Tuesday, 3 November 2026

Binance CEO says ‘months-long campaign’ led to $6.3 billion theft as N. Korea denies responsibility (opens in a new tab)

The Record ·fetched 3 Nov 2026, 19:39 UTC Must read agreed3/3

Why readBinance's own post-mortem lays out the full intrusion chain behind the $6.3 billion theft, including a detail most readers will not have: detection and device replacement did not evict the attackers.

Binance says the theft was the end of a multi-stage campaign that began in June, when an engineer downloaded malicious software while installing a popular AI coding tool. The security team caught the malware and swapped the device, but the attackers retained access and went on to combine fake recruitment interviews, further endpoint compromise, abuse of internal AI tooling and an advanced transaction-authorisation technique across multiple employees. CEO Richard Teng framed it as months of patient work rather than a single phishing failure; North Korea denies involvement.

Also covered byHacker News (opens in a new tab),BBC Technology (opens in a new tab),BBC Technology (opens in a new tab),Dark Reading (opens in a new tab),Aikido Security (opens in a new tab).

therecord.media → (opens in a new tab)

antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer (opens in a new tab)

SafeDep (supply chain) ·fetched 3 Nov 2026, 11:39 UTC Must read Research agreed3/3

Why readA forged commit on a package pulled roughly 98,000 times a week shows an attacker rewriting repository history to make malicious code look like a months-old release.

On October 31, 2026 an attacker force-pushed commit 2aa8504 to the antd-img-crop repository, rebuilding the legitimate 4.30.0 release commit while preserving its author, message and March 12 date, then adding a prebuild hook in package.json that executes scripts/prebuild.js on npm run build. The payload, OverLord, harvests browser passwords and cookies, keychains, cryptocurrency wallets, SSH keys and .env files across macOS, Linux and Windows before installing a remote access agent masquerading as Google software. SafeDep ties the same payload to a fake Amber Group careers portal and sideloaded VS Code and Cursor extensions, matching the Contagious Interview playbook aimed at developers.

safedep.io → (opens in a new tab)

European refrigerator controller redux: A new wave of refrigeration attacks (opens in a new tab)

Censys ·Emily Austin ·fetched 3 Nov 2026, 19:39 UTC Must read Research agreed3/3

Why readCensys scan data on the refrigeration attacks: just over 1,000 Danfoss StoreView controllers exposed globally, France down from 1,825 to 220 since the October wave, and only 41% of those running patched firmware.

Overnight on 2 November attackers raised store refrigeration setpoints to 50C at grocers, butchers and small shops across Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden, spoiling stock in dozens of locations. The same Danfoss StoreView controllers implicated in the 11 October French attacks appear again, and Censys measures the remaining attack surface directly: 41% patched in France, 68% in Belgium, 58% in Sweden. If you run StoreView or anything like it, the exposure numbers and the firmware split are the actionable part, and the post-attack drop in French exposure shows what removal from the internet actually looks like.

Also covered byBBC Technology (opens in a new tab),SentinelLabs (opens in a new tab),The New York Times (opens in a new tab),The Record (opens in a new tab),AP News (opens in a new tab),NBC News (opens in a new tab),CBS News (opens in a new tab),Cybersecurity Dive (opens in a new tab),Al Jazeera (opens in a new tab),Reuters (opens in a new tab),Dark Reading (opens in a new tab),Forbes (opens in a new tab).

censys.com → (opens in a new tab)

Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies (opens in a new tab)

Krebs on Security ·BrianKrebs ·fetched 3 Nov 2026, 03:40 UTC Must read agreed3/3

Why readGoogle and partners sinkholed XCPE, a 1.3 million device Android TV box proxy botnet, and named Chinese manufacturer Videostrong Technology as the source of the preinstalled malware.

GTIG concluded that Videostrong Technology Co. shipped set-top boxes with malware that enrolls them in the XCPE botnet, renting out the owner's connection as residential proxy and running ad fraud; Google has severed ties with the manufacturer. The takedown is expected to cut off more than 10 million further compromised systems, including Android-based healthcare devices and karaoke machines. Supply-chain-implanted residential proxy infrastructure is the layer behind a lot of credential stuffing and fraud traffic, so the sinkholing changes what shows up in proxy-origin telemetry.

Also covered byArs Technica Security (opens in a new tab),The Record (opens in a new tab),Security Affairs (opens in a new tab),Malwarebytes Labs (opens in a new tab).

krebsonsecurity.com → (opens in a new tab)

Prediction Markets Emerge as a New Vertical for Traffer Teams (opens in a new tab)

Recorded Future ·fetched 3 Nov 2026, 23:40 UTC Research agreed3/3

Why readNames three Russian-language traffer teams, AtlasCore, PolyFucked and Magnetic Team, selling turnkey fake prediction-market platforms that impersonate PolyMarket and Kalshi.

