-use-ai-powered-attack-framework-to-breach-workos/) ## Qubole’s trusted AWS access turned into a customer breach! **Researchers at Wiz reported** that attackers used credentials tied to data platform [Qubole’s own AWS account](https://news.lavx.hu/article/hackers-exploit-qubole-s-trusted-aws-access-to-breach-customer-accounts-steal-data) to assume integration roles in customer environments between 14 and 26 October. _The attackers pulled secrets from Secrets Manager, Lambda, and SSM, then downloaded S3 data._ Customers were told to remove unused vendor roles, restrict trust policies, and rotate any exposed secrets. [Read the report](https://thehackernews.com/2026/11/hackers-exploit-quboles-trusted-aws.html) ## French bank Crédit Mutuel Arkéa loses funds through a service provider! ![Spf Record Checker 1098](https://media.mailhop.org/autospf/spf-record-checker-1098-1794393783465.jpg) Crédit Mutuel Arkéa confirmed on 4 November that attackers reached it through an unnamed service provider’s platform and used the bank’s own account to send fraudulent transfers. **Blockchain investigator ZachXBT estimated** the losses at about [$133 million](https://www.helpnetsecurity.com/2026/11/09/credit-mutuel-arkea-cyberattack-133-million/), which the bank said was the right order of magnitude. The bank stated that customer assets were unaffected. [Read the report](https://securityaffairs.com/202628/cyber-crime/attackers-exploit-third-party-provider-to-raid-french-bank-credit-mutuel-arkea.html) ## France blames Iran’s Revolutionary Guards for supermarket fridge sabotage! On 9 November, France’s foreign minister formally attributed the October attacks on supermarket refrigeration to [Iran’s Revolutionary Guards](https://www.npr.org/2026/11/09/g-s1-152724/france-iran-cyber-sabotage-fridge-attacks). _Paris has opened a judicial investigation and requested international arrest warrants for members of the Shahid Kaveh unit, and the Iranian ambassador was summoned. Iran has denied the claims._ [Read the report](https://www.aljazeera.com/news/2026/11/9/france-accuses-iran-of-cyberattack-on-european-fridges) ## US agencies warn that refrigeration controllers are under attack! CISA, the FBI, and several **US federal departments** issued a joint advisory on 5 November about [attacks on industrial refrigeration](https://thehackernews.com/2026/11/us-agencies-warn-refrigeration.html) and cold-chain monitoring systems. Attackers can remotely alter settings and push cold storage into continuous heating or defrost. _The agencies recommend taking these controllers off the internet, isolating them on dedicated OT networks, and keeping offline backups._ [Read the advisory coverage](https://www.infosecurity-magazine.com/news/cisa-protect-refrigeration-networks/) ## GhostAction supply chain campaign keeps spreading through GitHub! Socket reported on 9 November that a new wave of the [GhostAction campaign](https://www.darkreading.com/application-security/ghostaction-hacking-wave-fizzles-attackers-github) has compromised more than **500 GitHub accounts**. T_he attackers used them to plant a credential-stealing workflow file in tens of thousands of repositories, targeting cloud, AI, and publishing keys._ Some affected repositories belong to large organizations. [Read the report](https://cybersecuritynews.com/ghostaction-github-account-compromise/) ![Spf Record Example 3287](https://media.mailhop.org/autospf/spf-record-example-3287-1794393821216.jpg) ## Ethersphere packages hijacked to steal crypto wallet keys! **OX Security reported** on 9 November that attackers used a suspected compromised developer key to [inject malicious code](https://cybernews.com/security/wordpress-essential-plugins-injected-malicious-code/) into the @ethersphere/bee-js npm package and the swarm-desktop GitHub repository. The malware targeted [crypto wallet keys](https://news.lavx.hu/article/attackers-hijack-ethersphere-release-tools-to-steal-swarm-wallet-keys) and deployed cross-platform backdoors. The npm package was reverted to a clean