Month: November 2026

Security investigations often begin with a single suspicious IOC, but deciding what it means requires context. The more relevant intelligence analysts can connect to that finding, the better they can determine what deserves attention and what to do next. October’s release introduces a new powerful capability in ANY.RUN’s Interactive Sandbox– Related Threat Context. Now SOCs…

Read more →

An attacker with a working credential may find the system already open to them. That is the uncomfortable reality behind the Cybersecurity and Infrastructure Security Agency’s (CISA) new strategy, “CISA 2030: Defend, Harden, Prevail.” The strategy prioritizes operational technology security, software supply chain integrity and continuity of essential services. It also acknowledges that strong defenses…

Read more →

ConnectWise has restored its Cloud Backup service following a supply-chain attack that disrupted operations for more than 2,300 managed service provider (MSP) partners and exposed security risks across downstream Microsoft 365 environments. The incident, attributed to the China-aligned threat group Storm-0940, involved compromised application credentials that attackers used to access customer tenants. While ConnectWise has…

Read more →

Hackers who breached Harvard University’s Alumni Affairs and Development systems in November 2025 stole data linked to more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned. […]

Read more →

A China-linked hacking group’s use of AI agents to identify security weaknesses during a global espionage campaign is raising concerns about whether enterprises can detect gaps in their defenses before automated attacks exploit them. CrowdStrike reported that the group, tracked as VAPOR PANDA, used an AI-powered penetration testing framework called ARTEX to target more than…

Read more →

Artificial intelligence is reshaping the economics of systems integration, pushing technology services providers to rethink how they deliver projects, price their offerings, and demonstrate value as enterprise customers demand measurable business outcomes. For Endava, a global technology services company combining consulting, digital engineering, and systems integration, those pressures are driving changes to its delivery methodology…

Read more →

Follow the cyber attacks of November 2026 as they happen. This live HACKMAGEDDON dashboard is updated every day with newly vetted incidents. It shows the leading motivations, attack vectors, targeted sectors and countries on an interactive map, plus a filterable, searchable timeline linking to each source.

Read more →

Google Mandiant has warned of the high cost of hijacked access to large language models, or LLMJacking

Read more →

CrowdStrike and Deloitte Spain announced an expanded cybersecurity alliance. This new phase of their collaboration focuses on AI-powered risk advisory. The partnership integrates executive security strategy with the implementation and day-to-day operations of the Security Operations Center (SOC), using Falcon IQ to turn exploitable risks into prioritized actions. This expansion combines CrowdStrike’s Falcon platform with…

Read more →

Apple is the rare big tech play that hasn’t become a giant bet on the AI boom.

Read more →

San Francisco, CA, November 3rd, 2026, CyberNewswire Cogent Security, an applied AI cybersecurity company, reported that the PHP2Shell vulnerability exposed significant gaps in enterprise vulnerability response. Disclosed on October 21, PHP2Shell involved two critical flaws that had remained in PHP for more than a decade. AI-assisted research helped identify the vulnerabilities and develop working exploits…

Read more →

ESET has been tracking a Russia-aligned group it calls Gorbag, which has been breaking into Ukrainian organizations since at least February 2025 using spearphishing attachments and a stealer that erases itself once the data is gone. Spearphishing email message from a compromised email sender (Source: ESET) Every target ESET identified sits in Ukraine. About a…

Read more →

Google dismantled a 1.3 million-device botnet allegedly built by Android TV box maker Videostrong to enable ad fraud and proxy abuse. Google and its partners dismantled a backdoor called XCPE that had enrolled more than 1.3 million set-top boxes in a botnet. The result of the investigation into the malware operation is the striking part:…

Read more →

Criminals who break into corporate cloud accounts are using the stolen access to run AI models at the victim’s expense, in some cases racking up more than $100,000 in charges in a single day, Google Threat Intelligence Group (GTIG) and Mandiant researchers have found. Usage chart showing LLMJacking generating a spike in API requests (Source:…

Read more →

Google and partners have taken down the XCPE botnet attributed to Chinese device maker Videostrong

Read more →

Ubuntu has published fixes for CVE-2026-98432, a critical Linux kernel flaw in IPv4 TCP connection handling. It carries a CVSS 3.1 score of 9.8 and can lead to remote code execution. The fixes for Ubuntu 22.04 LTS and newer are in the -proposed pocket, so they are not yet in the default updates channel. Critical…

