Wed 4 Nov · updated 18:50 UTC
Today in security
Today’s briefing
Updated 18:51 UTC
mSecure says encrypted cloud vault database stolen
7 updates since 07:00 · latest 18:51 UTC
mSecure's maker says an attacker took an encrypted copy of a database of current and former users who synced through mSecure Cloud. It has no evidence the vaults were opened and asks users to change their master password and stored secrets.
Known exploited11
CISA KEV entries named in the last 48 hours of coverage, by federal deadline
- In CISA KEV
WordPress CoreCVE-2026-119977
Federal deadline 6 Nov · In CISA KEV since 3 Nov
8.1High0.6% EPSS3 articles
- In CISA KEV
Google BrotliCVE-2026-111497
Federal deadline 10 Nov · In CISA KEV since 27 Oct
9.2Critical83% EPSS22 articles
- In CISA KEV
Zyxel GS1900-48HPv2 firmwareCVE-2026-7273
Federal deadline passed 24 Sep · In CISA KEV since 21 Sep
8.8High2.8% EPSS8 articles
- In CISA KEV
Adobe CommerceCVE-2026-75650
Federal deadline passed 11 Sep · In CISA KEV since 8 Sep
10.0Critical3.9% EPSS9 articles
Show 7 more · federal deadlines passed
- In CISA KEV
WebPros cPanel & WHM and WP2 (WordPress Squared)CVE-2026-41940
Federal deadline passed 3 May · In CISA KEV since 30 Apr · Used in ransomware campaigns
9.8Critical99% EPSS17 articles
- In CISA KEV
Apple Multiple ProductsCVE-2025-43510
Federal deadline passed 3 Apr · In CISA KEV since 20 Mar
Not scored0.4% EPSS9 articles
- In CISA KEV
Apple Multiple ProductsCVE-2025-43520
Federal deadline passed 3 Apr · In CISA KEV since 20 Mar
Not scored0.4% EPSS9 articles
- In CISA KEV
Apple Multiple ProductsCVE-2026-20700
Federal deadline passed 5 Mar · In CISA KEV since 12 Feb
Not scored1.7% EPSS12 articles
- In CISA KEV
Apple Multiple ProductsCVE-2025-43529
Federal deadline passed 5 Jan · In CISA KEV since 15 Dec 2025
Not scored26% EPSS9 articles
- In CISA KEV
Google ChromiumCVE-2025-14174
Federal deadline passed 2 Jan · In CISA KEV since 12 Dec 2025
Not scored55% EPSS7 articles
- In CISA KEV
RARLAB WinRARCVE-2025-8088
Federal deadline passed 2 Sep 2025 · In CISA KEV since 12 Aug 2025 · Used in ransomware campaigns
8.4High94% EPSS23 articles
Latest news83
The last 24 hours, newest first; stories about known exploited CVEs are above
Latest story at 18:50 UTC. Red diamonds mark the 3 stories about exploited CVEs.
- 18:50 UTC. mSecure cyberattack: hacker stole encrypted cloud vault database. 1 outlet.
- 16:51 UTC. 320,000 files leak from Bristol schools cyberattack. 1 outlet.
- 16:24 UTC. Google disrupts XCPE botnet that infected 1.3 million devices. 1 outlet.
- 16:06 UTC. Check Point Finds Prompt Adware in OpenAI Codex Jailbreak Tool. 1 outlet.
- 15:00 UTC. SlippyNunchucks abuses Sogou keyboard to deliver malware. 1 outlet.
- 14:53 UTC. Debian APT flaw lets network attackers swap packages and run root code. 2 outlets.
- 14:34 UTC. Sysdig launches runtime security and governance for AI agents. 1 outlet.
- 14:24 UTC. Barracuda patches ESG flaws that can enable root access. 1 outlet.
- 14:17 UTC. Security teams turn to automation to speed incident updates. 1 outlet.
- 14:09 UTC. Sentra Raises $150 Million to Expand AI Data Security. 1 outlet.
- 14:00 UTC. APT29 targets mobile devices in watering hole campaign. 2 outlets. About an exploited CVE.
- 14:00 UTC. Cloudflare Adds Controls to Manage Personal Agent Traffic. 1 outlet.
- 13:24 UTC. SANS reports scans targeting vulnerable web email scripts. 1 outlet.
- 13:08 UTC. mSecure urges subscribers to reset passwords after suspicious activity. 2 outlets.
- 12:52 UTC. Crédit Mutuel Arkéa confirms cyberattack as $133M flows to crypto. 1 outlet.
- 12:52 UTC. Cyberattack sends French blood storage readings soaring to 110°C. 1 outlet.
- 12:43 UTC. Wiz links AI platform breaches to stolen access tokens. 1 outlet.
- 12:27 UTC. Two Canadians Charged in University Supercomputer Mining Scheme. 1 outlet.
- 12:16 UTC. Chrome 157 fixes 213 security flaws, including seven critical. 1 outlet.
- 12:07 UTC. Rails fixes critical flaw allowing server file writes via uploads. 1 outlet.
- 12:00 UTC. Bitdefender links 3AM ransomware to AI assisted school attack. 1 outlet.
- 11:46 UTC. Xen flaws let malicious virtual machines access host memory. 1 outlet.
- 11:34 UTC. LiteLLM Compromise Exposes Risks in Agent Runtime Security. 1 outlet.
- 11:24 UTC. SlippyNunchucks hijacks Sogou to deploy DarkVigil backdoor. 1 outlet.
- 11:02 UTC. Police seize over 100 servers in international fraud probe. 1 outlet.
- 10:54 UTC. Attackers poison OpsShield cPGuard updates, breach 2,950 servers. 1 outlet.
- 10:52 UTC. MUJI says cyberattack exposed 1.09 million full card numbers. 1 outlet.
- 10:38 UTC. Google Chrome 157 fixes 213 flaws, including seven critical bugs. 1 outlet.
