Wednesday, 4 November 2026

North Korean fake job interview led to $6.3B Binance heist (opens in a new tab)

The Register Security ·fetched 4 Nov 2026, 03:38 UTC Must read agreed3/3

Why readBinance's own incident report traces the record $6.3B theft back to a fake job interview that put malware on one engineer's work laptop, then through the company's internal AI tooling.

The exchange says the October 29 breach was a multi-stage campaign, not a single phishing hit: social engineering through a bogus recruitment process, a malware download onto a work-issued machine, compromise of internal AI tooling, endpoint takeover, and finally an advanced method of subverting transaction authorization. The FBI has attributed it to TraderTraitor, the Lazarus-linked North Korean crew that works both sides of the job market, planting IT workers inside Western firms and posing as employers to bait engineers. The internal AI tooling step is the part most organizations have not modeled; agent and assistant infrastructure sitting inside the trust boundary is now a documented lateral movement path.

Also covered byWIRED Security (opens in a new tab),SafeDep (supply chain) (opens in a new tab).

theregister.com → (opens in a new tab)

APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 4 Nov 2026, 15:38 UTC agreed2/3

Why readA nation-state actor turned a third-party analytics script into a mobile exploit delivery channel, which collapses the usual separation between supply chain risk and mobile N-day risk.

Sekoia attributes a watering hole operation it calls Poisoned Source, found in mid-October 2026, to APT29, built on three vectors: injected JavaScript on compromised legitimate sites, lookalike domains imitating US, Ukrainian, and Czech properties, and a supply chain compromise of Ukrainian analytics provider Plerdy SEO Tracker. The injected code fingerprints browser and device attributes, then the delivery infrastructure serves a platform-specific N-day chain for iOS or Android. Payloads steal browser cookies and in some cases Wi-Fi passwords or full device data. The write-up is journalism on a vendor report rather than the primary research itself.

thehackernews.com → (opens in a new tab)

Poisoned cPGuard update hits thousands of web hosting servers (opens in a new tab)

Help Net Security ·Zeljka Zorz ·fetched 4 Nov 2026, 11:41 UTC Must read agreed3/3

Why readcPGuard's update infrastructure was hijacked to push malicious versions 5.88.12 through 5.88.19 to roughly 3,000 Linux web hosting servers.

An attacker uploaded fake cPGuard updates to OPSShield's update server, distributing trojanised builds to nearly 3,000 customer servers running the security suite on Linux web hosts. The same intrusion took customer contact details and hashed passwords from the billing and licensing server. Anyone running cPGuard should treat the named version range as compromised and assume the host, not just the product, needs review.

Also covered byBleepingComputer (opens in a new tab).

helpnetsecurity.com → (opens in a new tab)

Gorbag: Orcs at the border harvesting intelligence from Ukraine (opens in a new tab)

ESET WeLiveSecurity ·fetched 4 Nov 2026, 11:41 UTC Must read Research agreed3/3

Why readProfiles Gorbag, a Russia-aligned actor hitting Ukrainian law enforcement, local administrations near the front line and defence entities with smash-and-grab infostealers including GIFTEDCROOK.

Gorbag has been active since at least February 2025 against Ukrainian targets exclusively, favouring justice and law enforcement bodies, front-line local administrations and the defence sector. Rather than persistent implants, the group collects browser credentials, VPN configurations and selected documents in a single pass before the malware attempts to self-delete, behaviour consistent with an initial access broker handing collection onward. Tooling overlaps with GIFTEDCROOK, which CERT-UA attributes to UAC-0226, but the targeting profile has not been documented publicly before.

Also covered byInfosecurity Magazine (opens in a new tab).

welivesecurity.com → (opens in a new tab)

French blood service hit by Europe-wide cyberattacks on refrigeration (opens in a new tab)

The Record ·fetched 4 Nov 2026, 15:38 UTC agreed3/3

Why readThe European refrigeration attack wave has reached medical cold chain, and it got there through third-party cold storage operators rather than the blood service itself.

