Tue 3 Nov · updated 17:01 UTC
Today in security
Today’s briefing
Updated 14:50 UTC
Binance traces theft to fake job interviews
4 updates since 07:00 · latest 14:50 UTC
Binance says attackers compromised employees through fake job interviews and malware, then used internal AI tools and stolen credentials to reach its wallet signing service. It puts the loss at about billion and says it will cover it.
Known exploited8
CISA KEV entries named in the last 48 hours of coverage, by federal deadline
- In CISA KEV
Google BrotliCVE-2026-111497
Federal deadline 10 Nov · In CISA KEV since 27 Oct
9.2Critical83% EPSS22 articles
- In CISA KEV
Ivanti Connect SecureCVE-2026-118527
Federal deadline 13 Nov · In CISA KEV since 30 Oct
Not scored8 articles
- In CISA KEV
Ivanti Connect SecureCVE-2026-111357
Federal deadline passed 2 Nov · In CISA KEV since 30 Oct
7.0High0.5% EPSS8 articles
- In CISA KEV
Cisco Secure Firewall Adaptive Security Appliance (ASA) SoftwareCVE-2026-76418
Federal deadline passed 1 Nov · In CISA KEV since 29 Oct
8.6High0.8% EPSS7 articles
Show 4 more · federal deadlines passed
- In CISA KEV
BeyondTrust Remote SupportCVE-2026-102764
Federal deadline passed 19 Oct · In CISA KEV since 16 Oct
9.3Critical19% EPSS13 articles
- In CISA KEV
Ivanti Connect SecureCVE-2026-104935
Federal deadline passed 16 Oct · In CISA KEV since 13 Oct
8.6High87% EPSS21 articles
- In CISA KEV
Adobe CommerceCVE-2026-75650
Federal deadline passed 11 Sep · In CISA KEV since 8 Sep
10.0Critical3.9% EPSS9 articles
- In CISA KEV
RARLAB WinRARCVE-2025-8088
Federal deadline passed 2 Sep 2025 · In CISA KEV since 12 Aug 2025 · Used in ransomware campaigns
8.4High94% EPSS23 articles
Latest news76
The last 24 hours, newest first; stories about known exploited CVEs are above
Latest story at 16:03 UTC. Red diamonds mark the 3 stories about exploited CVEs.
- 16:03 UTC. Kaspersky finds BlackX bootkit bypassing Secure Boot on Windows. 1 outlet.
- 15:41 UTC. Google reports LLMjacking attacks driving cloud bills to $1 million. 1 outlet.
- 15:35 UTC. Google Details Criminal Enterprise Reselling Stolen LLM Access. 1 outlet.
- 15:30 UTC. ESET says Gorbag targets Ukrainian officials with spyware. 1 outlet. About an exploited CVE.
- 15:16 UTC. Hijacked cPGuard updates backdoor Linux servers and steal data. 1 outlet.
- 14:32 UTC. Frontline Education Breach Exposes Data of Over 1.3 Million. 1 outlet.
- 14:30 UTC. BTCPay Server flaw exploited to steal cryptocurrency from wallets. 1 outlet.
- 14:12 UTC. CrowdStrike agrees to buy Fiddler AI and Dreadnode. 1 outlet.
- 14:11 UTC. Google links Videostrong to backdoor in 1.3 million TV boxes. 1 outlet.
- 14:00 UTC. Bitdefender links 3AM attack on UK school to AI-like loops. 1 outlet.
- 14:00 UTC. Cloudflare launches Zero Wire vulnerability intelligence feed. 1 outlet.
- 13:57 UTC. Check Point finds prompt adware in Codex jailbreak bundle. 1 outlet.
- 12:54 UTC. Cyberattack hits fridges in 12 European countries, including the UK. 1 outlet.
- 12:37 UTC. StepSecurity launches tools to find malicious files left by attacks. 1 outlet.
- 12:01 UTC. Leakers$ claims billboard hacks exposed weak content systems. 1 outlet.
- 11:26 UTC. Revolve says customer payment card data was stolen in breach. 1 outlet.
- 11:18 UTC. Gartner framework urges organisations to rethink vulnerability prioritisation. 1 outlet.
- 11:00 UTC. Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware. 1 outlet.
- 10:45 UTC. Google warns LLMJacking could cost businesses up to $1m. 1 outlet.
- 10:00 UTC. Kaspersky details machine learning for tracking OT network behaviour. 1 outlet.
- 09:49 UTC. UK cyber chief warns of AI attacks on infrastructure by 2028. 1 outlet.
- 09:35 UTC. Google Helps Dismantle XCPE Botnet Built by Chinese Firm. 1 outlet.
- 09:32 UTC. TWCA to Revoke Noncompliant Certificates After Serial Number Flaw. 1 outlet.
- 08:55 UTC. Ubuntu tests a fix for a Linux kernel flaw rated 9.8. 3 outlets.
- 08:49 UTC. NATO Adds AI Agents to Crossed Swords Cyber Exercise. 1 outlet.
- 08:31 UTC. BTCPay Server flaw linked to Bitcoin and Litecoin wallet thefts. 1 outlet.
- 08:13 UTC. Attackers breach cPGuard updates to steal server credentials. 1 outlet.
