Cybersecurity

Hackers hijack cPGuard autoupdate to deploy backdoor, steal data

Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script.

WorkOS says attacker used ARTEX AI to breach internal sales app

Developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications.

mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious Activity

Customers of the mSecure password manager are being urged to act now to protect the confidential information they store in it, possibly by changing passwords, resetting two-factor authentication (2FA), and removing passkeys.

Chainstack Reports Production Systems Breach Exposing Customer Data and Password Hashes

Blockchain infrastructure provider Chainstack on Tuesday disclosed that it was targeted in a cyber attack that allowed an unauthorized party to gain access to some parts of its infrastructure.

Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft

Binance on Tuesday said the record-setting theft of $6.43 billion in assets from the world's largest cryptocurrency exchange was the culmination of a "sophisticated, multi-stage campaign" that involved the use of a tampered Homebrew…

Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges

Google on Monday warned that threat actors are hijacking enterprise access to Large Language Models (LLMs) to fraudulently leverage expensive computing resources and AI services.

Also: BleepingComputer

Russia, China likely to ramp up UK cyberattacks

Barracuda warns of critical flaws allowing root access to devices

Cybersecurity company Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges.

Also: The Hacker News

Gartner Predicts SOCs Will Have 50% More Engineers Than Analysts by 2028

Gartner predicts that security operations centers will have 50% more engineers than analysts by 2028 as AI agents take over routine alert handling.

Frontline Education Data Breach Impacts Over 1.3 Million

Hackers exploited a flaw in third-party software and stole the personal information of school district staff and students.

UK school estate hit by 3AM ransomware in suspected AI-assisted attack

A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host.

Android’s November 2026 Updates Patch Over 200 Vulnerabilities

The most severe is a critical flaw in Framework leading to remote code execution without user interaction.

Critical Node-RED Flaw Exploited in Attacks

Multiple attacks from the same IP address attempted to deploy various payloads, including a Linux bot and webshells.

Also: BleepingComputer

Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed.

Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials

Threat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber.

Macronix Builds Hardware Security into NOR Flash Ahead of EU Cyber Resilience Act

The European Union's Cyber Resilience Act (CRA), which becomes mandatory in December 2027, is raising the bar for cybersecurity in connected devices.

UK to face AI-powered cyber attacks within two years, warns NCSC

In a worst-case scenario, self-replicating artificial intelligence could launch cyber attacks at will against UK targets by 2028

Fintech platform Sageworks taken offline after suspected cyberattack

Financial technology company Abrigo has restored its Sageworks risk management application, except for borrower-facing capabilities, following an outage triggered by "irregular activity" in its environment.

⚡ Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, Android Spyware and More

Some attacks this week didn't need much of a trick. A fake support call, a trusted extension, a shared link, or a device with no password. Small things that people barely think about. Yet each was enough to cause serious trouble.

Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access

A botnet of more than 1.3 million Android devices, mostly TV set-top boxes, lost control of its servers in late October in a takedown led by Google.

Also: BleepingComputer

Telenor flags Nordic cybersecurity need

Telenor warned Nordic businesses could be caught out by a major cyberattack after its research showed a less than 50% rate of preparedness regarding critical services.

Malicious Claude Code Extension Served in Cursor Supply Chain Attack

The extension performed host reconnaissance and attempted to create a reverse SSH tunnel.

Synology warns of C3RB3R ransomware attacks targeting NAS devices

Taiwanese network-attached storage (NAS) appliance maker Synology warned customers to update their devices immediately due to a surge in C3RB3r ransomware attacks.

Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data

Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs.