Mon 2 Nov · updated 09:01 UTC
Today in security
Today’s briefing
07:00 UTC edition
BTCPay Server links hot-wallet thefts to older releases
BTCPay Server says attackers drained hot wallets on instances running version 2.4.1 or older, while it has no credible reports of drains on 2.4.7. The project said traces indicate vulnerabilities fixed in 2.4.2 were used and attackers logged in as admin on affected servers, but it has not published its promised detailed account. The update follows Sunday's warning to shut down older instances; Volexity's report that three Ivanti flaws were exploited adds detail to the access-chain story carried in the previous edition.
Known exploited7
CISA KEV entries named in the last 48 hours of coverage, by federal deadline
- In CISA KEV
Ivanti Connect SecureCVE-2026-111357
Federal deadline 2 Nov · In CISA KEV since 30 Oct
7.0High0.5% EPSS5 articles
- In CISA KEV
Google BrotliCVE-2026-111497
Federal deadline 10 Nov · In CISA KEV since 27 Oct
9.2Critical83% EPSS21 articles
- In CISA KEV
Ivanti Connect SecureCVE-2026-118527
Federal deadline 13 Nov · In CISA KEV since 30 Oct
Not scored5 articles
- In CISA KEV
Cisco Secure Firewall Adaptive Security Appliance (ASA) SoftwareCVE-2026-76418
Federal deadline passed 1 Nov · In CISA KEV since 29 Oct
8.6High0.8% EPSS7 articles
Show 3 more · federal deadlines passed
- In CISA KEV
BeyondTrust Remote SupportCVE-2026-102764
Federal deadline passed 19 Oct · In CISA KEV since 16 Oct
9.3Critical19% EPSS13 articles
- In CISA KEV
Ivanti Connect SecureCVE-2026-104935
Federal deadline passed 16 Oct · In CISA KEV since 13 Oct
8.6High87% EPSS19 articles
- In CISA KEV
Drupal CoreCVE-2026-9082
Federal deadline passed 27 May · In CISA KEV since 22 May
9.8Critical89% EPSS9 articles
Latest news29
The last 24 hours, newest first; stories about known exploited CVEs are above
Latest story at 08:47 UTC. Red diamonds mark the 4 stories about exploited CVEs.
- 08:47 UTC. Hackers set ICA store freezers to 50°C weeks after French attacks. 1 outlet.
- 08:09 UTC. Cisco Talos finds NIK C2 using OpenAI in live attacks. 1 outlet.
- 08:01 UTC. Malwarebytes roundup highlights a week of security stories. 1 outlet.
- 08:00 UTC. Kaspersky finds AI guided CyberStrikeAI attacks on schools. 1 outlet.
- 07:57 UTC. Volexity links Ivanti Connect Secure zero days to UTA0576. 1 outlet. About an exploited CVE.
- 07:07 UTC. North Korean groups use AI to accelerate cyber operations. 1 outlet.
- 06:23 UTC. CloudSEK uncovers Rust botnet targeting IoT and enterprise systems. 1 outlet.
- 05:51 UTC. VOLTA infostealer uses AI to rank victims by financial value. 1 outlet.
- 02:53 UTC. Russian emergency app hit with fake nuclear alert after Ukraine hack. 1 outlet.
- 02:33 UTC. Google researchers disclose Linux kernel privilege escalation PoC. 1 outlet.
- 02:16 UTC. Critical FreePBX Vulnerabilities Patched in User Manager. 1 outlet.
- 02:05 UTC. AI Agents Turn Spoken Design Prompts Into Physical Hardware. 1 outlet.
- 02:03 UTC. Apache Wicket fixes 19 flaws across three supported releases. 1 outlet.
- 02:00 UTC. Volexity reports Ivanti flaws exploited in the wild. 1 outlet.
- 01:39 UTC. Weekly report flags exploited flaws absent from CISA KEV. 1 outlet. About an exploited CVE.