- 08:00 UTC. Kaspersky links AI driven CyberStrikeAI attacks to school intrusions. 1 outlet.
- 07:43 UTC. New fridge attacks disrupt more than 100 European stores. 1 outlet.
- 07:43 UTC. Synology warns ransomware operators are targeting outdated NAS devices. 1 outlet.
- 07:33 UTC. TeamViewer flaw could let remote hosts take over client PCs. 1 outlet.
- 07:27 UTC. Cyberattacks disrupt supermarket refrigeration across Europe. 2 outlets.
- 07:26 UTC. Anthropic bars Claude from cloning commercial video games. 1 outlet.
- 07:21 UTC. NIS2 Holds Boards Accountable for Access Control Oversight. 1 outlet.
- 07:01 UTC. Malware campaign hijacks Hugging Face models to mine cryptocurrency. 1 outlet.
- 06:24 UTC. Apple spyware alerts reach German lawmakers, BSI advises action. 1 outlet.
- 06:09 UTC. Teams help desk impersonation enabled AD CS domain attacks. 1 outlet.
- 05:34 UTC. Attackers Exploit CryptoPayment Gateway Flaw to Steal Wallet Keys. 1 outlet.
- 04:10 UTC. Cogent Security joins Fortune Cyber 60 for second year. 1 outlet.
- 03:45 UTC. Imperva links Magento attacks to PSK Agent RAT deployment. 1 outlet. About an exploited CVE.
- 03:35 UTC. Seven phpMyAdmin vulnerabilities expose users to account attacks. 1 outlet.
- 03:30 UTC. NCSC warns AI could fuel UK infrastructure ransomware by 2028. 2 outlets.
- 02:49 UTC. Brazil's Mercado Bitcoin halts withdrawals after $40 million drain. 1 outlet.
- 02:24 UTC. Google and partners dismantle botnet infecting 1.3 million TV boxes. 3 outlets.
- 02:12 UTC. Apache fixes eight high risk flaws across three projects. 1 outlet.
- 02:00 UTC. Stormcast covers crypto attacks and flaws in network security tools. 1 outlet.
- 01:53 UTC. SUSE fixes Rancher flaws exposing cloud credentials and shells. 1 outlet.
- 01:45 UTC. Google fixes 216 Android flaws in November security update. 2 outlets.
- 01:41 UTC. Arista patches two flaws that risk remote code execution. 1 outlet. About an exploited CVE.
- 01:11 UTC. macOS flaw lets local attackers gain root privileges. 1 outlet.
- 01:00 UTC. Researcher discloses Axis Camera Station flaws enabling host takeover. 1 outlet.
- 00:51 UTC. WorkOS says hackers used AI tool ARTEX to reach its sales records. 1 outlet.
- 00:37 UTC. Linux Kernel Roundup Flags Two Critical iSCSI Flaws. 1 outlet.
- 00:00 UTC. Attackers exploit Node-RED flaw to run commands on exposed systems. 3 outlets.
- 23:27 UTC. Syrian hacker sentenced for Assad regime conspiracy. 1 outlet.
- 23:27 UTC. Contractor Linked Personal AI Agent to Secure Pentagon System. 1 outlet.
- 23:27 UTC. BYOD offers UNM hospital patients up to $2,500 after attack. 1 outlet.
- 23:27 UTC. HHS settles ransomware investigation with Lehigh Valley Health Network. 1 outlet.
- 23:27 UTC. Liverpool Hospital Investigates Staff Over Patient Record Access. 1 outlet.
- 23:26 UTC. European Supermarket Freezers Hit by a Second Cyberattack. 1 outlet.
- 23:25 UTC. Suntory says cloud breach exposed data of 100,000 people. 1 outlet.
- 23:25 UTC. Hong Kong watchdog investigates airline and retailer data leaks. 1 outlet.
- 23:25 UTC. Killingly schools disclose network incident exposing personal data. 1 outlet.
- 23:25 UTC. HYBE breach exposes employee medical and financial records. 1 outlet.
- 23:00 UTC. Unit 42 details espionage, cybercrime and AI enabled attacks. 1 outlet.
- 22:27 UTC. Binance Hack Shows How One Laptop Led to Billions in Losses. 3 outlets.
- 20:20 UTC. Microsoft finds just 2,000 CVEs linked to real world attacks. 1 outlet.
- 18:34 UTC. Cisco Talos finds VOLTA infostealer uses AI to rank victims. 1 outlet.
