Mon 2 Nov · updated 17:30 UTC
Today in security
Today’s briefing
Updated 16:43 UTC
Apple warns German MPs and ministers of mercenary spyware
5 updates since 07:00 · latest 16:43 UTC
Members of the Bundestag and federal government received Apple threat notifications from 29 October. Germany's BSI told them to assume their iPhones may be compromised; nobody has said who is behind the attacks or how many people were targeted.
- Brazil's Mercado Bitcoin halts withdrawals after security incident
- Refrigeration attacks reach Irish and Estonian supermarkets
- Danfoss says default passwords exposed attacked Dutch cooling systems
- Supermarket refrigeration fails across three countries
- 07:00 edition: BTCPay Server links hot-wallet thefts to older releases
Known exploited6
CISA KEV entries named in the last 48 hours of coverage, by federal deadline
- In CISA KEV
Ivanti Connect SecureCVE-2026-111357
Federal deadline 2 Nov · In CISA KEV since 30 Oct
7.0High0.5% EPSS8 articles
- In CISA KEV
Google BrotliCVE-2026-111497
Federal deadline 10 Nov · In CISA KEV since 27 Oct
9.2Critical83% EPSS21 articles
- In CISA KEV
Ivanti Connect SecureCVE-2026-118527
Federal deadline 13 Nov · In CISA KEV since 30 Oct
Not scored8 articles
- In CISA KEV
Cisco Secure Firewall Adaptive Security Appliance (ASA) SoftwareCVE-2026-76418
Federal deadline passed 1 Nov · In CISA KEV since 29 Oct
8.6High0.8% EPSS7 articles
Show 2 more · federal deadlines passed
- In CISA KEV
BeyondTrust Remote SupportCVE-2026-102764
Federal deadline passed 19 Oct · In CISA KEV since 16 Oct
9.3Critical19% EPSS13 articles
- In CISA KEV
Ivanti Connect SecureCVE-2026-104935
Federal deadline passed 16 Oct · In CISA KEV since 13 Oct
8.6High87% EPSS21 articles
Latest news61
The last 24 hours, newest first; stories about known exploited CVEs are above
Latest story at 16:43 UTC. Red diamonds mark the 5 stories about exploited CVEs.
- 16:43 UTC. Apple warns German MPs and ministers of mercenary spyware attacks. 1 outlet.
- 15:34 UTC. Google and police dismantle Videostrong Android TV botnet. 1 outlet.
- 15:01 UTC. SecurityWeek reports 37 cybersecurity deals announced in October. 1 outlet.
- 15:00 UTC. Freezer tampering disrupts supermarkets across Northern Europe. 1 outlet.
- 15:00 UTC. Microsoft’s AI risk report overlooks flaws exposing government targets. 1 outlet.
- 14:52 UTC. Brazil's Mercado Bitcoin halts withdrawals after $40 million drain. 1 outlet.
- 14:49 UTC. Barracuda fixes flaws that could give attackers appliance root access. 1 outlet.
- 14:46 UTC. DarkBlinders targets Israeli and Iraqi Kurdish government systems. 1 outlet.
- 14:45 UTC. Armadin Tests Find 88% of Severe Flaws Outside Vendor Advisories. 1 outlet.
- 14:44 UTC. Florida aid website breach may expose data of 4.9 million people. 1 outlet.
- 14:24 UTC. Malwarebytes exposes underground trade in fake online reviews. 1 outlet.
- 14:22 UTC. Applebee’s fixes app flaw that exposed customer data. 1 outlet.
- 14:05 UTC. Guardz integrates Palo Alto browser security for small businesses. 1 outlet.
- 14:00 UTC. FortiGuard links PapRAT espionage campaign to Bitter in Asia. 2 outlets.
- 14:00 UTC. Google reports attackers running up $1 million LLM bills. 1 outlet.
- 13:35 UTC. Revolve Says Data Breach Exposed Information of 180,000 Customers. 1 outlet.
- 13:30 UTC. Google disrupts XCPE botnet infecting 1.3 million devices. 2 outlets.
- 13:25 UTC. Supermarket freezer attacks spread to Belgium and Sweden. 1 outlet.
- 13:25 UTC. Google offers $250,000 for cloud takeover vulnerabilities. 1 outlet.
- 12:53 UTC. Suspected cyberattack hits store fridges in seven European countries. 1 outlet.
- 12:09 UTC. Cyberattacks disrupt supermarket refrigeration across Europe. 1 outlet.
