Overview of incoming advisories.
2179 results found
A major security incident at Binance resulted in a $6.34 billion hack traced back to a malicious coding assignment targeting developer machines. The attack chain involved compromise of developer endpoints, exploitation of AI tooling, and ultimately unauthorized wallet signing. The article from StepSecurity analyzes the November 3 findings and outlines how the breach progressed from initial developer machine compromise to critical wallet operations. It highlights the risks of supply chain and developer-environment attacks in cryptocurrency platforms. The article also provides guidance on developer-machine security controls and incident response recommendations to prevent similar attacks.
View original advisory →Attackers compromised the update infrastructure of cPGuard, a web security suite, to distribute a backdoor and a data-stealing script to its users. The attack targeted the autoupdate mechanism, allowing threat actors to push malicious code to systems running cPGuard. This represents a supply chain attack where the security product itself became the delivery vector. The backdoor enables persistent access to compromised systems, while the data-stealing component exfiltrates sensitive information. Users of cPGuard who had automatic updates enabled are potentially affected. The incident highlights the risks of trusting automated update mechanisms without integrity verification.
View original advisory →North Korean hackers conducted a sophisticated social engineering attack against Binance by using a fake job interview to trick an employee into installing malware. The malware allowed the attackers to compromise Binance's wallet infrastructure, resulting in the theft of approximately $6.34 billion in digital assets. This attack is attributed to North Korean state-sponsored threat actors, consistent with the Lazarus Group's known tactics of targeting cryptocurrency exchanges. The use of fake job interviews as an initial infection vector is a well-documented technique employed by North Korean cyber actors. This represents one of the largest cryptocurrency heists in history, highlighting the severe financial impact of social engineering combined with malware deployment against major crypto platforms.
View original advisory →LLMjacking attacks involve threat actors hijacking cloud-hosted large language model (LLM) services to generate fraudulent usage charges. Some victim organizations are losing more than $100,000 per day due to unauthorized AI resource consumption. Google has highlighted these attacks as a significant and growing threat to cloud customers. Attackers typically gain access to cloud credentials and then abuse AI services at scale. The cumulative financial damage from these attacks has surpassed $1 million in cloud AI charges. This type of attack targets the billing infrastructure of cloud AI platforms rather than traditional data exfiltration. Organizations using cloud-based AI services are urged to monitor usage anomalies and secure their credentials.
View original advisory →Blockchain infrastructure provider Chainstack disclosed a cyberattack resulting in unauthorized access to parts of its production infrastructure. The breach exposed customer data and password hashes. The incident is believed to be part of a large-scale, AI-powered attack campaign that was identified the previous week. An external attacker gained unauthorized access to portions of Chainstack's systems. The attack highlights growing concerns about AI-assisted cyberattacks targeting cloud and blockchain infrastructure providers. Chainstack serves as a managed blockchain node infrastructure provider used by developers and enterprises.
View original advisory →Binance disclosed a record-breaking $6.43 billion theft resulting from a sophisticated, multi-stage attack campaign. The breach involved a tampered Homebrew installation used as a supply chain attack vector, combined with recruitment-themed social engineering targeting two Binance engineers. The attackers leveraged AI tool abuse alongside fake job interview lures to compromise internal systems. Binance emphasized this was not a simple phishing incident but a carefully orchestrated operation. The attack highlights the growing risk of supply chain manipulation and social engineering in the cryptocurrency sector. This incident represents one of the largest cryptocurrency thefts in history.
View original advisory →Barracuda has disclosed two vulnerabilities affecting its products that can be chained together to allow attackers to bypass authorization controls and gain root access. The first is a pre-authentication authorization bypass vulnerability and the second is a command injection vulnerability. Together they have been assigned CVE-2026-116606 with a CVSS score of 9.3, indicating critical severity. If successfully exploited, an unauthenticated attacker could potentially take full control of a vulnerable Barracuda device. Organizations using affected Barracuda products are advised to apply patches or mitigations promptly.