- 10:30 UTC. Trojanised ARTEX Docker Image Let Attackers Run Commands on Hosts. 1 outlet.
- 10:24 UTC. Joe Security adds adaptive detonation to probe evasive malware. 1 outlet.
- 10:20 UTC. NVIDIA rotates SSH keys after breach of its Brev platform. 1 outlet.
- 09:55 UTC. Cloudflare launches Zero Wire vulnerability intelligence platform. 1 outlet.
- 09:30 UTC. Rails patches 21 flaws, including critical file write bug. 1 outlet.
- 09:25 UTC. Fake interview campaign leads to major Binance crypto heist. 1 outlet.
- 09:24 UTC. SOCRadar links leepsmarts to LLM key theft and academic fraud. 1 outlet. About an exploited CVE.
- 09:23 UTC. North Korea protests US claims linking hackers to Binance heist. 2 outlets.
- 09:15 UTC. SnappyMail Remote Code Execution Chain Disclosed With Public PoC Exploit Code. 1 outlet.
- 08:49 UTC. Brazil's Mercado Bitcoin halts withdrawals after $40 million drain. 1 outlet.
- 08:27 UTC. Meta reveals Muse AI flaws as bug bounty payouts hit $1.2m. 1 outlet.
- 08:17 UTC. Russian Police Arrest Suspected Members of VasyGrek Group. 1 outlet.
- 08:01 UTC. Mandiant links UNC6993 to costly enterprise LLM hijacking. 1 outlet.
- 07:46 UTC. Google patches Android flaw enabling remote code execution. 2 outlets.
- 07:16 UTC. Airbyte Connector Builder flaw exploited to run code in containers. 1 outlet.
- 07:00 UTC. BITTER group targets South Asian organisations with PapRAT. 1 outlet.
- 06:49 UTC. Cyberattack turned the Nikke game's PC launcher into a spy tool. 1 outlet.
- 06:16 UTC. Kimsuky GitHub staging infrastructure remains active despite disclosure. 1 outlet.
- 02:51 UTC. Fridge cyberattack hits 13 countries and France's blood service. 1 outlet.
- 02:17 UTC. PoC exposes critical remote code flaw in Puppet Server. 1 outlet.
- 02:10 UTC. Exposed refrigerator controls spoil food across European supermarkets. 1 outlet.
- 02:03 UTC. HPE fixes 46 Fabric Composer flaws, including a critical password bug. 1 outlet.
- 02:00 UTC. Hunt.io traces 69GB data theft from Philippine agency. 1 outlet.
- 01:40 UTC. Binarly warns of exploited Zyxel GS1900 switch zero day. 2 outlets.
- 01:16 UTC. Researcher discloses macOS root exploit for CVE-2026-112445. 1 outlet.
- 00:50 UTC. GitBook says AI-driven cyberattack exposed customer API tokens. 1 outlet.
- 00:40 UTC. CERT/CC discloses two critical flaws in INFINITT PACS. 1 outlet.
- 00:00 UTC. SUSE patches critical Rancher Fleet flaw enabling cluster takeover. 1 outlet.
- 23:52 UTC. FBI links Binance wallet theft to North Korean actors. 1 outlet.
- 23:37 UTC. SonicWall discloses two unpatched GMS vulnerabilities. 2 outlets.
- 23:32 UTC. SolarWinds patches critical command injection flaw in Dameware. 1 outlet.
- 23:21 UTC. Google Chrome 157 fixes 213 flaws, including seven critical bugs. 1 outlet.
- 22:29 UTC. NSW Health breach prompts police criminal investigation. 1 outlet.
- 22:16 UTC. European supermarket fridge attacks expose cold chain risks. 1 outlet.
- 21:57 UTC. German Police Dismantle Investment Fraud Service, Arrest Seven. 1 outlet.
- 20:31 UTC. CISA Flags Exploited WordPress Flaw Allowing Unauthenticated Code Execution. 3 outlets. About an exploited CVE.
- 20:07 UTC. Cyberattacks send fake emergency alerts in Ukraine and Russia. 2 outlets.
- 20:02 UTC. Xsolis breach exposes patient data at nine health systems. 2 outlets.
- 19:58 UTC. Japanese Firms Turn to Cyber Insurance After Data Breaches. 2 outlets.
- 19:57 UTC. South Korea Calls Emergency Meeting Over Entourage Data Leak. 2 outlets.
- 19:55 UTC. Syrian hacker sentenced for Assad regime cyber conspiracy. 1 outlet.
- 19:55 UTC. Contractor connected personal AI agent to secure Pentagon system. 1 outlet.
- 19:55 UTC. BYOD hackers apologise after disrupting UNM hospital systems. 1 outlet.
- 19:55 UTC. HHS settles HIPAA ransomware investigation with Lehigh Valley. 1 outlet.
- 19:54 UTC. Liverpool hospital investigates staff access to Southport attack records. 1 outlet.
- 19:54 UTC. CSX breach exposes personal information of 40,000 employees. 1 outlet.
- 19:44 UTC. Binance details how fake job interviews enabled a $6.34B hack. 1 outlet.