- 11:50 UTC. Critical Langflow flaws expose servers to unauthenticated attacks. 1 outlet.
- 11:37 UTC. OpenAI tightens ChatGPT violence rules and teen safeguards. 1 outlet.
- 11:30 UTC. Prophet Security survey finds AI use rising in SOCs. 1 outlet.
- 11:29 UTC. Malicious Claude Code extension targets Cursor users in supply chain attack. 1 outlet.
- 11:17 UTC. UTA0576 Chains Three Ivanti Flaws to Gain Root Access. 1 outlet. About an exploited CVE.
- 11:08 UTC. Attackers Use Teams Helpdesk Impersonation to Abuse AD CS. 1 outlet.
- 10:53 UTC. Hackers slip seed phrase stealer into Solana Mobile app store. 1 outlet.
- 10:49 UTC. AI Driven Campaign Targets Government Linux Servers. 1 outlet.
- 10:43 UTC. SOCRadar reports claims of leaks targeting firms and military. 1 outlet.
- 10:27 UTC. Chainalysis discloses breach after AI driven cyberattack. 1 outlet.
- 10:20 UTC. Hackers Send Fake Nuclear Alerts Through Ukraine and Russia Apps. 1 outlet.
- 09:33 UTC. Polymarket to refund traders after DNS hijack attack. 1 outlet.
- 09:30 UTC. Chainalysis says external actor accessed customer data. 1 outlet.
- 09:09 UTC. Amadeus breach exposes passenger records across global airlines. 1 outlet.
- 08:59 UTC. Tech firms back robots.txt standard for AI training controls. 1 outlet.
- 08:44 UTC. MediaTek patches 57 flaws, including six critical modem bugs. 1 outlet.
- 08:40 UTC. FBI Links North Korea’s TraderTraitor to Binance Heist. 2 outlets.
- 08:25 UTC. Chainalysis investigates AI-powered intrusion exposing user data. 1 outlet.
- 08:09 UTC. Cisco Talos finds NIK C2 using OpenAI in live attacks. 1 outlet.
- 08:01 UTC. Malwarebytes roundup highlights a week of security stories. 1 outlet.
- 08:00 UTC. Kaspersky finds AI guided CyberStrikeAI attacks on schools. 1 outlet.
- 07:57 UTC. Volexity links Ivanti Connect Secure zero days to UTA0576. 2 outlets. About an exploited CVE.
- 07:07 UTC. North Korean groups use AI to accelerate cyber operations. 1 outlet.
- 06:23 UTC. CloudSEK uncovers Rust botnet targeting IoT and enterprise systems. 1 outlet.
- 05:51 UTC. VOLTA infostealer uses AI to rank victims by financial value. 1 outlet.
- 04:52 UTC. Hackers drain BTCPay hot wallets on servers left unpatched since July. 1 outlet.
- 02:53 UTC. Russian emergency app hit with fake nuclear alert after Ukraine hack. 1 outlet.
- 02:33 UTC. Google researchers disclose Linux kernel privilege escalation PoC. 1 outlet.
- 02:16 UTC. FreePBX maintainers patch two critical User Manager flaws. 1 outlet.
- 02:05 UTC. AI Agents Turn Spoken Design Prompts Into Physical Hardware. 1 outlet.
- 02:03 UTC. Apache Wicket fixes 19 flaws across three supported releases. 1 outlet.
- 02:00 UTC. Volexity reports Ivanti flaws exploited in the wild. 1 outlet.
- 01:39 UTC. Weekly report flags exploited flaws absent from CISA KEV. 1 outlet. About an exploited CVE.
- 01:33 UTC. Brotli flaw prompts updates across runtimes and software. 1 outlet. About an exploited CVE.
- 01:00 UTC. pgAdmin 4 fixes 15 flaws, including a critical command injection. 1 outlet.
- 00:45 UTC. Dell fixes 44 PowerStore flaws, seven rated CVSS 9.8. 1 outlet.
- 00:31 UTC. Ransomware targets unpatched Synology NAS devices. 1 outlet.
- 00:30 UTC. LXD flaw lets attackers impersonate trusted TLS clients. 1 outlet.
- 00:03 UTC. Hackers hijack Ukraine's Air Alert app to send fake nuclear alerts. 1 outlet.
- 00:00 UTC. Rapid7 details BeyondTrust flaw exploited for code execution. 1 outlet. About an exploited CVE.
- 21:23 UTC. CVSS 9.8 Linux flaw lets attackers take root on Go servers by default. 2 outlets.