- 01:33 UTC. Brotli flaw prompts updates across runtimes and software. 1 outlet. About an exploited CVE.
- 01:00 UTC. pgAdmin 4 fixes 15 flaws, including a critical command injection. 1 outlet.
- 00:45 UTC. Dell fixes 44 PowerStore flaws, seven rated CVSS 9.8. 1 outlet.
- 00:31 UTC. Ransomware targets unpatched Synology NAS devices. 1 outlet.
- 00:30 UTC. LXD flaw lets attackers impersonate trusted TLS clients. 1 outlet.
- 00:03 UTC. Hackers hijack Ukraine's Air Alert app to send fake nuclear alerts. 1 outlet.
- 00:00 UTC. Rapid7 details BeyondTrust flaw exploited for code execution. 1 outlet. About an exploited CVE.
- 23:47 UTC. Hackers drain BTCPay hot wallets on servers left unpatched since July. 1 outlet.
- 18:02 UTC. Security Affairs newsletter tracks AI’s impact on cybersecurity. 1 outlet.
- 17:25 UTC. Security Affairs rounds up malware campaigns and spyware research. 1 outlet.
- 17:03 UTC. CVSS 9.8 Linux flaw lets attackers take root on Go servers by default. 1 outlet.
- 13:22 UTC. Security Affairs newsletter rounds up major cyber threat stories. 1 outlet.
- 12:16 UTC. Android flaw lets invisible SMS block calls and emergency services. 1 outlet.
- 11:15 UTC. Northstar Security launches with $7 million seed funding. 1 outlet.
- 09:55 UTC. How North Korea is laundering $6.4 billion stolen from Binance. 2 outlets.
- 09:20 UTC. AI hacking tool ARTEX used by four threat actors, two tied to China. 1 outlet.
- 09:12 UTC. Didier Stevens adds JSON extraction to his OneNote tool. 1 outlet.
- Known exploited CVE
- CVE not in KEV
- Other story
- Size: outlets on the story
- Stories an hour
Show as tableHide table
| Time (UTC) | Story | Outlets | Type |
|---|---|---|---|
| 08:47 | Hackers set ICA store freezers to 50°C weeks after French attacks | 1 | Other |
| 08:09 | Cisco Talos finds NIK C2 using OpenAI in live attacks | 1 | Other |
| 08:01 | Malwarebytes roundup highlights a week of security stories | 1 | Other |
| 08:00 | Kaspersky finds AI guided CyberStrikeAI attacks on schools | 1 | Other |
| 07:57 | Volexity links Ivanti Connect Secure zero days to UTA0576 | 1 | Known exploited |
| 07:07 | North Korean groups use AI to accelerate cyber operations | 1 | Other |
| 06:23 | CloudSEK uncovers Rust botnet targeting IoT and enterprise systems | 1 | Other |
| 05:51 | VOLTA infostealer uses AI to rank victims by financial value | 1 | Other |
| 02:53 | Russian emergency app hit with fake nuclear alert after Ukraine hack | 1 | Other |
| 02:33 | Google researchers disclose Linux kernel privilege escalation PoC | 1 | CVE |
| 02:16 | Critical FreePBX Vulnerabilities Patched in User Manager | 1 | Other |
| 02:05 | AI Agents Turn Spoken Design Prompts Into Physical Hardware | 1 | Other |
| 02:03 | Apache Wicket fixes 19 flaws across three supported releases | 1 | CVE |
| 02:00 | Volexity reports Ivanti flaws exploited in the wild | 1 | Other |
| 01:39 | Weekly report flags exploited flaws absent from CISA KEV | 1 | Known exploited |
| 01:33 | Brotli flaw prompts updates across runtimes and software | 1 | Known exploited |
| 01:00 | pgAdmin 4 fixes 15 flaws, including a critical command injection | 1 | CVE |
| 00:45 | Dell fixes 44 PowerStore flaws, seven rated CVSS 9.8 | 1 | CVE |
| 00:31 | Ransomware targets unpatched Synology NAS devices | 1 | CVE |
| 00:30 | LXD flaw lets attackers impersonate trusted TLS clients | 1 | CVE |