The Établissement Français du Sang says temperature and defrost thresholds were raised to extreme levels at cold storage rooms on three of its sites this week, part of a broader run of attacks on refrigeration control systems across Europe. EFS reports no blood products lost and no health impact, crediting its own monitoring and alarms for catching the anomalies fast; the compromised units were run by outside providers, not EFS. The service declined to name the control system vendor or model, which leaves defenders in the same sector without a specific product to go check.

Also covered byThe Register Security (opens in a new tab),DataBreaches.net (opens in a new tab),CBS News (opens in a new tab),AP News (opens in a new tab),Euronews.com (opens in a new tab),upi (opens in a new tab),Anadolu Ajansı (opens in a new tab).

therecord.media → (opens in a new tab)

Hackers use n-day exploits in zero-click attacks on iOS, Android devices (opens in a new tab)

BleepingComputer ·Bill Toulas ·fetched 4 Nov 2026, 11:41 UTC agreed3/3

Why readSekoia ties a watering-hole operation to APT29 that fingerprints browsers and then fires platform-specific n-day chains at iOS and Android with no user interaction.

Compromised sites belonging to a Ukrainian gas producer, a US chemical industry trade association and a Bulgarian military-related site served a profiling payload that identifies browser version before delivering n-day exploit chains. Lookalike domains impersonating the America250 site and Raffles London at The OWO relayed real content in an adversary-in-the-middle setup. Attribution to APT29 is moderate-to-high confidence; the takeaway for defenders is that patched-but-not-updated mobile fleets are the target, not zero-days.

bleepingcomputer.com → (opens in a new tab)

China-Aligned Group Abuses Sogou Input Method to Deliver Malware (opens in a new tab)

Infosecurity Magazine ·fetched 4 Nov 2026, 23:40 UTC agreed3/3

Why readA China-aligned group hijacked Sogou Input Method's brand-promotion update channel, which fetches config over plaintext HTTP, to push the DarkVigil implant in six countries.

ESET researcher Anh Ho attributes the activity to SlippyNunchucks, active since at least 15 September 2023 and assessed with high confidence as aligned with Chinese state surveillance interests. From 1 July 2026, users of Tencent's Sogou keyboard received DarkVigil implants after DNS hijacking redirected the unencrypted HTTP fetch of a Sogou brand-promotion configuration, turning legitimate application traffic into a delivery channel. The victim spread initially looked like an exploit, which is worth remembering when triaging: a plaintext update path plus network position is enough.

infosecurity-magazine.com → (opens in a new tab)

Hackers exploited iOS and Android flaws to infect phones (opens in a new tab)

Ars Technica Security ·Dan Goodin ·fetched 4 Nov 2026, 23:40 UTC agreed3/3

Why readWatering-hole campaign attributed with moderate to high confidence to Russia's SVR, using a reverse proxy at america250[.]holiday against the real america250.org to serve patched iOS and Android n-days.

Visitors to potentially hundreds of sites, many tied to the war in Ukraine plus one marking the 250th anniversary of the US Constitution, received injected JavaScript that profiled the device before delivering platform-specific payloads. Those payloads stole browser cookies and, in some cases, Wi-Fi passwords and full mobile device data, with tooling the researchers call DarkSword. The exploits were for flaws already patched, so this is a campaign that fed on update lag rather than on zero-days, and the impersonation domain is a usable pivot for hunting.

arstechnica.com → (opens in a new tab)

UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame? (opens in a new tab)

Ars Technica Security ·Dan Goodin ·fetched 4 Nov 2026, 03:38 UTC agreed3/3

Why readExplains how the BlackX UEFI bootkit infected Windows machines that had installed every Secure Boot patch and certificate revocation Microsoft shipped after BlackLotus.

