Wed 4 Nov · updated 04:01 UTC
Today in security
Latest briefing
Tuesday 3 November edition
Reports describe exploitation of two software flaws
Tuesday's lead is VulnCheck's report of active exploitation of CVE-2026-58115, alongside Defused Cyber's finding that attackers are attempting to exploit the unpatched CryptoPayment Gateway WordPress plugin flaw CVE-2026-81648. The focus shifts from the previous edition's BTCPay Server lead to current activity against exposed systems and a payment plugin, although neither account gives a victim count. The reporting does not agree on the product affected by CVE-2026-58115: The Hacker News identifies Siemens SIMATIC IoT2050 Advanced devices, while SecurityOnline describes Node-RED installations.
Known exploited8
CISA KEV entries named in the last 48 hours of coverage, by federal deadline
- In CISA KEV
WordPress CoreCVE-2026-119977
Federal deadline 6 Nov · In CISA KEV since 3 Nov
8.1High0.6% EPSS1 article
- In CISA KEV
Google BrotliCVE-2026-111497
Federal deadline 10 Nov · In CISA KEV since 27 Oct
9.2Critical83% EPSS22 articles
- In CISA KEV
Ivanti Connect SecureCVE-2026-118527
Federal deadline 13 Nov · In CISA KEV since 30 Oct
4.3Medium8 articles
- In CISA KEV
Ivanti Connect SecureCVE-2026-111357
Federal deadline passed 2 Nov · In CISA KEV since 30 Oct
7.0High0.5% EPSS8 articles
Show 4 more · federal deadlines passed
- In CISA KEV
Ivanti Connect SecureCVE-2026-104935
Federal deadline passed 16 Oct · In CISA KEV since 13 Oct
8.6High89% EPSS21 articles
- In CISA KEV
Zyxel GS1900-48HPv2 firmwareCVE-2026-7273
Federal deadline passed 24 Sep · In CISA KEV since 21 Sep
8.8High2.8% EPSS7 articles
- In CISA KEV
Adobe CommerceCVE-2026-75650
Federal deadline passed 11 Sep · In CISA KEV since 8 Sep
10.0Critical3.9% EPSS9 articles
- In CISA KEV
RARLAB WinRARCVE-2025-8088
Federal deadline passed 2 Sep 2025 · In CISA KEV since 12 Aug 2025 · Used in ransomware campaigns
8.4High94% EPSS23 articles
Latest news89
The last 24 hours, newest first; stories about known exploited CVEs are above
Latest story at 02:51 UTC. Red diamonds mark the 2 stories about exploited CVEs.
- 02:51 UTC. Fridge cyberattack hits 13 countries and France's blood service. 1 outlet.
- 02:17 UTC. PoC exposes critical remote code flaw in Puppet Server. 1 outlet.
- 02:10 UTC. Exposed refrigerator controls spoil food across European supermarkets. 1 outlet.
- 02:03 UTC. HPE fixes 46 Fabric Composer flaws, including a critical password bug. 1 outlet.
- 02:00 UTC. Nearly 69GB of Philippine migrant worker data stolen. 1 outlet.
- 01:40 UTC. Binarly warns of exploited Zyxel GS1900 switch zero day. 1 outlet.
- 01:16 UTC. Researcher discloses macOS root exploit for CVE-2026-112445. 1 outlet.
- 00:50 UTC. GitBook says AI-driven cyberattack exposed customer API tokens. 1 outlet.
- 00:40 UTC. CERT/CC discloses two critical flaws in INFINITT PACS. 1 outlet.
- 00:00 UTC. SUSE patches critical Rancher Fleet flaw enabling cluster takeover. 1 outlet.
- 23:52 UTC. FBI links Binance wallet theft to North Korean actors. 1 outlet.
- 23:37 UTC. SonicWall discloses two unpatched GMS vulnerabilities. 1 outlet.
- 23:32 UTC. SolarWinds patches critical command injection flaw in Dameware. 1 outlet.
- 23:21 UTC. Google Chrome 157 fixes 213 flaws, including seven critical bugs. 1 outlet.
- 22:29 UTC. NSW Health breach prompts police criminal investigation. 1 outlet.
- 22:16 UTC. European supermarket fridge attacks expose cold chain risks. 1 outlet.
- 21:57 UTC. German Police Dismantle Investment Fraud Service, Arrest Seven. 1 outlet.
- 20:31 UTC. CISA Flags Exploited WordPress Flaw Allowing Unauthenticated Code Execution. 1 outlet. About an exploited CVE.
- 20:07 UTC. Cyberattacks send fake emergency alerts in Ukraine and Russia. 2 outlets.
- 20:02 UTC. Xsolis breach exposes patient data at nine health systems. 2 outlets.
- 19:58 UTC. Japanese Firms Turn to Cyber Insurance After Data Breaches. 2 outlets.
- 19:57 UTC. South Korea Calls Emergency Meeting Over Entourage Data Leak. 2 outlets.
- 19:55 UTC. Syrian hacker sentenced for Assad regime cyber conspiracy. 1 outlet.
- 19:55 UTC. Contractor connected personal AI agent to secure Pentagon system. 1 outlet.
- 19:55 UTC. BYOD hackers apologise after disrupting UNM hospital systems. 1 outlet.
- 19:55 UTC. HHS settles HIPAA ransomware investigation with Lehigh Valley. 1 outlet.
- 19:54 UTC. Liverpool hospital investigates staff access to Southport attack records. 1 outlet.
- 19:54 UTC. CSX breach exposes personal information of 40,000 employees. 1 outlet.
- 18:46 UTC. mSecure Warns Users to Reset Passwords After Suspicious Activity. 1 outlet.
- 18:16 UTC. Chainstack Breach Exposes Customer Data and Password Hashes. 1 outlet.
- 17:32 UTC. Microsoft details fake installer campaign delivering monetisation payloads. 1 outlet.
- 17:00 UTC. Microsoft named Gartner Leader for AI agent management platforms. 1 outlet.
- 16:55 UTC. Binance Details How Fake Interviews Led to $6.43 Billion Theft. 2 outlets.
