← All threat briefs

Daily Cybersecurity Brief — 2026-11-05

SECURITY // 2026-11-05

Daily Cybersecurity Brief — 2026-11-05

High-Signal Security Journalism

  • Want to Rent an Internet Address at the White House? — Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder’s web hosting business... (Source: Krebs on Security)
  • Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware — A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations. "Active since at least February 2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice... (Source: The Hacker News)
  • Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets — BTCPay Server, a self-hosted, open-source cryptocurrency payment processor, has urged users to install the latest version of its software in response to reports of Bitcoin and Litecoin being stolen from hot wallets on instances running older versions. "Our investigation found that these attacks targ... (Source: The Hacker News)
  • The Race Against the 3-Day Clock: How Rapid7 Helps Meet BOD 26-04 Compliance — Introduction to BOD 26-04On June 10, 2026, CISA issued Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk." Strip away the regulatory language and it reads like a single operational fact: for a vulnerability that is actively exploited, publicly reachable, and grants an... (Source: Rapid7 Blog)

Threat Intelligence & Malware Analysis

  • Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies — Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user’s Internet connection out to strangers and conducts advertising fraud. Experts involved in the take... (Source: Krebs on Security)
  • Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a medium-severity security flaw impacting multiple Apple operating systems to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation. The vulnerability in question is CVE-2024-278... (Source: The Hacker News)
  • Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root — A flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own. The attacker's code then runs as root, according to advisories that Debian, Ubuntu, and APT's developers published on November 4. The attack needs AP... (Source: The Hacker News)
  • APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits — The Russia-linked threat actor known as APT29 is presumed to be behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack involving a Ukrainian web analytics service called Plerdy SEO Tracker. "The injected JavaS... (Source: The Hacker News)
  • China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor — A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP). Th... (Source: The Hacker News)
  • Russian Police Arrest 3 Suspected VasyGrek Hackers, Dismantle Criminal Infrastructure — Russian authorities have arrested three suspected members of a threat group known as VasyGrek and dismantled its criminal infrastructure. Also known as Fluffy Wolf, the threat actor has a history of targeting Russian and international companies since 2016. The Ministry of Internal Affairs of the Rus... (Source: The Hacker News)
  • Chainstack Reports Production Systems Breach Exposing Customer Data and Password Hashes — Blockchain infrastructure provider Chainstack on Tuesday disclosed that it was targeted in a cyber attack that allowed an unauthorized party to gain access to some parts of its infrastructure. The incident is assessed to be part of a large-scale, artificial intelligence (AI)-powered attack campaign ... (Source: The Hacker News)
  • Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft — Binance on Tuesday said the record-setting theft of $6.43 billion in assets from the world's largest cryptocurrency exchange was the culmination of a "sophisticated, multi-stage campaign" that involved the use of a tampered Homebrew installation and recruitment-themed social engineering attack targe... (Source: The Hacker News)
  • Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges — Google on Monday warned that threat actors are hijacking enterprise access to Large Language Models (LLMs) to fraudulently leverage expensive computing resources and AI services. The tactic is called LLMjacking, a form of resource hijacking adapted for the LLM era, where an attacker obtains an API k... (Source: The Hacker News)
  • cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes — An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers. The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an... (Source: The Hacker News)
  • Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw — Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks. The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated v... (Source: The Hacker News)
  • Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors — A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an u... (Source: The Hacker News)
  • Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials — Threat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber. The vulnerability in question is CVE-2026-81648, which carries a CVSS score of 10.0. Successful exploitation of the fl... (Source: The Hacker News)
  • ⚡ Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, Android Spyware and More — Some attacks this week didn't need much of a trick. A fake support call, a trusted extension, a shared link, or a device with no password. Small things that people barely think about. Yet each was enough to cause serious trouble. Then there were the bigger messes. Billions stolen, hidden networks of... (Source: The Hacker News)
  • Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access — A botnet of more than 1.3 million Android devices, mostly TV set-top boxes, lost control of its servers in late October in a takedown led by Google. Google says it is highly confident that device maker Videostrong intentionally put a backdoor in the boxes and sold access to criminals. They used the ... (Source: The Hacker News)
  • DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment — Cybersecurity researchers have disclosed details of a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026. According to a report published by Dream Research Labs, the campaign has led to the compromise of a ... (Source: The Hacker News)
  • Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts — Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been track... (Source: The Hacker News)
  • See the agents, set the terms: new visibility and control for personal agents — Personal agents are the intermediary between humans and the Internet, turning a person's instructions into requests and actions on websites. A customer might ask a personal agent to compare products across your site, find support articles, or complete a purchase. To a site owner, all three interacti... (Source: Cloudflare Blog (security tag))