- Known exploited CVE
- CVE not in KEV
- Other story
- Size: outlets on the story
- Stories an hour
Show as tableHide table
| Time (UTC) | Story | Outlets | Type |
|---|---|---|---|
| 18:50 | mSecure cyberattack: hacker stole encrypted cloud vault database | 1 | Other |
| 16:51 | 320,000 files leak from Bristol schools cyberattack | 1 | Other |
| 16:24 | Google disrupts XCPE botnet that infected 1.3 million devices | 1 | Other |
| 16:06 | Check Point Finds Prompt Adware in OpenAI Codex Jailbreak Tool | 1 | Other |
| 15:00 | SlippyNunchucks abuses Sogou keyboard to deliver malware | 1 | Other |
| 14:53 | Debian APT flaw lets network attackers swap packages and run root code | 2 | CVE |
| 14:34 | Sysdig launches runtime security and governance for AI agents | 1 | Other |
| 14:24 | Barracuda patches ESG flaws that can enable root access | 1 | CVE |
| 14:17 | Security teams turn to automation to speed incident updates | 1 | Other |
| 14:09 | Sentra Raises $150 Million to Expand AI Data Security | 1 | Other |
| 14:00 | APT29 targets mobile devices in watering hole campaign | 2 | Known exploited |
| 14:00 | Cloudflare Adds Controls to Manage Personal Agent Traffic | 1 | Other |
| 13:24 | SANS reports scans targeting vulnerable web email scripts | 1 | CVE |
| 13:08 | mSecure urges subscribers to reset passwords after suspicious activity | 2 | Other |
| 12:52 | Crédit Mutuel Arkéa confirms cyberattack as $133M flows to crypto | 1 | Other |
| 12:52 | Cyberattack sends French blood storage readings soaring to 110°C | 1 | Other |
| 12:43 | Wiz links AI platform breaches to stolen access tokens | 1 | Other |
| 12:27 | Two Canadians Charged in University Supercomputer Mining Scheme | 1 | Other |
| 12:16 | Chrome 157 fixes 213 security flaws, including seven critical | 1 | CVE |
| 12:07 | Rails fixes critical flaw allowing server file writes via uploads | 1 | Other |
| 12:00 | Bitdefender links 3AM ransomware to AI assisted school attack | 1 | Other |
| 11:46 | Xen flaws let malicious virtual machines access host memory | 1 | CVE |
| 11:34 | LiteLLM Compromise Exposes Risks in Agent Runtime Security | 1 | Other |
| 11:24 | SlippyNunchucks hijacks Sogou to deploy DarkVigil backdoor | 1 | CVE |
| 11:02 | Police seize over 100 servers in international fraud probe | 1 | Other |
| 10:54 | Attackers poison OpsShield cPGuard updates, breach 2,950 servers | 1 | Other |
| 10:52 | MUJI says cyberattack exposed 1.09 million full card numbers | 1 | Other |
| 10:38 | Google Chrome 157 fixes 213 flaws, including seven critical bugs | 1 | Other |
| 10:30 | Trojanised ARTEX Docker Image Let Attackers Run Commands on Hosts | 1 | Other |
| 10:24 | Joe Security adds adaptive detonation to probe evasive malware | 1 | Other |
| 10:20 | NVIDIA rotates SSH keys after breach of its Brev platform | 1 | Other |
| 09:55 | Cloudflare launches Zero Wire vulnerability intelligence platform | 1 | Other |
| 09:30 | Rails patches 21 flaws, including critical file write bug | 1 | Other |
| 09:25 | Fake interview campaign leads to major Binance crypto heist | 1 | Other |
| 09:24 | SOCRadar links leepsmarts to LLM key theft and academic fraud | 1 | Known exploited |
| 09:23 | North Korea protests US claims linking hackers to Binance heist | 2 | Other |
| 09:15 | SnappyMail Remote Code Execution Chain Disclosed With Public PoC Exploit Code | 1 | Other |
| 08:49 | Brazil's Mercado Bitcoin halts withdrawals after $40 million drain | 1 | Other |
| 08:27 | Meta reveals Muse AI flaws as bug bounty payouts hit $1.2m | 1 | Other |
| 08:17 | Russian Police Arrest Suspected Members of VasyGrek Group | 1 | Other |
| 08:01 | Mandiant links UNC6993 to costly enterprise LLM hijacking | 1 | CVE |
| 07:46 | Google patches Android flaw enabling remote code execution | 2 | CVE |
| 07:16 | Airbyte Connector Builder flaw exploited to run code in containers | 1 | Other |
| 07:00 | BITTER group targets South Asian organisations with PapRAT | 1 | Other |
| 06:49 | Cyberattack turned the Nikke game's PC launcher into a spy tool | 1 | Other |
| 06:16 | Kimsuky GitHub staging infrastructure remains active despite disclosure | 1 | Other |
| 02:51 | Fridge cyberattack hits 13 countries and France's blood service | 1 | Other |
| 02:17 | PoC exposes critical remote code flaw in Puppet Server | 1 | CVE |
| 02:10 | Exposed refrigerator controls spoil food across European supermarkets | 1 | Other |
| 02:03 | HPE fixes 46 Fabric Composer flaws, including a critical password bug | 1 | CVE |
| 02:00 | Hunt.io traces 69GB data theft from Philippine agency | 1 | Other |
| 01:40 | Binarly warns of exploited Zyxel GS1900 switch zero day | 2 | CVE |
| 01:16 | Researcher discloses macOS root exploit for CVE-2026-112445 | 1 | CVE |
| 00:50 | GitBook says AI-driven cyberattack exposed customer API tokens | 1 | Other |
| 00:40 | CERT/CC discloses two critical flaws in INFINITT PACS | 1 | CVE |
| 00:00 | SUSE patches critical Rancher Fleet flaw enabling cluster takeover | 1 | CVE |
| 23:52 | FBI links Binance wallet theft to North Korean actors | 1 | Other |
| 23:37 | SonicWall discloses two unpatched GMS vulnerabilities | 2 | CVE |
| 23:32 | SolarWinds patches critical command injection flaw in Dameware | 1 | CVE |
| 23:21 | Google Chrome 157 fixes 213 flaws, including seven critical bugs | 1 | CVE |
| 22:29 | NSW Health breach prompts police criminal investigation | 1 | Other |
| 22:16 | European supermarket fridge attacks expose cold chain risks | 1 | Other |
| 21:57 | German Police Dismantle Investment Fraud Service, Arrest Seven | 1 | Other |
| 20:31 | CISA Flags Exploited WordPress Flaw Allowing Unauthenticated Code Execution | 3 | Known exploited |
| 20:07 | Cyberattacks send fake emergency alerts in Ukraine and Russia | 2 | Other |
| 20:02 | Xsolis breach exposes patient data at nine health systems | 2 | Other |
| 19:58 | Japanese Firms Turn to Cyber Insurance After Data Breaches | 2 | Other |