View original advisory →Google has issued a warning about a growing threat called LLMjacking, where attackers hijack enterprise access to Large Language Models (LLMs) to exploit expensive AI computing resources. Threat actors obtain API keys through various means including phishing, source code leaks, misconfigured environments, and exposed client-side code. The attacks can cost victim enterprises up to $1 million in fraudulent cloud charges. LLMjacking is an evolution of traditional resource hijacking adapted specifically for the AI/LLM era. The attackers leverage stolen credentials to abuse AI services at the expense of legitimate account holders. This represents a significant financial and operational risk for enterprises using cloud-based AI services.
View original advisory →An attacker compromised the update distribution system of cPGuard, a Linux server security tool developed by OPSSHIELD, on November 2. The attacker used the hijacked update channel to push a malicious script to customer Linux servers. The script deployed a backdoor and harvested password hashes along with other sensitive files. OPSSHIELD confirmed that the attacker has already exfiltrated some of the collected data. Affected versions include cPGuard 5.88.25 and later. This is a supply chain attack targeting the software update mechanism of a widely used security product. Server administrators using affected versions should treat their systems as compromised and rotate credentials immediately.
View original advisory →Barracuda Networks has issued a warning to customers about two critical vulnerabilities affecting its devices. These flaws allow attackers to execute commands with root privileges, potentially giving full control over affected systems. Barracuda is urging customers to apply patches immediately to remediate the risk. The vulnerabilities are considered critical due to the level of access they grant to unauthenticated or unauthorized attackers. No specific CVE identifiers are mentioned in the available content. Barracuda Networks, a cybersecurity vendor, has historically been targeted by sophisticated threat actors exploiting its appliances. The advisory highlights the ongoing risk posed by vulnerabilities in network security appliances. Organizations using Barracuda products should prioritize patching these flaws as soon as possible.
View original advisory →CISA issued an advisory for Subnet Solutions PowerSYSTEM Center disclosing two critical vulnerabilities affecting multiple versions of the product. CVE-2026-63017 involves incorrect authorization allowing low-privileged authenticated users to access administrator-level resources. CVE-2026-63774 is an SQL injection vulnerability in the report designer enabling authenticated users to execute unauthorized SQL commands. Both vulnerabilities carry CVSS v3.1 scores of 9.0 (CRITICAL) and CVSS v4.0 scores of 9.4 (CRITICAL). Affected products include PowerSYSTEM Center 2020 (<=5.29.x), 2024 (6.0.x-6.2.x), and 2026 (7.0.x-7.1.x). The software is deployed worldwide in Critical Manufacturing and Energy sectors. Mitigations include upgrading to PowerSYSTEM Center 2026 Update 1.1, monitoring user activity, and disabling access to browser developer tools and the report designer. No known public exploitation has been reported, and the vulnerabilities are not exploitable remotely.
View original advisory →A Russia-aligned threat actor known as Gorbag has been conducting cyberattacks against Ukrainian organizations since at least February 2025. The group primarily targets law enforcement and justice entities, local administrations near the front line, and the defense sector in Ukraine. Gorbag exploits a vulnerability in WinRAR to deploy information-stealing malware. The campaign is focused exclusively on Ukrainian targets, suggesting a geopolitical motivation tied to the ongoing conflict. ESET researchers have been tracking this group and its activities. The malware used is described as a simple but effective information stealer. The exploitation of WinRAR flaws is a known technique used by various threat actors, particularly those aligned with Russian interests.
View original advisory →BTCPay Server, an open-source self-hosted cryptocurrency payment processor, has been actively exploited by hackers to steal Bitcoin and Litecoin from hot wallets. The attacks specifically targeted instances running BTCPay Server version 2.4.1 (released July 23, 2026) or earlier. The BTCPay Server team has urged all users to immediately update to the latest version to mitigate the risk. Hot wallets, being internet-connected, are particularly vulnerable to such attacks. The exploitation appears to be actively ongoing, making this a high-severity incident for anyone running older versions of the software. No specific CVE identifier was mentioned in the available content, but the vulnerability is tied to a confirmed flaw in older releases.