Vulnerabilities & Exploits

  • Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution — Zyxel GS1900 network switches that received the vendor's earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found. The exploit lets anyone who can reach a switch's web management interface run commands on it without logging in. Zyxel has r... (Source: The Hacker News)
  • OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run — OpenAI on Wednesday detailed a pipeline that employed an upcoming cyber-focused artificial intelligence (AI) model to validate and patch 948 local privilege escalation vulnerabilities in Linux for $1.2 million in API costs. "Our prototype identified and analyzed 2,308 candidate Linux kernel findings... (Source: The Hacker News)
  • SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records — SonicWall has warned of two vulnerabilities impacting end-of-life Global Management System (GMS) systems that it said will not be patched. Details of the security flaws, which affect SonicWall GMS 9.5.2 and earlier versions, are below - CVE-2026-109593 (CVSS score: 9.1) - An unauthenticated file rea... (Source: The Hacker News)
  • Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads — A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick. The Rails project disclosed the flaw in an advisory and fixed it in versions 8.1.4.1 and 8.0.5.2. The flaw ... (Source: The Hacker News)
  • Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory — Two flaws in the Xen hypervisor allow a malicious guest virtual machine (VM) to read and write the memory of other VMs on the same host, including dom0. Dom0 is the VM that, by default, has full permissions and manages the others. Patches are out, and there is no known mitigation, the Xen Project sa... (Source: The Hacker News)
  • Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction — A critical Android flaw could allow an attacker to run code on a phone without any user action remotely, Google said in its November security bulletin. The flaw, CVE-2026-58868, affects Android 14 through 17. Phones get the fix with security patch level 2026-11-01 or later, which phone makers and ca... (Source: The Hacker News)
  • CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), is a case of Time-... (Source: The Hacker News)
  • Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access — Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device. The vulnerabilities, a pre-authentication authorization bypass vulnerability and a command i... (Source: The Hacker News)
  • Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing — Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update. The flaw, tra... (Source: The Hacker News)
  • The 4 Elements of Exposure Prioritization and How to Operationalize Them — Your team is remediating more vulnerabilities than ever, yet your breach risk has barely changed. You're spending too much time and effort on exposures attackers may never exploit, while higher-risk exposures sit, waiting in the queue. Gartner®'s report on exposure prioritization states that fewer t... (Source: The Hacker News)
  • Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers — Two critical flaws in Langflow could let a remote attacker with no account bypass authentication or run arbitrary code, IBM said last week. Langflow is an open-source tool for building AI agents and workflows, and its vulnerability reports go to IBM. Every release from 1.0.0 through 1.12.8 has the f... (Source: The Hacker News)
  • Is Your SOC Ready for AI Agents? A Maturity Check Before You Deploy — Forty percent of security teams now use AI every day, and another 56% are testing it. Only 4% have no plans to adopt it, according to Prophet Security's State of AI in Security Operations 2026 survey of more than 250 CISOs, SOC leaders and practitioners. For the teams still testing, the next decisio... (Source: The Hacker News)
  • Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) — OverviewOn October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357, a missing authentication for critical function vulnerability (CWE-306), with a CVSSv3.1 score of 8.8;... (Source: Rapid7 Blog)
  • Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities — You run security at your organization. It's 7:00 am, and you're having breakfast. You receive a ping: a new critical vulnerability has been disclosed. Your team scrambles to compare vendor advisories, read technical research, check which systems run the affected software, and answer familiar questio... (Source: Cloudflare Blog (security tag))
  • Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles — Key Points Check Point Research analyzed the Haiou jailbreak bundle, a prompt package targeting OpenAI Codex. Such jailbreaks are designed to weaken model guardrails and enable tasks related to hacking, software cracking, and information security. The analyzed bundle can be classified as prompt adwa... (Source: Check Point Research)
  • 2nd November – Threat Intelligence Report — For the latest discoveries in cyber research for the week of 2nd November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Binance, a global cryptocurrency exchange, has suffered a cyberattack resulting in the theft of approximately $6.3 billion in digital assets. Attacker... (Source: Check Point Research)
  • Guiding Customers Through Critical PHP Vulnerabilities — Over the past week, our industry has faced a wave of critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). As Palo Alto Networks Chief Technology and Product Officer Lee Klarich highlighted, these high-severity vulnerability disclosures are just the beginning of a massive accelerati... (Source: Palo Alto Networks Blog)