- Known exploited CVE
- CVE not in KEV
- Other story
- Size: outlets on the story
- Stories an hour
Show as tableHide table
| Time (UTC) | Story | Outlets | Type |
|---|---|---|---|
| 16:43 | Apple warns German MPs and ministers of mercenary spyware attacks | 1 | Other |
| 15:34 | Google and police dismantle Videostrong Android TV botnet | 1 | Other |
| 15:01 | SecurityWeek reports 37 cybersecurity deals announced in October | 1 | Other |
| 15:00 | Freezer tampering disrupts supermarkets across Northern Europe | 1 | Other |
| 15:00 | Microsoft’s AI risk report overlooks flaws exposing government targets | 1 | Other |
| 14:52 | Brazil's Mercado Bitcoin halts withdrawals after $40 million drain | 1 | Other |
| 14:49 | Barracuda fixes flaws that could give attackers appliance root access | 1 | CVE |
| 14:46 | DarkBlinders targets Israeli and Iraqi Kurdish government systems | 1 | Other |
| 14:45 | Armadin Tests Find 88% of Severe Flaws Outside Vendor Advisories | 1 | Other |
| 14:44 | Florida aid website breach may expose data of 4.9 million people | 1 | Other |
| 14:24 | Malwarebytes exposes underground trade in fake online reviews | 1 | Other |
| 14:22 | Applebee’s fixes app flaw that exposed customer data | 1 | Other |
| 14:05 | Guardz integrates Palo Alto browser security for small businesses | 1 | Other |
| 14:00 | FortiGuard links PapRAT espionage campaign to Bitter in Asia | 2 | Other |
| 14:00 | Google reports attackers running up $1 million LLM bills | 1 | CVE |
| 13:35 | Revolve Says Data Breach Exposed Information of 180,000 Customers | 1 | Other |
| 13:30 | Google disrupts XCPE botnet infecting 1.3 million devices | 2 | Other |
| 13:25 | Supermarket freezer attacks spread to Belgium and Sweden | 1 | Other |
| 13:25 | Google offers $250,000 for cloud takeover vulnerabilities | 1 | Other |
| 12:53 | Suspected cyberattack hits store fridges in seven European countries | 1 | Other |
| 12:09 | Cyberattacks disrupt supermarket refrigeration across Europe | 1 | Other |
| 11:50 | Critical Langflow flaws expose servers to unauthenticated attacks | 1 | CVE |
| 11:37 | OpenAI tightens ChatGPT violence rules and teen safeguards | 1 | Other |
| 11:30 | Prophet Security survey finds AI use rising in SOCs | 1 | Other |
| 11:29 | Malicious Claude Code extension targets Cursor users in supply chain attack | 1 | Other |
| 11:17 | UTA0576 Chains Three Ivanti Flaws to Gain Root Access | 1 | Known exploited |
| 11:08 | Attackers Use Teams Helpdesk Impersonation to Abuse AD CS | 1 | Other |
| 10:53 | Hackers slip seed phrase stealer into Solana Mobile app store | 1 | Other |
| 10:49 | AI Driven Campaign Targets Government Linux Servers | 1 | Other |
| 10:43 | SOCRadar reports claims of leaks targeting firms and military | 1 | Other |
| 10:27 | Chainalysis discloses breach after AI driven cyberattack | 1 | Other |
| 10:20 | Hackers Send Fake Nuclear Alerts Through Ukraine and Russia Apps | 1 | Other |
| 09:33 | Polymarket to refund traders after DNS hijack attack | 1 | Other |
| 09:30 | Chainalysis says external actor accessed customer data | 1 | Other |
| 09:09 | Amadeus breach exposes passenger records across global airlines | 1 | Other |
| 08:59 | Tech firms back robots.txt standard for AI training controls | 1 | CVE |
| 08:44 | MediaTek patches 57 flaws, including six critical modem bugs | 1 | CVE |
| 08:40 | FBI Links North Korea’s TraderTraitor to Binance Heist | 2 | Other |
| 08:25 | Chainalysis investigates AI-powered intrusion exposing user data | 1 | Other |
| 08:09 | Cisco Talos finds NIK C2 using OpenAI in live attacks | 1 | Other |
| 08:01 | Malwarebytes roundup highlights a week of security stories | 1 | Other |
| 08:00 | Kaspersky finds AI guided CyberStrikeAI attacks on schools | 1 | Other |
| 07:57 | Volexity links Ivanti Connect Secure zero days to UTA0576 | 2 | Known exploited |
| 07:07 | North Korean groups use AI to accelerate cyber operations | 1 | Other |
| 06:23 | CloudSEK uncovers Rust botnet targeting IoT and enterprise systems | 1 | Other |
| 05:51 | VOLTA infostealer uses AI to rank victims by financial value | 1 | Other |
| 04:52 | Hackers drain BTCPay hot wallets on servers left unpatched since July | 1 | Other |
| 02:53 | Russian emergency app hit with fake nuclear alert after Ukraine hack | 1 | Other |
| 02:33 | Google researchers disclose Linux kernel privilege escalation PoC | 1 | CVE |
| 02:16 | FreePBX maintainers patch two critical User Manager flaws | 1 | Other |
| 02:05 | AI Agents Turn Spoken Design Prompts Into Physical Hardware | 1 | Other |
| 02:03 | Apache Wicket fixes 19 flaws across three supported releases | 1 | CVE |