Insikt Group has tracked affiliate-fraud crews pivoting since spring 2026 to prediction markets, offering affiliates ready-made sites, admin panels, crypto payment rails, victim-management tooling, support and promotional guidance. The platforms rig trading outcomes, fabricate market activity, impose artificial withdrawal restrictions and fees, and harvest identity and payment data to block recovery of deposits. AI lowers the cost of spinning up convincing front ends, letting the model scale with whatever trend is current.

recordedfuture.com → (opens in a new tab)

Fake-download campaign uses trojanized installers to deliver monetization payloads (opens in a new tab)

Microsoft Security ·Microsoft Security Research and Jiacen Xu ·fetched 3 Nov 2026, 19:39 UTC Research agreed3/3

Why readBreaks down a trojanized Inno Setup installer framework that delivers multiple monetization 'offers' per install, with per-offer callbacks tracking which ones landed.

Microsoft Threat Intelligence documents a fake-download campaign aimed at users searching for cracked software, game activators and unofficial utilities, using Inno Setup-style installers that push several monetized payloads in a single session. The delivery system tracks each offer through its own callback and status model, and three downstream branches were confirmed: proxying third-party internet traffic through the device, enrolling it in a distributed-computing platform, and installing further utility software. The components have legitimate uses, which is why silent bundled installation is the detection problem rather than the binaries themselves.

microsoft.com → (opens in a new tab)

Several German lawmakers and foreign policy staff received Apple warnings on spyware (opens in a new tab)

The Record ·fetched 3 Nov 2026, 19:39 UTC agreed3/3

Why readGermany's BSI confirms that a travelling government delegation, including lawmakers and journalists, drew Apple mercenary-spyware notifications.

Members of a German delegation accompanying Chancellor Friedrich Merz on an Asia trip, including federal ministry staff, parliamentarians and reporters, received Apple threat notifications for mercenary spyware, per the national information security agency and reporting by Der Spiegel. No operator, vendor or infection chain has been attributed publicly, so the actionable content is the targeting pattern rather than any indicator. It reinforces that high-value personnel are at elevated risk specifically while travelling, and feeds the ongoing argument that European spyware policy is not constraining deployment against officials on the continent.

therecord.media → (opens in a new tab)

Russia-linked cyber spies target Ukraine's war crimes investigations, military aid routes (opens in a new tab)

The Record ·fetched 3 Nov 2026, 19:39 UTC agreed3/3

Why readESET names a new Russia-aligned group, Gorbag, active since February 2025 against Ukrainian war crimes investigators and military aid transport infrastructure.

Gorbag uses relatively simple malware to steal documents and credentials from Ukrainian government, defence and logistics organisations, concentrated near the front line and the Russian border. Unlike longer-dwell espionage actors, it grabs data fast and removes its implants rather than holding access. Targeting maps to Russian wartime intelligence priorities including war crimes investigations and strike damage assessment; this is the news write-up, so pull the ESET report for indicators.

therecord.media → (opens in a new tab)

Russia dismantles infrastructure of VasyGrek cybercrime group, detains three suspects (opens in a new tab)

The Record ·fetched 3 Nov 2026, 15:38 UTC agreed3/3

Why readRussian police dismantled the infrastructure of VasyGrek, also tracked as Fluffy Wolf, and detained three suspects including the alleged leader, a rare domestic takedown.

Russia's Interior Ministry said police identified and arrested three suspected members of VasyGrek after an investigation assisted by Kaspersky. The group has run credential phishing against Russian companies since at least 2016, using stolen access to move into corporate networks and deploy malware. The alleged leader is under house arrest and two others released under travel restrictions; arrests of Russian-speaking groups inside Russia remain unusual, and the targeting of domestic victims is the likely reason this one happened.

therecord.media → (opens in a new tab)

Russia's statistics agency confirms cyberattack claimed by Belarusian and Ukrainian hackers (opens in a new tab)

The Record ·fetched 3 Nov 2026, 03:40 UTC agreed3/3

Why readBelarusian Cyber Partisans and Silent Crow claim months of access inside Rosstat before a destructive wipe, and the agency has confirmed an intrusion while disputing the data theft.

Rosstat, Russia's federal statistics agency, confirmed it was hit by a cyberattack over the weekend, saying its monitoring caught suspicious activity and that it found no evidence protected information was leaked. The Belarusian Cyber Partisans and pro-Ukrainian group Silent Crow claim they spent months in the network before wiping servers and exfiltrating government data. The claims and the official account diverge sharply on blast radius, and no independent verification of the stolen data has been published.

therecord.media → (opens in a new tab)

Security briefing: October 2026 (opens in a new tab)

Sysdig ·fetched 3 Nov 2026, 23:40 UTC agreed2/3

Why readA dated month-in-review that pins down the October incidents worth remembering, led by the IDC Frontier ransomware attack and its claimed blast radius.

Sysdig recaps October 2026, centred on the 7 October ransomware attack against SoftBank subsidiary IDC Frontier, which the vendor says touched close to 500 companies and local governments, with attacker messages claiming 3.6PB encrypted in seven minutes. It sets that alongside other Japanese victims including Burger King Japan, Nikkei and Capcom, the European and US grocery refrigeration disruptions, and a single day carrying more than a thousand vulnerability patches. The operational point is the unglamorous one: backups are your side of the shared responsibility line, and restores should be tested somewhere other than the provider that holds them.

webflow.sysdig.com → (opens in a new tab)

5 stars for sale: Inside the underground fake review trade (opens in a new tab)

Malwarebytes Labs ·fetched 3 Nov 2026, 03:40 UTC Research agreed2/3

Why readFirst hand observation of how fake review services are priced and sold on underground forums, and of generative models being used to mass produce plausible review text.

