Wed 4 Nov · updated 12:30 UTC
Today in security
Today’s briefing
Updated 10:52 UTC
MUJI says card numbers of a million members exposed
2 updates since 07:00 · latest 10:52 UTC
Ryohin Keikaku, which runs MUJI, says attackers may have reached full card numbers of more than a million MUJI Card members, about 345,000 still valid, without expiry dates or security codes. It also widened its earlier count of 27 million customer records.
Known exploited9
CISA KEV entries named in the last 48 hours of coverage, by federal deadline
- In CISA KEV
WordPress CoreCVE-2026-119977
Federal deadline 6 Nov · In CISA KEV since 3 Nov
8.1High0.6% EPSS3 articles
- In CISA KEV
Google BrotliCVE-2026-111497
Federal deadline 10 Nov · In CISA KEV since 27 Oct
9.2Critical83% EPSS22 articles
- In CISA KEV
Ivanti Connect SecureCVE-2026-118527
Federal deadline 13 Nov · In CISA KEV since 30 Oct
4.3Medium8 articles
- In CISA KEV
Ivanti Connect SecureCVE-2026-111357
Federal deadline passed 2 Nov · In CISA KEV since 30 Oct
7.0High0.5% EPSS8 articles
Show 5 more · federal deadlines passed
- In CISA KEV
Ivanti Connect SecureCVE-2026-104935
Federal deadline passed 16 Oct · In CISA KEV since 13 Oct
8.6High89% EPSS21 articles
- In CISA KEV
Zyxel GS1900-48HPv2 firmwareCVE-2026-7273
Federal deadline passed 24 Sep · In CISA KEV since 21 Sep
8.8High2.8% EPSS8 articles
- In CISA KEV
Adobe CommerceCVE-2026-75650
Federal deadline passed 11 Sep · In CISA KEV since 8 Sep
10.0Critical3.9% EPSS9 articles
- In CISA KEV
WebPros cPanel & WHM and WP2 (WordPress Squared)CVE-2026-41940
Federal deadline passed 3 May · In CISA KEV since 30 Apr · Used in ransomware campaigns
9.8Critical99% EPSS17 articles
- In CISA KEV
RARLAB WinRARCVE-2025-8088
Federal deadline passed 2 Sep 2025 · In CISA KEV since 12 Aug 2025 · Used in ransomware campaigns
8.4High94% EPSS23 articles
Latest news81
The last 24 hours, newest first; stories about known exploited CVEs are above
Latest story at 12:00 UTC. Red diamonds mark the 3 stories about exploited CVEs.
- 11:02 UTC. Police seize over 100 servers in international fraud probe. 1 outlet.
- 10:54 UTC. Attackers poison OpsShield cPGuard updates, breach 2,950 servers. 1 outlet.
- 10:52 UTC. MUJI says cyberattack exposed 1.09 million full card numbers. 1 outlet.
- 10:38 UTC. Google Chrome 157 fixes 213 flaws, including seven critical bugs. 1 outlet.
- 10:30 UTC. Trojanised ARTEX Docker Image Let Attackers Run Commands on Hosts. 1 outlet.
- 10:24 UTC. Joe Security adds adaptive detonation to probe evasive malware. 1 outlet.
- 10:20 UTC. NVIDIA rotates SSH keys after breach of its Brev platform. 1 outlet.
- 09:30 UTC. Rails patches 21 flaws, including critical file write bug. 1 outlet.
- 09:25 UTC. Fake interview campaign leads to major Binance crypto heist. 1 outlet.
- 09:24 UTC. SOCRadar links leepsmarts to LLM key theft and academic fraud. 1 outlet. About an exploited CVE.
- 09:15 UTC. SnappyMail Remote Code Execution Chain Disclosed With Public PoC Exploit Code. 1 outlet.
- 08:49 UTC. Brazil's Mercado Bitcoin halts withdrawals after $40 million drain. 1 outlet.
- 08:27 UTC. Meta reveals Muse AI flaws as bug bounty payouts hit $1.2m. 1 outlet.
- 08:17 UTC. Russian Police Arrest Suspected Members of VasyGrek Group. 1 outlet.
- 07:46 UTC. Google patches Android flaw enabling remote code execution. 2 outlets.
- 07:16 UTC. Airbyte Connector Builder flaw exploited to run code in containers. 1 outlet.
- 07:00 UTC. BITTER group targets South Asian organisations with PapRAT. 1 outlet.
- 06:49 UTC. Cyberattack turned the Nikke game's PC launcher into a spy tool. 1 outlet.
- 06:16 UTC. Kimsuky GitHub staging infrastructure remains active despite disclosure. 1 outlet.
- 02:51 UTC. Fridge cyberattack hits 13 countries and France's blood service. 1 outlet.
- 02:17 UTC. PoC exposes critical remote code flaw in Puppet Server. 1 outlet.
- 02:10 UTC. Exposed refrigerator controls spoil food across European supermarkets. 1 outlet.
- 02:03 UTC. HPE fixes 46 Fabric Composer flaws, including a critical password bug. 1 outlet.
- 02:00 UTC. Hunt.io traces 69GB data theft from Philippine agency. 1 outlet.
- 01:40 UTC. Binarly warns of exploited Zyxel GS1900 switch zero day. 2 outlets.
- 01:16 UTC. Researcher discloses macOS root exploit for CVE-2026-112445. 1 outlet.
- 00:50 UTC. GitBook says AI-driven cyberattack exposed customer API tokens. 1 outlet.
- 00:40 UTC. CERT/CC discloses two critical flaws in INFINITT PACS. 1 outlet.
- 00:00 UTC. SUSE patches critical Rancher Fleet flaw enabling cluster takeover. 1 outlet.
- 23:52 UTC. FBI links Binance wallet theft to North Korean actors. 1 outlet.