- Known exploited CVE
- CVE not in KEV
- Other story
- Size: outlets on the story
- Stories an hour
Show as tableHide table
| Time (UTC) | Story | Outlets | Type |
|---|---|---|---|
| 16:03 | Kaspersky finds BlackX bootkit bypassing Secure Boot on Windows | 1 | CVE |
| 15:41 | Google reports LLMjacking attacks driving cloud bills to $1 million | 1 | CVE |
| 15:35 | Google Details Criminal Enterprise Reselling Stolen LLM Access | 1 | Other |
| 15:30 | ESET says Gorbag targets Ukrainian officials with spyware | 1 | Known exploited |
| 15:16 | Hijacked cPGuard updates backdoor Linux servers and steal data | 1 | Other |
| 14:32 | Frontline Education Breach Exposes Data of Over 1.3 Million | 1 | Other |
| 14:30 | BTCPay Server flaw exploited to steal cryptocurrency from wallets | 1 | Other |
| 14:12 | CrowdStrike agrees to buy Fiddler AI and Dreadnode | 1 | Other |
| 14:11 | Google links Videostrong to backdoor in 1.3 million TV boxes | 1 | Other |
| 14:00 | Bitdefender links 3AM attack on UK school to AI-like loops | 1 | Other |
| 14:00 | Cloudflare launches Zero Wire vulnerability intelligence feed | 1 | Other |
| 13:57 | Check Point finds prompt adware in Codex jailbreak bundle | 1 | Other |
| 12:54 | Cyberattack hits fridges in 12 European countries, including the UK | 1 | Other |
| 12:37 | StepSecurity launches tools to find malicious files left by attacks | 1 | Other |
| 12:01 | Leakers$ claims billboard hacks exposed weak content systems | 1 | Other |
| 11:26 | Revolve says customer payment card data was stolen in breach | 1 | Other |
| 11:18 | Gartner framework urges organisations to rethink vulnerability prioritisation | 1 | Other |
| 11:00 | Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware | 1 | Other |
| 10:45 | Google warns LLMJacking could cost businesses up to $1m | 1 | Other |
| 10:00 | Kaspersky details machine learning for tracking OT network behaviour | 1 | Other |
| 09:49 | UK cyber chief warns of AI attacks on infrastructure by 2028 | 1 | Other |
| 09:35 | Google Helps Dismantle XCPE Botnet Built by Chinese Firm | 1 | Other |
| 09:32 | TWCA to Revoke Noncompliant Certificates After Serial Number Flaw | 1 | Other |
| 08:55 | Ubuntu tests a fix for a Linux kernel flaw rated 9.8 | 3 | CVE |
| 08:49 | NATO Adds AI Agents to Crossed Swords Cyber Exercise | 1 | Other |
| 08:31 | BTCPay Server flaw linked to Bitcoin and Litecoin wallet thefts | 1 | Other |
| 08:13 | Attackers breach cPGuard updates to steal server credentials | 1 | Other |
| 08:00 | Kaspersky links AI driven CyberStrikeAI attacks to school intrusions | 1 | Other |
| 07:43 | New fridge attacks disrupt more than 100 European stores | 1 | Other |
| 07:43 | Synology warns ransomware operators are targeting outdated NAS devices | 1 | CVE |
| 07:33 | TeamViewer flaw could let remote hosts take over client PCs | 1 | CVE |
| 07:27 | Cyberattacks disrupt supermarket refrigeration across Europe | 2 | Other |
| 07:26 | Anthropic bars Claude from cloning commercial video games | 1 | Other |
| 07:21 | NIS2 Holds Boards Accountable for Access Control Oversight | 1 | Other |
| 07:01 | Malware campaign hijacks Hugging Face models to mine cryptocurrency | 1 | Other |
| 06:24 | Apple spyware alerts reach German lawmakers, BSI advises action | 1 | Other |
| 06:09 | Teams help desk impersonation enabled AD CS domain attacks | 1 | Other |
| 05:34 | Attackers Exploit CryptoPayment Gateway Flaw to Steal Wallet Keys | 1 | CVE |
| 04:10 | Cogent Security joins Fortune Cyber 60 for second year | 1 | Other |
| 03:45 | Imperva links Magento attacks to PSK Agent RAT deployment | 1 | Known exploited |
| 03:35 | Seven phpMyAdmin vulnerabilities expose users to account attacks | 1 | CVE |
| 03:30 | NCSC warns AI could fuel UK infrastructure ransomware by 2028 | 2 | Other |
| 02:49 | Brazil's Mercado Bitcoin halts withdrawals after $40 million drain | 1 | Other |
| 02:24 | Google and partners dismantle botnet infecting 1.3 million TV boxes | 3 | Other |
| 02:12 | Apache fixes eight high risk flaws across three projects | 1 | CVE |
| 02:00 | Stormcast covers crypto attacks and flaws in network security tools | 1 | Other |
| 01:53 | SUSE fixes Rancher flaws exposing cloud credentials and shells | 1 | CVE |
| 01:45 | Google fixes 216 Android flaws in November security update | 2 | CVE |
| 01:41 | Arista patches two flaws that risk remote code execution | 1 | Known exploited |
| 01:11 | macOS flaw lets local attackers gain root privileges | 1 | CVE |
| 01:00 | Researcher discloses Axis Camera Station flaws enabling host takeover | 1 | CVE |
| 00:51 | WorkOS says hackers used AI tool ARTEX to reach its sales records | 1 | Other |
| 00:37 | Linux Kernel Roundup Flags Two Critical iSCSI Flaws | 1 | CVE |
| 00:00 | Attackers exploit Node-RED flaw to run commands on exposed systems | 3 | CVE |
| 23:27 | Syrian hacker sentenced for Assad regime conspiracy | 1 | Other |
| 23:27 | Contractor Linked Personal AI Agent to Secure Pentagon System | 1 | Other |
| 23:27 | BYOD offers UNM hospital patients up to $2,500 after attack | 1 | Other |
| 23:27 | HHS settles ransomware investigation with Lehigh Valley Health Network | 1 | Other |