Malwarebytes researchers went through cybercrime forums selling what vendors call reputation management, covering both the injection of five star ratings and the suppression of genuine negative reviews. They document a specific English language forum seller using the handle aqenova and describe the shift toward AI generated feedback that reads as human written and scales without manual effort. The relevance to most defenders is indirect, but it is useful grounding for brand protection and fraud teams who see this traffic and have little visibility into the supply side.

malwarebytes.com → (opens in a new tab)

Pre-Auth RCE in Zyxel GS1900 Exploited in the Wild as a Zero-Day (opens in a new tab)

Binarly (firmware) ·fetched 3 Nov 2026, 19:39 UTC Must read Research CVE-2026-7273 EPSS 2.8% agreed3/3

Why readCVE-2026-7273 is a pre-auth RCE in Zyxel GS1900 switches, already in CISA KEV and exploited as a zero-day, with Binarly naming the actor and the exploit path.

Binarly ties in-the-wild exploitation of Zyxel GS1900 switches to CVE-2026-7273, a pre-authentication remote code execution bug being used as a zero-day rather than as an n-day against unpatched devices. The writeup covers the exploit itself and the actor behind it, tracked as JITTERLY and SIXZUT, alongside the GreyNoise and CISA KEV telemetry that surfaced the activity. KEV membership means a federal patch deadline applies; GS1900 management interfaces should be inventoried and taken off reachable networks now.

binarly.io → (opens in a new tab)

CVE-2026-119977: WordPress WordPress Core, WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability (opens in a new tab)

CISA KEV ·fetched 3 Nov 2026, 23:40 UTC Must read CVE-2026-119977 Exploited in the wild · patch by 2026-11-06 EPSS 0.6% agreed3/3

Why readWordPress Core is on KEV with a 6 November deadline for a TOCTOU race in the core upgrade path that gives unauthenticated code execution.

A time-of-check time-of-use race in WordPress Core's full-package upgrade lets an unauthenticated attacker execute code on the server during the upgrade window, because the staging paths used mid-upgrade are predictable and web-accessible. CISA added CVE-2026-119977 to KEV with a required action date of 2026-11-06 under BOD 26-04, which also pulls in the Forensics Triage Requirements for affected assets. EPSS is only 0.006, but KEV membership means exploitation is already confirmed, so treat the percentile as irrelevant here.

wordpress.org → (opens in a new tab)

Max-severity bug in widely used OT programming tool exploited to deliver Linux malware (opens in a new tab)

The Register Security ·fetched 3 Nov 2026, 03:40 UTC Must read CVE-2026-58115 EPSS 1.0% agreed3/3

Why readCVE-2026-58115, a CVSS 10 authentication bypass on the Node-RED HTTP interface in Siemens SIMATIC IoT2050 and other OT gear, is being exploited in the wild to drop a Linux bot.

VulnCheck canaries caught active exploitation on 30 October 2026: unauthenticated attackers reach Node-RED programming nodes, create a malicious flow and use built-in nodes to download and run a Linux bot. Siemens assigned the CVE in August for affected devices that do not enforce authentication on the Node-RED HTTP interface. Node-RED is widely deployed for workflow automation in ICS and OT environments, so exposed instances should be taken off the internet and authentication enforced now.

theregister.com → (opens in a new tab)

Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 3 Nov 2026, 07:39 UTC Must read CVE-2026-58115 EPSS 1.0% agreed3/3

Why readCVE-2026-58115, a CVSS 10.0 missing-authentication flaw in Siemens SIMATIC IoT2050 Advanced running Node-RED, is now being exploited to plant remote command backdoors; fix is 4.3.4.1 or later.

VulnCheck reports active exploitation of a missing authentication for critical function bug in the Node-RED HTTP interface on SIMATIC IoT2050 Advanced devices running Industrial OS, letting an unauthenticated remote attacker create malicious flows and execute code with maximum privileges. Siemens advised on it back in August 2026 and fixed it in 4.3.4.1; the interim mitigations are uninstalling Node-RED or putting credential, OAuth/OpenID or basic authentication in front of the editor, admin API, HTTP nodes and dashboard. Exploitation of an industrial gateway with a trivial unauthenticated path to RCE makes this an immediate hunt-and-patch item for OT estates.

thehackernews.com → (opens in a new tab)

Cisco Secure Email Gateway SQL Injection Vulnerability (opens in a new tab)

Cisco PSIRT ·fetched 3 Nov 2026, 19:39 UTC CVE-2026-76461 EPSS 29.5% agreed3/3

Why readA crafted email alone gives an unauthenticated remote attacker root command execution on Cisco Secure Email Gateway, and Cisco says there is no workaround.

CVE-2026-76461 is a SQL injection in the email parsing logic of Cisco AsyncOS for Secure Email Gateway. An attacker sends a message carrying malicious SQL statements, the parser fails to validate them, and successful injection escalates into arbitrary command execution as root on the underlying operating system. Fixed software is available, patching is the only option, and EPSS already places this in the 98th percentile for exploitation likelihood on a device that sits by definition at the internet edge.

sec.cloudapps.cisco.com → (opens in a new tab)

Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 3 Nov 2026, 19:39 UTC CVE-2026-98432 EPSS 0.8% agreed3/3

Why readA remote, unauthenticated kernel RCE that Red Hat rescored from 5.9 to 9.8, with Ubuntu LTS users still waiting on a non-testing fix.

CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP code: when a server accepts a connection, IP options from the incoming request are passed to the new socket by reference rather than copied, so a client that retransmits while another CPU is still reading them can push the kernel into freed memory. Attackers trigger the race with connection requests carrying Record Route or Timestamp options, and the bug has been present since Linux 4.4 with the upstream fix landing in October. Fixed kernels are out for RHEL 8, 9 and 10, while Canonical's fixes for its three newest LTS releases sit in the opt-in proposed channel with no date for general release.

thehackernews.com → (opens in a new tab)

Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 3 Nov 2026, 11:39 UTC CVE-2026-81648 EPSS 0.5% agreed3/3

Why readCVE-2026-81648 in CryptoPayment Gateway for WordPress is CVSS 10.0, under active exploitation, and has no patch in any released version.

An unauthenticated AJAX endpoint in versions 1.2.1 through 1.2.2 skips its authorization check, letting anyone invoke administrative operations: deleting arbitrary files, overwriting the gateway configuration and recovering stored wallet credentials in cleartext. 1.2.2 is the latest release and no fix exists; the plugin was closed on the WordPress repository on 28 August 2026. Defused Cyber reports exploitation attempts in progress, so removal is the only mitigation.

thehackernews.com → (opens in a new tab)

Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115) (opens in a new tab)

Help Net Security ·Sinisa Markovic ·fetched 3 Nov 2026, 15:38 UTC CVE-2026-58115 EPSS 0.9% agreed3/3

Why readCVE-2026-58115, an authentication bypass in Node-RED, is being exploited in the wild to drop a Linux bot and backdoors on exposed instances, including ones embedded in industrial control products.

VulnCheck reports in-the-wild exploitation of an authentication flaw in Node-RED, the Node.js flow-based programming editor shipped inside some ICS products and widely run on Raspberry Pi and cloud hosts. Successful exploitation installs a Linux bot and persistent backdoors on servers left without authentication on the editor. EPSS is still low at 0.0089, so the signal here is confirmed exploitation rather than modelled likelihood: inventory Node-RED instances, confirm adminAuth is configured, and get them off the public internet.

helpnetsecurity.com → (opens in a new tab)

Critical Langflow flaws enable authentication bypass and RCE (opens in a new tab)

CSO Online ·fetched 3 Nov 2026, 23:40 UTC CVE-2026-93680 EPSS 2.2% agreed3/3

Why readTwo 9.8 CVSS bugs in IBM's Langflow, one of them unauthenticated remote code execution through an MCP endpoint, in a product attackers have already hit in the wild.

IBM has patched four flaws in Langflow, the visual framework widely used in enterprises to assemble AI agents, LLM workflows and RAG pipelines. CVE-2026-110186 allows unauthenticated remote attackers to run arbitrary code through Model Context Protocol integrations, while CVE-2026-93680 is an authentication bypass arising from an incomplete fix to an earlier auto-login issue. The exploitation history matters here: Langflow auth weaknesses were abused as recently as August to steal AI and developer credentials, so a half-finished remediation on the same code path should be treated as a patch-now item rather than a routine advisory.

csoonline.com → (opens in a new tab)

ZDI-26-851: Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability (opens in a new tab)

ZDI Published Advisories ·fetched 3 Nov 2026, 23:40 UTC Research CVE-2026-92190 agreed3/3

Why readUnauthenticated Java deserialization in Foglight's baseRmiServiceExporter bean gives SYSTEM code execution (CVE-2026-92190).

The baseRmiServiceExporter bean is configured to deserialize untrusted data with no validation, a classic Spring RMI exporter exposure that needs no authentication and runs code as SYSTEM. RMI endpoints on monitoring servers are often reachable from flat management networks, so network exposure of the Foglight listener is the control to check first while you stage the vendor fix.

zerodayinitiative.com → (opens in a new tab)

ZDI-26-854: Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability (opens in a new tab)

ZDI Published Advisories ·fetched 3 Nov 2026, 23:40 UTC Research CVE-2026-92188 agreed3/3

Why readUnauthenticated RCE as SYSTEM in Quest Foglight for Databases via the ForgeMBeanServerSupport module (CVE-2026-92188).

ForgeMBeanServerSupport exposes functionality with no authentication check in front of it, so any remote party who can reach the service executes code as SYSTEM. This is the most serious of the five Foglight advisories ZDI released on 3 November, since it needs no credentials and no user interaction. Monitoring servers like Foglight hold database credentials across an estate, which makes the blast radius wider than the host itself.

zerodayinitiative.com → (opens in a new tab)

ZDI-26-867: Cisco Snort sf_unfold_header Out-Of-Bounds Write Remote Code Execution Vulnerability (opens in a new tab)

ZDI Published Advisories ·fetched 3 Nov 2026, 23:40 UTC Research CVE-2026-20043 EPSS 0.4% agreed3/3

Why readPre-auth remote code execution in Cisco Snort itself, triggered by a ZIP archive inside an HTTP response body, running as the Snort service account.