View original advisory →Synology is urging customers to update their DiskStation Manager (DSM) software after ransomware attacks were observed targeting NAS devices. Threat actors are exploiting a vulnerability that was patched in December 2024, focusing on devices still running outdated DSM versions. The attacks aim to encrypt victim data and demand ransom payments. Synology has issued a public statement advising immediate updates to mitigate risk. The incident highlights the ongoing danger of unpatched network-attached storage devices exposed to the internet.
View original advisory →Attackers remotely manipulated refrigeration control settings at supermarkets across multiple European countries including Belgium, Sweden, and Estonia overnight on November 2, 2026. The attacks caused fridges and freezers to warm up, forcing stores to discard or pull chilled and frozen food products. No single chain reported more than several dozen affected stores. Danfoss, a Danish manufacturer of refrigeration controls, appears to be connected to the affected systems. This appears to be a second wave of such attacks targeting critical food retail infrastructure. The incident highlights the vulnerability of industrial control systems used in everyday commercial settings. The attacks demonstrate the potential for cyberattacks to have direct physical and economic consequences on food supply chains.
View original advisory →A maximum-severity vulnerability (CVE-2026-58115, CVSS 10.0) in Siemens SIMATIC IoT2050 Advanced devices is being actively exploited in the wild. The flaw involves missing authentication for a critical function, allowing unauthenticated remote attackers to execute arbitrary code. Attackers are leveraging this vulnerability to plant remote command backdoors on affected devices. The issue was disclosed by VulnCheck. The affected product is Siemens SIMATIC IoT2050 Advanced, an industrial IoT gateway device. The critical nature of the vulnerability and its active exploitation make it a high-priority concern for industrial and operational technology environments. Organizations using these devices are urged to apply patches or mitigations immediately.
View original advisory →Threat actors are actively attempting to exploit a critical unpatched vulnerability (CVE-2026-81648) in the CryptoPayment Gateway WordPress plugin, which carries a maximum CVSS score of 10.0. The flaw allows unauthenticated users to delete arbitrary files on the server and extract sensitive wallet credentials. The vulnerability has not yet been patched, making all installations potentially at risk. Findings were reported by Defused Cyber. The exploitation of this flaw could lead to significant financial losses given the cryptocurrency payment context. The combination of file deletion and credential extraction capabilities makes this a severe threat to affected site owners.
View original advisory →A critical time-of-check time-of-use (TOCTOU) race condition vulnerability has been identified in WordPress Core affecting versions 4.7.0 through 7.1.3. The flaw allows unauthenticated attackers to execute arbitrary code on the server by exploiting predictable, web-accessible staging paths used during full-package core upgrades. The attack window exists during the upgrade process, making it a significant risk for sites undergoing updates. CISA has flagged this vulnerability under BOD 26-04, requiring prioritized patching. WordPress has released version 7.1.4 to address the issue. Organizations are urged to update immediately and conduct forensic triage per CISA implementation guidance. The vulnerability has been assigned CVE-2026-119977 and is documented in the NVD. Wordfence has also published threat intelligence details on the exploit mechanism.
View original advisory →Unit 42 published its threat intelligence highlights for November 2, 2026, covering a broad range of current cyber threats. The report focuses on cyberespionage activities targeting organizations globally. Financial extortion campaigns are also highlighted as a significant threat vector. A notable trend discussed is the rapid adoption of artificial intelligence across offensive cybersecurity workflows by threat actors. The article serves as a summary digest of the most pressing threat intelligence from Unit 42 researchers. It signals an evolving threat landscape where AI is increasingly weaponized by adversaries.
View original advisory →Chinese threat actors deployed ARTEX, an open-source multi-agent AI penetration-testing framework, in automated attacks targeting over 200 organizations across 14 countries. The use of AI-driven tooling marks a significant escalation in the sophistication and scale of state-sponsored cyberattacks. ARTEX enables automated reconnaissance, exploitation, and lateral movement, reducing the need for manual intervention. The breadth of the campaign — spanning 14 countries — suggests a broad targeting strategy potentially aimed at intelligence gathering or pre-positioning. The use of open-source AI frameworks lowers the barrier for advanced attack automation. This incident highlights the growing threat of AI-augmented offensive cyber operations by nation-state actors.
View original advisory →