Read more →

A campaign tracked as Yoba abuses interest in generative AI to push cryptocurrency-mining malware through fake GitHub projects. Check Point Research published its findings on October 27, 2026, after about two months of tracking. The operators pair legitimate, signed OpenAI and Anthropic executables with a malicious winmm.dll, so the payload loads through DLL sideloading. The…

Read more →

“Zoom Got It Done” is the tagline for the company’s new Zoom Ahead campaign, with the focus being how Zoom’s AI-first capabilities take conversations to completion. This one features Kate McKinnon and builds on their “I Use Zoom!” spot with Bowen Yang that kicked off this consumer-friendly campaign late last year. For the record, I’m…

Read more →

OpenAI increased its security bug bounties to encourage independent researchers to find vulnerabilities in its software. The program now offers bonuses for high-quality reports. The program encourages researchers to disclose vulnerabilities responsibly and complements OpenAI’s Defense Factory, where engineers use the company’s models to find and reproduce vulnerabilities and test fixes. New bounty payouts and…

Read more →

Opal Security will host agent.ID, a free virtual event focused on adapting identity and access management (IAM) to AI agents, on November 5, 2026. The event will bring together CISOs and identity leaders from Elastic, Instacart, Notion, Databricks, Knostic and other organizations to discuss how agents can be governed through assigned ownership, defined permissions and…

Read more →

Attackers exploited the critical StyleSmuggler vulnerability in Magento and Adobe Commerce to deploy PSK Agent, a remote access trojan enabling command execution, traffic proxying, and persistent server access. The campaign ran September 9–13, 2026, targeting stores across Western Europe, North America, and Asia-Pacific. Imperva’s earlier analysis reports a CVSS score of 10.0 and exploitation preceding…

Read more →

BTCPay Server, a self-hosted, open-source cryptocurrency payment processor, has urged users to install the latest version of its software in response to reports of Bitcoin and Litecoin being stolen from hot wallets on instances running older versions. “Our investigation found that these attacks targeted servers running BTCPay Server 2.4.1 (released on 23 July 2026) or…

Read more →

AI, identity-based attacks, and expanding digital operations are putting pressure on already overstretched cybersecurity teams. Security vendor Barracuda’s Cybersecurity Skills Gap report also found that security teams are struggling to keep pace with expanding responsibilities. The vast majority of the 2,000 IT and security decision-makers surveyed report cybersecurity skills gaps. In particular, the most common…

Read more →

Read more →

Read more →

Read more →

Read more →

Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks. The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. “These attacks aim to encrypt data and extort ransom,” it said…

Read more →

Attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers. No chain reported more than several dozen affected stores, and some had to throw away chilled and frozen food or take it off the shelf. Danfoss, a Danish…

Read more →

NIS2 Article 20 makes management bodies answerable for the access controls they approve, and boards are starting to ask for proof that those controls work. NIS2 board accountability gives directors a more direct role in cybersecurity. Under Article 20, the management bodies of essential and important entities must approve the cybersecurity risk-management measures required by…

Read more →

A Linux kernel flaw that sat unnoticed for nearly five years can let an unprivileged local user take full root control of a system. Tracked as CVE-2026-31695, the bug was found and fixed by researcher Alexander Popov. He has now published a working exploit against a default Fedora 44 Server install on x86_64. The full…

Read more →

DarkBlinders has compromised a high-profile Israeli individual associated with the security sector and a government cloud environment in Iraqi Kurdistan, combining credential phishing, a fake meeting application, and GitHub-based backdoors. Dream Security observed the cyberespionage campaign between August and October 2026 and reported that it remained active at publication. Confirmed activity included credential theft and…

Read more →

AI can find vulnerabilities in minutes, but people still hold the edge in judging what a flaw means for a business. In this Help Net Security interview, Kara Sprague, CEO of HackerOne, talks about business logic bugs, what AI does to the crowd model, and why routine medium-severity findings may pay less. She also covers…

Read more →

Apple warns German Bundestag lawmakers of mercenary spyware attacks; BSI urges victims to assume compromise. The German government is warning politicians and public figures that they were targeted by government-backed spyware. The warning follows Apple’s notifications, which began reaching iPhones on October 29, according to the federal cybersecurity office, the BSI. The BSI says members…

Read more →

Google has announced a $250,000 reward, called the “Root-in-Cloud” program, for researchers who can demonstrate complete administrative takeover of arbitrary Google Cloud projects or organizations without prior access. Google announced the initiative on October 30 to address architectural vulnerabilities that could compromise tenant isolation or cause harmful interactions between cloud services. The program emphasizes research…