BlackX, a new in-the-wild UEFI bootkit, compromised organisations that had applied the 2022 patch for the BlackLotus vulnerability plus Microsoft's 2023 and 2024 updates adding a new certificate and the means to revoke trust in older signed boot managers. Goodin works through where that chain of trust failed in practice, and whether the gap sits with Microsoft's rollout of those revocations. Worth checking which revocations are actually applied on your estate rather than assuming the patches implied them.

arstechnica.com → (opens in a new tab)

WorkOS says attacker used ARTEX AI to breach internal sales app (opens in a new tab)

BleepingComputer ·Bill Toulas ·fetched 4 Nov 2026, 07:38 UTC agreed3/3

Why readA named victim attributes a real breach to an attacker running an AI offensive-security framework, moving agentic attack tooling from demo to incident report.

WorkOS disclosed unauthorized access on 30 October 2026 to an internal application used by its sales team, exposing CRM business contact records and summaries of customer communications; the company states that production services and customer app data were not touched. WorkOS attributes the recon and exploitation attempts to an attacker driving the ARTEX AI offensive-security framework rather than working by hand. WorkOS supplies authentication, SSO and identity infrastructure to roughly 3,000 companies including OpenAI, Anthropic, Snowflake and Netlify, so the contact and account-history data taken is useful raw material for targeted social engineering against those customers.

bleepingcomputer.com → (opens in a new tab)

When trust becomes the payload: Inside the threats, etc quarterly report (opens in a new tab)

Elastic Security Labs ·Terrance DeJesus,Jason Pappalexis,Andrew Pease ·fetched 4 Nov 2026, 15:38 UTC agreed3/3

Why readQuarterly intrusion data showing adversaries pivoting to abuse of trusted components: RMM tools with valid signatures, approved AI coding assistants, and pre-authorized first-party OAuth applications.

Elastic Security Threat Command's quarterly report draws on confirmed customer intrusions and first-party research between April and September 2026, and the through-line is abuse of software the organisation already trusts rather than defeat of security controls. Three abuse patterns are covered: signed RMM tooling installed by IT, AI coding assistants on approved software lists, and tenant-preauthorized first-party applications used for sign-in on a user's behalf. Useful for deciding which trusted-by-default allowances in your own stack deserve a second look.

elastic.co → (opens in a new tab)

Attacker abuses Microsoft Entra ID to target downstream MSP clients (opens in a new tab)

Cybersecurity Dive ·David Jones ·fetched 4 Nov 2026, 19:37 UTC agreed3/3

Why readA single operator using still-valid stolen Entra ID credentials pivoted from MSP tenants into downstream client environments, with Todyl putting hard numbers on the blast radius.

The attacker targeted 45 app registrations across roughly 18 organisations, authenticated successfully to at least 33 and reached 27 organisations including MSP customers in energy, government, food and agriculture, transportation and construction. Activity included searches across 25 tenants, 81 files downloaded and access to around 2,300 mailbox items, run from a VPS against a stockpile of stolen credentials in a pattern Todyl likens to a self-propagating worm. Attempts are ongoing, so MSPs should audit app registration consent grants and sign-in logs for valid-credential logins from hosting providers.

cybersecuritydive.com → (opens in a new tab)

CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 4 Nov 2026, 07:38 UTC Must read CVE-2026-119977 EPSS 0.6% agreed3/3

Why readCVE-2026-119977, a TOCTOU race in WordPress Core that gives unauthenticated RCE during the upgrade window, is now in KEV with confirmed exploitation.

The flaw (CVSS 8.1) stems from predictable, web-accessible staging paths used during full-package Core upgrades: an attacker who hits that brief window during a complete update can execute code on the server with no account on the site. Wordfence detailed the mechanism last week and patches shipped late last month. KEV listing means exploitation is confirmed and federal agencies have a patch deadline; any site that has not completed a Core update since the fix is the exposure.

thehackernews.com → (opens in a new tab)

CVE-2024-27834: Apple Multiple Products, Apple Multiple Products Improper Authentication Vulnerability (opens in a new tab)

CISA KEV ·fetched 4 Nov 2026, 23:40 UTC Must read CVE-2024-27834 Exploited in the wild · patch by 2026-11-18 EPSS 0.6% agreed3/3

Why readCISA added CVE-2024-27834 to KEV with a 2026-11-18 federal remediation deadline, covering iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5.