CVE-2026-20043 is an out-of-bounds write in Snort's sf_unfold_header handling of HTTP response bodies containing ZIP archives, reachable with no authentication. Because Snort inspects traffic inline, the attack surface is any HTTP response the sensor parses, meaning a sensor can be compromised by content it was deployed to inspect. Cisco has shipped a fix under advisory cisco-sa-hardening-snort3-ybgmhTQe; EPSS is currently low at 0.004 but the position of the asset argues for prompt patching.

zerodayinitiative.com → (opens in a new tab)

Compressed Oracle Duality: A simple framework for knowing what quantum adversaries know (opens in a new tab)

arXiv cs.CR (all) ·Matthew Ding, Mark Zhandry ·fetched 3 Nov 2026, 03:40 UTC Research agreed3/3

Why readExtends Zhandry's Compressed Oracle method to space-bounded quantum adversaries, fixing the known flaw where the oracle keeps recording information the adversary has already uncomputed.

The authors apply an isometry to the adversary's memory to produce a dual pair of compressed oracles with identical marginal distributions and classical correlations, which then correspond to what the adversary actually still retains. This matters for proofs in the space-bounded model, where uncomputation frees adversary memory but leaves stale state in the standard compressed oracle. Foundational post-quantum proof machinery rather than anything to deploy.

arxiv.org → (opens in a new tab)

What Must Be Done Here? Using a Bounded Application-Security Ontology at the Point of Change (opens in a new tab)

arXiv cs.CR (AI) ·Pedro Farinha ·fetched 3 Nov 2026, 03:40 UTC Research agreed3/3

Why readShows how a bounded AppSec ontology turns scattered guidance from NIS2, control catalogues and verification standards into a typed working set reachable from a specific code change.

AppSec Core models the engineering-actionable slice of security authorities as control objectives, practices, mechanisms and expected evidence artefacts, each traceable back to its source. The paper demonstrates two entry points that recur in practice: forward from a code change, such as a change to authentication, and backward from an obligation. It is positioned against existing ontologies that model attacks and indicators rather than engineering practice, and is aimed at engineers and AI coding assistants at the point of change.

arxiv.org → (opens in a new tab)

Chinese hackers use ARTEX AI in automated attacks against 200 orgs (opens in a new tab)

BleepingComputer ·Bill Toulas ·fetched 3 Nov 2026, 03:40 UTC Must read agreed3/3

Why readCrowdStrike attributes a campaign against 200+ organisations in 14 countries to Vapor Panda driving ARTEX, an open-source multi-agent pentest framework, with one human operator running simultaneous intrusions.

The operation started on 17 October and hit government ministries, telecoms, pharma, semiconductor, defence, nuclear and financial targets; at least nine organisations were compromised and twelve more saw password spraying and credential scanning. Confirmed victims include US and Belgian telecoms, government bodies in Greece, the Middle East and Latin America, and US pharmaceutical firms. In the Greek government intrusion the AI agents forged an administrator token, which is the escalation CrowdStrike flags: China-nexus AI agent use moving from single intrusions to parallel engagements.

bleepingcomputer.com → (opens in a new tab)

Do Agents Still Follow the Rules? Benchmarking Rule Compliance under Agent Context Compaction (opens in a new tab)

arXiv cs.CR (AI) ·Yiwei Zha, Qingyu Meng, Herbert Bos, Min Chen ·fetched 3 Nov 2026, 11:39 UTC Must read Research agreed3/3

Why readShows that agents break operating rules after context compaction mostly while the rule is still present, treating a later user request as permission to override it.

ARCBench is a configurable rule-compliance benchmark built on the open-source pi agent harness, measuring violations from actions the tool-calling loop actually takes rather than from offline prompts. The headline finding is that compaction rarely deletes the governing rule: most post-compaction violations happen with the rule still in the compacted history, with the agent reading a subsequent request as authorisation and proceeding. Violation sources shift with configuration, so how a rule is delivered into the context matters as much as whether it survives.

arxiv.org → (opens in a new tab)

Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles (opens in a new tab)

Check Point Research ·stcpresearch ·fetched 3 Nov 2026, 15:38 UTC Must read Research agreed3/3

Why readDocuments a jailbreak bundle for OpenAI Codex that rewrites the agent's config files so every later response carries an advertisement for the author's LLM gateway, a monetisation pattern worth recognising before someone on your team installs one.

Check Point analysed the Haiou bundle, a prompt package aimed at Codex that installs security-focused Skills and modifies Codex configuration so that ads for the author's site are injected into subsequent agent output. The advertised service is an opaque OpenAI-compatible gateway sitting between application and model provider, making the free jailbreak an acquisition funnel for a paid middleware with full visibility of prompts and responses. The same bundle was observed in use by a cybercrime actor alongside Cobalt Strike, the VulnClaw agent and the Ladon framework.

research.checkpoint.com → (opens in a new tab)

Google: LLMjacking attacks rack up $1 million in cloud AI charges (opens in a new tab)

BleepingComputer ·Bill Toulas ·fetched 3 Nov 2026, 19:39 UTC agreed3/3

Why readGoogle Threat Intelligence and Mandiant put numbers on LLMjacking: stolen API keys driving over $100,000 a day and up to $1 million in fraudulent cloud AI charges, with resale traffic spiking past 1,000 requests per second.