- 23:37 UTC. SonicWall discloses two unpatched GMS vulnerabilities. 1 outlet.
- 23:32 UTC. SolarWinds patches critical command injection flaw in Dameware. 1 outlet.
- 23:21 UTC. Google Chrome 157 fixes 213 flaws, including seven critical bugs. 1 outlet.
- 22:29 UTC. NSW Health breach prompts police criminal investigation. 1 outlet.
- 22:16 UTC. European supermarket fridge attacks expose cold chain risks. 1 outlet.
- 21:57 UTC. German Police Dismantle Investment Fraud Service, Arrest Seven. 1 outlet.
- 20:31 UTC. CISA Flags Exploited WordPress Flaw Allowing Unauthenticated Code Execution. 3 outlets. About an exploited CVE.
- 20:07 UTC. Cyberattacks send fake emergency alerts in Ukraine and Russia. 2 outlets.
- 20:02 UTC. Xsolis breach exposes patient data at nine health systems. 2 outlets.
- 19:58 UTC. Japanese Firms Turn to Cyber Insurance After Data Breaches. 2 outlets.
- 19:57 UTC. South Korea Calls Emergency Meeting Over Entourage Data Leak. 2 outlets.
- 19:55 UTC. Syrian hacker sentenced for Assad regime cyber conspiracy. 1 outlet.
- 19:55 UTC. Contractor connected personal AI agent to secure Pentagon system. 1 outlet.
- 19:55 UTC. BYOD hackers apologise after disrupting UNM hospital systems. 1 outlet.
- 19:55 UTC. HHS settles HIPAA ransomware investigation with Lehigh Valley. 1 outlet.
- 19:54 UTC. Liverpool hospital investigates staff access to Southport attack records. 1 outlet.
- 19:54 UTC. CSX breach exposes personal information of 40,000 employees. 1 outlet.
- 18:49 UTC. How North Korea is laundering $6.4 billion stolen from Binance. 2 outlets.
- 18:46 UTC. mSecure Warns Users to Reset Passwords After Suspicious Activity. 1 outlet.
- 18:16 UTC. Chainstack Breach Exposes Customer Data and Password Hashes. 1 outlet.
- 17:32 UTC. Microsoft details fake installer campaign delivering monetisation payloads. 1 outlet.
- 17:08 UTC. Google dismantles botnet infecting 1.3 million Android TV boxes. 1 outlet.
- 17:00 UTC. Microsoft named Gartner Leader for AI agent management platforms. 1 outlet.
- 16:55 UTC. Binance Details How Fake Interviews Led to $6.43 Billion Theft. 2 outlets.
- 16:31 UTC. Synology warns ransomware operators are targeting outdated NAS devices. 1 outlet.
- 16:03 UTC. Kaspersky finds BlackX bootkit bypassing Secure Boot on Windows. 1 outlet.
- 15:59 UTC. Barracuda flaws can be chained to gain root access. 1 outlet.
- 15:41 UTC. Google reports LLMjacking attacks driving cloud bills to $1 million. 2 outlets.
- 15:38 UTC. Dark Reading outlines nine ways to navigate modern cyber threats. 1 outlet.
- 15:35 UTC. Google Details Criminal Enterprise Reselling Stolen LLM Access. 1 outlet.
- 15:30 UTC. ESET says Gorbag targets Ukrainian officials with spyware. 1 outlet. About an exploited CVE.
- 15:16 UTC. Hijacked cPGuard updates backdoor Linux servers and steal data. 1 outlet.
- 14:56 UTC. Apple warns people in 99 countries of spyware targeting. 1 outlet.
- 14:32 UTC. Frontline Education Breach Exposes Data of Over 1.3 Million. 1 outlet.
- 14:30 UTC. BTCPay Server flaw exploited to steal $1.63m in crypto. 1 outlet.
- 14:12 UTC. CrowdStrike agrees to buy Fiddler AI and Dreadnode. 1 outlet.
- 14:11 UTC. Google links Videostrong to backdoor in 1.3 million TV boxes. 1 outlet.
- 14:00 UTC. Bitdefender links 3AM attack on UK school to AI-like loops. 2 outlets.
- 14:00 UTC. Cloudflare launches Zero Wire vulnerability intelligence feed. 2 outlets.
- 13:57 UTC. Check Point finds prompt adware in Codex jailbreak bundle. 1 outlet.
- 13:45 UTC. Cyberattacks Disrupt Supermarket Refrigeration Across Europe. 1 outlet.
- 12:49 UTC. CVSS 9.8 Linux flaw lets attackers take root on Go servers by default. 1 outlet.