Read more →

IBM has disclosed seven vulnerabilities in Langflow OSS, including critical flaws such as authentication bypass and code injection that attackers can exploit remotely without credentials. The bulletin addresses Langflow versions 1.0.0 through 1.12.8 and advises administrators to upgrade to version 1.13.0. According to IBM’s security bulletin, published October 28 and updated October 29, the vulnerabilities…

Read more →

HTTP2Shell (CVE-2026-111497), the critical Brotli bug first known as Node2Shell, is a remote code execution flaw in the compression library inside Node.js, Bun, Envoy, Python and more. AI found it: OpenAI’s agents turned it up in late September during a high-compute red-teaming campaign. Finding bugs is getting faster. Fixing them isn’t. HTTP2Shell shows why that…

Read more →

A campaign by the BITTER threat group that delivers a custom remote access trojan (RAT) called PapRAT to South Asian organizations. FortiGuard attributes the activity to the group with high confidence, based on lure filenames, command-and-control (C2) patterns, file metadata, and malware analysis The campaign uses three chains. The first relies on a malicious LNK…

Read more →

When a developer tells an AI coding agent to “set up a GitHub MCP,” the agent has to pick a package. New research from Glow Labs documents sessions where it picked one out of an archived repository that will never be patched again. Source: Glow Security Reviewing real AI coding session transcripts, Glow Labs found…

Read more →

Amperity will enable Stellantis to recognise customers across brands, households and vehicles to deliver relevant experiences in the moments that matter.

Read more →

A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code. “SIMATIC IoT2050 Advanced devices running

Read more →

Threat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber. The vulnerability in question is CVE-2026-81648, which carries a CVSS score of 10.0. Successful exploitation of the flaw could permit unauthenticated users to delete arbitrary files on the server and extract

Read more →

The IPFire project has released fireperf, an open-source measurement tool that opens connections at a fixed rate and reports what the device in the middle did with each one. It is free software aimed at administrators, developers and testers who evaluate firewalls, routers and other systems that keep a state for every connection. What fireperf…

Read more →

It’s early days for AI-assisted work, and sentiments are mixed about its benefits: Does AI actually bring value and save employees time, or does it bog them down and add unnecessary activities? Data from ActivTrak seems to vacillate between those two potential realities: The latest research from the productivity tracking software company says employees who…

Read more →

Google and industry partners have dismantled the XCPE botnet. This firmware-level backdoor enrolled more than 1.3 million Android set-top boxes. Google Threat Intelligence Group (GTIG) assesses with high confidence that Android OEM and ODM Videostrong Technology Co. built and operated the backdoor for profit. The Google Threat Intelligence report calls it intentional, not a rogue…

Read more →

Cyber Security Architect Planck Technologies | Portugal | Remote – View job details As a Cyber Security Architect, you will design security architectures for telecommunications networks, platforms, and cloud environments. You will define security frameworks, assess risks, conduct threat modeling, and evaluate security technologies. You will partner with engineering teams to embed security into deployments,…

Read more →

WorkOS reported unauthorized access to an internal sales application on October 30, 2026. The investigation found that attackers used an AI-assisted offensive security framework to automate reconnaissance and exploitation. The company’s ongoing inquiry suggests that the incident affected customer relationship management (CRM) and customer support information. However, WorkOS confirmed that there is no evidence showing…

Read more →

Anthropic has launched beta support for running endpoint detection and response (EDR) sensors within Claude Cowork’s local virtual machine. This enhancement gives enterprise security teams visibility into AI agent activity that traditional host-based monitoring cannot detect. The new feature is compatible with Claude Desktop on both Windows and macOS for Team and Enterprise customers. According…

Read more →

San Francisco, CA, 3rd November 2026, CyberNewswire

Read more →

Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user’s Internet connection out to strangers and conducts advertising fraud. Experts involved in the takedown say the action is likely to sever the…

Read more →

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Read more →

Just a couple of weeks after a cyberattack on French supermarket refrigeration systems resulted in spoiled food, and even some fires, retailers in Belgium, Ireland, Sweden, Finland, and Estonia were hit with nearly-identical attacks on Monday. The mid-October attack prompted an advisory from the French Computer Emergency Response Team (CERT-FR) recommending that organizations disconnect any…

Read more →

From the Banana equivalent dose article in Wikipedia: The major natural source of radioactivity in plant tissue is potassium: 0.0117% of the naturally occurring potassium is the unstable isotope potassium-40. This isotope decays with a half-life of about 1.25 billion years (4×1016 seconds), and therefore the radioactivity of natural potassium is about 31 becquerel/gram (Bq/g),…

Read more →

Understanding how attackers can move through an environment after gaining initial access is key to protecting critical assets, security experts say.