| 23:27 | Liverpool Hospital Investigates Staff Over Patient Record Access | 1 | Other |
| 23:26 | European Supermarket Freezers Hit by a Second Cyberattack | 1 | Other |
| 23:25 | Suntory says cloud breach exposed data of 100,000 people | 1 | Other |
| 23:25 | Hong Kong watchdog investigates airline and retailer data leaks | 1 | Other |
| 23:25 | Killingly schools disclose network incident exposing personal data | 1 | Other |
| 23:25 | HYBE breach exposes employee medical and financial records | 1 | Other |
| 23:00 | Unit 42 details espionage, cybercrime and AI enabled attacks | 1 | Other |
| 22:27 | Binance Hack Shows How One Laptop Led to Billions in Losses | 3 | Other |
| 20:20 | Microsoft finds just 2,000 CVEs linked to real world attacks | 1 | Other |
| 18:34 | Cisco Talos finds VOLTA infostealer uses AI to rank victims | 1 | Other |
- Kaspersky finds BlackX bootkit bypassing Secure Boot on Windows
Kaspersky has identified organisations infected with BlackX, a UEFI bootkit that can bypass Secure Boot on Windows machines despite the systems having Microsoft’s relevant updates installed. BlackX exploits…
Ars TechnicaCVE-2022-21894
- Google reports LLMjacking attacks driving cloud bills to $1 million
Google has warned that attackers are hijacking enterprise access to Large Language Models (LLMs) to drain cloud resources and services, creating fraudulently large computing charges. In a report shared with The Hacker…
The Hacker NewsCVE-2026-40217
- Google Details Criminal Enterprise Reselling Stolen LLM Access
Cybercriminals have established a thriving business model around stealing access to commercial LLMs and reselling it, with victims incurring resource costs up to around $1 million before access is revoked. The…
Dark Reading
- Hijacked cPGuard updates backdoor Linux servers and steal data
An attacker compromised the update system for the cPGuard security tool, breaching credentials at 02:06 UTC on 2 November 2026 and distributing a malicious script to Linux servers running cPGuard versions 5.88.12…
The Hacker News
- How North Korea is laundering $6.4 billion stolen from Binance
Binance says the attackers got in through fake job interviews, then used internal AI tools and stolen credentials to reach its wallet signing service. Analysts say software is laundering the funds around stablecoin…
CyberSIXT
- Frontline Education Breach Exposes Data of Over 1.3 Million
Frontline Education says attackers exploited a vulnerability in a third-party software product to gain unauthorised access to its environment on 14 August. The company says it fixed the security flaw, strengthened…
SecurityWeek
- BTCPay Server flaw exploited to steal cryptocurrency from wallets
Hackers stole cryptocurrency from hot wallets on BTCPay Server instances running version 2.4.1 or earlier. The project said in an incident update on 2 November 2026 that attackers used a different method to exploit a…
Infosecurity
- CrowdStrike agrees to buy Fiddler AI and Dreadnode
CrowdStrike has agreed to acquire AI monitoring company Fiddler AI and AI security testing firm Dreadnode. The companies have not disclosed the terms; The Wall Street Journal reported a combined price of about US$495…
SecurityWeek
- Google links Videostrong to backdoor in 1.3 million TV boxes
Google’s Threat Intelligence Group (GTIG) says it has high confidence that Android device maker Videostrong Technology built and operated the x[.]cpe backdoor for financial gain, infecting 1.3 million certified Android…
Malwarebytes
- Bitdefender links 3AM attack on UK school to AI-like loops
Bitdefender says a 3AM ransomware affiliate attacked a school in the UK, stealing backup credentials, creating rogue domain-admin accounts and linking previously separate Active Directory domains. The attackers used…
Dark Reading
- Cloudflare launches Zero Wire vulnerability intelligence feed
Cloudflare has launched Zero Wire, a public vulnerability intelligence feed within Cloudflare Radar. The company says the service is intended to help security teams assess significant vulnerabilities in Internet-facing…
Cloudflare
- Check Point finds prompt adware in Codex jailbreak bundle
Check Point Research says it found Haiou, a Chinese-language jailbreak bundle for OpenAI Codex, on a misconfigured web server used by a threat actor operating Cobalt Strike. The server’s logs showed the actor…
Check Point
- Cyberattacks Disrupt Supermarket Refrigeration Across Europe
Supermarkets in at least nine European countries reported cyber incidents affecting refrigeration systems on 1 November 2026, with food stocks destroyed or removed from sale. Retailers in Belgium, Estonia, Finland,…
Infosecurity
- Cyberattack hits fridges in 12 European countries, including the UK
The UK's cyber agency says vulnerable refrigeration technology was exploited in Britain, hitting meat suppliers, after supermarkets in 11 other European countries reported tampered fridges. Danfoss blames outdated…
CyberSIXT
- CVSS 9.8 Linux flaw lets attackers take root on Go servers by default
Red Hat and Ubuntu have fixed kernels out or in testing, and Marcus Hutchins says threat actors appear to be scanning for the up to 2.1 million exposed servers.