The flaw is an improper authentication issue that lets an attacker who already has arbitrary read and write primitives bypass pointer authentication, removing one of the main exploit mitigations on Apple platforms. KEV listing means exploitation is confirmed in the wild despite an EPSS of only 0.006. Federal agencies must comply by 2026-11-18 under BOD 26-04, and the entry also invokes CISA's forensics triage requirements, so affected assets need evidence preservation alongside patching.

support.apple.com → (opens in a new tab)

Node-RED authentication hole being exploited in the wild (opens in a new tab)

CSO Online ·fetched 4 Nov 2026, 07:38 UTC Must read CVE-2026-58115 EPSS 0.9% agreed3/3

Why readCVE-2026-58115, the unauthenticated Node-RED admin API flaw, is being exploited in the wild to deploy Linux bots, months after Siemens shipped fixes.

VulnCheck caught an attacker on 30 October 2026 using the flaw to push a flow that downloads and runs a Linux bot, with the request originating from an IP in Microsoft's ASN (AS8075); 16 further events from the same IP carried several different payloads. The root problem is deployment practice as much as the bug: Node-RED ships with authentication disabled and expects operators to enable it before exposure. Because these instances sit in IoT and IIoT environments, including critical infrastructure, they are frequently outside the inventory a CISO or CIO controls.

csoonline.com → (opens in a new tab)

CVE-2026-109518: RCE in apt(1) (DSA 6607-1) (opens in a new tab)

oss-security ·fetched 4 Nov 2026, 23:40 UTC CVE-2026-109518 agreed3/3

Why readAPT can merge two separate package downloads when an HTTP redirect produces the same URI, letting a man-in-the-middle swap a package during a resumed download.

Max Justicz found that APT mishandles files when resuming an HTTP download: if a redirect makes two different package downloads share a URI, APT merges them, and an attacker positioned on the network can substitute package content. Debian tracks it as CVE-2026-109518 and has published DSA 6607-1. This touches every Debian and Debian-derived host that fetches packages over plain HTTP or through a proxy, so patch apt ahead of the usual package-manager cadence and confirm your mirrors are reached over HTTPS.

seclists.org → (opens in a new tab)

CVE-2026-58868: Critical Android Bug Could Let Attackers Run Remote Code (opens in a new tab)

Security Affairs ·Pierluigi Paganini ·fetched 4 Nov 2026, 11:41 UTC Must read CVE-2026-58868 EPSS 0.2% agreed3/3

Why readCVE-2026-58868 is a zero-click heap overflow in Android's FrameDecoder.cpp reachable on versions 14 through 17, fixed only at patch level 2026-11-01.

Google's November Android bulletin fixes a critical out-of-bounds write in onOutputReceived in FrameDecoder.cpp, reachable remotely with no user interaction and no additional execution privileges. Affected builds span Android 14 through 17, and the fix arrives via security patch level 2026-11-01, which means OEM and carrier lag decides real exposure. EPSS sits at 0.002 today, so the urgency is the zero-click class rather than observed mass exploitation.

Also covered byThe Hacker News (opens in a new tab).

securityaffairs.com → (opens in a new tab)

Debian apt security update: man-in-the-middle arbitrary code execution (opens in a new tab)

Hacker News ·vesinisa ·fetched 4 Nov 2026, 15:38 UTC 67 points agreed3/3

Why readA man-in-the-middle can swap a Debian package after signature verification and get arbitrary code execution as root; apt on trixie needs 3.0.4.

Debian has issued a security update for apt covering a flaw that lets a man-in-the-middle attacker replace a package after it has been verified, resulting in arbitrary code execution as root. Stable (trixie) is fixed in apt 3.0.4, which additionally addresses several out-of-bounds issues. Any host that pulls packages over a network path you do not fully control, including build and CI images, should be patched promptly.