- Known exploited CVE
- CVE not in KEV
- Other story
- Size: outlets on the story
- Stories an hour
Show as tableHide table
| Time (UTC) | Story | Outlets | Type |
|---|---|---|---|
| 11:02 | Police seize over 100 servers in international fraud probe | 1 | Other |
| 10:54 | Attackers poison OpsShield cPGuard updates, breach 2,950 servers | 1 | Other |
| 10:52 | MUJI says cyberattack exposed 1.09 million full card numbers | 1 | Other |
| 10:38 | Google Chrome 157 fixes 213 flaws, including seven critical bugs | 1 | Other |
| 10:30 | Trojanised ARTEX Docker Image Let Attackers Run Commands on Hosts | 1 | Other |
| 10:24 | Joe Security adds adaptive detonation to probe evasive malware | 1 | Other |
| 10:20 | NVIDIA rotates SSH keys after breach of its Brev platform | 1 | Other |
| 09:30 | Rails patches 21 flaws, including critical file write bug | 1 | Other |
| 09:25 | Fake interview campaign leads to major Binance crypto heist | 1 | Other |
| 09:24 | SOCRadar links leepsmarts to LLM key theft and academic fraud | 1 | Known exploited |
| 09:15 | SnappyMail Remote Code Execution Chain Disclosed With Public PoC Exploit Code | 1 | Other |
| 08:49 | Brazil's Mercado Bitcoin halts withdrawals after $40 million drain | 1 | Other |
| 08:27 | Meta reveals Muse AI flaws as bug bounty payouts hit $1.2m | 1 | Other |
| 08:17 | Russian Police Arrest Suspected Members of VasyGrek Group | 1 | Other |
| 07:46 | Google patches Android flaw enabling remote code execution | 2 | CVE |
| 07:16 | Airbyte Connector Builder flaw exploited to run code in containers | 1 | Other |
| 07:00 | BITTER group targets South Asian organisations with PapRAT | 1 | Other |
| 06:49 | Cyberattack turned the Nikke game's PC launcher into a spy tool | 1 | Other |
| 06:16 | Kimsuky GitHub staging infrastructure remains active despite disclosure | 1 | Other |
| 02:51 | Fridge cyberattack hits 13 countries and France's blood service | 1 | Other |
| 02:17 | PoC exposes critical remote code flaw in Puppet Server | 1 | CVE |
| 02:10 | Exposed refrigerator controls spoil food across European supermarkets | 1 | Other |
| 02:03 | HPE fixes 46 Fabric Composer flaws, including a critical password bug | 1 | CVE |
| 02:00 | Hunt.io traces 69GB data theft from Philippine agency | 1 | Other |
| 01:40 | Binarly warns of exploited Zyxel GS1900 switch zero day | 2 | CVE |
| 01:16 | Researcher discloses macOS root exploit for CVE-2026-112445 | 1 | CVE |
| 00:50 | GitBook says AI-driven cyberattack exposed customer API tokens | 1 | Other |
| 00:40 | CERT/CC discloses two critical flaws in INFINITT PACS | 1 | CVE |
| 00:00 | SUSE patches critical Rancher Fleet flaw enabling cluster takeover | 1 | CVE |
| 23:52 | FBI links Binance wallet theft to North Korean actors | 1 | Other |
| 23:37 | SonicWall discloses two unpatched GMS vulnerabilities | 1 | CVE |
| 23:32 | SolarWinds patches critical command injection flaw in Dameware | 1 | CVE |
| 23:21 | Google Chrome 157 fixes 213 flaws, including seven critical bugs | 1 | CVE |
| 22:29 | NSW Health breach prompts police criminal investigation | 1 | Other |
| 22:16 | European supermarket fridge attacks expose cold chain risks | 1 | Other |
| 21:57 | German Police Dismantle Investment Fraud Service, Arrest Seven | 1 | Other |
| 20:31 | CISA Flags Exploited WordPress Flaw Allowing Unauthenticated Code Execution | 3 | Known exploited |
| 20:07 | Cyberattacks send fake emergency alerts in Ukraine and Russia | 2 | Other |
| 20:02 | Xsolis breach exposes patient data at nine health systems | 2 | Other |
| 19:58 | Japanese Firms Turn to Cyber Insurance After Data Breaches | 2 | Other |
| 19:57 | South Korea Calls Emergency Meeting Over Entourage Data Leak | 2 | Other |
| 19:55 | Syrian hacker sentenced for Assad regime cyber conspiracy | 1 | Other |
| 19:55 | Contractor connected personal AI agent to secure Pentagon system | 1 | Other |
| 19:55 | BYOD hackers apologise after disrupting UNM hospital systems | 1 | Other |
| 19:55 | HHS settles HIPAA ransomware investigation with Lehigh Valley | 1 | Other |
| 19:54 | Liverpool hospital investigates staff access to Southport attack records | 1 | Other |
| 19:54 | CSX breach exposes personal information of 40,000 employees | 1 | Other |
| 18:49 | How North Korea is laundering $6.4 billion stolen from Binance | 2 | Other |
| 18:46 | mSecure Warns Users to Reset Passwords After Suspicious Activity | 1 | Other |
| 18:16 | Chainstack Breach Exposes Customer Data and Password Hashes | 1 | Other |
| 17:32 | Microsoft details fake installer campaign delivering monetisation payloads | 1 | Other |
| 17:08 | Google dismantles botnet infecting 1.3 million Android TV boxes | 1 | Other |
| 17:00 | Microsoft named Gartner Leader for AI agent management platforms | 1 | Other |
| 16:55 | Binance Details How Fake Interviews Led to $6.43 Billion Theft | 2 | Other |
| 16:31 | Synology warns ransomware operators are targeting outdated NAS devices | 1 | CVE |
| 16:03 | Kaspersky finds BlackX bootkit bypassing Secure Boot on Windows | 1 | CVE |
| 15:59 | Barracuda flaws can be chained to gain root access | 1 | CVE |
| 15:41 | Google reports LLMjacking attacks driving cloud bills to $1 million | 2 | CVE |
| 15:38 | Dark Reading outlines nine ways to navigate modern cyber threats | 1 | Other |
| 15:35 | Google Details Criminal Enterprise Reselling Stolen LLM Access | 1 | Other |
| 15:30 | ESET says Gorbag targets Ukrainian officials with spyware | 1 | Known exploited |
| 15:16 | Hijacked cPGuard updates backdoor Linux servers and steal data | 1 | Other |
| 14:56 | Apple warns people in 99 countries of spyware targeting | 1 | CVE |
| 14:32 | Frontline Education Breach Exposes Data of Over 1.3 Million | 1 | Other |
| 14:30 | BTCPay Server flaw exploited to steal $1.63m in crypto | 1 | Other |
| 14:12 | CrowdStrike agrees to buy Fiddler AI and Dreadnode | 1 | Other |
| 14:11 | Google links Videostrong to backdoor in 1.3 million TV boxes | 1 | Other |
| 14:00 | Bitdefender links 3AM attack on UK school to AI-like loops | 2 | Other |
| 14:00 | Cloudflare launches Zero Wire vulnerability intelligence feed | 2 | Other |
| 13:57 | Check Point finds prompt adware in Codex jailbreak bundle | 1 | Other |
| 13:45 | Cyberattacks Disrupt Supermarket Refrigeration Across Europe | 1 | Other |
| 12:49 | CVSS 9.8 Linux flaw lets attackers take root on Go servers by default | 1 | CVE |
- Bitdefender links 3AM ransomware to AI assisted school attack
Bitdefender’s investigation has found that a UK school estate was compromised by the 3AM ransomware group using a hybrid human-AI approach. The incident took place from 10 to 19 September 2026, during which attackers…
Infosecurity
- Police seize over 100 servers in international fraud probe
The Itzehoe Public Prosecutor’s Office in Germany led an international operation on 3 November to disrupt a multimillion‑euro investment-fraud network. Police seized more than 100 servers and shuttered several…
Infosecurity
- Attackers poison OpsShield cPGuard updates, breach 2,950 servers
SecurityWeek reports that OpsShield, an Indian IT security company, was compromised through its update distribution infrastructure, with attackers serving malicious cPGuard updates to customers. Using hijacked…
SecurityWeek
- MUJI says cyberattack exposed 1.09 million full card numbers
Ryohin Keikaku, which runs MUJI, says full card numbers of 1.09 million MUJI Card members were exposed, on top of 27.26 million customer records it disclosed on 30 October. About 345,000 cards are still valid.