CyberSIXTCVE-2026-98432
- StepSecurity launches tools to find malicious files left by attacks
StepSecurity has launched Malicious Files for GitHub in beta, alongside a renamed and expanded Malicious Files feature in its Dev Machine Guard product. The tools are designed to detect files left by supply-chain…
StepSecurity
- Google patches over 200 flaws in Android November updates
Google has announced November 2026 security updates for Android addressing more than 200 vulnerabilities, including about two dozen rated critical. The first update, marked by security patch level 2026-11-01, fixes 119…
SecurityWeekCVE-2026-58868
- Attackers Exploit Critical Node-RED Flaw to Deploy Malware
VulnCheck says attackers have exploited CVE-2026-58115, a critical Node-RED vulnerability rated 10/10 on the CVSS scale. The flaw is a lack of authentication on Node-RED’s HTTP interface, which can expose programming…
SecurityWeekCVE-2026-58115
- Leakers$ claims billboard hacks exposed weak content systems
Digital billboards in Egypt, Malaysia and Brazil displayed explicit footage after attackers accessed software used to manage and send content to LED screens. On 29 October, footage appeared on a large billboard beside…
Malwarebytes
- NCSC warns AI ransomware could hit UK infrastructure by 2028
The UK’s National Cyber Security Centre (NCSC) says AI-powered malicious software is “highly likely” to be used in financially motivated attacks on critical national infrastructure by 2028. The warning covers…
Infosecurity
- Revolve says customer payment card data was stolen in breach
Online fashion retailer Revolve Group has notified customers that names, addresses and payment card numbers and expiry dates were stolen. The breach affected customers who had saved a card as a payment method in their…
Malwarebytes
- Red Hat fixes critical Linux TCP flaw enabling remote code execution
Red Hat has released fixes for a use-after-free vulnerability in the Linux kernel’s IPv4 TCP code, tracked as CVE-2026-98432, which can be exploited remotely and without authentication to achieve remote code execution.…
The Hacker NewsCVE-2026-98432
- Gartner framework urges organisations to rethink vulnerability prioritisation
The Hacker News reports on Gartner’s framework for prioritising exposure remediation, highlighting that fewer than 10% of vulnerabilities are exploited and that CVSS scores alone do not predict exploitation or business…
The Hacker News
- Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware
A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations. "Active since at least February 2025, the group has focused…
The Hacker News
- Google warns LLMJacking could cost businesses up to $1m
Google’s Mandiant unit has warned that enterprise exposure to LLMJacking is increasing, with multiple incidents reported this year across financial services, retail, technology and transportation sectors. In its…
Infosecurity
- Kaspersky details machine learning for tracking OT network behaviour
Kaspersky’s SecureList feature outlines MLEP in KICS for Networks 5.0, the machine-learning-based event processor designed to track OT device network behaviour. Developed to address gaps in asset inventories and the…
securelist.com
- Google disrupts XCPE botnet that hijacked 1.3 million devices
Google and partners dismantled a backdoor campaign dubbed XCPE that enrolled more than 1.3 million set‑top boxes into a botnet used for ad fraud and proxy abuse, Security Affairs reports. The backdoor, preloaded in…
Security Affairs
- UK cyber chief warns of AI attacks on infrastructure by 2028
The U.K. will likely face artificial intelligence-enhanced cyberattacks on its critical infrastructure by 2028, according to Britain’s cyber chief, Richard Horne. Speaking ahead of the National Cyber Security Centre…
SecurityWeek
- Google Helps Dismantle XCPE Botnet Built by Chinese Firm
Google has disclosed that it helped dismantle the XCPE botnet, which it assessed with high confidence to have been built by Videostrong Technology, a Chinese Android ODM/OEM. The operation reportedly involved more than…
Infosecurity
- TWCA to Revoke Noncompliant Certificates After Serial Number Flaw
Taiwan’s TWCA Certificate Authority has acknowledged a compliance defect in its PKI after independent researchers found insufficient randomness in serial numbers across multiple intermediate certificates. The flaw…
SecurityOnline
- Google dismantles botnet infecting 1.3 million Android devices
Google says it has dismantled XCPE (also known as X[.]CPE), a backdoor and botnet affecting more than 1.3 million Android set‑top boxes. The operation was developed and run by Videostrong Technology, a China‑based…
SecurityWeek
- Ubuntu tests a fix for a Linux kernel flaw rated 9.8
CVE-2026-98432, a Linux kernel TCP flaw with a CVSS of 9.8, has been addressed in Ubuntu’s -proposed pocket for 22.04 LTS and newer. The issue lies in how the kernel sets up IPv4 TCP connections, and the bug has…
SecurityOnlineCVE-2026-98432
- NATO Adds AI Agents to Crossed Swords Cyber Exercise
NATO’s Crossed Swords 2026 drill, staged by the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn, Estonia, has introduced an AI-enabled dimension to its cyber and kinetic operations training. The…
SecurityWeek
- FBI attributes $6.3 billion Binance heist to North Korea
The article reports that Binance suffered a substantial breach, with attackers draining 6.3 billion dollars from its hot wallets after compromising administrative credentials obtained beforehand. It notes that around 3…