AI/ML Security

  • Researchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak Toolkit — Cybersecurity researchers have disclosed details of an OpenAI Codex jailbreak bundle that's designed to modify an artificial intelligence (AI) agent's trusted instructions to insert advertisements for a third-party AI gateway. The phenomenon has been codenamed prompt adware by Check Point Research. ... (Source: The Hacker News)
  • Radio With No Radar: Why Agent Runtime Security Fails Without the Layers Beneath It — Nearly every agent security pitch now ends on the same promise: the product stops the bad action in real time. The promise holds for one kind of agent, the kind whose traffic passes through a gateway the enterprise owns. Most agents never touch one. One recent case shows what that gap looks like in ... (Source: The Hacker News)
  • Rapid7 Achieves ISO/IEC 42001 Certification for its AI Management System — Exciting news for AI governance! Rapid7 has achieved ISO/IEC 42001:2023 certification for our Artificial Intelligence Management System (AIMS). The certificate was issued by Schellman Compliance, LLC, an ANAB accredited certification body, following an independent audit of how we govern the AI syste... (Source: Rapid7 Blog)
  • The ROI of Agentic Remediation: Real-World Results with Wiz Green Agent — Learn how Fireblocks, Rogo, and project44 used Green Agent to eliminate cross-team blockers and accelerate critical risk resolution. (Source: Wiz Blog)
  • From Reactive to Proactive: Empowering SOC Teams with the Wiz Red and Blue Agents — Red Agent gives SOC teams validated pre-breach alerts, while Blue Agent investigates active threats at machine speed, helping teams stay ahead in the AI threat era. (Source: Wiz Blog)
  • New Cortex XDR Integration with Claude Cowork Secures Desktop AI Agents — AI agents working directly on the desktop offer new ways to automate complex tasks, yet they operate outside traditional endpoint controls and pose unacceptable risks to many security leaders. Today, we're announcing a new Cortex XDR integration with Claude Cowork to deliver visibility and threat de... (Source: Palo Alto Networks Blog)

Vendor Advisories & Patches

  • mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious Activity — Customers of the mSecure password manager are being urged to act now to protect the confidential information they store in it, possibly by changing passwords, resetting two-factor authentication (2FA), and removing passkeys. The warning came in an email sent on November 3 in the name of developer mS... (Source: The Hacker News)
  • Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data — Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged accounts, including one for a domain controller. Microsoft said ... (Source: The Hacker News)

Reports & Analysis

  • New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food — Attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers. No chain reported more than several dozen affected stores, and some had to throw away chilled an... (Source: The Hacker News)