| 19:57 | South Korea Calls Emergency Meeting Over Entourage Data Leak | 2 | Other |
| 19:55 | Syrian hacker sentenced for Assad regime cyber conspiracy | 1 | Other |
| 19:55 | Contractor connected personal AI agent to secure Pentagon system | 1 | Other |
| 19:55 | BYOD hackers apologise after disrupting UNM hospital systems | 1 | Other |
| 19:55 | HHS settles HIPAA ransomware investigation with Lehigh Valley | 1 | Other |
| 19:54 | Liverpool hospital investigates staff access to Southport attack records | 1 | Other |
| 19:54 | CSX breach exposes personal information of 40,000 employees | 1 | Other |
| 19:44 | Binance details how fake job interviews enabled a $6.34B hack | 1 | Other |
- mSecure cyberattack: hacker stole encrypted cloud vault database
The password manager's maker, mSeven Software, told customers an attacker took an encrypted copy of a database of current and former users who synced through mSecure Cloud. It asks them to change their master password…
CyberSIXT
- mSecure urges users to change passwords after suspicious activity
mSecure, the password manager from mSeven Software, has warned current and former customers to take action after detecting “suspicious activity” tied to the mSecure app. The notice, published on 3 November by The…
Malwarebytes
- APT flaw lets attackers swap packages and run code as root
A flaw in APT, the package manager used by Debian and Ubuntu, could let an attacker who can modify package downloads swap a verified package for their own, with the malicious code then running with root privileges. The…
The Hacker NewsCVE-2026-109518
- SonicWall will not patch two flaws in its end of life GMS
SonicWall has warned that two vulnerabilities affecting its End-of-Life Global Management System (GMS) will not be patched. The flaws affect GMS 9.5.2 and earlier, and SonicWall states that there will be no remediation…
The Hacker NewsCVE-2026-109593
- 320,000 files leak from Bristol schools cyberattack
More than 320,000 files from 39 schools on Bristol City Council's Trading with Schools platform are online, a month after the council said it had found no evidence that data had been stolen.
CyberSIXT
- Google disrupts XCPE botnet that infected 1.3 million devices
Google and industry partners have disrupted the XCPE botnet, which Google’s Threat Intelligence Group (GTIG) attributes with high confidence to Videostrong Technology Co. The operation infected more than 1.3 million…
Dark Reading
- Check Point Finds Prompt Adware in OpenAI Codex Jailbreak Tool
Cybersecurity researchers have disclosed a jailbreak bundle for OpenAI Codex that modifies an AI agent’s trusted instructions to insert advertisements for a third‑party AI gateway. The release, dubbed Haiou (meaning…
The Hacker News
- Binance says hackers planned $6.3 billion crypto heist for months
Binance has disclosed that the hackers who allegedly stole billions of dollars in cryptocurrency spent months planning the heist, employing social engineering alongside novel malware and other techniques. The company,…
Ars Technica
- SlippyNunchucks abuses Sogou keyboard to deliver malware
A China-aligned group named SlippyNunchucks has exploited Sogou Input Method’s brand-promotion mechanism to deliver the DarkVigil toolset to users across six countries, turning legitimate app traffic into a malware…
Infosecurity
- Debian APT flaw lets network attackers swap packages and run root code
CVE-2026-109518 lets a man-in-the-middle replace a package after APT has verified it, when an HTTP download resumes. Debian fixed it on 4 November in apt 3.0.4 and 2.6.2; unstable is still unfixed.
CyberSIXTCVE-2026-109518
- Sysdig launches runtime security and governance for AI agents
Sysdig has announced a governance-focused extension to its runtime security platform, delivering automated oversight for agentic AI through a product called Sysdig AI Defense. The solution is designed to observe the…
SecurityWeek
- Barracuda patches ESG flaws that can enable root access
Barracuda has issued patches for two vulnerabilities that can be chained to gain root access on its Email Security Gateway (ESG) appliances. The authentication bypass, CVE-2026-116606 (CVSS 9.3), affects ESG versions…
SecurityWeekCVE-2026-116606
- Security teams turn to automation to speed incident updates
Automated threat detection and response are increasingly common, with organisations moving towards fully AI-enabled security operations centres in places. Yet the article notes that while automation can cut incident…
Dark Reading
- Sentra Raises $150 Million to Expand AI Data Security
Sentra, the agentic data security firm, has announced a $150 million Series C funding round, bringing its total raised to over $260 million. The round was led by Capital One Ventures, with participation from existing…
SecurityWeek
- Cloudflare Adds Controls to Manage Personal Agent Traffic
Cloudflare has introduced new analytics and finer-grained access controls to help site owners see and manage personal agents that visit their sites. Personal agents bridge human requests and automated web interactions,…
Cloudflare
- SANS reports scans targeting vulnerable web email scripts
SANS Internet Storm Center researcher Johannes Ullrich reported a slight increase in scans for e-mail-related scripts on honeypots. The requests included paths such as `/sendmail.php`, `/test-mail.php`,…
SANS ISCCVE-2000-0411
- mSecure urges subscribers to reset passwords after suspicious activity
mSecure’s security notification has urged current and former subscribers to take rapid action after reports of suspicious activity within its ecosystem. The vendor told customers to secure all sensitive records stored…
SecurityOnline
- Crédit Mutuel Arkéa confirms cyberattack as $133M flows to crypto
The Brittany-based bank says an attack allowed fraudulent transactions and its customers will lose nothing. Investigator ZachXBT traced more than $133 million moved out through crypto exchanges since 1 November.