CyberSIXT
- Google Chrome 157 fixes 213 flaws, including seven critical bugs
Google has rolled out Chrome 157 to the stable channel, addressing a total of 213 vulnerabilities, with seven rated critical memory-safety flaws. The release notes identify a buffer overflow in Dawn, the open source…
SecurityWeek
- Binance details $6.34 billion theft linked to North Korean group
Binance has published its initial incident report detailing a months-long campaign that culminated in a breach of its wallet signing systems, leading to a theft of about $6.34 billion in cryptocurrency. The firm says…
SecurityWeek
- Trojanised ARTEX Docker Image Let Attackers Run Commands on Hosts
The ARTEX backdoor was baked into a trojanised Docker image of a Chinese-language AI penetration testing tool. The backdoored image, published under tomicdd/artex (and identical to congdonglinux/artex in digest),…
badbyte.io
- Android flaw could let attackers run code without interaction
CVE-2026-58868 is a critical Android vulnerability disclosed in Security Affairs, affecting Android 14 through 17. The flaw arises from a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp,…
Security AffairsCVE-2026-58868
- Joe Security adds adaptive detonation to probe evasive malware
Reinach, Switzerland, 4 November 2026 — Joe Security has launched Adaptive Detonation, a new capability within Joe Sandbox AI designed to probe malware more deeply by countering evasion and unmet execution conditions.…
SecurityOnline
- NVIDIA rotates SSH keys after breach of its Brev platform
NVIDIA has disclosed a security breach affecting its Brev cloud development platform for AI, with intruder activity detected within the Brev infrastructure between 4 and 20 October 2026. The incident potentially…
SecurityOnline
- Cloudflare launches Zero Wire vulnerability intelligence platform
Cloudflare has launched an open repository called Cloudflare Zero Wire to track critical software vulnerabilities and aggregate actionable threat intelligence across the global internet. The platform operates within…
SecurityOnline
- Rails patches 21 flaws, including critical file write bug
Rails has issued security updates for versions 8.0.5.2 and 8.1.4.1 to fix 21 flaws across Active Storage, parameters handling, IP spoofing, and several XSS and DoS issues. The most severe vulnerability, cited as…
SecurityOnline
- Fake interview campaign leads to major Binance crypto heist
Threat actors carried out a months-long campaign targeting multiple Binance software engineers using sophisticated social engineering and zero-day malware, culminating in a record-breaking digital heist. Binance…
Infosecurity
- North Korea protests US claims linking hackers to Binance heist
Several missiles were launched toward the sea by North Korea on Wednesday, according to South Korea’s Joint Chiefs of Staff, which said the launches targeted North Korea’s eastern waters and are under analysis by South…
SecurityWeek
- SnappyMail Remote Code Execution Chain Disclosed With Public PoC Exploit Code
SnappyMail RCE chain disclosed with a public proof-of-concept exploit. The auth bypass hit dev builds only; avoid master builds from Oct 22-Nov 4. Related Posts: Airbyte Vulnerability Exploited in the Wild Lets…
SecurityOnline
- Brazil's Mercado Bitcoin halts withdrawals after $40 million drain
Brazil's largest crypto exchange puts the assets involved at about $38 million and says $11 million is already blocked. Customers will not lose money, it says; how the transfers were signed is unknown.