- 16:03 UTC. Kaspersky finds BlackX bootkit bypassing Secure Boot on Windows. 1 outlet.
- 15:59 UTC. Barracuda flaws can be chained to gain root access. 1 outlet.
- 15:41 UTC. Google reports LLMjacking attacks driving cloud bills to $1 million. 1 outlet.
- 15:38 UTC. Dark Reading outlines nine ways to navigate modern cyber threats. 1 outlet.
- 15:35 UTC. Google Details Criminal Enterprise Reselling Stolen LLM Access. 1 outlet.
- 15:30 UTC. ESET says Gorbag targets Ukrainian officials with spyware. 1 outlet. About an exploited CVE.
- 15:16 UTC. Hijacked cPGuard updates backdoor Linux servers and steal data. 1 outlet.
- 14:56 UTC. Apple warns people in 99 countries of spyware targeting. 1 outlet.
- 14:32 UTC. Frontline Education Breach Exposes Data of Over 1.3 Million. 1 outlet.
- 14:30 UTC. BTCPay Server flaw exploited to steal $1.63m in crypto. 1 outlet.
- 14:12 UTC. CrowdStrike agrees to buy Fiddler AI and Dreadnode. 1 outlet.
- 14:11 UTC. Google links Videostrong to backdoor in 1.3 million TV boxes. 1 outlet.
- 14:00 UTC. Bitdefender links 3AM attack on UK school to AI-like loops. 1 outlet.
- 14:00 UTC. Cloudflare launches Zero Wire vulnerability intelligence feed. 1 outlet.
- 13:57 UTC. Check Point finds prompt adware in Codex jailbreak bundle. 1 outlet.
- 12:37 UTC. StepSecurity launches tools to find malicious files left by attacks. 1 outlet.
- 12:21 UTC. Google patches over 200 flaws in Android November updates. 1 outlet.
- 12:01 UTC. Leakers$ claims billboard hacks exposed weak content systems. 1 outlet.
- 11:45 UTC. NCSC warns AI ransomware could hit UK infrastructure by 2028. 1 outlet.
- 11:26 UTC. Revolve says customer payment card data was stolen in breach. 1 outlet.
- 11:18 UTC. Gartner framework urges organisations to rethink vulnerability prioritisation. 1 outlet.
- 11:00 UTC. Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware. 1 outlet.
- 10:45 UTC. Google warns LLMJacking could cost businesses up to $1m. 1 outlet.
- 10:00 UTC. Kaspersky details machine learning for tracking OT network behaviour. 1 outlet.
- 09:49 UTC. UK cyber chief warns of AI attacks on infrastructure by 2028. 1 outlet.
- 09:35 UTC. Google Helps Dismantle XCPE Botnet Built by Chinese Firm. 1 outlet.
- 09:32 UTC. TWCA to Revoke Noncompliant Certificates After Serial Number Flaw. 1 outlet.
- 09:22 UTC. Google dismantles botnet infecting 1.3 million Android devices. 3 outlets.
- 08:55 UTC. Ubuntu tests a fix for a Linux kernel flaw rated 9.8. 3 outlets.
- 08:49 UTC. NATO Adds AI Agents to Crossed Swords Cyber Exercise. 1 outlet.
- 08:48 UTC. FBI attributes $6.3 billion Binance heist to North Korea. 2 outlets.
- 08:31 UTC. BTCPay Server flaw linked to Bitcoin and Litecoin wallet thefts. 1 outlet.
- 08:13 UTC. Attackers breach cPGuard updates to steal server credentials. 1 outlet.
- 08:00 UTC. Kaspersky links AI driven CyberStrikeAI attacks to school intrusions. 1 outlet.
- 07:43 UTC. New fridge attacks disrupt more than 100 European stores. 1 outlet.
- 07:43 UTC. Synology warns ransomware operators are targeting outdated NAS devices. 2 outlets.
- 07:33 UTC. TeamViewer flaw could let remote hosts take over client PCs. 1 outlet.
- 07:27 UTC. Cyberattacks disrupt supermarket refrigeration across Europe. 2 outlets.
- 07:26 UTC. Anthropic bars Claude from cloning commercial video games. 1 outlet.
- 07:21 UTC. NIS2 Holds Boards Accountable for Access Control Oversight. 1 outlet.
- 07:01 UTC. Malware campaign hijacks Hugging Face models to mine cryptocurrency. 1 outlet.
- 06:24 UTC. Apple spyware alerts reach German lawmakers, BSI advises action. 1 outlet.
- 06:09 UTC. Teams help desk impersonation enabled AD CS domain attacks. 1 outlet.
- 05:34 UTC. Attackers exploit Siemens IoT2050 flaw to install backdoors. 2 outlets.
- 05:34 UTC. Attackers Exploit CryptoPayment Gateway Flaw to Steal Wallet Keys. 1 outlet.