version. [Read the analysis](https://www.ox.security/blog/ethersphere-hijacked-with-crypto-stealing-malware-via-github-npm/) ## N-able takes N-central offline after a zero-day dump! [N-able took its hosted N-central platform offline](https://www.techtarget.com/news/n-able-takes-n-central-platform-offline-after-zero-day-dump/874195/) on 9 November and asked **on-premises customers** to shut down their servers. _The move followed a researcher’s public release of more than 30 alleged zero-days, called Able2Shell, with proof-of-concept code._ N-able said it had seen no confirmed exploitation in customer environments but was working on a hotfix. [Read the report](https://www.bleepingcomputer.com/news/security/n-able-takes-cloud-platform-offline-after-30-plus-zero-days-published/) ## “SSHole” OpenSSH bug lets attackers log in to passwordless accounts! **OpenSSH released version 10.6p2** on 5 November to fix [CVE-2026-123158](https://www.itnews.com.au/news/lightweight-linux-distros-vulnerable-to-sshole-password-bypass-630155), an authentication bypass on musl-based Linux systems without PAM, including Alpine Linux. _The flaw let attackers log in with long passwords to accounts that should have none, and the fix requires restarting sshd._ Admins who cannot patch right away were advised to disable password logins. [Read the report](https://www.securityweek.com/openssh-rushes-patches-for-sshole-authentication-bypass/) ![Spf Flattening 9704](https://media.mailhop.org/autospf/spf-flattening-9704-1794393732733.jpg) ## GPUStack flaw added to CISA’s exploited vulnerabilities list! CISA added CVE-2026-102895 to its Known [Exploited Vulnerabilities catalog](https://securityaffairs.com/202813/hacking/u-s-cisa-adds-ibm-signalwire-freeswitch-openssh-and-gpustack-flaws-to-its-known-exploited-vulnerabilities-catalog.html) on 9 November, with a federal patch deadline of 12 November. The flaw in the **AI GPU cluster manager** lets requests from the loopback address gain admin rights. Attackers used it to create backends that open reverse shells. Users should upgrade to version 2.2.0 or later and rotate any secrets the platform stored. [Read the report](https://tech-insider.org/cisa-kev-gpustack-freeswitch-openssh-aspera-faspex-nov-12-deadline-2026/) ## Linux kernel TCP flaw sparks suspected internet-wide scanning! Canonical raised the priority of [CVE-2026-98432](https://pasqualepillitteri.it/en/news/28306/cve-2026-98432-linux-kernel-tcp-flaw-no-patch), a kernel use-after-free in IPv4 TCP handling, to Critical on 3 November. **Researcher Marcus Hutchins reported** probing of port 443 over MPTCP beginning 2 November, which he believes is aimed at this flaw. His earlier scan found about 2.1 million servers reachable over MPTCP. [Read the report](https://cyberpress.org/ubuntu-critical-linux-kernel-remote-code-execution/) ## ModSecurity WAF bypass exploit goes public without a patch! [HKCERT warned on 9 November](https://sqmagazine.co.uk/modsecurity-upload-bypass-exploit-public/) that proof-of-concept code is public for CVE-2026-104269, a **ModSecurity upload bypass**. _The flaw lets a file that looks like a JPG reach a Go, Python, Node.js, or Java app as a PHP script, which can lead to remote code execution if the file is in a web-accessible folder_. The advisory lists no fixed release yet. [Read the report](https://sqmagazine.co.uk/modsecurity-upload-bypass-exploit-public/) Alongside these emerging threats, strong [email security](https://autospf.com/) practices remain essential for **protecting organizational domains**. Properly configured [DMARC](https://autospf.com/dmarc/), [DKIM](https://autospf.com/blog/how-to-configure-dkim-for-simplelists/), and [SPF records](https://autospf.com/blog/what-spf-records-are-and-how-they-protect-email-domains/) help prevent email spoofing, reduce phishing risks, and strengthen domain-level protection against email-based attacks. ![Brad Slavin](https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager General Manager of DuoCircle. Product strategy and commercial lead