Reports describe exploitation of two software flaws

The Hacker News reported on 3 November that VulnCheck had identified active exploitation of CVE-2026-58115, a missing-authentication flaw with a CVSS score of 10.0.The Hacker News The Hacker News said the flaw affects Siemens SIMATIC IoT2050 Advanced devices.The Hacker News SecurityOnline instead described the vulnerability as a flaw in the Node-RED administrative HTTP API, allowing unauthenticated attackers to modify flows and execute system commands on exposed hosts.SecurityOnline It reported that live exploitation began around 30 October 2026, with automated attack flows observed against exposed systems.SecurityOnline The accounts do not resolve the difference in product identification or state how many systems have been compromised.The Hacker NewsSecurityOnline

The Hacker News reported on 3 November that Defused Cyber had found threat actors attempting to exploit CVE-2026-81648 in the CryptoPayment Gateway WordPress plugin.The Hacker News The vulnerability has a CVSS score of 10.0 and is unpatched.The Hacker News The vulnerability could expose wallet credentials, according to The Hacker News's description.The Hacker News The account gives no number of affected sites and does not confirm successful exploitation or identify a fix.The Hacker News

Imperva said Magento and Adobe Commerce stores in Western Europe, North America and the Asia-Pacific were compromised between 9 and 13 September 2026 through exploitation of CVE-2026-75650.SecurityOnline The firm identified five attack clusters using similar PHP payloads against the same Magento endpoint.SecurityOnline Imperva described a chain that began with PHP code injected through a PayPal-related endpoint and ended with PSK Agent RAT, a 10.5 MB Go binary capable of remote command execution, host discovery and SOCKS5 proxying.SecurityOnline It also found a public PHP webshell variant in some cases.SecurityOnline Imperva said attribution remained unconfirmed, describing a likely Chinese-speaking nexus with moderate confidence.SecurityOnline

Google said on 2 November that it and industry partners dismantled the XCPE botnet, which had infected more than 1.3 million Android TV set-top boxes.Krebs on Security The malware secretly rented users' internet connections to third parties and conducted advertising fraud.Krebs on Security Google's Threat Intelligence Group estimated that the action also cut off access to more than 10 million additional compromised devices, including other Android-based internet of things products.Krebs on Security Google took legal action to shut down associated domains and control servers.Krebs on Security Krebs on Security reported that the botnet was tied to Videostrong Technology Co.; Synthient researcher Ben Brundage said the scale was likely higher than 1.3 million.Krebs on Security