- Known exploited CVE
- CVE not in KEV
- Other story
- Size: outlets on the story
- Stories an hour
Show as tableHide table
| Time (UTC) | Story | Outlets | Type |
|---|---|---|---|
| 02:51 | Fridge cyberattack hits 13 countries and France's blood service | 1 | Other |
| 02:17 | PoC exposes critical remote code flaw in Puppet Server | 1 | CVE |
| 02:10 | Exposed refrigerator controls spoil food across European supermarkets | 1 | Other |
| 02:03 | HPE fixes 46 Fabric Composer flaws, including a critical password bug | 1 | CVE |
| 02:00 | Nearly 69GB of Philippine migrant worker data stolen | 1 | Other |
| 01:40 | Binarly warns of exploited Zyxel GS1900 switch zero day | 1 | CVE |
| 01:16 | Researcher discloses macOS root exploit for CVE-2026-112445 | 1 | CVE |
| 00:50 | GitBook says AI-driven cyberattack exposed customer API tokens | 1 | Other |
| 00:40 | CERT/CC discloses two critical flaws in INFINITT PACS | 1 | CVE |
| 00:00 | SUSE patches critical Rancher Fleet flaw enabling cluster takeover | 1 | CVE |
| 23:52 | FBI links Binance wallet theft to North Korean actors | 1 | Other |
| 23:37 | SonicWall discloses two unpatched GMS vulnerabilities | 1 | CVE |
| 23:32 | SolarWinds patches critical command injection flaw in Dameware | 1 | CVE |
| 23:21 | Google Chrome 157 fixes 213 flaws, including seven critical bugs | 1 | CVE |
| 22:29 | NSW Health breach prompts police criminal investigation | 1 | Other |
| 22:16 | European supermarket fridge attacks expose cold chain risks | 1 | Other |
| 21:57 | German Police Dismantle Investment Fraud Service, Arrest Seven | 1 | Other |
| 20:31 | CISA Flags Exploited WordPress Flaw Allowing Unauthenticated Code Execution | 1 | Known exploited |
| 20:07 | Cyberattacks send fake emergency alerts in Ukraine and Russia | 2 | Other |
| 20:02 | Xsolis breach exposes patient data at nine health systems | 2 | Other |
| 19:58 | Japanese Firms Turn to Cyber Insurance After Data Breaches | 2 | Other |
| 19:57 | South Korea Calls Emergency Meeting Over Entourage Data Leak | 2 | Other |
| 19:55 | Syrian hacker sentenced for Assad regime cyber conspiracy | 1 | Other |
| 19:55 | Contractor connected personal AI agent to secure Pentagon system | 1 | Other |
| 19:55 | BYOD hackers apologise after disrupting UNM hospital systems | 1 | Other |
| 19:55 | HHS settles HIPAA ransomware investigation with Lehigh Valley | 1 | Other |
| 19:54 | Liverpool hospital investigates staff access to Southport attack records | 1 | Other |
| 19:54 | CSX breach exposes personal information of 40,000 employees | 1 | Other |
| 18:46 | mSecure Warns Users to Reset Passwords After Suspicious Activity | 1 | Other |
| 18:16 | Chainstack Breach Exposes Customer Data and Password Hashes | 1 | Other |
| 17:32 | Microsoft details fake installer campaign delivering monetisation payloads | 1 | Other |
| 17:00 | Microsoft named Gartner Leader for AI agent management platforms | 1 | Other |
| 16:55 | Binance Details How Fake Interviews Led to $6.43 Billion Theft | 2 | Other |
| 16:03 | Kaspersky finds BlackX bootkit bypassing Secure Boot on Windows | 1 | CVE |
| 15:59 | Barracuda flaws can be chained to gain root access | 1 | CVE |
| 15:41 | Google reports LLMjacking attacks driving cloud bills to $1 million | 1 | CVE |
| 15:38 | Dark Reading outlines nine ways to navigate modern cyber threats | 1 | Other |
| 15:35 | Google Details Criminal Enterprise Reselling Stolen LLM Access | 1 | Other |
| 15:30 | ESET says Gorbag targets Ukrainian officials with spyware | 1 | Known exploited |
| 15:16 | Hijacked cPGuard updates backdoor Linux servers and steal data | 1 | Other |
| 14:56 | Apple warns people in 99 countries of spyware targeting | 1 | CVE |
| 14:32 | Frontline Education Breach Exposes Data of Over 1.3 Million | 1 | Other |
| 14:30 | BTCPay Server flaw exploited to steal $1.63m in crypto | 1 | Other |
| 14:12 | CrowdStrike agrees to buy Fiddler AI and Dreadnode | 1 | Other |
| 14:11 | Google links Videostrong to backdoor in 1.3 million TV boxes | 1 | Other |
| 14:00 | Bitdefender links 3AM attack on UK school to AI-like loops | 1 | Other |
| 14:00 | Cloudflare launches Zero Wire vulnerability intelligence feed | 1 | Other |
| 13:57 | Check Point finds prompt adware in Codex jailbreak bundle | 1 | Other |
| 12:37 | StepSecurity launches tools to find malicious files left by attacks | 1 | Other |
| 12:21 | Google patches over 200 flaws in Android November updates | 1 | CVE |
| 12:01 | Leakers$ claims billboard hacks exposed weak content systems | 1 | Other |
| 11:45 | NCSC warns AI ransomware could hit UK infrastructure by 2028 | 1 | Other |
| 11:26 | Revolve says customer payment card data was stolen in breach | 1 | Other |
| 11:18 | Gartner framework urges organisations to rethink vulnerability prioritisation | 1 | Other |
| 11:00 | Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware | 1 | Other |
| 10:45 | Google warns LLMJacking could cost businesses up to $1m | 1 | Other |
| 10:00 | Kaspersky details machine learning for tracking OT network behaviour | 1 | Other |
| 09:49 | UK cyber chief warns of AI attacks on infrastructure by 2028 | 1 | Other |
| 09:35 | Google Helps Dismantle XCPE Botnet Built by Chinese Firm | 1 | Other |
| 09:32 | TWCA to Revoke Noncompliant Certificates After Serial Number Flaw | 1 | Other |
| 09:22 | Google dismantles botnet infecting 1.3 million Android devices | 3 | Other |
| 08:55 | Ubuntu tests a fix for a Linux kernel flaw rated 9.8 | 3 | CVE |
| 08:49 | NATO Adds AI Agents to Crossed Swords Cyber Exercise | 1 | Other |
| 08:48 | FBI attributes $6.3 billion Binance heist to North Korea | 2 | Other |
| 08:31 | BTCPay Server flaw linked to Bitcoin and Litecoin wallet thefts | 1 | Other |
| 08:13 | Attackers breach cPGuard updates to steal server credentials | 1 | Other |
| 08:00 | Kaspersky links AI driven CyberStrikeAI attacks to school intrusions | 1 | Other |
| 07:43 | New fridge attacks disrupt more than 100 European stores | 1 | Other |
| 07:43 | Synology warns ransomware operators are targeting outdated NAS devices | 2 | CVE |
| 07:33 | TeamViewer flaw could let remote hosts take over client PCs | 1 | CVE |
| 07:27 | Cyberattacks disrupt supermarket refrigeration across Europe | 2 | Other |
| 07:26 | Anthropic bars Claude from cloning commercial video games | 1 | Other |
| 07:21 | NIS2 Holds Boards Accountable for Access Control Oversight | 1 | Other |
| 07:01 | Malware campaign hijacks Hugging Face models to mine cryptocurrency | 1 | Other |
| 06:24 | Apple spyware alerts reach German lawmakers, BSI advises action | 1 | Other |
| 06:09 | Teams help desk impersonation enabled AD CS domain attacks | 1 | Other |
| 05:34 | Attackers exploit Siemens IoT2050 flaw to install backdoors | 2 | CVE |
| 05:34 | Attackers Exploit CryptoPayment Gateway Flaw to Steal Wallet Keys | 1 | CVE |
- Fridge cyberattack hits 13 countries and France's blood service
Attackers changed the settings of cold rooms used by France's blood service the same night supermarket fridges were tampered with across Europe. France's health ministry says the incident was caught in time.