SecurityOnline
- BTCPay Server flaw linked to Bitcoin and Litecoin wallet thefts
BTCPay Server has urged users to upgrade to the latest software after reports that Bitcoin and Litecoin were stolen from hot wallets on installations running older builds. The firm said the attacks targeted servers…
The Hacker News
- Attackers breach cPGuard updates to steal server credentials
On 2 November 2026, at 02:06 UTC, an attacker used stolen credentials to breach OPSSHIELD’s update distribution network and push a tampered script through the cPGuard update channel. OPSSHIELD says the intruder…
SecurityOnline
- Kaspersky links AI driven CyberStrikeAI attacks to school intrusions
Kaspersky researchers have identified a new wave of intrusions described as CyberStrikeAI framework attacks, targeting educational organisations in Africa and Latin America. The operations hinge on a modular Go-based…
SecurityOnline
- New fridge attacks disrupt more than 100 European stores
More than 100 European stores were affected as supermarket fridge attacks returned, with incidents spanning Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden, and some units reported heat up to 50°C…
SecurityWeek
- Synology warns ransomware operators are targeting outdated NAS devices
Synology says its DiskStation Manager (DSM) software powering its NAS devices is being targeted again by ransomware operators, this time using exploits against versions it patched in December 2024. The firm disclosed…
The Hacker NewsCVE-2024-10441
- TeamViewer flaw could let remote hosts take over client PCs
A security alert published by Do Son of SecurityOnline[.]info on 3 November 2026 describes a TeamViewer client vulnerability that enables remote code execution. The flaw is reported to allow a compromised remote…
SecurityOnlineCVE-2026-111585
- Cyberattacks disrupt supermarket refrigeration across Europe
Overnight into Monday, 2 November, attackers remotely altered refrigeration controls at supermarkets across several European countries, causing fridges and freezers to heat up or operate at abnormally high…
The Hacker News
- Anthropic bars Claude from cloning commercial video games
Anthropic has introduced a policy shift that blocks Claude from cloning commercial video games. Updated directives now prohibit requests to replicate protected titles, with Claude Opus 5.5 and Claude Code receiving two…
SecurityOnline
- NIS2 Holds Boards Accountable for Access Control Oversight
NIS2 Article 20 places management bodies of essential and important entities under liability for the cybersecurity measures they approve, oversee, and report on, with enforcement powers exercised under national law…
Security Affairs
- Malware campaign hijacks Hugging Face models to mine cryptocurrency
Pluto Research has tracked an active campaign active on Hugging Face and ModelScope that hijacks GPU servers by abusing open-weight model repositories. The attacker exploits the trust_remote_code parameter in Python…
SecurityOnline
- Apple spyware alerts reach German lawmakers, BSI advises action
Apple has begun sending threat notifications to Bundestag lawmakers and other prominent figures that point to attacks using mercenary spyware, according to the Security Affairs report and corroborating statements from…
Security Affairs
- Teams help desk impersonation enabled AD CS domain attacks
Two intrusions investigated by Microsoft Threat Intelligence began with help desk impersonation on Teams, using fake IT staff with support-style display names to persuade users to start Quick Assist and share the…
SecurityOnline
- Attackers exploit Siemens IoT2050 flaw to install backdoors
Siemens has warned that its SIMATIC IoT2050 Advanced devices, running Industrial OS with Node-RED, are exposed by a critical vulnerability tracked as CVE-2026-58115 (CVSS 10.0). The flaw is a missing authentication…
The Hacker NewsCVE-2026-58115
- Attackers Exploit CryptoPayment Gateway Flaw to Steal Wallet Keys
Threat actors are attempting to exploit CVE-2026-81648, a critical, maximum-severity flaw in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber. The NVD description states the…
The Hacker NewsCVE-2026-81648
- Cogent Security joins Fortune Cyber 60 for second year
Cogent Security, an applied AI cybersecurity firm, says its research on the PHP2Shell vulnerability exposed significant gaps in enterprise vulnerability response. disclosed on 21 October, the two critical flaws in PHP…
SecurityOnline
- Seven phpMyAdmin vulnerabilities expose users to account attacks
Seven phpMyAdmin vulnerabilities were disclosed on 30 October 2026, affecting all versions up to and including 5.2.3. The flaws span CSRF and WebAuthn bypasses, an SSRF weakness, two SQL injection vectors and a stored…
SecurityOnlineCVE-2026-119426
- NCSC warns AI could fuel UK infrastructure ransomware by 2028
The NCSC warned on 3 November 2026 that AI-powered malware is highly likely to be used in a ransomware attack on the UK’s critical national infrastructure by 2028. Its *State of the Cyber Nation* report says hostile…
NCSC
- Brazil's Mercado Bitcoin halts withdrawals after $40 million drain
Brazil's largest crypto exchange puts the assets involved at about $38 million and says $11 million is already blocked. Customers will not lose money, it says; how the transfers were signed is unknown.