CyberSIXT
- Cyberattack sends French blood storage readings soaring to 110°C
The France Blood Service (EFS) confirmed a cyber-attack aimed at temperature-controlled refrigeration equipment supplied by Coolworld, a Dutch rental company operating in France among other countries. The incident,…
Infosecurity
- Wiz links AI platform breaches to stolen access tokens
Hackers are increasingly targeting AI platforms to harvest and monetise AI access tokens, with several high-profile breaches disclosed over the past few weeks. SecurityWeek reports that incidents affecting Chainstack,…
SecurityWeek
- Two Canadians Charged in University Supercomputer Mining Scheme
Two Canadian men have been indicted in the United States for a multi-year campaign that hijacked university supercomputers to secretly mine Electroneum cryptocurrency. A federal grand jury charged Ryan James Roach, 35,…
SecurityWeek
- Chrome 157 fixes 213 security flaws, including seven critical
Google has released Chrome 157 to the stable channel for Windows, Mac and Linux, with the desktop update bringing versions 157.0.8103.38/ .39 for Windows and Mac and 157.0.8103.38 for Linux, Malwarebytes reports. The…
MalwarebytesCVE-2026-121035
- Rails fixes critical flaw allowing server file writes via uploads
A critical vulnerability in Ruby on Rails’ Active Storage could let an unauthenticated attacker write arbitrary files to a server by uploading a crafted file when the app uses ImageMagick for image processing. The…
The Hacker News
- Bitdefender links 3AM ransomware to AI assisted school attack
Bitdefender’s investigation has found that a UK school estate was compromised by the 3AM ransomware group using a hybrid human-AI approach. The incident took place from 10 to 19 September 2026, during which attackers…
Infosecurity
- Xen flaws let malicious virtual machines access host memory
Two vulnerabilities in the Xen hypervisor could allow a malicious guest VM to read and write memory belonging to other VMs on the same host, including dom0. The Xen Project disclosed advisory XSA-523 on 3 November…
The Hacker NewsCVE-2026-102703
- LiteLLM Compromise Exposes Risks in Agent Runtime Security
The Hacker News reports on how agent runtime security remains vulnerable when enforcement is treated as a single gateway rather than a multi-point, live map of an organisation’s agents and their context. The piece…
The Hacker News
- SlippyNunchucks hijacks Sogou to deploy DarkVigil backdoor
A China-aligned threat actor known as SlippyNunchucks has been linked to a DNS hijacking operation that targets Windows versions of Sogou Input Method to deliver a backdoor called DarkVigil (also referred to as FDMTP).…
The Hacker NewsCVE-2026-120422
- Police seize over 100 servers in international fraud probe
The Itzehoe Public Prosecutor’s Office in Germany led an international operation on 3 November to disrupt a multimillion‑euro investment-fraud network. Police seized more than 100 servers and shuttered several…
Infosecurity
- Attackers poison OpsShield cPGuard updates, breach 2,950 servers
SecurityWeek reports that OpsShield, an Indian IT security company, was compromised through its update distribution infrastructure, with attackers serving malicious cPGuard updates to customers. Using hijacked…
SecurityWeek
- MUJI says cyberattack exposed 1.09 million full card numbers
Ryohin Keikaku, which runs MUJI, says full card numbers of 1.09 million MUJI Card members were exposed, on top of 27.26 million customer records it disclosed on 30 October. About 345,000 cards are still valid.
CyberSIXT
- Google Chrome 157 fixes 213 flaws, including seven critical bugs
Google has rolled out Chrome 157 to the stable channel, addressing a total of 213 vulnerabilities, with seven rated critical memory-safety flaws. The release notes identify a buffer overflow in Dawn, the open source…
SecurityWeek
- Binance details $6.34 billion theft linked to North Korean group
Binance has published its initial incident report detailing a months-long campaign that culminated in a breach of its wallet signing systems, leading to a theft of about $6.34 billion in cryptocurrency. The firm says…
SecurityWeek
- Trojanised ARTEX Docker Image Let Attackers Run Commands on Hosts
The ARTEX backdoor was baked into a trojanised Docker image of a Chinese-language AI penetration testing tool. The backdoored image, published under tomicdd/artex (and identical to congdonglinux/artex in digest),…
badbyte.io
- Android flaw could let attackers run code without interaction
CVE-2026-58868 is a critical Android vulnerability disclosed in Security Affairs, affecting Android 14 through 17. The flaw arises from a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp,…
Security AffairsCVE-2026-58868
- Joe Security adds adaptive detonation to probe evasive malware
Reinach, Switzerland, 4 November 2026 — Joe Security has launched Adaptive Detonation, a new capability within Joe Sandbox AI designed to probe malware more deeply by countering evasion and unmet execution conditions.…
SecurityOnline
- NVIDIA rotates SSH keys after breach of its Brev platform
NVIDIA has disclosed a security breach affecting its Brev cloud development platform for AI, with intruder activity detected within the Brev infrastructure between 4 and 20 October 2026. The incident potentially…
SecurityOnline
- Cloudflare launches Zero Wire vulnerability intelligence platform
Cloudflare has launched an open repository called Cloudflare Zero Wire to track critical software vulnerabilities and aggregate actionable threat intelligence across the global internet. The platform operates within…
SecurityOnline
- Rails patches 21 flaws, including critical file write bug
Rails has issued security updates for versions 8.0.5.2 and 8.1.4.1 to fix 21 flaws across Active Storage, parameters handling, IP spoofing, and several XSS and DoS issues. The most severe vulnerability, cited as…
SecurityOnline
- Fake interview campaign leads to major Binance crypto heist
Threat actors carried out a months-long campaign targeting multiple Binance software engineers using sophisticated social engineering and zero-day malware, culminating in a record-breaking digital heist. Binance…
Infosecurity
- North Korea protests US claims linking hackers to Binance heist
Several missiles were launched toward the sea by North Korea on Wednesday, according to South Korea’s Joint Chiefs of Staff, which said the launches targeted North Korea’s eastern waters and are under analysis by South…
SecurityWeek
- SnappyMail Remote Code Execution Chain Disclosed With Public PoC Exploit Code
SnappyMail RCE chain disclosed with a public proof-of-concept exploit. The auth bypass hit dev builds only; avoid master builds from Oct 22-Nov 4. Related Posts: Airbyte Vulnerability Exploited in the Wild Lets…
SecurityOnline
- Brazil's Mercado Bitcoin halts withdrawals after $40 million drain
Brazil's largest crypto exchange puts the assets involved at about $38 million and says $11 million is already blocked. Customers will not lose money, it says; how the transfers were signed is unknown.