CyberSIXT
- PoC exposes critical remote code flaw in Puppet Server
SecurityOnline[.]info reports that a full PoC exploit for CVE-2026-115731, a critical Puppet Server RCE flaw rated CVSS 9.4, has been published. The OpenVox project’s GitHub advisory and a write‑up from Neodyme confirm…
SecurityOnlineCVE-2026-115731
- Exposed refrigerator controls spoil food across European supermarkets
A breach affecting hundreds, potentially thousands, of refrigerators across Europe has been discussed in the SANS Internet Storm Center’s Stormcast for 4 November 2026. The episode attributes the intrusion to devices…
SANS ISC
- HPE fixes 46 Fabric Composer flaws, including a critical password bug
HPE has released details of 46 security vulnerabilities affecting its Fabric Composer (AFC) product, with the most severe entry, CVE-2026-95731, rated 9.8 on CVSS v3.1. The flaws span three critical, 20 high, 18 medium…
SecurityOnlineCVE-2026-95731
- Nearly 69GB of Philippine migrant worker data stolen
An unknown attacker copied nearly 69GB of data from the Philippine Overseas Employment Administration, including 27 SQL Server backups, in a transfer lasting 24 minutes. Hunt[.]io found logs and tools on a staging…
Dark Reading
- Binarly warns of exploited Zyxel GS1900 switch zero day
A Zyxel GS1900 zero‑day has been exploited in the wild, researchers from Binarly warn. The flaw, tracked as CVE-2026-107441, is an out‑of‑bounds write in the GS1900 web interface’s dispatcher.cgi that lets an…
SecurityOnlineCVE-2026-107441
- Researcher discloses macOS root exploit for CVE-2026-112445
A security researcher known as Mas0nShi has disclosed full details and PoC exploit code for CVE-2026-112445, a macOS privilege-escalation flaw. The issue is described as a straightforward bug in launchd daemons that…
SecurityOnlineCVE-2026-112445
- GitBook says AI-driven cyberattack exposed customer API tokens
The documentation platform says attackers using AI agents reached infrastructure credentials on 2 November, putting integration tokens, Git Sync secrets and API tokens at risk. Customers must rotate them.
CyberSIXT
- CERT/CC discloses two critical flaws in INFINITT PACS
Two critical vulnerabilities have been disclosed affecting INFINITT PACS, the hospital imaging platform used by thousands of sites worldwide. CERT/CC issued a security notice on 2 November 2026 detailing two flaws in…
SecurityOnlineCVE-2026-16305
- SUSE patches critical Rancher Fleet flaw enabling cluster takeover
SUSE has published advisories on 29 October 2026 warning of two serious Rancher Fleet vulnerabilities in the GitOps management engine, with the most severe CVE-2026-94290 allowing local privilege escalation to…
SecurityOnlineCVE-2026-94290
- FBI links Binance wallet theft to North Korean actors
Binance reports that on 29 October 2026, attackers drained multiple hot wallets within four minutes, transferring 233.46 million XRP to an attacker address, followed by assets on Solana, Optimism and Bitcoin wallets.…
SecurityOnline
- SonicWall discloses two unpatched GMS vulnerabilities
SonicWall has disclosed two critical, unpatched vulnerabilities in its Global Management System (GMS), tracked as CVE-2026-109593 and CVE-2026-109594, with a highest CVSS score of 9.1. The vendor’s security notice…
SecurityOnlineCVE-2026-109593
- SolarWinds patches critical command injection flaw in Dameware
SolarWinds says it has patched a critical command injection flaw in Dameware, tracked as CVE-2026-28336, with the release of Dameware 2026.3.1. The vendor rates the vulnerability at CVSSv3 9.9 and warns that…
SecurityOnlineCVE-2026-28336
- Google Chrome 157 fixes 213 flaws, including seven critical bugs
Google has promoted Chrome 157 to the stable channel, delivering version 157.0.8103.38 for Linux and 157.0.8103.38/.39 for Windows and macOS, with Google reporting 213 security fixes and seven rated as critical. The…
SecurityOnlineCVE-2026-121156
- NSW Health breach prompts police criminal investigation
A major cyber breach has been declared at NSW Health, with officials emphasising that patient data has not been affected. Cyber Security NSW says the incident concerns an isolated server within NSW Health and that the…
DataBreaches
- European supermarket fridge attacks expose cold chain risks
A second wave of attacks on European supermarket refrigeration systems has raised concerns about the cold chain’s vulnerability to remote access and Internet-facing control systems. UK outlets including the BBC and…
Dark Reading
- German Police Dismantle Investment Fraud Service, Arrest Seven
German police, supported by Europol and Eurojust, have dismantled a multinational “crime-as-a-service” operation linked to investment fraud. The Itzehoe Public Prosecutor’s Office in Germany led the raid against a…
Dark Reading
- Cyberattacks send fake emergency alerts in Ukraine and Russia
Authorities in Ukraine and Russia reported fake emergency alerts via their official alerting apps as cyber operations targeted these mobile services, with Ukraine warning residents of an imminent nuclear threat. The AP…
wordpress-1685287-6764806.cloudwaysapps.com
- Ukraine and Russia both report fake emergency alerts after cyberattacks target apps as limited ceasefire ends
AP reports: Authorities in Ukraine and Russia said their emergency alert mobile apps had been targeted by cyberattacks, with users in Ukraine receiving false warnings of an imminent nuclear threat. It was not clear if…
DataBreaches
- Xsolis breach exposes patient data at nine health systems
A data breach at AI company Xsolis exposed patient data across at least nine health systems, affecting about 1.4 million individuals, according to reporting cited by Dissent’s Giles Bruce. Xsolis, which provides…
wordpress-1685287-6764806.cloudwaysapps.com
- Xsolis breach affects 1.4 million people across nine health systems
DataBreaches[.]net reports that healthcare AI company Xsolis disclosed a data breach affecting its IT environment, with a targeted phishing incident reported on 5 June and unauthorised access on 20 January, resulting…
DataBreaches
- Japanese Firms Turn to Cyber Insurance After Data Breaches
More Japanese companies are turning to cyber insurance after prominent data breaches, according to Maddie Baker.