Read more →

Google and an assortment of partners shut down a botnet that an approved Android device manufacturer purposefully deployed across more than 1.3 million TV set-top boxes, the company said Monday.  Videostrong Technology Co., a China-based Android original equipment and device manufacturer, implanted a backdoor into multiple devices it sold. Those backdoors established XCPE, an expansive…

Read more →

Investors are awaiting the first detailed address from new CEO John Ternus.

Read more →

Chinese hackers used ARTEX, an open-source, multi-agent AI penetration-testing framework, in attacks against more than 200 organizations across 14 countries. […]

Read more →

Brings 25 years of global experience to help Australian customers connect print, automation, workflows and information.

Read more →

While researching the inner workings of Geiger-Müller counters, I stumbled upon Rad Pro. It’s an open-source project developing firmware for cheap GM meters. You get yourself a GM meter and replace its firmware with Rad Pro. For some meters (like FNIRSI), it’s as simple as mounting the meter as a USB storage device and copying…

Read more →

Major industry groups are clamoring for Congress to include a 10-year extension of a law that they say is essential to cyber threat information sharing in the annual defense policy bill. Congress has mixed a series of short-term renewals and lapses of the Cybersecurity Information Sharing Act of 2015 (CISA 2015) — which provides legal…

Read more →

In this article Classifying the vulnerability landscape Vulnerabilities exploited in the wild Where defenders should focus Patching is slow, while exploitation is fast Impact, exposure and where to focus Next in line How Microsoft Security helps defenders act References Learn More The vulnerability landscape continues to expand. From 1999 through September 2026, approximately 383,000 software…

Read more →

What did you last record on your iPhone? A lecture, perhaps, a call with your landlord, or notes…

Read more →

Financial technology company Abrigo has restored its Sageworks risk management application, except for borrower-facing capabilities, following an outage triggered by “irregular activity” in its environment. […]

Read more →

VOLTA is an AI-powered infostealer that steals personal data, then uses LLMs to assess victims’ value and rank targets for attackers. Cisco Talos has analyzed a new Windows infostealer called VOLTA, which calls itself VOLTA-AUTODOXER. It steals the usual data, then hands the loot to a large language model that ranks what the victim is…

Read more →

The following resources address the coverage available for PHP2Shell today, as well as ways Cisco customers can begin to increase resilience for whatever AI-driven threat comes next.

Read more →

Google and industry partners have dismantled the XCPE malware botnet consisting of more than 1.3 million Android TV streaming TV boxes that Google says its manufacturer intentionally infected with malware to generate revenue through cybercrime activities. […]

Read more →

As the email administrator for your organization’s domain, you receive a Domain-based Message Authentication, Reporting, and Conformance (DMARC) aggregate report showing email passing DomainKeys Identified Mail (DKIM) verification as though it came from your domain, sent from IP addresses you don’t recognize to recipients you didn’t contact. To clear the issue, you rotate your DKIM…

Read more →

On the heels of Anthropic’s similar move, the change will be tested among select users before being rolled out.

Read more →

The partnership could provide one of the nation’s largest AI companies with a bevy of personal medical data. 

Read more →

New reports indicate the touchscreens are to become the standard on premium MacBook Pros.

Read more →

The open-source browser’s newest feature lets you pop out a page – or part of a page – into its own mini window. See why this is incredibly cool.

Read more →

Huntress breaks down threat hunting, how the process works, which methodologies matter, and why human-led detection catches what automation misses.

Read more →

Some attacks this week didn’t need much of a trick. A fake support call, a trusted extension, a shared link, or a device with no password. Small things that people barely think about. Yet each was enough to cause serious trouble. Then there were the bigger messes. Billions stolen, hidden networks of hacked devices, poisoned…

Read more →

HomeView settings reveal potential video recording and streaming options alongside privacy features.

Read more →

It turns out even bots can’t escape bureaucracy.