CyberSIXT
- Meta reveals Muse AI flaws as bug bounty payouts hit $1.2m
Meta has disclosed the top Muse bug bounty findings, with total payouts reaching about $1.2 million since the private programme began in April and went public at Muse’s launch on 8 September. The highest single…
SecurityWeek
- Russian Police Arrest Suspected Members of VasyGrek Group
Three individuals suspected of belonging to the threat group known as VasyGrek, also called Fluffy Wolf, have been arrested by Russian police as part of a broader operation to dismantle the group’s criminal…
The Hacker News
- Mandiant links UNC6993 to costly enterprise LLM hijacking
Mandiant’s threat intelligence on enterprise LLMJacking reveals a multi‑jurisdictional campaign in 2026 where attackers hijack corporate AI access by stealing cloud credentials and API keys to run unauthorised model…
SecurityOnlineCVE-2026-40217
- Google patches Android flaw enabling remote code execution
Google has released patches for a critical Android vulnerability that could allow remote code execution without user interaction. The flaw, CVE-2026-58868, affects Android versions 14 through 17 and is addressed in…
The Hacker NewsCVE-2026-58868
- Airbyte Connector Builder flaw exploited to run code in containers
Japan’s JPCERT/CC has warned that Airbyte’s Connector Builder vulnerability allows arbitrary code execution and has been “confirmed to be exploited in the wild.” The flaw affects all Airbyte versions prior to 2.2.0,…
SecurityOnline
- BITTER group targets South Asian organisations with PapRAT
FortiGuard Labs has uncovered a cyber espionage operation targeting government, energy and engineering organisations across South Asia, attributed with high confidence to the BITTER group (TA397). The campaign deploys…
SecurityOnline
- Cyberattack turned the Nikke game's PC launcher into a spy tool
The team behind Goddess of Victory: Nikke says the PC launcher's script files may have been tampered with. Researchers say files on the publisher's CDN installed a remote-access agent for weeks.
CyberSIXT
- Kimsuky GitHub staging infrastructure remains active despite disclosure
On 2 November 2026 researchers found that twenty-five GitHub accounts linked to the Kimsuky Operation GitPower campaign remained active, using around 120 public repositories to stage remote access software and regional…
SecurityOnline
- Zyxel's patch missed the switch flaw attackers were exploiting
An exploit used against Zyxel GS1900 switches works on firmware patched for the flaw CISA listed in September. Binarly found a second bug, CVE-2026-107441; switches need the newer firmware.
CyberSIXTCVE-2026-107441
- Fridge cyberattack hits 13 countries and France's blood service
Attackers changed the settings of cold rooms used by France's blood service the same night supermarket fridges were tampered with across Europe. France's health ministry says the incident was caught in time.
CyberSIXT
- PoC exposes critical remote code flaw in Puppet Server
SecurityOnline[.]info reports that a full PoC exploit for CVE-2026-115731, a critical Puppet Server RCE flaw rated CVSS 9.4, has been published. The OpenVox project’s GitHub advisory and a write‑up from Neodyme confirm…
SecurityOnlineCVE-2026-115731
- Exposed refrigerator controls spoil food across European supermarkets
A breach affecting hundreds, potentially thousands, of refrigerators across Europe has been discussed in the SANS Internet Storm Center’s Stormcast for 4 November 2026. The episode attributes the intrusion to devices…
SANS ISC
- HPE fixes 46 Fabric Composer flaws, including a critical password bug
HPE has released details of 46 security vulnerabilities affecting its Fabric Composer (AFC) product, with the most severe entry, CVE-2026-95731, rated 9.8 on CVSS v3.1. The flaws span three critical, 20 high, 18 medium…
SecurityOnlineCVE-2026-95731
- Hunt.io traces 69GB data theft from Philippine agency
An unknown threat actor exfiltrated what Hunt[.]io characterised as nearly 69GB of data from the Philippine Overseas Employment Administration (POEA), including information on overseas-employment case management,…
Dark Reading
- Binarly warns of exploited Zyxel GS1900 switch zero day
A Zyxel GS1900 zero‑day has been exploited in the wild, researchers from Binarly warn. The flaw, tracked as CVE-2026-107441, is an out‑of‑bounds write in the GS1900 web interface’s dispatcher.cgi that lets an…
SecurityOnlineCVE-2026-107441
- Researcher discloses macOS root exploit for CVE-2026-112445
A security researcher known as Mas0nShi has disclosed full details and PoC exploit code for CVE-2026-112445, a macOS privilege-escalation flaw. The issue is described as a straightforward bug in launchd daemons that…
SecurityOnlineCVE-2026-112445
- GitBook says AI-driven cyberattack exposed customer API tokens
The documentation platform says attackers using AI agents reached infrastructure credentials on 2 November, putting integration tokens, Git Sync secrets and API tokens at risk. Customers must rotate them.
CyberSIXT
- CERT/CC discloses two critical flaws in INFINITT PACS
Two critical vulnerabilities have been disclosed affecting INFINITT PACS, the hospital imaging platform used by thousands of sites worldwide. CERT/CC issued a security notice on 2 November 2026 detailing two flaws in…
SecurityOnlineCVE-2026-16305
- SUSE patches critical Rancher Fleet flaw enabling cluster takeover
SUSE has published advisories on 29 October 2026 warning of two serious Rancher Fleet vulnerabilities in the GitOps management engine, with the most severe CVE-2026-94290 allowing local privilege escalation to…
SecurityOnlineCVE-2026-94290
- FBI links Binance wallet theft to North Korean actors
Binance reports that on 29 October 2026, attackers drained multiple hot wallets within four minutes, transferring 233.46 million XRP to an attacker address, followed by assets on Solana, Optimism and Bitcoin wallets.…
SecurityOnline
- SonicWall discloses two unpatched GMS vulnerabilities
SonicWall has disclosed two critical, unpatched vulnerabilities in its Global Management System (GMS), tracked as CVE-2026-109593 and CVE-2026-109594, with a highest CVSS score of 9.1. The vendor’s security notice…
SecurityOnlineCVE-2026-109593
- SolarWinds patches critical command injection flaw in Dameware
SolarWinds says it has patched a critical command injection flaw in Dameware, tracked as CVE-2026-28336, with the release of Dameware 2026.3.1. The vendor rates the vulnerability at CVSSv3 9.9 and warns that…