wordpress-1685287-6764806.cloudwaysapps.com
- Japanese Companies Turn to Cyber Insurance After Data Breaches
Maddie Baker, writing for DataBreaches[.]net on 3 November 2026, reports that cyber insurance policies typically cover costs arising from data breaches, including expenses for digital forensic analysis to identify…
DataBreaches
- South Korea Calls Emergency Meeting Over Entourage Data Leak
The presidential office in South Korea held an emergency meeting on Tuesday to address a leak involving personal data connected to President Lee Jae Myung and members of his overseas trip entourage in June. The…
wordpress-1685287-6764806.cloudwaysapps.com
- South Korea investigates leak of president's trip entourage data
The Korean presidential office convened an emergency meeting on 3 November 2026 to address the leak of personal information relating to President Lee Jae Myung and members of his overseas trip entourage in June. The…
DataBreaches
- Syrian hacker sentenced for Assad regime cyber conspiracy
Ahmad Umar Agha, also known as Th3Pr0, has been sentenced by a federal district court in the Eastern District of Virginia to 42 months’ imprisonment for his central role in a wide-ranging hacking conspiracy conducted…
wordpress-1685287-6764806.cloudwaysapps.com
- Contractor connected personal AI agent to secure Pentagon system
A defence contractor connected a personal AI agent to a secure Department of Defense system, according to WIRED’s reporting cited by DataBreaches[.]net. The AI in question was Anthropic’s Claude Code, and it was used…
wordpress-1685287-6764806.cloudwaysapps.com
- BYOD hackers apologise after disrupting UNM hospital systems
Hackers identifying themselves as the BYOD group attacked the University of New Mexico (UNM) health-system, including UNM Hospital (UNMH), earlier this week, according to a report cycle cited by DataBreaches. The…
wordpress-1685287-6764806.cloudwaysapps.com
- HHS settles HIPAA ransomware investigation with Lehigh Valley
The US Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced a settlement with Lehigh Valley Health Network (LVHN) and its affiliated entities over potential HIPAA Privacy, Security…
wordpress-1685287-6764806.cloudwaysapps.com
- Liverpool hospital investigates staff access to Southport attack records
A second hospital in Liverpool has begun an investigation into two potential instances of staff accessing medical records linked to the Southport terror attack, according to ITV. The cases were identified at Liverpool…
wordpress-1685287-6764806.cloudwaysapps.com
- CSX breach exposes personal information of 40,000 employees
CSX, one of the United States’ largest transportation companies, disclosed a cybersecurity incident that granted unauthorised access to certain information, including employee data such as Social Security numbers. The…
wordpress-1685287-6764806.cloudwaysapps.com
- Binance details how fake job interviews enabled a $6.34B hack
Binance has detailed how a multi-stage cyber operation in October 2026 enabled attackers to siphon about $6.34 billion in digital assets, using fake recruitment interviews, malware downloads, compromised developer…
Security Affairs
- How North Korea is laundering $6.4 billion stolen from Binance
Binance says the theft followed a months-long campaign: a trojanised Homebrew installer in June, a fake job interview in September and abuse of an internal AI tool. Analysts say software is laundering the funds around…
CyberSIXT
- mSecure Warns Users to Reset Passwords After Suspicious Activity
mSecure users are being asked to take precautionary steps after a communication from the company’s developer, mSeven Software, on 3 November 2026 warning of “suspicious activity” connected to the app. The notice does…
The Hacker News
- Chainstack Breach Exposes Customer Data and Password Hashes
Chainstack said it was targeted in a cyber attack that granted an unauthorised party access to parts of its infrastructure, with intrusion stemming from a third‑party component. The company’s timeline shows the…
The Hacker News
- Microsoft details fake installer campaign delivering monetisation payloads
Microsoft Threat Intelligence has detailed a four-stage fake-download campaign that uses trojanised Inno Setup-style installers to deliver monetisation payloads. The operation targets users seeking cracked commercial…
Microsoft
- Google dismantles botnet infecting 1.3 million Android TV boxes
Google’s Threat Intelligence Group says it has disrupted x[.]cpe, a botnet that reached more than 1.3 million Google-certified Android TV devices. Trend Micro counted 1,472,554 infected devices. Most were in Brazil,…
Ars Technica
- Microsoft named Gartner Leader for AI agent management platforms
Microsoft has been named a Leader in the inaugural Gartner Magic Quadrant for AI Agent Management Platforms, published on 27 October 2026 with the report dated 27 October 2026 and referenced by Microsoft on 3 November…
Microsoft
- Binance Details How Fake Interviews Led to $6.43 Billion Theft