Read more →

Every SIEM can hand its data back in one of two shapes: the original raw events, or its own parsed JSON. For analysis outside the SIEM, raw events are almost always the better choice. Export them for a narrow time window through the API or CLI, not the browser. The table below shows the best…

Read more →

Miami, United States, November 2nd, 2026, CyberNewswire Prisma Browser for Business joins Guardz to connect browser protection with email, identity and endpoint security, helping security teams investigate and respond to threats across the workspace Guardz, the Agentic Workspace Security platform built for managed service providers (MSPs), today announced the integration of Prisma Browser for Business…

Read more →

AI workloads are spreading across specialized cloud environments. Cisco AI Transit is designed to extend the existing SD-WAN fabric to these destinations, helping network teams preserve a common policy model.

Read more →

CISA added two new Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) to its Known Exploited Vulnerabilities catalog on Friday, after Ivanti updated an earlier security advisory with details about the flaws. Three flaws chained to gain a foothold CVE-2026-111357, a missing authentication for a critical function vulnerability that allows a local authenticated attacker to escalate their…

Read more →

For the latest discoveries in cyber research for the week of 2nd November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Binance, a global cryptocurrency exchange, has suffered a cyberattack resulting in the theft of approximately $6.3 billion in digital assets. Attackers reportedly compromised a DevOps engineer’s laptop and abused internal wallet infrastructure…

Read more →

LogTotal accepts three kinds of files: Windows event logs in EVTX, JSON (one event per line works best), and syslog-style text. Text and JSON uploads go through the sanitize step before analysis; EVTX files don’t yet. If your logs are in some other shape, there’s almost always a one-line command that converts them. The common…

Read more →

Google shut down the servers behind XCPE, a backdoor hidden in the firmware of Android TV set-top boxes. Google’s Threat Intelligence Group attributes the operation with high confidence to Videostrong Technology, the company that manufactured many of those boxes. More than 1.3 million devices were enrolled. XCPE malware overview (Source: Google) Access The business model…

Read more →

A botnet of more than 1.3 million Android devices, mostly TV set-top boxes, lost control of its servers in late October in a takedown led by Google. Google says it is highly confident that device maker Videostrong intentionally put a backdoor in the boxes and sold access to criminals. They used the boxes for ad fraud…

Read more →

Broadcom’s restructuring of the VMware ecosystem is changing how technology providers compete, collaborate and make money, pushing some partners toward new business models as the market consolidates. A new partnership between AHEAD and RapidScale illustrates that shift, with the companies dividing licensing and managed cloud responsibilities rather than pursuing an acquisition. In an interview with…

Read more →

Administrators can read and export every event log, but only from an elevated prompt. For everyone else, the built-in Event Log Readers group grants read access to most logs, locally and remotely, without admin rights. Add the account with net localgroup “Event Log Readers” /add, then sign out and back in. A handful of channels…

Read more →

On most distributions, two group memberships cover nearly everything an analyst needs: adm for the text logs in /var/log on Debian and Ubuntu, and systemd-journal for the full system journal. Add the account with sudo usermod -aG adm,systemd-journal and start a new login session. A few logs stay root-only by design, notably /var/log/secure and /var/log/messages…

Read more →

The maintainer of BTCPay Server, an open-source cryptocurrency payment processor, has urged users to install the latest version as hackers have been draining “hot wallets” on instances running older versions. […]

Read more →

Mobile carriers can retain years of call and text metadata, exposing sensitive details about customers’ relationships, locations, and daily routines if breached. Cape examines the privacy risks of long-term telecom data retention and how its mobile service reduces exposure by automatically deleting call records. […]

Read more →

The latest “Digital Defense Report” identifies government agencies as prime targets for AI attacks but doesn’t mention that they are broadly being targeted through Microsoft bugs.

Read more →

Last week, an often-ignored TCP option, introduced in 2020, made the news due to a new vulnerability in Linux’s implementation (RFC 8684,  CVE-2026-98432) Instead of looking at the vulnerability, I am using this diary to talk a bit about multipath TCP (MPTCP) and how you may see it used in your network. What is MPTCP? Traditionally, TCP…

Read more →

A new Windows infostealer sends the data it steals to an AI model and asks it to rank the victim’s assets by how much money they could bring in, Cisco Talos has found. “There is a new idea in the cybercrime world — cast a wide net, steal everything, and let AI sort out the…

Read more →

Cybersecurity researchers have disclosed details of a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026. According to a report published by Dream Research Labs, the campaign has led to the compromise of a high-profile individual in Israel, along with additional compromises…

Read more →