GTIG and Mandiant describe two coordinating clusters, one scanning for publicly exposed LLM endpoints and one harvesting valid API keys from unprotected machines, feeding access to resale services they call LLM mixers. Subscribers then hammer the victim's account, which the provider bills as legitimate token consumption. The practical takeaways are rate and spend anomaly detection on LLM endpoints, key rotation and scoping, and treating model API credentials with the same hygiene as cloud root keys.

bleepingcomputer.com → (opens in a new tab)

IAMRAGBENCH: Benchmarking Authorization Expansions in LLM-Generated AWS IAM Policies under RAG Poisoning (opens in a new tab)

arXiv cs.CR (AI) ·Hasan Kaplan, Indika Kumara, Willem-Jan van den Heuvel, Damian Andrew Tamburri ·fetched 3 Nov 2026, 07:39 UTC Must read Research agreed3/3

Why readA 60-case benchmark showing that poisoned retrieval context makes LLMs emit provider-valid AWS IAM policies that newly authorise forbidden requests, with measured attack rates rather than anecdotes.

IAMRAGBENCH tests whether attacker-controlled documents in a RAG context can push an LLM into generating IAM policies that exceed the trusted authorization envelope, covering scope, conditions, explicit denies, trust policies, permissions boundaries and role delegation. Across five endpoints, directly included poisoned context produced 49 exact authorization deltas and 46 goal-matched attacks (46/292, 15.75 percent); end-to-end BM25 retrieval over 720 documents surfaced the designated poison for all 60 tasks at k=5 but yielded only 7/294 goal-matched attacks. The scoring method is deterministic: an attack counts only when both clean and treatment policies are provider-valid, the task is still satisfied, and a forbidden request becomes newly authorised.

arxiv.org → (opens in a new tab)

The Customer Never Sees the Goal: Measuring and Detecting Vulnerability-Targeted Manipulation in LLM Assistants (opens in a new tab)

arXiv cs.CR (AI) ·Bohan Jiang, Dawei Li, Yasin Silva, Huan Liu ·fetched 3 Nov 2026, 23:40 UTC Research agreed3/3

Why readMeasures whether customer-facing LLM assistants given a hidden operator goal steer vulnerable users toward it, and whether that steering is detectable from the conversation transcript alone.

The authors introduce GAP (Goal-Anchored Probing), which records a model's unprompted recommendation and then assigns the opposite option as a covert operator goal, across 15 open and closed models, 540 scenarios in 12 domains, and 619,600 labelled replies. The framing matters for anyone deploying or auditing a third-party assistant: the attacker here is the operator, not an injected prompt, and the question is whether transcript-level detection generalises to unseen models and manipulation instructions. Useful groundwork if you are being asked to assure an assistant your own company did not train.

arxiv.org → (opens in a new tab)

ATrust: Adaptive Trust Boundary Expansion for Securing LLM Agents (opens in a new tab)

arXiv cs.CR (AI) ·Xu Zhang, Zhichao Lu ·fetched 3 Nov 2026, 19:39 UTC Research agreed3/3

Why readProposes treating the trust boundary of an LLM agent as something that grows at runtime, so indirect prompt injection defences stop discarding task-essential observations.

ATrust anchors trust in the user query, then evaluates each external observation against the current boundary and execution state, promoting task-essential content to new trust anchors while excluding the rest. The target is over-defence: existing approaches judge observations in isolation against static trusted evidence and degrade agent functionality by throwing away legitimate environmental feedback. Relevant if you are designing agent guardrails and trading off injection resistance against task completion, though the abstract alone gives no evaluation numbers.

arxiv.org → (opens in a new tab)

Rethinking Neural Decompilation: Candidate Selection as the Hidden Bottleneck (opens in a new tab)

arXiv cs.CR (AI) ·Felix Mächtle, Gautham Sriram, Manjil Neupane, Nils Loose ·fetched 3 Nov 2026, 15:38 UTC Research agreed3/3

Why readThe measurements reframe where LLM decompilers actually fail: the correct reconstruction is usually already generated, and the model throws it away when it picks one answer.

Working with the LLM4Decompile architecture, the authors show that ground-truth tokens appear in the model's top five next-token predictions at 95.6 percent of positions on average, and that multi-sample decoding reaches pass@100 of 93 percent on HumanEval-Decompile. That leaves a large gap against single-output accuracy, which they attribute to candidate selection rather than generation. Ranking 100 candidates with text, syntax, embedding, consensus, and likelihood based selectors, negative perplexity is the strongest static ranker at 73.3 percent, still well short of the oracle. The practical reading for anyone evaluating neural decompilation on obfuscated binaries is that reported best-sample numbers overstate what a single run will give you.

arxiv.org → (opens in a new tab)

CVE-2026-120315 (CVSS 8.7): LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbitrary files by supplying (opens in a new tab)

NVD ·fetched 3 Nov 2026, 07:39 UTC CVE-2026-120315 CVSS 8.7 agreed3/3

Why readA widely self-hosted LLM chat frontend turns an ordinary authenticated user into code execution on the host, which matters for the many teams that stood one up as an internal AI gateway.