CyberSIXT
- Meta reveals Muse AI flaws as bug bounty payouts hit $1.2m
Meta has disclosed the top Muse bug bounty findings, with total payouts reaching about $1.2 million since the private programme began in April and went public at Muse’s launch on 8 September. The highest single…
SecurityWeek
- Russian Police Arrest Suspected Members of VasyGrek Group
Three individuals suspected of belonging to the threat group known as VasyGrek, also called Fluffy Wolf, have been arrested by Russian police as part of a broader operation to dismantle the group’s criminal…
The Hacker News
- Mandiant links UNC6993 to costly enterprise LLM hijacking
Mandiant’s threat intelligence on enterprise LLMJacking reveals a multi‑jurisdictional campaign in 2026 where attackers hijack corporate AI access by stealing cloud credentials and API keys to run unauthorised model…
SecurityOnlineCVE-2026-40217
- Google patches Android flaw enabling remote code execution
Google has released patches for a critical Android vulnerability that could allow remote code execution without user interaction. The flaw, CVE-2026-58868, affects Android versions 14 through 17 and is addressed in…
The Hacker NewsCVE-2026-58868
- Airbyte Connector Builder flaw exploited to run code in containers
Japan’s JPCERT/CC has warned that Airbyte’s Connector Builder vulnerability allows arbitrary code execution and has been “confirmed to be exploited in the wild.” The flaw affects all Airbyte versions prior to 2.2.0,…
SecurityOnline
- BITTER group targets South Asian organisations with PapRAT
FortiGuard Labs has uncovered a cyber espionage operation targeting government, energy and engineering organisations across South Asia, attributed with high confidence to the BITTER group (TA397). The campaign deploys…
SecurityOnline
- Cyberattack turned the Nikke game's PC launcher into a spy tool
The team behind Goddess of Victory: Nikke says the PC launcher's script files may have been tampered with. Researchers say files on the publisher's CDN installed a remote-access agent for weeks.
CyberSIXT
- Kimsuky GitHub staging infrastructure remains active despite disclosure
On 2 November 2026 researchers found that twenty-five GitHub accounts linked to the Kimsuky Operation GitPower campaign remained active, using around 120 public repositories to stage remote access software and regional…
SecurityOnline
- Zyxel's patch missed the switch flaw attackers were exploiting
An exploit used against Zyxel GS1900 switches works on firmware patched for the flaw CISA listed in September. Binarly found a second bug, CVE-2026-107441; switches need the newer firmware.
CyberSIXTCVE-2026-107441
- Fridge cyberattack hits 13 countries and France's blood service
Attackers changed the settings of cold rooms used by France's blood service the same night supermarket fridges were tampered with across Europe. France's health ministry says the incident was caught in time.
CyberSIXT
- PoC exposes critical remote code flaw in Puppet Server
SecurityOnline[.]info reports that a full PoC exploit for CVE-2026-115731, a critical Puppet Server RCE flaw rated CVSS 9.4, has been published. The OpenVox project’s GitHub advisory and a write‑up from Neodyme confirm…
SecurityOnlineCVE-2026-115731
- Exposed refrigerator controls spoil food across European supermarkets
A breach affecting hundreds, potentially thousands, of refrigerators across Europe has been discussed in the SANS Internet Storm Center’s Stormcast for 4 November 2026. The episode attributes the intrusion to devices…
SANS ISC
- HPE fixes 46 Fabric Composer flaws, including a critical password bug
HPE has released details of 46 security vulnerabilities affecting its Fabric Composer (AFC) product, with the most severe entry, CVE-2026-95731, rated 9.8 on CVSS v3.1. The flaws span three critical, 20 high, 18 medium…
SecurityOnlineCVE-2026-95731
- Hunt.io traces 69GB data theft from Philippine agency
An unknown threat actor exfiltrated what Hunt[.]io characterised as nearly 69GB of data from the Philippine Overseas Employment Administration (POEA), including information on overseas-employment case management,…
Dark Reading
- Binarly warns of exploited Zyxel GS1900 switch zero day
A Zyxel GS1900 zero‑day has been exploited in the wild, researchers from Binarly warn. The flaw, tracked as CVE-2026-107441, is an out‑of‑bounds write in the GS1900 web interface’s dispatcher.cgi that lets an…
SecurityOnlineCVE-2026-107441
- Researcher discloses macOS root exploit for CVE-2026-112445
A security researcher known as Mas0nShi has disclosed full details and PoC exploit code for CVE-2026-112445, a macOS privilege-escalation flaw. The issue is described as a straightforward bug in launchd daemons that…
SecurityOnlineCVE-2026-112445
- GitBook says AI-driven cyberattack exposed customer API tokens
The documentation platform says attackers using AI agents reached infrastructure credentials on 2 November, putting integration tokens, Git Sync secrets and API tokens at risk. Customers must rotate them.