| 00:03 | Hackers hijack Ukraine's Air Alert app to send fake nuclear alerts | 1 | Other |
| 00:00 | Rapid7 details BeyondTrust flaw exploited for code execution | 1 | Known exploited |
| 23:47 | Hackers drain BTCPay hot wallets on servers left unpatched since July | 1 | Other |
| 18:02 | Security Affairs newsletter tracks AI’s impact on cybersecurity | 1 | Other |
| 17:25 | Security Affairs rounds up malware campaigns and spyware research | 1 | Other |
| 17:03 | CVSS 9.8 Linux flaw lets attackers take root on Go servers by default | 1 | CVE |
| 13:22 | Security Affairs newsletter rounds up major cyber threat stories | 1 | CVE |
| 12:16 | Android flaw lets invisible SMS block calls and emergency services | 1 | CVE |
| 11:15 | Northstar Security launches with $7 million seed funding | 1 | Other |
| 09:55 | How North Korea is laundering $6.4 billion stolen from Binance | 2 | Other |
| 09:20 | AI hacking tool ARTEX used by four threat actors, two tied to China | 1 | Other |
| 09:12 | Didier Stevens adds JSON extraction to his OneNote tool | 1 | Other |
- Hackers set ICA store freezers to 50°C weeks after French attacks
Several ICA supermarkets in southern Sweden threw out their chilled and frozen stock on Monday after their fridges and freezers were turned up to 50°C overnight. Coop and about 40 Delhaize stores in Belgium reported…
cybersixt.com
- Cisco Talos finds NIK C2 using OpenAI in live attacks
Cisco Talos researchers have uncovered an active threat framework named NIK C2 that integrates a live OpenAI API client directly into compromised Windows hosts. The 64-bit Go-based implant harvests credentials, streams…
SecurityOnline
- Malwarebytes roundup highlights a week of security stories
Malwarebytes Labs’ weekly roundup for 26 October to 1 November 2026 lists stories published during the week, covering browser extensions, cryptocurrency theft, data breaches, software updates, scams and privacy. It…
Malwarebytes
- Kaspersky finds AI guided CyberStrikeAI attacks on schools
Kaspersky’s Cyber Threat Intelligence team uncovered a campaign in which a C2 agent framework controlled by an artificial intelligence orchestrator—CyberStrikeAI—was used to conduct post‑exploitation activities against…
securelist.com
- North Korean groups use AI to accelerate cyber operations
North Korean state-sponsored threat actors are increasingly embedding artificial intelligence into their cyber operations to speed up and scale attacks, Microsoft Threat Intelligence reports published in October 2026.…
SecurityOnline
- CloudSEK uncovers Rust botnet targeting IoT and enterprise systems
CloudSEK researchers uncovered in October 2026 a Rust-based doorway botnet operating across a broad IoT and enterprise target footprint, exposing 41 gigabytes of operational data from two open directories. The Rust…
SecurityOnline
- VOLTA infostealer uses AI to rank victims by financial value
Cybersecurity researchers have disclosed a new Windows infostealer, VOLTA-AUTODOXER (VOLTA), that embeds an AI-driven dossier capability to rank victims by monetisable value. The malware harvests a wide range of data…
The Hacker News
- Russian emergency app hit with fake nuclear alert after Ukraine hack
Russia's Emergency Situations Ministry says hackers took over its mobile app and sent fake alerts, hours after Ukraine's Air Alert app was hijacked the same way. Both governments say their sirens kept working.
