This briefing covers 9 cybersecurity and geopolitics stories published around Sunday, November 8, 2026, and 8 disclosed vulnerabilities (CVE-2026-123573, CVE-2026-123575, CVE-2026-123576, CVE-2026-123577 and others). Each entry links to the original reporting.
Crédit Mutuel Arkéa suffered $133 million in fraudulent transactions after threat actors compromised a third-party service provider and pivoted into the bank's payment systems.
imgproxy versions 3.3.0–4.0.16 fail to validate the ICO data_size field, letting any unauthenticated attacker crash workers with a 23-byte file claiming ~4GB allocation. Severity 8.7 HIGH; unpatched internet-facing image proxies in media and CDN infrastructure are exposed with zero authentication barrier.
Hickory DNS hickory-proto 0.3.1–0.26.1 processes malicious DNS messages with quadratic-time name compression, letting remote attackers spike CPU to service-denial levels. Any resolver running this library in production DNS infrastructure is a target requiring immediate patch to 0.26.1.
Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 enters an unbounded loop during DNSSEC NSEC3 closest-encloser proof validation when fed a cross-zone SOA record, panicking debug builds and exhausting memory in release builds.
Hickory DNS 0.25.0-alpha.3 through 0.25.2 loops indefinitely on cyclic NS referrals lacking glue records, amplifying upstream query volume; zero-TTL NS records compound the effect.
Hickory DNS 0.24.0–0.26.2 imposes no size limit on DNS-over-HTTPS request bodies over HTTP/2 or HTTP/3, enabling remote memory exhaustion without authentication. DoH resolvers are increasingly critical infrastructure; this flaw requires no exploitable logic, only sustained large POST requests.
Hickory DNS 0.24.0–0.26.1 pre-allocates buffers based on attacker-supplied length prefixes for QUIC connections and applies no timeout, allowing persistent memory exhaustion across many connections.
Hickory DNS before 0.26.2 sets no timeout or body-size limit on incomplete DoH HTTP/2 connections, enabling remote attackers to hold connections open and exhaust server memory. The fix requires upgrading to 0.26.2; any public-facing DoH resolver on older versions is trivially deniable.
hickory-dns 0.20.1–0.26.2 panics and crashes when parsing a zone file where a SVCB or HTTPS record service parameter value is a lone quote character. Any pipeline that processes untrusted zone files—provisioning systems, secondary nameservers—can be crashed by a single malformed record.