| 02:00 | Volexity reports Ivanti flaws exploited in the wild | 1 | Other |
| 01:39 | Weekly report flags exploited flaws absent from CISA KEV | 1 | Known exploited |
| 01:33 | Brotli flaw prompts updates across runtimes and software | 1 | Known exploited |
| 01:00 | pgAdmin 4 fixes 15 flaws, including a critical command injection | 1 | CVE |
| 00:45 | Dell fixes 44 PowerStore flaws, seven rated CVSS 9.8 | 1 | CVE |
| 00:31 | Ransomware targets unpatched Synology NAS devices | 1 | CVE |
| 00:30 | LXD flaw lets attackers impersonate trusted TLS clients | 1 | CVE |
| 00:03 | Hackers hijack Ukraine's Air Alert app to send fake nuclear alerts | 1 | Other |
| 00:00 | Rapid7 details BeyondTrust flaw exploited for code execution | 1 | Known exploited |
| 21:23 | CVSS 9.8 Linux flaw lets attackers take root on Go servers by default | 2 | CVE |
- Apple warns German MPs and ministers of mercenary spyware attacks
Germany's cyber agency has told Bundestag members and government officials who got Apple threat notifications to treat their iPhones as compromised. Nobody has said who sent the spyware or how many people were targeted.
CyberSIXT
- Google disrupts botnet infecting 1.3 million Android devices
Google says a botnet of more than 1.3 million Android devices, predominantly Android TV box models, was disrupted in late October by a takedown led by Google. The firm states videostrong, a Shenzhen-based maker of…
The Hacker News
- Google and police dismantle Videostrong Android TV botnet
Google and international law enforcement have dismantled the Videostrong XCPE botnet, which enrolled more than 1.3 million Android TV devices, telehealth monitors, karaoke consoles and digital signs into a covert…
SecurityOnline
- SecurityWeek reports 37 cybersecurity deals announced in October
SecurityWeek reports that 37 cybersecurity merger and acquisition deals were announced in October 2026. Among the headline transactions, Absolute Security agreed to acquire FirmGuard, the UEFI BIOS firmware security…
SecurityWeek
- Freezer tampering disrupts supermarkets across Northern Europe
A spate of supermarket freezer temperature spikes swept Northern Europe, with refrigeration units reportedly set to fifty degrees Celsius overnight. The incident, first noted on the morning of 2 November 2026, affected…
SecurityOnline
- Microsoft’s AI risk report overlooks flaws exposing government targets
Dark Reading reports that Microsoft’s 2026 Digital Defense Report identifies government agencies and services as prime targets for AI-enabled cyber threats, noting the emphasis on nation-state activity. However, the…
Dark Reading
- Brazil's Mercado Bitcoin halts withdrawals after $40 million drain
Brazil's largest crypto exchange says it contained a security incident and customers will not lose money. Hypernative counted more than $40 million leaving its wallets across ten blockchains; how the transfers were…
CyberSIXT
- SANS details detection of Linux Multipath TCP vulnerability
An ISC diary entry by Johannes Ullrich, published and updated on 2 November 2026, reports a new vulnerability in Linux’s implementation of Multipath TCP (MPTCP) tied to RFC 8684 and CVE-2026-98432. The note stresses…
SANS ISCCVE-2026-98432
- Barracuda fixes flaws that could give attackers appliance root access
Barracuda Networks released security fixes on 2 November 2026 addressing two high-risk vulnerabilities across multiple Barracuda ESG and related appliance products. When chained, the flaws could enable an attacker to…
SecurityOnlineCVE-2026-116606
- DarkBlinders targets Israeli and Iraqi Kurdish government systems
Cybersecurity researchers have disclosed a state‑aligned Iranian threat group operation, DarkBlinders, targeting an Israeli individual and a Kurdistan Region government cloud environment between August and October…
The Hacker News
- Armadin Tests Find 88% of Severe Flaws Outside Vendor Advisories
Armadin, the offensive security startup founded by Mandiant’s Kevin Mandia, has published data from live attack tests showing that 88% of critical and high-severity weaknesses would not have been caught by vendor…
Infosecurity
- Florida aid website breach may expose data of 4.9 million people
The Florida Department of Education (FLDOE) has disclosed that hackers breached its FloridaStudentFinancialAidSG[.]org site, the online hub for state-funded scholarships and grants, potentially exposing personal data…
SecurityWeek
- Malwarebytes exposes underground trade in fake online reviews
Malwarebytes researchers inspected cybercrime forums where operators offer reputation management services, including flooding products with five-star reviews or removing negative feedback. In one instance, a seller…