CyberSIXT
- CERT/CC discloses two critical flaws in INFINITT PACS
Two critical vulnerabilities have been disclosed affecting INFINITT PACS, the hospital imaging platform used by thousands of sites worldwide. CERT/CC issued a security notice on 2 November 2026 detailing two flaws in…
SecurityOnlineCVE-2026-16305
- SUSE patches critical Rancher Fleet flaw enabling cluster takeover
SUSE has published advisories on 29 October 2026 warning of two serious Rancher Fleet vulnerabilities in the GitOps management engine, with the most severe CVE-2026-94290 allowing local privilege escalation to…
SecurityOnlineCVE-2026-94290
- FBI links Binance wallet theft to North Korean actors
Binance reports that on 29 October 2026, attackers drained multiple hot wallets within four minutes, transferring 233.46 million XRP to an attacker address, followed by assets on Solana, Optimism and Bitcoin wallets.…
SecurityOnline
- SonicWall discloses two unpatched GMS vulnerabilities
SonicWall has disclosed two critical, unpatched vulnerabilities in its Global Management System (GMS), tracked as CVE-2026-109593 and CVE-2026-109594, with a highest CVSS score of 9.1. The vendor’s security notice…
SecurityOnlineCVE-2026-109593
- SolarWinds patches critical command injection flaw in Dameware
SolarWinds says it has patched a critical command injection flaw in Dameware, tracked as CVE-2026-28336, with the release of Dameware 2026.3.1. The vendor rates the vulnerability at CVSSv3 9.9 and warns that…
SecurityOnlineCVE-2026-28336
- Google Chrome 157 fixes 213 flaws, including seven critical bugs
Google has promoted Chrome 157 to the stable channel, delivering version 157.0.8103.38 for Linux and 157.0.8103.38/.39 for Windows and macOS, with Google reporting 213 security fixes and seven rated as critical. The…
SecurityOnlineCVE-2026-121156
- NSW Health breach prompts police criminal investigation
A major cyber breach has been declared at NSW Health, with officials emphasising that patient data has not been affected. Cyber Security NSW says the incident concerns an isolated server within NSW Health and that the…
DataBreaches
- European supermarket fridge attacks expose cold chain risks
A second wave of attacks on European supermarket refrigeration systems has raised concerns about the cold chain’s vulnerability to remote access and Internet-facing control systems. UK outlets including the BBC and…
Dark Reading
- German Police Dismantle Investment Fraud Service, Arrest Seven
German police, supported by Europol and Eurojust, have dismantled a multinational “crime-as-a-service” operation linked to investment fraud. The Itzehoe Public Prosecutor’s Office in Germany led the raid against a…
Dark Reading
- Cyberattacks send fake emergency alerts in Ukraine and Russia
Authorities in Ukraine and Russia reported fake emergency alerts via their official alerting apps as cyber operations targeted these mobile services, with Ukraine warning residents of an imminent nuclear threat. The AP…
wordpress-1685287-6764806.cloudwaysapps.com
- Ukraine and Russia both report fake emergency alerts after cyberattacks target apps as limited ceasefire ends
AP reports: Authorities in Ukraine and Russia said their emergency alert mobile apps had been targeted by cyberattacks, with users in Ukraine receiving false warnings of an imminent nuclear threat. It was not clear if…
DataBreaches
- Xsolis breach exposes patient data at nine health systems
A data breach at AI company Xsolis exposed patient data across at least nine health systems, affecting about 1.4 million individuals, according to reporting cited by Dissent’s Giles Bruce. Xsolis, which provides…
wordpress-1685287-6764806.cloudwaysapps.com
- Xsolis breach affects 1.4 million people across nine health systems
DataBreaches[.]net reports that healthcare AI company Xsolis disclosed a data breach affecting its IT environment, with a targeted phishing incident reported on 5 June and unauthorised access on 20 January, resulting…
DataBreaches
- Japanese Firms Turn to Cyber Insurance After Data Breaches
More Japanese companies are turning to cyber insurance after prominent data breaches, according to Maddie Baker.
wordpress-1685287-6764806.cloudwaysapps.com
- Japanese Companies Turn to Cyber Insurance After Data Breaches
Maddie Baker, writing for DataBreaches[.]net on 3 November 2026, reports that cyber insurance policies typically cover costs arising from data breaches, including expenses for digital forensic analysis to identify…
DataBreaches
- South Korea Calls Emergency Meeting Over Entourage Data Leak
The presidential office in South Korea held an emergency meeting on Tuesday to address a leak involving personal data connected to President Lee Jae Myung and members of his overseas trip entourage in June. The…
wordpress-1685287-6764806.cloudwaysapps.com
- South Korea investigates leak of president's trip entourage data
The Korean presidential office convened an emergency meeting on 3 November 2026 to address the leak of personal information relating to President Lee Jae Myung and members of his overseas trip entourage in June. The…
DataBreaches
- Syrian hacker sentenced for Assad regime cyber conspiracy
Ahmad Umar Agha, also known as Th3Pr0, has been sentenced by a federal district court in the Eastern District of Virginia to 42 months’ imprisonment for his central role in a wide-ranging hacking conspiracy conducted…
wordpress-1685287-6764806.cloudwaysapps.com
- Contractor connected personal AI agent to secure Pentagon system
A defence contractor connected a personal AI agent to a secure Department of Defense system, according to WIRED’s reporting cited by DataBreaches[.]net. The AI in question was Anthropic’s Claude Code, and it was used…
wordpress-1685287-6764806.cloudwaysapps.com
- BYOD hackers apologise after disrupting UNM hospital systems
Hackers identifying themselves as the BYOD group attacked the University of New Mexico (UNM) health-system, including UNM Hospital (UNMH), earlier this week, according to a report cycle cited by DataBreaches. The…
wordpress-1685287-6764806.cloudwaysapps.com