CyberSIXT
- Google and partners dismantle botnet infecting 1.3 million TV boxes
Google said on 2 November 2026 that it and industry partners dismantled a botnet built from more than 1.3 million Android TV set‑top boxes, which carried malware that secretly rents the user’s Internet connection to…
Krebs on Security
- Apache fixes eight high risk flaws across three projects
Apache Software Foundation has released security fixes on 2 November 2026 addressing eight high‑risk vulnerabilities across three core projects: Apache Syncope, Apache Fineract, and Apache Arrow. The most severe flaw…
SecurityOnlineCVE-2026-64618
- Stormcast covers crypto attacks and flaws in network security tools
On 3 November 2026, the SANS Internet Storm Center's Stormcast discusses several security topics touched on in recent weeks. Host Johannes Ullrich explains how to detect multipath TCP usage on a network by looking for…
SANS ISC
- SUSE fixes Rancher flaws exposing cloud credentials and shells
SUSE has issued security updates to fix three serious Rancher vulnerabilities discovered in late October 2026, with patches released on 29 October 2026. The flaws enable credential leakage and request forgery, and they…
SecurityOnlineCVE-2026-88811
- Google fixes 216 Android flaws in November security update
Google’s November 2026 Android Security Bulletin fixes 216 vulnerabilities across two patch levels, according to the November 2026 update. The most serious issue is a critical Framework flaw that enables remote code…
SecurityOnlineCVE-2026-58868
- macOS flaw lets local attackers gain root privileges
Security researchers publicly released PoC exploit code for a local privilege escalation in Apple macOS, tracked as CVE-2026-112487. The flaw resides in revisiond (com.apple.revisiond), the root LaunchDaemon behind…
SecurityOnlineCVE-2026-112487
- Researcher discloses Axis Camera Station flaws enabling host takeover
A public PoC exploit and vulnerability details have been disclosed for Axis Camera Station, outlining an attack chain that combines an authentication bypass, insecure deserialization and weak encryption to gain control…
SecurityOnlineCVE-2025-30026
- WorkOS says hackers used AI tool ARTEX to reach its sales records
The identity provider says attackers got into an internal sales tool holding customer contacts, account histories and excerpts of calls and Slack conversations. Its production systems were not touched, and it has not…
CyberSIXT
- Linux Kernel Roundup Flags Two Critical iSCSI Flaws
The Linux kernel CNA reported 129 new CVEs between 26 October and 1 November 2026. The bulk of the disclosures were on 28 October (117) with 26 October contributing the remaining 12. The two most severe flaws are rated…
SecurityOnlineCVE-2026-99154
- Attackers exploit Node-RED flaw to run commands on exposed systems
Security researchers have warned that a critical Node-RED remote code execution flaw, tracked as CVE-2026-58115 with a maximum CVSS v3 score of 10.0, is being exploited in the wild. VulnCheck reported that…
SecurityOnlineCVE-2026-58115
- Syrian hacker sentenced for Assad regime conspiracy
Ahmad Umar Agha, also known as Th3Pr0, has been sentenced by a federal district court in the Eastern District of Virginia to 42 months in prison for his central role in a wide-ranging hacking conspiracy conducted on…
DataBreaches
- Contractor Linked Personal AI Agent to Secure Pentagon System
WIRED reports that earlier this year a defence contractor, employed by Accenture, connected a secure centralised Department of Defense system used by multiple intelligence agencies to their personal Claude Code AI…
DataBreaches
- BYOD offers UNM hospital patients up to $2,500 after attack
Hackers calling themselves BYOD claimed responsibility for the University of New Mexico (UNM) hospital cyberattack and subsequently offered to decrypt systems and compensate affected patients. In a statement attributed…
DataBreaches
- HHS settles ransomware investigation with Lehigh Valley Health Network
The U.S. Department of Health and Human Services, Office for Civil Rights (OCR), has settled a ransomware investigation with Lehigh Valley Health Network (LVHN) and its affiliated entities, the agency announced on 29…
DataBreaches
- Liverpool Hospital Investigates Staff Over Patient Record Access
ITV reported that a second hospital in Liverpool, Liverpool Heart and Chest Hospital, is investigating two potential instances of staff accessing medical records related to the Southport terror attack. The cases were…
DataBreaches
- European Supermarket Freezers Hit by a Second Cyberattack
The Guardian reports that supermarket freezers across Europe have suffered a second suspected cyber-attack, with chains in Sweden, Belgium and Luxembourg noting overnight rises in fridge temperatures. The incidents…
DataBreaches
- Suntory says cloud breach exposed data of 100,000 people
Kyodo News reports that Suntory Holdings Ltd, a major Japanese beverage manufacturer, said personal data relating to around 100,000 people was leaked after unauthorized access to an external cloud service used by the…
DataBreaches
- Hong Kong watchdog investigates airline and retailer data leaks
The Office of the Privacy Commissioner for Personal Data (Hong Kong) said it has received multiple notifications of data breaches affecting Hong Kong Airlines, Cathay Pacific, Malaysia Airlines, and electronics…
DataBreaches
- Killingly schools disclose network incident exposing personal data