Malwarebytes
- Applebee’s fixes app flaw that exposed customer data
Applebee’s has fixed a security flaw that exposed customers’ personal information after a researcher discovered a database password embedded in the restaurant chain’s Android app. The researcher, Robert Wiggins, found…
Malwarebytes
- Guardz integrates Palo Alto browser security for small businesses
Guardz, the MSP‑focussed Agentic Workspace Security platform, today announced the integration of Palo Alto Networks Prisma Browser for Business. The collaboration links Prisma Browser’s protection with Guardz’s broader…
SecurityOnline
- FortiGuard links PapRAT espionage campaign to Bitter in Asia
A South Asian cyber-espionage group, tracked as Bitter (TA397) and observed by FortiGuard Labs, has been seen deploying a custom remote access Trojan named PapRAT alongside native Windows tools to maintain access to…
Infosecurity
- Fortinet details BITTER’s expanding PapRAT attacks in South Asia
Fortinet’s FortiGuard Labs researchers report that the India-linked cyber espionage group BITTER (also known as TA397) is targeting organisations across South Asia with attacks designed to compromise Windows systems,…
Dark Reading
- Google reports attackers running up $1 million LLM bills
Google Threat Intelligence Group (GTIG) says it investigated multiple “LLMJacking” incidents in 2026, in which attackers hijacked organisations’ access to cloud-based large language models (LLMs). The affected…
Google CloudCVE-2026-40217
- Revolve Says Data Breach Exposed Information of 180,000 Customers
Online fashion retailer Revolve has disclosed a data breach that exposed personal and payment card information for at least 180,000 customers. The incident occurred on 11 September and involved unauthorised access to…
SecurityWeek
- Google disrupts XCPE botnet infecting 1.3 million devices
Google and industry partners have disrupted the XCPE backdoor and botnet, which Google says had enrolled more than 1.3 million devices. Google Threat Intelligence Group assesses with high confidence that Android device…
Google Cloud
- Supermarket freezer attacks spread to Belgium and Sweden
Supermarket freezer attacks have spread from France to Belgium, Luxembourg and Sweden, with overnight incidents on 1–2 November 2026 causing sudden temperature rises in dozens of store refrigeration systems. In Belgium…
SOCRadar
- Google offers $250,000 for cloud takeover vulnerabilities
Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward of $250,000 for security weaknesses that could grant full administrative control over Google Cloud organisations or projects.…
SecurityWeek
- Suspected cyberattack hits store fridges in seven European countries
Refrigeration maker Danfoss says at least 17 Dutch businesses were attacked through systems left on unsecured networks with default passwords, as stores in Sweden, Belgium, Luxembourg, Finland, Ireland and Estonia…
CyberSIXT
- Cyberattacks disrupt supermarket refrigeration across Europe
A new wave of fridge cyberattacks has affected supermarket refrigeration systems across several European countries, with Belgian and Luxembourg stores joining incidents already seen in Sweden and Estonia. The owners…
Security Affairs
- Critical Langflow flaws expose servers to unauthenticated attacks
Two critical flaws in Langflow, the open‑source tool for building AI agents and workflows, could allow unauthenticated remote attackers to bypass authentication or execute arbitrary code on Langflow servers. IBM’s…
The Hacker NewsCVE-2026-93680
- OpenAI tightens ChatGPT violence rules and teen safeguards
OpenAI has announced tightened ChatGPT violence restrictions aimed at curbing harmful conversations across its global user base. Over the coming weeks, the platform will actively terminate dialogues fixated on severe…
SecurityOnline
- Prophet Security survey finds AI use rising in SOCs
Prophet Security’s State of AI in Security Operations 2026 reports that 40% of security teams now use AI daily and a further 56% are testing it, based on a survey of more than 250 CISOs, SOC leaders and practitioners.…
The Hacker News
- Malicious Claude Code extension targets Cursor users in supply chain attack
Cursor users were targeted by a malicious, tampered copy of Anthropic’s Claude Code extension in a supply chain incident believed to have been carried out by abusing Cursor’s marketplace. The tainted extensions,…
SecurityWeek
- Attackers Use Teams Helpdesk Impersonation to Abuse AD CS