Binance has disclosed that the record-breaking loss of about $6.43 billion in assets resulted from a multi-stage campaign rather than a single breach. The company describes the attack as a supply-chain and…
The Hacker News
- Synology warns ransomware operators are targeting outdated NAS devices
Synology has issued a warning that ransomware operators are targeting NAS devices running outdated DSM software, exploiting a 2024 vulnerability that the vendor had already addressed by December 2024. The company says…
Security AffairsCVE-2024-10441
- Kaspersky finds BlackX bootkit bypassing Secure Boot on Windows
Kaspersky has identified organisations infected with BlackX, a UEFI bootkit that can bypass Secure Boot on Windows machines despite the systems having Microsoft’s relevant updates installed. BlackX exploits…
Ars TechnicaCVE-2022-21894
- Barracuda flaws can be chained to gain root access
Barracuda has disclosed two vulnerabilities in its products that, if chained together, could bypass authorisation and grant root access to a compromised device. The issues are CVE-2026-116606, a pre-authentication…
The Hacker NewsCVE-2026-116606
- Google reports LLMjacking attacks driving cloud bills to $1 million
Google has warned that attackers are hijacking enterprise access to Large Language Models (LLMs) to drain cloud resources and services, creating fraudulently large computing charges. In a report shared with The Hacker…
The Hacker NewsCVE-2026-40217
- Dark Reading outlines nine ways to navigate modern cyber threats
Dark Reading’s 9 Cyber Awareness Tips, published on 3 November 2026, map practical risk-reducing behaviours to how today’s attacks actually unfold. The piece argues that threats stem from everyday actions and trusted…
Dark Reading
- Google Details Criminal Enterprise Reselling Stolen LLM Access
Cybercriminals have established a thriving business model around stealing access to commercial LLMs and reselling it, with victims incurring resource costs up to around $1 million before access is revoked. The…
Dark Reading
- Hijacked cPGuard updates backdoor Linux servers and steal data
An attacker compromised the update system for the cPGuard security tool, breaching credentials at 02:06 UTC on 2 November 2026 and distributing a malicious script to Linux servers running cPGuard versions 5.88.12…
The Hacker News
- Apple warns people in 99 countries of spyware targeting
Apple has warned targeted individuals in 99 countries about a sophisticated mercenary spyware campaign aimed at iPhone users, with researchers confirming the legitimacy of the alerts but noting that initial forensic…
SecurityOnlineCVE-2026-59769
- Frontline Education Breach Exposes Data of Over 1.3 Million
Frontline Education says attackers exploited a vulnerability in a third-party software product to gain unauthorised access to its environment on 14 August. The company says it fixed the security flaw, strengthened…
SecurityWeek
- BTCPay Server flaw exploited to steal $1.63m in crypto
Hackers have stolen cryptocurrency from hot wallets on outdated BTCPay Server instances, with blockchain analysis tracing about $1.63m in Bitcoin and Litecoin to addresses linked to the thefts. BTCPay Server said in an…
Infosecurity
- CrowdStrike agrees to buy Fiddler AI and Dreadnode
CrowdStrike has agreed to acquire AI monitoring company Fiddler AI and AI security testing firm Dreadnode. The companies have not disclosed the terms; The Wall Street Journal reported a combined price of about US$495…
SecurityWeek
- Google links Videostrong to backdoor in 1.3 million TV boxes
Google’s Threat Intelligence Group (GTIG) says it has high confidence that Android device maker Videostrong Technology built and operated the x[.]cpe backdoor for financial gain, infecting 1.3 million certified Android…
Malwarebytes
- Bitdefender links 3AM attack on UK school to AI-like loops
Bitdefender says a 3AM ransomware affiliate attacked a school in the UK, stealing backup credentials, creating rogue domain-admin accounts and linking previously separate Active Directory domains. The attackers used…
Dark Reading
- Cloudflare launches Zero Wire vulnerability intelligence feed
Cloudflare has launched Zero Wire, a public vulnerability intelligence feed within Cloudflare Radar. The company says the service is intended to help security teams assess significant vulnerabilities in Internet-facing…
Cloudflare
- Check Point finds prompt adware in Codex jailbreak bundle
Check Point Research says it found Haiou, a Chinese-language jailbreak bundle for OpenAI Codex, on a misconfigured web server used by a threat actor operating Cobalt Strike. The server’s logs showed the actor…
Check Point
- Cyberattacks Disrupt Supermarket Refrigeration Across Europe
Supermarkets in at least nine European countries reported cyber incidents affecting refrigeration systems on 1 November 2026, with food stocks destroyed or removed from sale. Retailers in Belgium, Estonia, Finland,…
Infosecurity
- CVSS 9.8 Linux flaw lets attackers take root on Go servers by default
Red Hat and Ubuntu have fixed kernels out or in testing, and Marcus Hutchins says threat actors appear to be scanning for the up to 2.1 million exposed servers.