SecurityOnlineCVE-2026-28336
- Google Chrome 157 fixes 213 flaws, including seven critical bugs
Google has promoted Chrome 157 to the stable channel, delivering version 157.0.8103.38 for Linux and 157.0.8103.38/.39 for Windows and macOS, with Google reporting 213 security fixes and seven rated as critical. The…
SecurityOnlineCVE-2026-121156
- NSW Health breach prompts police criminal investigation
A major cyber breach has been declared at NSW Health, with officials emphasising that patient data has not been affected. Cyber Security NSW says the incident concerns an isolated server within NSW Health and that the…
DataBreaches
- European supermarket fridge attacks expose cold chain risks
A second wave of attacks on European supermarket refrigeration systems has raised concerns about the cold chain’s vulnerability to remote access and Internet-facing control systems. UK outlets including the BBC and…
Dark Reading
- German Police Dismantle Investment Fraud Service, Arrest Seven
German police, supported by Europol and Eurojust, have dismantled a multinational “crime-as-a-service” operation linked to investment fraud. The Itzehoe Public Prosecutor’s Office in Germany led the raid against a…
Dark Reading
- Cyberattacks send fake emergency alerts in Ukraine and Russia
Authorities in Ukraine and Russia reported fake emergency alerts via their official alerting apps as cyber operations targeted these mobile services, with Ukraine warning residents of an imminent nuclear threat. The AP…
wordpress-1685287-6764806.cloudwaysapps.com
- Ukraine and Russia both report fake emergency alerts after cyberattacks target apps as limited ceasefire ends
AP reports: Authorities in Ukraine and Russia said their emergency alert mobile apps had been targeted by cyberattacks, with users in Ukraine receiving false warnings of an imminent nuclear threat. It was not clear if…
DataBreaches
- Xsolis breach exposes patient data at nine health systems
A data breach at AI company Xsolis exposed patient data across at least nine health systems, affecting about 1.4 million individuals, according to reporting cited by Dissent’s Giles Bruce. Xsolis, which provides…
wordpress-1685287-6764806.cloudwaysapps.com
- Xsolis breach affects 1.4 million people across nine health systems
DataBreaches[.]net reports that healthcare AI company Xsolis disclosed a data breach affecting its IT environment, with a targeted phishing incident reported on 5 June and unauthorised access on 20 January, resulting…
DataBreaches
- Japanese Firms Turn to Cyber Insurance After Data Breaches
More Japanese companies are turning to cyber insurance after prominent data breaches, according to Maddie Baker.
wordpress-1685287-6764806.cloudwaysapps.com
- Japanese Companies Turn to Cyber Insurance After Data Breaches
Maddie Baker, writing for DataBreaches[.]net on 3 November 2026, reports that cyber insurance policies typically cover costs arising from data breaches, including expenses for digital forensic analysis to identify…
DataBreaches
- South Korea Calls Emergency Meeting Over Entourage Data Leak
The presidential office in South Korea held an emergency meeting on Tuesday to address a leak involving personal data connected to President Lee Jae Myung and members of his overseas trip entourage in June. The…
wordpress-1685287-6764806.cloudwaysapps.com
- South Korea investigates leak of president's trip entourage data
The Korean presidential office convened an emergency meeting on 3 November 2026 to address the leak of personal information relating to President Lee Jae Myung and members of his overseas trip entourage in June. The…
DataBreaches
- Syrian hacker sentenced for Assad regime cyber conspiracy
Ahmad Umar Agha, also known as Th3Pr0, has been sentenced by a federal district court in the Eastern District of Virginia to 42 months’ imprisonment for his central role in a wide-ranging hacking conspiracy conducted…
wordpress-1685287-6764806.cloudwaysapps.com
- Contractor connected personal AI agent to secure Pentagon system
A defence contractor connected a personal AI agent to a secure Department of Defense system, according to WIRED’s reporting cited by DataBreaches[.]net. The AI in question was Anthropic’s Claude Code, and it was used…
wordpress-1685287-6764806.cloudwaysapps.com
- BYOD hackers apologise after disrupting UNM hospital systems
Hackers identifying themselves as the BYOD group attacked the University of New Mexico (UNM) health-system, including UNM Hospital (UNMH), earlier this week, according to a report cycle cited by DataBreaches. The…
wordpress-1685287-6764806.cloudwaysapps.com
- HHS settles HIPAA ransomware investigation with Lehigh Valley
The US Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced a settlement with Lehigh Valley Health Network (LVHN) and its affiliated entities over potential HIPAA Privacy, Security…
wordpress-1685287-6764806.cloudwaysapps.com
- Liverpool hospital investigates staff access to Southport attack records
A second hospital in Liverpool has begun an investigation into two potential instances of staff accessing medical records linked to the Southport terror attack, according to ITV. The cases were identified at Liverpool…
wordpress-1685287-6764806.cloudwaysapps.com
- CSX breach exposes personal information of 40,000 employees
CSX, one of the United States’ largest transportation companies, disclosed a cybersecurity incident that granted unauthorised access to certain information, including employee data such as Social Security numbers. The…
wordpress-1685287-6764806.cloudwaysapps.com
- Binance details how fake job interviews enabled a $6.34B hack
Binance has detailed how a multi-stage cyber operation in October 2026 enabled attackers to siphon about $6.34 billion in digital assets, using fake recruitment interviews, malware downloads, compromised developer…
Security Affairs
- How North Korea is laundering $6.4 billion stolen from Binance
Binance says the theft followed a months-long campaign: a trojanised Homebrew installer in June, a fake job interview in September and abuse of an internal AI tool. Analysts say software is laundering the funds around…
CyberSIXT
- mSecure Warns Users to Reset Passwords After Suspicious Activity
mSecure users are being asked to take precautionary steps after a communication from the company’s developer, mSeven Software, on 3 November 2026 warning of “suspicious activity” connected to the app. The notice does…