Attackers impersonated an organisation’s IT or helpdesk on Microsoft Teams, persuading staff to share remote control via Quick Assist and thereby gain hands-on access to workstations. Microsoft described two intrusions…
The Hacker News
- Hackers slip seed phrase stealer into Solana Mobile app store
A fake "SKR Claim" app that asked for wallet seed phrases sat in the Solana dApp Store's spotlight for an hour after someone broke into the store's publishing portal. Solana Mobile patched a bug that let the store link…
CyberSIXT
- AI Driven Campaign Targets Government Linux Servers
Cybersecurity researchers have detailed a cyber espionage campaign targeting government Linux infrastructure, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026 and tracked under the name…
The Hacker News
- SOCRadar reports claims of leaks targeting firms and military
SOCRadar’s Dark Web Team reported a string of posts claiming disparate data exposures and access offerings. The most explicit claim concerns a “Pataya Food” 500GB data leak, attributed to an actor using the alias…
SOCRadar
- Chainalysis discloses breach after AI driven cyberattack
Chainalysis has disclosed a data breach following an AI-driven cyberattack in October 2026, with the company stating that an external actor used offensive agentic techniques to gain unauthorised access to its systems…
SecurityWeek
- Hackers Send Fake Nuclear Alerts Through Ukraine and Russia Apps
Hackers hit Ukraine’s and Russia’s emergency alert apps, sending fake nuclear and attack warnings and raising public-safety concerns. Ukraine and Russia said on Sunday night that their emergency alert systems had been…
Security Affairs
- FBI links Binance crypto breach to North Korea’s TraderTraitor
The FBI attributes the Binance crypto exchange breach last week to North Korea’s TraderTraitor group, also known as Jade Sleet, UNC4899 and Slow Pisces. In a brief statement published on 31 October, the Bureau said…
Infosecurity
- Polymarket to refund traders after DNS hijack attack
Polymarket says it will return about $3.9 million to traders following a recent supply chain attack, with early findings from DebugBear attributing the incident to DNS hijacking of DebugBear’s own domain. Security week…
SecurityWeek
- Chainalysis says external actor accessed customer data
Chainalysis has disclosed a security incident in which an external actor employed “offensive agentic techniques” to gain unauthorised access to internal systems and tools. In a post dated 30 October 2026, the firm said…
Infosecurity
- Amadeus breach exposes passenger records across global airlines
A cyber incident has exposed passenger travel records across multiple international carriers via a compromise of Amadeus, a centralised travel distribution platform. Intruders gained unauthorised access using valid…
SecurityOnline
- Tech firms back robots.txt standard for AI training controls
Major technology firms have united behind a proposed AI training preference standard that publishers can declare in robots.txt files. Google, Microsoft, OpenAI, and Anthropic are backing the specification, which aims…
SecurityOnlineCVE-2026-20051
- MediaTek patches 57 flaws, including six critical modem bugs
MediaTek published its November 2026 product security bulletin, fixing 57 security flaws across multiple chipset architectures. The update covers six critical vulnerabilities in the cellular modem components that…
SecurityOnlineCVE-2026-20499
- FBI Links North Korea’s TraderTraitor to Binance Heist
The FBI has formally attributed the record Binance cryptocurrency heist to North Korea’s TraderTraitor group, with officials urging the crypto industry to help prevents the stolen funds from being laundered. The attack…
SecurityWeek
- Chainalysis investigates AI-powered intrusion exposing user data
Chainalysis says it was the target of a cyber security incident in October, with a threat actor gaining access to its systems and internal tools using what the company describes as offensive agentic techniques powered…
Security Affairs
- Cisco Talos finds NIK C2 using OpenAI in live attacks
Cisco Talos researchers have uncovered an active threat framework named NIK C2 that integrates a live OpenAI API client directly into compromised Windows hosts. The 64-bit Go-based implant harvests credentials, streams…
SecurityOnline
- Malwarebytes roundup highlights a week of security stories
Malwarebytes Labs’ weekly roundup for 26 October to 1 November 2026 lists stories published during the week, covering browser extensions, cryptocurrency theft, data breaches, software updates, scams and privacy. It…
Malwarebytes
- Kaspersky finds AI guided CyberStrikeAI attacks on schools