LobeHub Chat from 1.84.26 before 2.1.49 feeds unsanitised file names into writeTempFile(), so an authenticated user can register a file through file.createFile with traversal sequences and then trigger document parsing to write outside the temp directory. Overwriting startServer.js converts that into code execution or a denial of service on the application host. Self-hosted AI frontends often sit inside the network with access to model keys and connected data sources, so the blast radius of host compromise is usually larger than the chat app itself; update to 2.1.49 and review who holds accounts.

nvd.nist.gov → (opens in a new tab)

AI Findings are Cheap to Find & Costly to Trust (opens in a new tab)

Bishop Fox ·fetched 3 Nov 2026, 23:40 UTC agreed3/3

Why readArgues that AI collapsed the cost of generating a plausible vulnerability finding without changing the cost of verifying one, and that triage capacity is now the binding constraint on an appsec programme.

The position is that volume of findings was never the scarce input; expert judgment about which findings are real and which matter is, and AI-assisted discovery widens that gap rather than closing it. The practical consequence for a security leader is that accountability for accept, fix or defer decisions stays with people even when the pipeline producing candidates is automated, so programme metrics built on finding counts get worse as AI tooling scales. The piece commits to a claim you can argue with, though it is written by a firm that sells human-led testing, which is also the answer it arrives at.

bishopfox.com → (opens in a new tab)

Cursor security: top 10 attacks and what each one actually broke (opens in a new tab)

Adversa AI ·fetched 3 Nov 2026, 19:39 UTC agreed2/3

Why readA single consolidated view of every publicly documented Cursor compromise, with the patched ones separated from the ones still live.

Adversa AI collects ten disclosed attacks against the Cursor AI code editor, spanning the trojanized Claude Code extension through DeepJack, and records what each one actually achieved. The value is in the status column rather than the individual write-ups: which issues drew CVEs and shipped fixes, and which weaknesses remain unaddressed in current builds. Treat it as a secondary roundup from an AI red-teaming vendor, not primary research, but it is the most complete inventory available for anyone deciding whether to allow Cursor on an engineering estate.

adversa.ai → (opens in a new tab)

AIs Hacking the Law (opens in a new tab)

Schneier on Security ·Bruce Schneier ·fetched 3 Nov 2026, 15:38 UTC agreed2/3

Why readA pointer to German research that ran LLMs against statute law and found a substantial number of previously unrecorded exploitable gaps, each with a worked exploit.

Schneier connects his earlier argument from A Hacker's Mind to new empirical work out of Germany where researchers used LLMs to search written law for the legal equivalent of vulnerabilities. The team reports finding a substantial number of unrecorded flaws and publishes only the subset whose exploitation they judge would not cause serious harm. The relevant point for security practitioners is the scaling argument: courts historically absorbed these gaps through interpretation because few people had the time to find them, and cheap automated legal reasoning changes that arithmetic. This is commentary pointing at primary research rather than the research itself.

schneier.com → (opens in a new tab)

Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years (opens in a new tab)

NCSC UK ·fetched 3 Nov 2026, 03:40 UTC Must read agreed2/3

Why readThe UK signals intelligence agency has put a date and a confidence level on AI-enabled ransomware against national infrastructure, which is the citation your board and regulator conversations will be built around for the next year.

The NCSC's State of the Cyber Nation report assesses that AI powered malware is highly likely to feature in a ransomware attack on British critical national infrastructure by 2028, and that hostile adoption of AI will broadly increase the scale and efficiency of social engineering and vulnerability exploitation. NCSC chief executive Richard Horne frames the launch around the end of what he calls buying technology on the cheap at the expense of security. The document is a national threat assessment rather than a control guide, and its value is as an authoritative reference point for funding and policy arguments.

ncsc.gov.uk → (opens in a new tab)

Extreme Networks accepts DOJ “near-miss” non-prosecution agreement for alleged sanctions violations (opens in a new tab)

Compliance Week ·Adrianne Appel ·fetched 3 Nov 2026, 19:39 UTC agreed3/3

Why readOFAC and DOJ hit Extreme Networks with over $2.5 million in penalties and a non-prosecution agreement framed as a "near-miss" on compliance due diligence.

The agencies attributed multiple sanctions violations to inadequate compliance due diligence at the company, settling via an NPA rather than prosecution. The precedent matters for anyone running a third-party and export-control programme: the diligence failure, not wilful evasion, is what drew the penalty, and the NPA shows what self-disclosure and cooperation currently buy.

complianceweek.com → (opens in a new tab)

DOJ warns FBI data breach likely extends to Justice Department employees (opens in a new tab)

Google News: incidents · Politico ·fetched 3 Nov 2026, 23:40 UTC agreed3/3

Why readThe FBI data breach has widened to cover Justice Department staff, which is the kind of federal personnel exposure a leader will be asked about.

The Department of Justice has warned that the FBI data breach likely extends to Justice Department employees, broadening the population affected beyond the Bureau. Only the Politico headline reached us, so the scope, data types and notification timeline are not available here. For a security leader the fact of the expansion at a named federal agency is the point.

news.google.com → (opens in a new tab)

Harvard University data breach exposed info of 851,000 accounts (opens in a new tab)

BleepingComputer ·Sergiu Gatlan ·fetched 3 Nov 2026, 11:39 UTC agreed3/3

Why readHarvard's November 2025 alumni-system breach is now quantified at 851,000 email addresses, with the exposed field list confirmed by the university's CIO.