for AutoSPF's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Ready to get started? Try AutoSPF free — no credit card required. [ Book a Demo ](/book-a-demo/) Scan Your Domain Now Instantly scan your domain for DKIM, SPF, and DMARC issues Check My Domain Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fartex-exposes-secrets-workos-ai-breach-qubole-aws-breach%2F) [ ](https://twitter.com/intent/tweet?text=ARTEX%20Exposes%20Secrets%2C%20WorkOS%20AI%20Breach%2C%20Qubole%20AWS%20Breach&url=https%3A%2F%2Fautospf.com%2Fblog%2Fartex-exposes-secrets-workos-ai-breach-qubole-aws-breach%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fartex-exposes-secrets-workos-ai-breach-qubole-aws-breach%2F) Copy Related Articles - [ ![DIY-ing SPF](https://media.mailhop.org/autospf/images/2024/04/spf-record-example-5874.jpg) 10 Reasons Why DIY-ing SPF isn’t a Good Choice for Companies Intermediate ](/blog/10-reasons-diy-ing-spf-isnt-good-choice-for-companies/) - [ ![phishing actors](https://media.mailhop.org/autospf/images/2025/11/spf-record-checker-0096.jpg) The 12.4 billion shield for your email communications: Why DMARC software is the unsung hero in the war against phishing actors! Intermediate ](/blog/12-4-billion-dmarc-software-shield-protecting-email-from-phishing-actors/) - [ ![421 Error SMTP Guide](https://media.mailhop.org/autospf/spf-lookup-1607-1785756872932.jpg) 421 Error SMTP Survival Guide: Fix the 4.4.2 Connection Dropped Issue Intermediate ](/blog/421-error-smtp-survival-guide-fix-connection-dropped-email-issue/) - [ ![DNS vulnerabilities affecting email authentication](https://media.mailhop.org/autospf/spf-lookup-9081-1790592336407.jpg) 5 Common DNS Vulnerabilities Affecting Email Authentication Intermediate ](/blog/5-common-dns-vulnerabilities-affecting-email-authentication/) ## Related Articles [ Intermediate 6m 10 Reasons Why DIY-ing SPF isn’t a Good Choice for Companies Apr 4, 2024 ](/blog/10-reasons-diy-ing-spf-isnt-good-choice-for-companies/)[ Intermediate 5m The 12.4 billion shield for your email communications: Why DMARC software is the unsung hero in the war against phishing actors! Nov 19, 2025 ](/blog/12-4-billion-dmarc-software-shield-protecting-email-from-phishing-actors/)[ Intermediate 421 Error SMTP Survival Guide: Fix the 4.4.2 Connection Dropped Issue Aug 3, 2026 ](/blog/421-error-smtp-survival-guide-fix-connection-dropped-email-issue/)[ Intermediate 5 Common DNS Vulnerabilities Affecting Email Authentication Sep 28, 2026 ](/blog/5-common-dns-vulnerabilities-affecting-email-authentication/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"ARTEX Exposes Secrets, WorkOS AI Breach, Qubole AWS Breach","description":"Explore the latest cybersecurity threats, including ARTEX AI attacks, WorkOS and Qubole breaches, supply chain compromises, and critical vulnerabilities.","url":"https://autospf.com/blog/artex-exposes-secrets-workos-ai-breach-qubole-aws-breach/","datePublished":"2026-11-11T00:00:00.000Z","dateModified":"2026-11-11T00:00:00.000Z","dateCreated":"2026-11-11T00:00:00.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://autospf.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the General Manager of DuoCircle, the company behind AutoSPF, DMARC Report, Phish Protection, and Mailhop. He founded DuoCircle in 2014 to solve the SPF 10-DNS-lookup problem at scale and has led the company's growth to 2,000+ customers. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement) rather than hands-on DNS engineering.","image":"https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/artex-exposes-secrets-workos-ai-breach-qubole-aws-breach/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/spf-lookup-6499-1794393701673.jpg","caption":"AI Cybersecurity and Supply Chain Breaches"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://autospf.com/intermediate/"},{"@type":"ListItem","position":4,"name":"ARTEX Exposes Secrets, WorkOS AI Breach, Qubole AWS Breach","item":"https://autospf.com/blog/artex-exposes-secrets-workos-ai-breach-qubole-aws-breach/"}]} ```