CyberSIXTCVE-2026-98432
- StepSecurity launches tools to find malicious files left by attacks
StepSecurity has launched Malicious Files for GitHub in beta, alongside a renamed and expanded Malicious Files feature in its Dev Machine Guard product. The tools are designed to detect files left by supply-chain…
StepSecurity
- Google patches over 200 flaws in Android November updates
Google has announced November 2026 security updates for Android addressing more than 200 vulnerabilities, including about two dozen rated critical. The first update, marked by security patch level 2026-11-01, fixes 119…
SecurityWeekCVE-2026-58868
- Attackers Exploit Critical Node-RED Flaw to Deploy Malware
VulnCheck says attackers have exploited CVE-2026-58115, a critical Node-RED vulnerability rated 10/10 on the CVSS scale. The flaw is a lack of authentication on Node-RED’s HTTP interface, which can expose programming…
SecurityWeekCVE-2026-58115
- Leakers$ claims billboard hacks exposed weak content systems
Digital billboards in Egypt, Malaysia and Brazil displayed explicit footage after attackers accessed software used to manage and send content to LED screens. On 29 October, footage appeared on a large billboard beside…
Malwarebytes
- NCSC warns AI ransomware could hit UK infrastructure by 2028
The UK’s National Cyber Security Centre (NCSC) says AI-powered malicious software is “highly likely” to be used in financially motivated attacks on critical national infrastructure by 2028. The warning covers…
Infosecurity
- Revolve says customer payment card data was stolen in breach
Online fashion retailer Revolve Group has notified customers that names, addresses and payment card numbers and expiry dates were stolen. The breach affected customers who had saved a card as a payment method in their…
Malwarebytes
- Red Hat fixes critical Linux TCP flaw enabling remote code execution
Red Hat has released fixes for a use-after-free vulnerability in the Linux kernel’s IPv4 TCP code, tracked as CVE-2026-98432, which can be exploited remotely and without authentication to achieve remote code execution.…
The Hacker NewsCVE-2026-98432
- Gartner framework urges organisations to rethink vulnerability prioritisation
The Hacker News reports on Gartner’s framework for prioritising exposure remediation, highlighting that fewer than 10% of vulnerabilities are exploited and that CVSS scores alone do not predict exploitation or business…
The Hacker News
- Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware
A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations. "Active since at least February 2025, the group has focused…
The Hacker News
- Google warns LLMJacking could cost businesses up to $1m
Google’s Mandiant unit has warned that enterprise exposure to LLMJacking is increasing, with multiple incidents reported this year across financial services, retail, technology and transportation sectors. In its…
Infosecurity
- Kaspersky details machine learning for tracking OT network behaviour
Kaspersky’s SecureList feature outlines MLEP in KICS for Networks 5.0, the machine-learning-based event processor designed to track OT device network behaviour. Developed to address gaps in asset inventories and the…
securelist.com
- Google disrupts XCPE botnet that hijacked 1.3 million devices
Google and partners dismantled a backdoor campaign dubbed XCPE that enrolled more than 1.3 million set‑top boxes into a botnet used for ad fraud and proxy abuse, Security Affairs reports. The backdoor, preloaded in…
Security Affairs
- UK cyber chief warns of AI attacks on infrastructure by 2028
The U.K. will likely face artificial intelligence-enhanced cyberattacks on its critical infrastructure by 2028, according to Britain’s cyber chief, Richard Horne. Speaking ahead of the National Cyber Security Centre…
SecurityWeek
- Google Helps Dismantle XCPE Botnet Built by Chinese Firm
Google has disclosed that it helped dismantle the XCPE botnet, which it assessed with high confidence to have been built by Videostrong Technology, a Chinese Android ODM/OEM. The operation reportedly involved more than…
Infosecurity
- TWCA to Revoke Noncompliant Certificates After Serial Number Flaw
Taiwan’s TWCA Certificate Authority has acknowledged a compliance defect in its PKI after independent researchers found insufficient randomness in serial numbers across multiple intermediate certificates. The flaw…
SecurityOnline
- Google dismantles botnet infecting 1.3 million Android devices
Google says it has dismantled XCPE (also known as X[.]CPE), a backdoor and botnet affecting more than 1.3 million Android set‑top boxes. The operation was developed and run by Videostrong Technology, a China‑based…
SecurityWeek
- Ubuntu tests a fix for a Linux kernel flaw rated 9.8
CVE-2026-98432, a Linux kernel TCP flaw with a CVSS of 9.8, has been addressed in Ubuntu’s -proposed pocket for 22.04 LTS and newer. The issue lies in how the kernel sets up IPv4 TCP connections, and the bug has…
SecurityOnlineCVE-2026-98432
- NATO Adds AI Agents to Crossed Swords Cyber Exercise
NATO’s Crossed Swords 2026 drill, staged by the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn, Estonia, has introduced an AI-enabled dimension to its cyber and kinetic operations training. The…
SecurityWeek
- FBI attributes $6.3 billion Binance heist to North Korea
The article reports that Binance suffered a substantial breach, with attackers draining 6.3 billion dollars from its hot wallets after compromising administrative credentials obtained beforehand. It notes that around 3…
SecurityOnline
- BTCPay Server flaw linked to Bitcoin and Litecoin wallet thefts
BTCPay Server has urged users to upgrade to the latest software after reports that Bitcoin and Litecoin were stolen from hot wallets on installations running older builds. The firm said the attacks targeted servers…
The Hacker News
- Attackers breach cPGuard updates to steal server credentials
On 2 November 2026, at 02:06 UTC, an attacker used stolen credentials to breach OPSSHIELD’s update distribution network and push a tampered script through the cPGuard update channel. OPSSHIELD says the intruder…
SecurityOnline
- Kaspersky links AI driven CyberStrikeAI attacks to school intrusions
Kaspersky researchers have identified a new wave of intrusions described as CyberStrikeAI framework attacks, targeting educational organisations in Africa and Latin America. The operations hinge on a modular Go-based…
SecurityOnline
- New fridge attacks disrupt more than 100 European stores
More than 100 European stores were affected as supermarket fridge attacks returned, with incidents spanning Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden, and some units reported heat up to 50°C…
SecurityWeek
- Synology warns ransomware operators are targeting outdated NAS devices
Synology says its DiskStation Manager (DSM) software powering its NAS devices is being targeted again by ransomware operators, this time using exploits against versions it patched in December 2024. The firm disclosed…