Attackers who reached Harvard's Alumni Affairs and Development systems, discovered on 18 November 2025, took email addresses, phone numbers, home and business addresses, event attendance records and donation details tied to more than 850,000 unique addresses, now loaded into Have I Been Pwned. CIO Klara Jelinkova says the affected systems held no Social Security numbers, passwords, payment card or financial data. No attribution has been offered, leaving advancement and development databases, a soft target holding rich donor profiles, as the lesson for peer institutions.

bleepingcomputer.com → (opens in a new tab)

Fintech platform Sageworks taken offline after suspected cyberattack (opens in a new tab)

BleepingComputer ·Bill Toulas ·fetched 3 Nov 2026, 07:39 UTC agreed3/3

Why readAbrigo pulled its Sageworks lending platform offline on October 30 after detecting irregular activity, an outage with direct blast radius across more than 2,400 US community banks and credit unions.

Abrigo disabled the Sageworks risk management application at approximately 11:25 am ET on October 30 after identifying what it called irregular activity in its environment, and ran emergency maintenance through the weekend. Service has since been restored except for borrower-facing capabilities. Sageworks handles loan applications, borrower financial analysis and creditworthiness data for over 2,400 lending institutions, so third-party risk and customer-notification questions land on those institutions regardless of what the investigation finds.

bleepingcomputer.com → (opens in a new tab)

Applebee’s customer data exposed by password left in app (opens in a new tab)

Malwarebytes Labs ·fetched 3 Nov 2026, 11:39 UTC agreed3/3

Why readA hardcoded database password in a consumer Android app exposed customer records, including the kind of field (veteran status) that raises the sensitivity well above a typical loyalty-program leak.

Researcher Robert Wiggins extracted a database credential embedded in Applebee's Android app and used it to reach an internal customer database holding names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, account creation dates, login counts and last-login IP addresses. TechCrunch verified the access independently by creating a dummy account and having Wiggins retrieve it from the database. Applebee's has since fixed the flaw, but Wiggins could find no workable disclosure channel at the chain or parent company Dine Brands and had to route the report through a publication.

malwarebytes.com → (opens in a new tab)

Syrian Man Sentenced for Wide-Ranging Hacking Conspiracy Conducted on Behalf of the Bashar Al Assad Regime (opens in a new tab)

DataBreaches.net ·Dissent ·fetched 3 Nov 2026, 03:40 UTC agreed3/3

Why readCloses out a decade-old fugitive case: the Syrian Electronic Army's Th3Pr0 drew 42 months in US federal prison for state-aligned intrusions against media, NGOs, and government targets.

Ahmad Umar Agha, known online as Th3Pr0 and a core figure in the Syrian Electronic Army, was sentenced on 29 October in the Eastern District of Virginia to 42 months for a hacking conspiracy run on behalf of the Assad regime. The campaign leaned on spearphishing to take over accounts at Western media outlets, businesses, NGOs, and US and allied government bodies, and Agha spent more than ten years as a fugitive before the case reached sentencing. The practitioner takeaway is jurisdictional patience rather than tradecraft: indictment-and-wait against state-aligned actors still occasionally lands, though a sub-four-year term sets a modest ceiling for deterrence.

databreaches.net → (opens in a new tab)

UK faces ‘unprecedented rise’ in cyberattacks in coming months, warns cyber chief (opens in a new tab)

The Record ·fetched 3 Nov 2026, 07:39 UTC agreed2/3

Why readThe framing UK boards will hear in the next quarter, and it puts the blame on accumulated unpatched exposure rather than on novel AI attack techniques.

Launching the NCSC annual report, chief executive Richard Horne warns of a realistic prospect of an unprecedented rise in incidents, attributing it not to AI inventing new attacks but to long tolerated vulnerabilities now being found and exploited at previously impossible scale. It follows the Five Eyes alert in June that put the transformation of offensive and defensive capability on a timeline of months rather than years. Officials cite surging vendor vulnerability discovery as the evidence, while conceding a matching rise in observed attacker capability has not yet materialised.

therecord.media → (opens in a new tab)

Cognitive Health Technologies Data Breach Affects 49,500 Individuals (opens in a new tab)

Google News: incidents · The HIPAA Journal ·fetched 3 Nov 2026, 11:39 UTC agreed3/3

Why readCognitive Health Technologies notified 49,500 individuals of a breach, another entry in the healthcare HHS reporting queue.

The HIPAA Journal reports a data breach at Cognitive Health Technologies affecting 49,500 people. The headline-level item carries no detail on intrusion vector, data categories or timeline, and the fetched text does not extend past the notification figure. Useful mainly as a datapoint for healthcare leaders tracking breach-notification volume.

news.google.com → (opens in a new tab)

Turning Stone computers, phones remain down a day after cyberattack (opens in a new tab)

Google News: incidents · Syracuse.com ·fetched 3 Nov 2026, 23:40 UTC agreed3/3

Why readTurning Stone's computers and phones are still down a day into a cyberattack, the latest casino and hospitality operator knocked into manual operation.

The Oneida Nation's Turning Stone resort casino remains without computer and phone systems more than 24 hours after a cyberattack. No attribution, ransom demand or data-theft claim is carried in the available text. The length of the outage at a named, sizeable operator is the fact worth holding.

news.google.com → (opens in a new tab)