Also covered byHacker News (opens in a new tab).

lists.debian.org → (opens in a new tab) Discussion (opens in a new tab)

Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026 (opens in a new tab)

Cisco PSIRT ·fetched 4 Nov 2026, 19:37 UTC CVE-2026-105482 EPSS 82.6% agreed3/3

Why readFour Node.js flaws fixed on 22.x, 24.x and 26.x, including a Brotli decoder out-of-bounds write with RCE potential and two TLS hostname validation bypasses, now mapped to affected Cisco products.

Node.js shipped fixes on 21 October 2026 for CVE-2026-111497 (Brotli decoder out-of-bounds write, potential remote code execution), CVE-2026-105482 (DNS resolution truncation on embedded NUL characters, EPSS 0.83), CVE-2026-105483 (TLS hostname validation bypass using fullwidth IP digits) and CVE-2026-106069 (bypass via noncanonical IP addresses). Cisco rates all four High and extended the investigation to Brotli usage outside Node.js, so the affected-product list reaches beyond obvious Node-based appliances. The hostname validation bypasses matter most for anything terminating or proxying TLS: certificate pinning and host checks can be defeated without touching the certificate chain.

sec.cloudapps.cisco.com → (opens in a new tab)

Apache OFBiz: CVE Announcements (opens in a new tab)

oss-security ·fetched 4 Nov 2026, 23:40 UTC CVE-2026-68524 agreed3/3

Why readCVE-2026-68524 is a pre-authentication RCE in Apache OFBiz via an attacker-controlled screen, fixed only in 24.09.08.

Apache disclosed multiple OFBiz flaws affecting all versions before 24.09.08, the most serious being pre-auth remote code execution through an attacker-controlled screen render path, alongside CVE-2026-66903, an authenticated path traversal in Catalog Image Management. Upgrading to 24.09.08 is the only stated mitigation. OFBiz pre-auth RCEs have a consistent history of rapid in-the-wild weaponisation, so treat internet-facing instances as a same-week job and check access logs for unusual screen or controller requests.

seclists.org → (opens in a new tab)

CVE-2026-116606 (CVSS 9.3): An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a con (opens in a new tab)

NVD ·fetched 4 Nov 2026, 11:41 UTC CVE-2026-116606 CVSS 9.3 EPSS 0.7% agreed3/3

Why readPre-authentication configuration overwrite on Barracuda Email Security Gateway below 9.4.0.030: an attacker restores a crafted backup archive and owns the appliance's global config.

CVE-2026-116606 (CVSS 9.3) is an authentication bypass that lets an unauthenticated remote attacker reach a configuration-import function on Barracuda Email Security Gateway and restore a crafted but compatible backup archive, rewriting the appliance's global configuration. The affected versions are everything earlier than 9.4.0.030. This is an internet-facing mail security appliance with a history of in-the-wild targeting, so verify the running version, confirm the update applied, and audit configuration change history even though EPSS currently sits at 0.0073.

nvd.nist.gov → (opens in a new tab)

CVE-2026-120213 (CVSS 9.1): @fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, (opens in a new tab)

NVD ·fetched 4 Nov 2026, 07:38 UTC CVE-2026-120213 CVSS 9.1 EPSS 0.7% agreed3/3

Why read@fastify/http-proxy 9.0.0 through 11.6.5 fails to re-encode URL-decoded route parameters into rewritePrefix, so an encoded path separator plus a query or fragment delimiter escapes the pinned upstream prefix without any dot-dot traversal; fixed in 11.6.6.

When an application uses parameterised prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes decoded route parameters straight into rewritePrefix. A parameter encoding a separator together with a fragment or query delimiter decodes into real delimiters, injecting upstream path segments and stripping the mandatory suffix the rewritePrefix was meant to enforce. An unauthenticated attacker reaches upstream locations outside the intended prefix, giving path-restriction bypass and, depending on the backend, SSRF or authorisation bypass; upgrade to 11.6.6, as there is no workaround.

nvd.nist.gov → (opens in a new tab)

Rails security releases: 8.0.5.2 and 8.1.4.1 (opens in a new tab)

oss-security ·fetched 4 Nov 2026, 07:38 UTC agreed3/3

Why readRails 8.0.5.2 and 8.1.4.1 fix 21 security issues, and security support for the entire 8.0 series ends on 7 November 2026.