The Hacker News
- Chainstack Breach Exposes Customer Data and Password Hashes
Chainstack said it was targeted in a cyber attack that granted an unauthorised party access to parts of its infrastructure, with intrusion stemming from a third‑party component. The company’s timeline shows the…
The Hacker News
- Microsoft details fake installer campaign delivering monetisation payloads
Microsoft Threat Intelligence has detailed a four-stage fake-download campaign that uses trojanised Inno Setup-style installers to deliver monetisation payloads. The operation targets users seeking cracked commercial…
Microsoft
- Google dismantles botnet infecting 1.3 million Android TV boxes
Google’s Threat Intelligence Group says it has disrupted x[.]cpe, a botnet that reached more than 1.3 million Google-certified Android TV devices. Trend Micro counted 1,472,554 infected devices. Most were in Brazil,…
Ars Technica
- Microsoft named Gartner Leader for AI agent management platforms
Microsoft has been named a Leader in the inaugural Gartner Magic Quadrant for AI Agent Management Platforms, published on 27 October 2026 with the report dated 27 October 2026 and referenced by Microsoft on 3 November…
Microsoft
- Binance Details How Fake Interviews Led to $6.43 Billion Theft
Binance has disclosed that the record-breaking loss of about $6.43 billion in assets resulted from a multi-stage campaign rather than a single breach. The company describes the attack as a supply-chain and…
The Hacker News
- Synology warns ransomware operators are targeting outdated NAS devices
Synology has issued a warning that ransomware operators are targeting NAS devices running outdated DSM software, exploiting a 2024 vulnerability that the vendor had already addressed by December 2024. The company says…
Security AffairsCVE-2024-10441
- Kaspersky finds BlackX bootkit bypassing Secure Boot on Windows
Kaspersky has identified organisations infected with BlackX, a UEFI bootkit that can bypass Secure Boot on Windows machines despite the systems having Microsoft’s relevant updates installed. BlackX exploits…
Ars TechnicaCVE-2022-21894
- Barracuda flaws can be chained to gain root access
Barracuda has disclosed two vulnerabilities in its products that, if chained together, could bypass authorisation and grant root access to a compromised device. The issues are CVE-2026-116606, a pre-authentication…
The Hacker NewsCVE-2026-116606
- Google reports LLMjacking attacks driving cloud bills to $1 million
Google has warned that attackers are hijacking enterprise access to Large Language Models (LLMs) to drain cloud resources and services, creating fraudulently large computing charges. In a report shared with The Hacker…
The Hacker NewsCVE-2026-40217
- Dark Reading outlines nine ways to navigate modern cyber threats
Dark Reading’s 9 Cyber Awareness Tips, published on 3 November 2026, map practical risk-reducing behaviours to how today’s attacks actually unfold. The piece argues that threats stem from everyday actions and trusted…
Dark Reading
- Google Details Criminal Enterprise Reselling Stolen LLM Access
Cybercriminals have established a thriving business model around stealing access to commercial LLMs and reselling it, with victims incurring resource costs up to around $1 million before access is revoked. The…
Dark Reading
- Hijacked cPGuard updates backdoor Linux servers and steal data
An attacker compromised the update system for the cPGuard security tool, breaching credentials at 02:06 UTC on 2 November 2026 and distributing a malicious script to Linux servers running cPGuard versions 5.88.12…
The Hacker News
- Apple warns people in 99 countries of spyware targeting
Apple has warned targeted individuals in 99 countries about a sophisticated mercenary spyware campaign aimed at iPhone users, with researchers confirming the legitimacy of the alerts but noting that initial forensic…
SecurityOnlineCVE-2026-59769
- Frontline Education Breach Exposes Data of Over 1.3 Million
Frontline Education says attackers exploited a vulnerability in a third-party software product to gain unauthorised access to its environment on 14 August. The company says it fixed the security flaw, strengthened…
SecurityWeek
- BTCPay Server flaw exploited to steal $1.63m in crypto
Hackers have stolen cryptocurrency from hot wallets on outdated BTCPay Server instances, with blockchain analysis tracing about $1.63m in Bitcoin and Litecoin to addresses linked to the thefts. BTCPay Server said in an…
Infosecurity
- CrowdStrike agrees to buy Fiddler AI and Dreadnode
CrowdStrike has agreed to acquire AI monitoring company Fiddler AI and AI security testing firm Dreadnode. The companies have not disclosed the terms; The Wall Street Journal reported a combined price of about US$495…
SecurityWeek
- Google links Videostrong to backdoor in 1.3 million TV boxes
Google’s Threat Intelligence Group (GTIG) says it has high confidence that Android device maker Videostrong Technology built and operated the x[.]cpe backdoor for financial gain, infecting 1.3 million certified Android…
Malwarebytes
- Bitdefender links 3AM attack on UK school to AI-like loops
Bitdefender says a 3AM ransomware affiliate attacked a school in the UK, stealing backup credentials, creating rogue domain-admin accounts and linking previously separate Active Directory domains. The attackers used…
Dark Reading
- Cloudflare launches Zero Wire vulnerability intelligence feed
Cloudflare has launched Zero Wire, a public vulnerability intelligence feed within Cloudflare Radar. The company says the service is intended to help security teams assess significant vulnerabilities in Internet-facing…
Cloudflare
- Check Point finds prompt adware in Codex jailbreak bundle
Check Point Research says it found Haiou, a Chinese-language jailbreak bundle for OpenAI Codex, on a misconfigured web server used by a threat actor operating Cobalt Strike. The server’s logs showed the actor…
Check Point
- Cyberattacks Disrupt Supermarket Refrigeration Across Europe
Supermarkets in at least nine European countries reported cyber incidents affecting refrigeration systems on 1 November 2026, with food stocks destroyed or removed from sale. Retailers in Belgium, Estonia, Finland,…
Infosecurity
- CVSS 9.8 Linux flaw lets attackers take root on Go servers by default
Red Hat and Ubuntu have fixed kernels out or in testing, and Marcus Hutchins says threat actors appear to be scanning for the up to 2.1 million exposed servers.