cybersixt.com
- Google researchers disclose Linux kernel privilege escalation PoC
Security researchers have publicly disclosed technical details and a working proof-of-concept (PoC) exploit for a high-severity Linux kernel vulnerability, tracked as CVE-2026-31419, with a CVSS v3.1 score of 7.8. The…
SecurityOnlineCVE-2026-31419
- Critical FreePBX Vulnerabilities Patched in User Manager
Apply the latest update to fix critical FreePBX vulnerabilities, including a 9.3 CVSS authentication bypass and privilege escalation in User Manager. Related Posts: Public PoC Exploit Disclosed for Linux Kernel Bonding…
SecurityOnline
- AI Agents Turn Spoken Design Prompts Into Physical Hardware
Vibe manufacturing AI is described as a growing trend where multimodal, reasoning-capable agents translate spoken design goals into complete, manufacturable hardware. The piece claims that conversational AI can…
SecurityOnline
- Apache Wicket fixes 19 flaws across three supported releases
SecurityOnline[.]info reports that Apache Wicket has disclosed 19 security flaws across the 8.20.0, 9.25.0 and 10.12.0 branches. Do Son, writing for the outlet, notes that nine of the flaws are rated high severity,…
SecurityOnlineCVE-2026-84170
- Volexity reports Ivanti flaws exploited in the wild
On 2 November 2026, SANS ISC details several security developments discussed in this edition of Stormcast. Didier’s OneNote attachment extractor has gained a new feature that saves all attachments from OneNote files…
SANS ISC
- pgAdmin 4 fixes 15 flaws, including a critical command injection
pgAdmin 4 has a new security update, with version 9.19 released on 29 October 2026 to remediate 15 critical vulnerabilities. The PostgreSQL project notes that these flaws could allow remote code execution and…
SecurityOnlineCVE-2026-116241
- Dell fixes 44 PowerStore flaws, seven rated CVSS 9.8
Dell has issued Dell PowerStore security updates to fix 44 vulnerabilities across PowerStore T platforms, with seven flaws scoring 9.8 on CVSS v3.1. Dell’s advisory, DSA-2026-479, states the most severe issues are in…
SecurityOnlineCVE-2026-116443
- Ransomware targets unpatched Synology NAS devices
SecurityOnline reports a ransomware campaign affecting Synology network-attached storage devices, with attackers encrypting data on storage volumes. It says internet-exposed devices running outdated software are the…
SecurityOnlineCVE-2024-10441
- LXD flaw lets attackers impersonate trusted TLS clients
Canonical has patched CVE-2026-112816, a critical mutual TLS authentication flaw in LXD and MicroCloud, rated 10.0 under CVSSv4. Canonical says an attacker able to reach the LXD HTTPS API could authenticate as a…
SecurityOnlineCVE-2026-112816
- Hackers hijack Ukraine's Air Alert app to send fake nuclear alerts
Ukraine's Air Alert app sent false radiation, chemical and street-fighting warnings to phones on Sunday night. Officials say the state siren network kept working, and the app has been taken offline.
cybersixt.com
- Hackers drain BTCPay hot wallets on servers left unpatched since July
BTCPay Server says the hot wallet thefts hit instances running version 2.4.1 or older, released in July, and that it has no credible reports of drains on the current 2.4.7. Hosting providers shut older servers down.
cybersixt.com
- FBI blames North Korea linked group for Binance theft
The FBI has named North Korea as responsible for the theft of more than $6 billion in virtual assets from Binance around 29 October 2026, attributing the activity to the North Korea–linked TraderTraitor group, also…
Security Affairs
- Security Affairs newsletter tracks AI’s impact on cybersecurity
Security Affairs’ AI-Cybersecurity Newsletter Round 6 frames artificial intelligence as a rapidly evolving force in information security, noting that AI is reshaping both attacker playbooks and defender toolkits. The…
Security Affairs
- Security Affairs rounds up malware campaigns and spyware research
The Security Affairs Malware Newsletter Round 121 collects a selection of notable malware research and related security pieces from across the international landscape, as published by Pierluigi Paganini. The roundup…
Security Affairs
- CVSS 9.8 Linux flaw lets attackers take root on Go servers by default
The Go Security Team says Go 1.24 and later listen on Multipath TCP by default on Linux, the setup Anthropic's root exploit for CVE-2026-98432 needs. RHEL and Ubuntu kernels are still unpatched.