The Hacker NewsCVE-2024-10441
- TeamViewer flaw could let remote hosts take over client PCs
A security alert published by Do Son of SecurityOnline[.]info on 3 November 2026 describes a TeamViewer client vulnerability that enables remote code execution. The flaw is reported to allow a compromised remote…
SecurityOnlineCVE-2026-111585
- Cyberattacks disrupt supermarket refrigeration across Europe
Overnight into Monday, 2 November, attackers remotely altered refrigeration controls at supermarkets across several European countries, causing fridges and freezers to heat up or operate at abnormally high…
The Hacker News
- Anthropic bars Claude from cloning commercial video games
Anthropic has introduced a policy shift that blocks Claude from cloning commercial video games. Updated directives now prohibit requests to replicate protected titles, with Claude Opus 5.5 and Claude Code receiving two…
SecurityOnline
- NIS2 Holds Boards Accountable for Access Control Oversight
NIS2 Article 20 places management bodies of essential and important entities under liability for the cybersecurity measures they approve, oversee, and report on, with enforcement powers exercised under national law…
Security Affairs
- Malware campaign hijacks Hugging Face models to mine cryptocurrency
Pluto Research has tracked an active campaign active on Hugging Face and ModelScope that hijacks GPU servers by abusing open-weight model repositories. The attacker exploits the trust_remote_code parameter in Python…
SecurityOnline
- Apple spyware alerts reach German lawmakers, BSI advises action
Apple has begun sending threat notifications to Bundestag lawmakers and other prominent figures that point to attacks using mercenary spyware, according to the Security Affairs report and corroborating statements from…
Security Affairs
- Teams help desk impersonation enabled AD CS domain attacks
Two intrusions investigated by Microsoft Threat Intelligence began with help desk impersonation on Teams, using fake IT staff with support-style display names to persuade users to start Quick Assist and share the…
SecurityOnline
- Attackers exploit Siemens IoT2050 flaw to install backdoors
Siemens has warned that its SIMATIC IoT2050 Advanced devices, running Industrial OS with Node-RED, are exposed by a critical vulnerability tracked as CVE-2026-58115 (CVSS 10.0). The flaw is a missing authentication…
The Hacker NewsCVE-2026-58115
- Attackers Exploit CryptoPayment Gateway Flaw to Steal Wallet Keys
Threat actors are attempting to exploit CVE-2026-81648, a critical, maximum-severity flaw in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber. The NVD description states the…
The Hacker NewsCVE-2026-81648
CVEs in the news19
Named in the last 24 hours and not in CISA KEV, most covered first
CVE-2026-98432Linux Linux
3 articles today · CVSS 9.8 Linux flaw lets attackers take root on Go servers by default
9.8Critical0.8% EPSS · 10 articlesCVE-2026-58115Siemens SIMATIC IoT2050 Advanced
2 articles today · Attackers Exploit Critical Node-RED Flaw to Deploy Malware
10.0Critical0.9% EPSS · 4 articlesCVE-2024-10441Synology DiskStation Manager (DSM)
2 articles today · Synology warns ransomware operators are targeting outdated NAS devices
9.8Critical1.3% EPSS · 3 articlesCVE-2026-81648CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router
Attackers Exploit CryptoPayment Gateway Flaw to Steal Wallet Keys
10.0Critical0.5% EPSS · 1 articleCVE-2026-28336SolarWinds Dameware
SolarWinds patches critical command injection flaw in Dameware
9.9Critical1 articleCVE-2026-95731Hewlett Packard Enterprise (HPE) Fabric Composer
HPE fixes 46 Fabric Composer flaws, including a critical password bug
9.8Critical1 articleCVE-2026-121156Google Chrome
Google Chrome 157 fixes 213 flaws, including seven critical bugs
9.6Critical1 articleCVE-2026-115731Perforce Puppet Enterprise
PoC exposes critical remote code flaw in Puppet Server
9.4Critical1 articleCVE-2026-116606Barracuda Networks Barracuda Email Security Gateway (ESG)
Barracuda flaws can be chained to gain root access
9.3Critical0.7% EPSS · 2 articlesCVE-2026-94290SUSE Rancher
SUSE patches critical Rancher Fleet flaw enabling cluster takeover
9.1Critical0.5% EPSS · 1 articleCVE-2026-109593SonicWall Global Management System (GMS)
SonicWall discloses two unpatched GMS vulnerabilities
9.1Critical1 articleCVE-2026-59769FURUNO ELECTRIC CO., LTD. FA-50
Apple warns people in 99 countries of spyware targeting
9.1Critical0.6% EPSS · 2 articlesCVE-2026-107441Zyxel GS1900-24E firmware
Binarly warns of exploited Zyxel GS1900 switch zero day
8.8High0.3% EPSS · 1 articleCVE-2026-40217BerriAI LiteLLM
Google reports LLMjacking attacks driving cloud bills to $1 million
8.8High16% EPSS · 3 articlesCVE-2026-111585TeamViewer Full Client
TeamViewer flaw could let remote hosts take over client PCs
8.8High0.3% EPSS · 4 articlesCVE-2022-21894Microsoft Windows 10 Version 1809
Kaspersky finds BlackX bootkit bypassing Secure Boot on Windows
4.4Medium8.6% EPSS · 3 articlesCVE-2026-112445Vendor not yet named
Researcher discloses macOS root exploit for CVE-2026-112445
Not scored1 articleCVE-2026-16305INFINITT Healthcare System Manager
CERT/CC discloses two critical flaws in INFINITT PACS
Not scored0.3% EPSS · 1 articleCVE-2026-58868Google Android
Google patches over 200 flaws in Android November updates
Not scored0.2% EPSS · 2 articles
Developing stories4
Two or more articles in the last 24 hours; each bead is an article
- CVECVE-2026-98432LinuxDevelopinglatest 16 hours ago3 articles3 outlets
- Tue 3 Nov, 08:55 UTC. SecurityOnline, first report. Ubuntu tests a fix for a Linux kernel flaw rated 9.8.
- Tue 3 Nov, 11:23 UTC. The Hacker News, its first report on the story. Red Hat fixes critical Linux TCP flaw enabling remote code execution.
- Tue 3 Nov, 12:49 UTC. CyberSIXT, its first report on the story. CVSS 9.8 Linux flaw lets attackers take root on Go servers by default.
- Threat actorTraderTraitorDevelopinglatest 10 hours ago2 articles2 outlets
- Tue 3 Nov, 08:48 UTC. SecurityOnline, first report. FBI attributes $6.3 billion Binance heist to North Korea.
- Tue 3 Nov, 18:49 UTC. CyberSIXT, its first report on the story. How North Korea is laundering $6.4 billion stolen from Binance.
- CVECVE-2024-10441Synology DiskStation Manager (DSM)Developinglatest 12 hours ago2 articles2 outlets
- Tue 3 Nov, 07:43 UTC. The Hacker News, first report. Synology warns ransomware operators are targeting outdated NAS devices.
- Tue 3 Nov, 16:31 UTC. Security Affairs, its first report on the story. Synology warns ransomware operators are targeting outdated NAS devices.
- CVECVE-2026-58115Siemens SIMATIC IoT2050 AdvancedDevelopinglatest 17 hours ago2 articles2 outlets
- Tue 3 Nov, 05:34 UTC. The Hacker News, first report. Attackers exploit Siemens IoT2050 flaw to install backdoors.
- Tue 3 Nov, 12:10 UTC. SecurityWeek, its first report on the story. Attackers Exploit Critical Node-RED Flaw to Deploy Malware.