Killingly Public Schools reported that a data privacy incident occurred after a disruption to its computer network in October 2025. The district said it acted quickly to secure systems and took parts of its network…
DataBreaches
- HYBE breach exposes employee medical and financial records
HYBE, the entertainment group behind BTS, has disclosed a cyberattack that exposed personal information belonging to current and former employees and business partners. In an apology posted on its site, HYBE said an…
DataBreaches
- Unit 42 details espionage, cybercrime and AI enabled attacks
Unit 42 has published a threat intelligence overview for 2 November 2026, outlining a triad of ongoing adversary activity across cyberespionage, cybercrime and AI-enabled offensive operations. The report notes…
Unit 42
- Binance Hack Shows How One Laptop Led to Billions in Losses
The Dark Reading piece reports that Binance’s record hack began with a compromised developer laptop, which allowed attackers to reach an internal service container with the authority to initiate withdrawal requests.…
Dark Reading
- Microsoft finds just 2,000 CVEs linked to real world attacks
Microsoft Security researchers report that the vulnerability landscape continues to expand, with around 383,000 software vulnerabilities disclosed across platforms and technologies from 1999 to September 2026, yet only…
Microsoft
- Cisco Talos finds VOLTA infostealer uses AI to rank victims
Cisco Talos has analysed a Windows infostealer named VOLTA (self-styled VOLTA-AUTODOXER) that not only harvests a broad set of credentials and artefacts but also uses an AI model to prioritise victims. The malware…
Security Affairs
CVEs in the news14
Named in the last 24 hours and not in CISA KEV, most covered first
CVE-2026-58115Siemens SIMATIC IoT2050 Advanced
3 articles today · Attackers Exploit Critical Node-RED Flaw to Deploy Malware
10.0Critical0.9% EPSS · 4 articlesCVE-2026-98432Linux Linux
3 articles today · CVSS 9.8 Linux flaw lets attackers take root on Go servers by default
9.8Critical0.5% EPSS · 10 articlesCVE-2026-58868Google Android
2 articles today · Google patches over 200 flaws in Android November updates
Not scored0.2% EPSS · 2 articlesCVE-2026-81648CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router
Attackers Exploit CryptoPayment Gateway Flaw to Steal Wallet Keys
10.0Critical0.5% EPSS · 1 articleCVE-2024-10441Synology DiskStation Manager (DSM)
Synology warns ransomware operators are targeting outdated NAS devices
9.8Critical1.3% EPSS · 2 articlesCVE-2026-99154Linux Linux
Linux Kernel Roundup Flags Two Critical iSCSI Flaws
9.8Critical0.5% EPSS · 1 articleCVE-2026-88811SUSE Rancher
SUSE fixes Rancher flaws exposing cloud credentials and shells
9.1Critical0.4% EPSS · 1 articleCVE-2026-40217BerriAI LiteLLM
Google reports LLMjacking attacks driving cloud bills to $1 million
8.8High16% EPSS · 3 articlesCVE-2026-111585TeamViewer Full Client
TeamViewer flaw could let remote hosts take over client PCs
8.8High0.3% EPSS · 4 articlesCVE-2026-112487Apple macOS
macOS flaw lets local attackers gain root privileges
7.8High0.2% EPSS · 1 articleCVE-2026-119426phpMyAdmin phpMyAdmin
Seven phpMyAdmin vulnerabilities expose users to account attacks
7.7High0.3% EPSS · 1 articleCVE-2025-30026Axis Communications AB AXIS Camera Station Pro
Researcher discloses Axis Camera Station flaws enabling host takeover
5.3Medium0.7% EPSS · 1 articleCVE-2022-21894Microsoft Windows 10 Version 1809
Kaspersky finds BlackX bootkit bypassing Secure Boot on Windows
4.4Medium8.6% EPSS · 3 articlesCVE-2026-64618Apache Software Foundation Apache Fineract
Apache fixes eight high risk flaws across three projects
Not scored0.6% EPSS · 1 article
Developing stories4
Two or more articles in the last 24 hours; each bead is an article
- Threat actorTraderTraitorDevelopinglatest 2 hours ago3 articles3 outlets
- Mon 2 Nov, 22:27 UTC. Dark Reading, first report. Binance Hack Shows How One Laptop Led to Billions in Losses.
- Tue 3 Nov, 08:48 UTC. SecurityOnline, its first report on the story. FBI attributes $6.3 billion Binance heist to North Korea.
- Tue 3 Nov, 14:49 UTC. CyberSIXT, its first report on the story. How North Korea is laundering $6.4 billion stolen from Binance.
- CVECVE-2026-98432LinuxDevelopinglatest 4 hours ago3 articles3 outlets
- Tue 3 Nov, 08:55 UTC. SecurityOnline, first report. Ubuntu tests a fix for a Linux kernel flaw rated 9.8.
- Tue 3 Nov, 11:23 UTC. The Hacker News, its first report on the story. Red Hat fixes critical Linux TCP flaw enabling remote code execution.
- Tue 3 Nov, 12:49 UTC. CyberSIXT, its first report on the story. CVSS 9.8 Linux flaw lets attackers take root on Go servers by default.
- CVECVE-2026-58115Siemens SIMATIC IoT2050 AdvancedDevelopinglatest 5 hours ago3 articles3 outlets
- Tue 3 Nov, 00:00 UTC. SecurityOnline, first report. Attackers exploit Node-RED flaw to run commands on exposed systems.
- Tue 3 Nov, 05:34 UTC. The Hacker News, its first report on the story. Attackers exploit Siemens IoT2050 flaw to install backdoors.
- Tue 3 Nov, 12:10 UTC. SecurityWeek, its first report on the story. Attackers Exploit Critical Node-RED Flaw to Deploy Malware.
- CVECVE-2026-58868Google AndroidDevelopinglatest 5 hours ago2 articles2 outlets
- Tue 3 Nov, 01:45 UTC. SecurityOnline, first report. Google fixes 216 Android flaws in November security update.
- Tue 3 Nov, 12:21 UTC. SecurityWeek, its first report on the story. Google patches over 200 flaws in Android November updates.