cybersixt.comCVE-2026-98432
- Security Affairs newsletter rounds up major cyber threat stories
Security Affairs’ International Edition Round 602, drawn from Pierluigi Paganini’s weekly newsletter, compiles a selection of recent security stories across cybercrime, hacking, malware and related fields. The digest…
Security AffairsCVE-2026-118539
- Android flaw lets invisible SMS block calls and emergency services
Independent researcher Mark Blaszczyk has documented a zero-click SMS-based vulnerability in Android that can crash the device’s phone services and block ongoing calls, including emergency calls, without any user…
Security AffairsCVE-2026-58882
- Northstar Security launches with $7 million seed funding
Northstar Security has emerged from stealth with $7 million in seed funding led by Wing Venture Capital, with investments from MVP, Outliers, and cybersecurity veterans Gerhard Eschelbeck, Renaud Deraison, and Justin…
SecurityWeek
- How North Korea is laundering $6.4 billion stolen from Binance
Analysts tracking the $6.43 billion stolen from Binance say software is moving it every hour and working around stablecoin freezes. The FBI has asked THORChain, RPC and DeFi operators to block the addresses involved.
cybersixt.com
- AI hacking tool ARTEX used by four threat actors, two tied to China
Microsoft, CrowdStrike and Profero have each documented ARTEX in real intrusions, by four different threat actors. Two are tied to the Chinese state, and none of the reports links the four to each other.
cybersixt.com
- Didier Stevens adds JSON extraction to his OneNote tool
Didier Stevens reports a new capability added to his onedump.py tool to extract embedded files from OneNote files (with the .one extension) and output the results in JSON format. The enhancement is designed to…
SANS ISC
CVEs in the news9
Named in the last 24 hours and not in CISA KEV, most covered first
CVE-2026-112816Canonical LXD
LXD flaw lets attackers impersonate trusted TLS clients
10.0Critical0.3% EPSS · 2 articlesCVE-2026-116241pgadmin.org pgAdmin 4
pgAdmin 4 fixes 15 flaws, including a critical command injection
9.9Critical0.3% EPSS · 1 articleCVE-2024-10441Synology DiskStation Manager (DSM)
Ransomware targets unpatched Synology NAS devices
9.8Critical1.3% EPSS · 1 articleCVE-2026-98432Linux Linux
CVSS 9.8 Linux flaw lets attackers take root on Go servers by default
9.8Critical0.5% EPSS · 5 articlesCVE-2026-84170Apache Software Foundation Apache Wicket
Apache Wicket fixes 19 flaws across three supported releases
8.3High1 articleCVE-2026-31419Linux Linux
Google researchers disclose Linux kernel privilege escalation PoC
7.8High0.1% EPSS · 1 articleCVE-2026-116443Vendor not yet named
Dell fixes 44 PowerStore flaws, seven rated CVSS 9.8
Not scored1 articleCVE-2026-118539Drupal Commerce Core
Security Affairs newsletter rounds up major cyber threat stories
Not scored0.3% EPSS · 6 articlesCVE-2026-58882Vendor not yet named
Android flaw lets invisible SMS block calls and emergency services
Not scored1 article
Developing stories1
Two or more articles in the last 24 hours; each bead is an article
- Threat actorTraderTraitorDevelopinglatest 14 hours ago2 articles2 outlets
- Sun 1 Nov, 09:55 UTC. cybersixt.com, first report. How North Korea is laundering $6.4 billion stolen from Binance.
- Sun 1 Nov, 19:23 UTC. Security Affairs, its first report on the story. FBI blames North Korea linked group for Binance theft.