CyberSIXTCVE-2026-98432
CVEs in the news16
Named in the last 24 hours and not in CISA KEV, most covered first
CVE-2026-40217BerriAI LiteLLM
2 articles today · Mandiant links UNC6993 to costly enterprise LLM hijacking
8.8High16% EPSS · 4 articlesCVE-2026-107441Zyxel GS1900-24E firmware
2 articles today · Zyxel's patch missed the switch flaw attackers were exploiting
8.8High0.3% EPSS · 2 articlesCVE-2026-58868Google Android
2 articles today · Android flaw could let attackers run code without interaction
Not scored0.2% EPSS · 4 articlesCVE-2026-28336SolarWinds Dameware
SolarWinds patches critical command injection flaw in Dameware
9.9Critical1 articleCVE-2026-95731Hewlett Packard Enterprise (HPE) Fabric Composer
HPE fixes 46 Fabric Composer flaws, including a critical password bug
9.8Critical1 articleCVE-2024-10441Synology DiskStation Manager (DSM)
Synology warns ransomware operators are targeting outdated NAS devices
9.8Critical1.3% EPSS · 3 articlesCVE-2026-98432Linux Linux
CVSS 9.8 Linux flaw lets attackers take root on Go servers by default
9.8Critical0.8% EPSS · 10 articlesCVE-2026-121156Google Chrome
Google Chrome 157 fixes 213 flaws, including seven critical bugs
9.6Critical1 articleCVE-2026-115731Perforce Puppet Enterprise
PoC exposes critical remote code flaw in Puppet Server
9.4Critical1 articleCVE-2026-116606Barracuda Networks Barracuda Email Security Gateway (ESG)
Barracuda flaws can be chained to gain root access
9.3Critical0.7% EPSS · 2 articlesCVE-2026-94290SUSE Rancher
SUSE patches critical Rancher Fleet flaw enabling cluster takeover
9.1Critical0.5% EPSS · 1 articleCVE-2026-109593SonicWall Global Management System (GMS)
SonicWall discloses two unpatched GMS vulnerabilities
9.1Critical1 articleCVE-2026-59769FURUNO ELECTRIC CO., LTD. FA-50
Apple warns people in 99 countries of spyware targeting
9.1Critical0.6% EPSS · 2 articlesCVE-2022-21894Microsoft Windows 10 Version 1809
Kaspersky finds BlackX bootkit bypassing Secure Boot on Windows
4.4Medium8.6% EPSS · 3 articlesCVE-2026-112445Vendor not yet named
Researcher discloses macOS root exploit for CVE-2026-112445
Not scored1 articleCVE-2026-16305INFINITT Healthcare System Manager
CERT/CC discloses two critical flaws in INFINITT PACS
Not scored0.3% EPSS · 1 article
Developing stories6
Two or more articles in the last 24 hours; each bead is an article
- Threat actorTraderTraitorDevelopinglatest 2 hours ago3 articles2 outlets
- Tue 3 Nov, 18:49 UTC. CyberSIXT, first report. How North Korea is laundering $6.4 billion stolen from Binance.
- Wed 4 Nov, 09:23 UTC. SecurityWeek, its first report on the story. North Korea protests US claims linking hackers to Binance heist.
- Wed 4 Nov, 10:36 UTC. SecurityWeek. Binance details $6.34 billion theft linked to North Korean group.
- In CISA KEVCVECVE-2026-119977WordPress CoreDevelopinglatest 4 hours ago3 articles3 outlets
- Tue 3 Nov, 20:31 UTC. CISA, first report. CISA Flags Exploited WordPress Flaw Allowing Unauthenticated Code Execution. Cites a CVE in CISA KEV.
- Wed 4 Nov, 05:43 UTC. The Hacker News, its first report on the story. CISA Confirms Active Exploitation of WordPress Core Flaw. Cites a CVE in CISA KEV.
- Wed 4 Nov, 09:16 UTC. Security Affairs, its first report on the story. CISA adds actively exploited WordPress flaw to KEV catalog. Cites a CVE in CISA KEV.
- Threat actor3AMDevelopinglatest 49 minutes ago2 articles2 outlets
- Tue 3 Nov, 14:00 UTC. Dark Reading, first report. Bitdefender links 3AM attack on UK school to AI-like loops.
- Wed 4 Nov, 12:00 UTC. Infosecurity, its first report on the story. Bitdefender links 3AM ransomware to AI assisted school attack.
- CVECVE-2026-58868Google AndroidDevelopinglatest 2 hours ago2 articles2 outlets
- Wed 4 Nov, 07:46 UTC. The Hacker News, first report. Google patches Android flaw enabling remote code execution.
- Wed 4 Nov, 10:26 UTC. Security Affairs, its first report on the story. Android flaw could let attackers run code without interaction.
- CVECVE-2026-40217BerriAI LiteLLMDevelopinglatest 5 hours ago2 articles2 outlets
- Tue 3 Nov, 15:41 UTC. The Hacker News, first report. Google reports LLMjacking attacks driving cloud bills to $1 million.
- Wed 4 Nov, 08:01 UTC. SecurityOnline, its first report on the story. Mandiant links UNC6993 to costly enterprise LLM hijacking.
- CVECVE-2026-107441Zyxel GS1900-24E firmwareDevelopinglatest 8 hours ago2 articles2 outlets
- Wed 4 Nov, 01:40 UTC. SecurityOnline, first report. Binarly warns of exploited Zyxel GS1900 switch zero day.
- Wed 4 Nov, 04:52 UTC. CyberSIXT, its first report on the story. Zyxel's patch missed the switch flaw attackers were exploiting.