Kaspersky’s Cyber Threat Intelligence team uncovered a campaign in which a C2 agent framework controlled by an artificial intelligence orchestrator—CyberStrikeAI—was used to conduct post‑exploitation activities against…
securelist.com
- North Korean groups use AI to accelerate cyber operations
North Korean state-sponsored threat actors are increasingly embedding artificial intelligence into their cyber operations to speed up and scale attacks, Microsoft Threat Intelligence reports published in October 2026.…
SecurityOnline
- CloudSEK uncovers Rust botnet targeting IoT and enterprise systems
CloudSEK researchers uncovered in October 2026 a Rust-based doorway botnet operating across a broad IoT and enterprise target footprint, exposing 41 gigabytes of operational data from two open directories. The Rust…
SecurityOnline
- VOLTA infostealer uses AI to rank victims by financial value
Cybersecurity researchers have disclosed a new Windows infostealer, VOLTA-AUTODOXER (VOLTA), that embeds an AI-driven dossier capability to rank victims by monetisable value. The malware harvests a wide range of data…
The Hacker News
- Hackers drain BTCPay hot wallets on servers left unpatched since July
BTCPay Server says the hot wallet thefts hit instances running version 2.4.1 or older, released in July, and that it has no credible reports of drains on the current 2.4.7. Hosting providers shut older servers down.
CyberSIXT
- Russian emergency app hit with fake nuclear alert after Ukraine hack
Russia's Emergency Situations Ministry says hackers took over its mobile app and sent fake alerts, hours after Ukraine's Air Alert app was hijacked the same way. Both governments say their sirens kept working.
CyberSIXT
- Google researchers disclose Linux kernel privilege escalation PoC
Security researchers have publicly disclosed technical details and a working proof-of-concept (PoC) exploit for a high-severity Linux kernel vulnerability, tracked as CVE-2026-31419, with a CVSS v3.1 score of 7.8. The…
SecurityOnlineCVE-2026-31419
- FreePBX maintainers patch two critical User Manager flaws
SecurityOnline[.]info reports, in an item by Do Son dated 2 November 2026, that FreePBX maintainers released advisories addressing two critical flaws in the FreePBX User Manager module. The write-up notes that the…
SecurityOnline
- AI Agents Turn Spoken Design Prompts Into Physical Hardware
Vibe manufacturing AI is described as a growing trend where multimodal, reasoning-capable agents translate spoken design goals into complete, manufacturable hardware. The piece claims that conversational AI can…
SecurityOnline
- Apache Wicket fixes 19 flaws across three supported releases
SecurityOnline[.]info reports that Apache Wicket has disclosed 19 security flaws across the 8.20.0, 9.25.0 and 10.12.0 branches. Do Son, writing for the outlet, notes that nine of the flaws are rated high severity,…
SecurityOnlineCVE-2026-84170
- Volexity reports Ivanti flaws exploited in the wild
On 2 November 2026, SANS ISC details several security developments discussed in this edition of Stormcast. Didier’s OneNote attachment extractor has gained a new feature that saves all attachments from OneNote files…
SANS ISC
- pgAdmin 4 fixes 15 flaws, including a critical command injection
pgAdmin 4 has a new security update, with version 9.19 released on 29 October 2026 to remediate 15 critical vulnerabilities. The PostgreSQL project notes that these flaws could allow remote code execution and…
SecurityOnlineCVE-2026-116241
- Dell fixes 44 PowerStore flaws, seven rated CVSS 9.8
Dell has issued Dell PowerStore security updates to fix 44 vulnerabilities across PowerStore T platforms, with seven flaws scoring 9.8 on CVSS v3.1. Dell’s advisory, DSA-2026-479, states the most severe issues are in…
SecurityOnlineCVE-2026-116443
- Ransomware targets unpatched Synology NAS devices
SecurityOnline reports a ransomware campaign affecting Synology network-attached storage devices, with attackers encrypting data on storage volumes. It says internet-exposed devices running outdated software are the…
SecurityOnlineCVE-2024-10441
- LXD flaw lets attackers impersonate trusted TLS clients
Canonical has patched CVE-2026-112816, a critical mutual TLS authentication flaw in LXD and MicroCloud, rated 10.0 under CVSSv4. Canonical says an attacker able to reach the LXD HTTPS API could authenticate as a…
SecurityOnlineCVE-2026-112816
- Hackers hijack Ukraine's Air Alert app to send fake nuclear alerts
Ukraine's Air Alert app sent false radiation, chemical and street-fighting warnings to phones on Sunday night. Officials say the state siren network kept working, and the app has been taken offline.