- HHS settles HIPAA ransomware investigation with Lehigh Valley
The US Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced a settlement with Lehigh Valley Health Network (LVHN) and its affiliated entities over potential HIPAA Privacy, Security…
wordpress-1685287-6764806.cloudwaysapps.com
- Liverpool hospital investigates staff access to Southport attack records
A second hospital in Liverpool has begun an investigation into two potential instances of staff accessing medical records linked to the Southport terror attack, according to ITV. The cases were identified at Liverpool…
wordpress-1685287-6764806.cloudwaysapps.com
- CSX breach exposes personal information of 40,000 employees
CSX, one of the United States’ largest transportation companies, disclosed a cybersecurity incident that granted unauthorised access to certain information, including employee data such as Social Security numbers. The…
wordpress-1685287-6764806.cloudwaysapps.com
- Binance details how fake job interviews enabled a $6.34B hack
Binance has detailed how a multi-stage cyber operation in October 2026 enabled attackers to siphon about $6.34 billion in digital assets, using fake recruitment interviews, malware downloads, compromised developer…
Security Affairs
CVEs in the news17
Named in the last 24 hours and not in CISA KEV, most covered first
CVE-2026-109593SonicWall Global Management System (GMS)
2 articles today · SonicWall will not patch two flaws in its end of life GMS
9.1Critical0.5% EPSS · 2 articlesCVE-2026-107441Zyxel GS1900-24E firmware
2 articles today · Zyxel's patch missed the switch flaw attackers were exploiting
8.8High0.3% EPSS · 2 articlesCVE-2026-109518Debian APT
2 articles today · APT flaw lets attackers swap packages and run code as root
7.7High2 articlesCVE-2026-58868Google Android
2 articles today · Android flaw could let attackers run code without interaction
Not scored0.2% EPSS · 4 articlesCVE-2026-28336SolarWinds Dameware
SolarWinds patches critical command injection flaw in Dameware
9.9Critical1.6% EPSS · 1 articleCVE-2026-95731Hewlett Packard Enterprise (HPE) Fabric Composer
HPE fixes 46 Fabric Composer flaws, including a critical password bug
9.8Critical0.5% EPSS · 1 articleCVE-2026-121035Google Chrome
Chrome 157 fixes 213 security flaws, including seven critical
9.6Critical0.4% EPSS · 2 articlesCVE-2026-121156Google Chrome
Google Chrome 157 fixes 213 flaws, including seven critical bugs
9.6Critical0.4% EPSS · 2 articlesCVE-2026-115731Perforce Puppet Enterprise
PoC exposes critical remote code flaw in Puppet Server
9.4Critical0.4% EPSS · 1 articleCVE-2026-116606Barracuda Networks Barracuda Email Security Gateway (ESG)
Barracuda patches ESG flaws that can enable root access
9.3Critical0.7% EPSS · 3 articlesCVE-2026-94290SUSE Rancher
SUSE patches critical Rancher Fleet flaw enabling cluster takeover
9.1Critical0.5% EPSS · 1 articleCVE-2026-120422Sogou Sogou Input Method
SlippyNunchucks hijacks Sogou to deploy DarkVigil backdoor
8.9High1 articleCVE-2026-40217BerriAI LiteLLM
Mandiant links UNC6993 to costly enterprise LLM hijacking
8.8High17% EPSS · 4 articlesCVE-2000-0411Vendor not yet named
SANS reports scans targeting vulnerable web email scripts
Not scored7.5% EPSS · 1 articleCVE-2026-102703Xen Xen
Xen flaws let malicious virtual machines access host memory
Not scored1 articleCVE-2026-112445Vendor not yet named
Researcher discloses macOS root exploit for CVE-2026-112445
Not scored1 articleCVE-2026-16305INFINITT Healthcare System Manager
CERT/CC discloses two critical flaws in INFINITT PACS
Not scored0.3% EPSS · 1 article
Developing stories6
Two or more articles in the last 24 hours; each bead is an article
- Threat actorTraderTraitorDevelopinglatest 3 hours ago3 articles2 outlets
- Wed 4 Nov, 09:23 UTC. SecurityWeek, first report. North Korea protests US claims linking hackers to Binance heist.
- Wed 4 Nov, 10:36 UTC. SecurityWeek. Binance details $6.34 billion theft linked to North Korean group.
- Wed 4 Nov, 16:06 UTC. Ars Technica, its first report on the story. Binance says hackers planned $6.3 billion crypto heist for months.
- In CISA KEVCVECVE-2026-119977WordPress CoreDevelopinglatest 10 hours ago3 articles3 outlets
- Tue 3 Nov, 20:31 UTC. CISA, first report. CISA Flags Exploited WordPress Flaw Allowing Unauthenticated Code Execution. Cites a CVE in CISA KEV.
- Wed 4 Nov, 05:43 UTC. The Hacker News, its first report on the story. CISA Confirms Active Exploitation of WordPress Core Flaw. Cites a CVE in CISA KEV.
- Wed 4 Nov, 09:16 UTC. Security Affairs, its first report on the story. CISA adds actively exploited WordPress flaw to KEV catalog. Cites a CVE in CISA KEV.
- CVECVE-2026-109518Debian APTDevelopinglatest 2 hours ago2 articles2 outlets
- Wed 4 Nov, 14:53 UTC. CyberSIXT, first report. Debian APT flaw lets network attackers swap packages and run root code.
- Wed 4 Nov, 17:00 UTC. The Hacker News, its first report on the story. APT flaw lets attackers swap packages and run code as root.
- CVECVE-2026-109593SonicWall Global Management System (GMS)Developinglatest 2 hours ago2 articles2 outlets
- Tue 3 Nov, 23:37 UTC. SecurityOnline, first report. SonicWall discloses two unpatched GMS vulnerabilities.
- Wed 4 Nov, 17:00 UTC. The Hacker News, its first report on the story. SonicWall will not patch two flaws in its end of life GMS.
- In CISA KEVCVECVE-2025-43529Apple Multiple ProductsDevelopinglatest 5 hours ago2 articles2 outlets
- Wed 4 Nov, 14:00 UTC. Infosecurity, first report. APT29 targets mobile devices in watering hole campaign. Cites a CVE in CISA KEV.
- Wed 4 Nov, 14:27 UTC. The Hacker News, its first report on the story. APT29 linked to mobile watering hole campaign using exploits. Cites a CVE in CISA KEV.
- CVECVE-2026-58868Google AndroidDevelopinglatest 9 hours ago2 articles2 outlets
- Wed 4 Nov, 07:46 UTC. The Hacker News, first report. Google patches Android flaw enabling remote code execution.
- Wed 4 Nov, 10:26 UTC. Security Affairs, its first report on the story. Android flaw could let attackers run code without interaction.