CyberSIXT
- CVSS 9.8 Linux flaw lets attackers take root on Go servers by default
The Go Security Team says Go 1.24 and later listen on Multipath TCP by default on Linux, the setup Anthropic's root exploit for CVE-2026-98432 needs. RHEL and Ubuntu kernels are still unpatched.
CyberSIXTCVE-2026-98432
CVEs in the news12
Named in the last 24 hours and not in CISA KEV, most covered first
CVE-2026-98432Linux Linux
2 articles today · SANS details detection of Linux Multipath TCP vulnerability
9.8Critical0.5% EPSS · 6 articlesCVE-2026-112816Canonical LXD
LXD flaw lets attackers impersonate trusted TLS clients
10.0Critical0.3% EPSS · 2 articlesCVE-2026-116241pgadmin.org pgAdmin 4
pgAdmin 4 fixes 15 flaws, including a critical command injection
9.9Critical0.3% EPSS · 1 articleCVE-2026-93680IBM Langflow OSS
Critical Langflow flaws expose servers to unauthenticated attacks
9.8Critical2.2% EPSS · 1 articleCVE-2024-10441Synology DiskStation Manager (DSM)
Ransomware targets unpatched Synology NAS devices
9.8Critical1.3% EPSS · 1 articleCVE-2026-116606Barracuda Networks Barracuda Email Security Gateway (ESG)
Barracuda fixes flaws that could give attackers appliance root access
9.3Critical1 articleCVE-2026-40217BerriAI LiteLLM
Google reports attackers running up $1 million LLM bills
8.8High16% EPSS · 2 articlesCVE-2026-84170Apache Software Foundation Apache Wicket
Apache Wicket fixes 19 flaws across three supported releases
8.3High1 articleCVE-2026-31419Linux Linux
Google researchers disclose Linux kernel privilege escalation PoC
7.8High0.1% EPSS · 1 articleCVE-2026-20051Cisco Cisco NX-OS Software
Tech firms back robots.txt standard for AI training controls
7.4High0.2% EPSS · 1 articleCVE-2026-20499MediaTek, Inc. MediaTek chipset
MediaTek patches 57 flaws, including six critical modem bugs
Not scored1 articleCVE-2026-116443Vendor not yet named
Dell fixes 44 PowerStore flaws, seven rated CVSS 9.8
Not scored1 article
Developing stories4
Two or more articles in the last 24 hours; each bead is an article
- CVECVE-2026-98432LinuxDevelopinglatest 5 hours ago2 articles2 outlets
- Sun 1 Nov, 21:23 UTC. CyberSIXT, first report. CVSS 9.8 Linux flaw lets attackers take root on Go servers by default.
- Mon 2 Nov, 14:52 UTC. SANS ISC, its first report on the story. SANS details detection of Linux Multipath TCP vulnerability.
- Threat actorHAZY TIGERDevelopinglatest 5 hours ago2 articles2 outlets
- Mon 2 Nov, 14:00 UTC. Dark Reading, first report. Fortinet details BITTER’s expanding PapRAT attacks in South Asia.
- Mon 2 Nov, 14:00 UTC. Infosecurity, its first report on the story. FortiGuard links PapRAT espionage campaign to Bitter in Asia.
- In CISA KEVCVECVE-2026-111357Ivanti Connect SecureDevelopinglatest 8 hours ago2 articles2 outlets
- Mon 2 Nov, 07:57 UTC. SecurityWeek, first report. Volexity links Ivanti Connect Secure zero days to UTA0576. Cites a CVE in CISA KEV.
- Mon 2 Nov, 11:04 UTC. Rapid7, its first report on the story. Ivanti patches two more Connect Secure zero days exploited in attacks. Cites a CVE in CISA KEV.
- Threat actorTraderTraitorDevelopinglatest 9 hours ago2 articles2 outlets
- Mon 2 Nov, 08:40 UTC. SecurityWeek, first report. FBI Links North Korea’s TraderTraitor to Binance Heist.
- Mon 2 Nov, 10:15 UTC. Infosecurity, its first report on the story. FBI links Binance crypto breach to North Korea’s TraderTraitor.