Mike Dalessio announced security releases for both supported Rails branches covering 21 separate issues, with an upgrade recommended immediately. The harder deadline is maintenance: the 8.0 series loses security support on 7 November 2026, so anyone still on 8.0 needs a move to 8.1 planned now rather than a point upgrade. Older series are already unsupported and receive nothing.

Also covered byDark Reading (opens in a new tab).

seclists.org → (opens in a new tab)

CVE-2026-117518 (CVSS 8.2): @fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validate (opens in a new tab)

NVD ·fetched 4 Nov 2026, 07:38 UTC CVE-2026-117518 CVSS 8.2 EPSS 0.5% agreed3/3

Why readBackslash dot-segments slip past @fastify/reply-from's traversal check because the WHATWG URL parser normalises them to forward slashes, letting unauthenticated requests escape the intended upstream prefix; fixed in 12.8.1.

Versions up to and including 12.8.0 validated proxy paths against forward-slash dot-segments only, then built the target URL with the WHATWG parser, which converts a backslash and its percent-encoded form to a forward slash on the http, https, ws and wss schemes. A request using backslash dot-segments therefore resolves to a different upstream path, so applications that scope proxying to a prefix or put route guards in front of the forwarding call can have unauthenticated traffic reach other upstream endpoints. 12.8.1 normalises the path and rejects any segment resolving to a single or double dot, plus control characters and ambiguous whitespace, before constructing the URL; the parser-normalisation mismatch is worth checking in any hand-rolled proxy path filter.

nvd.nist.gov → (opens in a new tab)

Proving the Wrong Program: Miscompilations as a Threat to zkVM Guarantees (opens in a new tab)

arXiv cs.CR (AI) ·Hui Xuan Tan, Stefanos Chaliasos, Alastair F. Donaldson ·fetched 4 Nov 2026, 03:38 UTC Must read Research agreed3/3

Why readShows that real rustc and LLVM miscompilation bugs make production zkVMs produce valid proofs of the wrong computation: 48 of 88 bugs on SP1 and 46 on Jolt.

The authors assemble 88 known rustc and LLVM miscompilations with Rust reproducers, using an LLM agent to recover Rust triggers for 60 of 124 LLVM bugs that were only reported as IR, then run them against SP1 and Jolt. Forty-eight cause a guest to commit a wrong output on SP1 and 46 on Jolt, with 15 rustc bugs reproducing on both; most non-reproducing bugs simply never reach the faulty code on the RISC-V target. Real-world exposure looks low by accident, with byte-identical binaries in 447 of 552 guest-bug pairs across 13 guests from 10 SP1 projects, which means the risk is a deliberately chosen compiler version rather than bad luck.

arxiv.org → (opens in a new tab)

Making HTTP header injection critical with one prompt (opens in a new tab)

PortSwigger Research ·fetched 4 Nov 2026, 15:38 UTC agreed3/3

Why readBurp now has a scan check that chains HTTP request header injection into a CRLF-powered desync and proves impact by redirecting other users' requests to Collaborator.

PortSwigger has encoded the exploitation methodology from the CRLF-Powered Desync Attacks research into a Burp AT skill plus a new scan check for HTTP Request Header Injection. The skill runs the escalation autonomously in the background while the tester keeps working manually, taking a header injection finding through to a demonstrated desync that serves arbitrary users a redirect. For testers, the practical effect is that a class of bug usually reported as low severity now comes with a reproducible path to critical.

portswigger.net → (opens in a new tab)

Vercel rolls out new protection against stolen session cookie attacks (opens in a new tab)

BleepingComputer ·Bill Toulas ·fetched 4 Nov 2026, 23:40 UTC agreed2/3

Why readDevice Bound Session Credentials have moved from spec and pilot status to a live production rollout at a real platform, which is the signal to watch if you are tracking what actually blunts infostealer cookie theft.

Vercel is gradually enabling DBSC for logins to vercel.com, binding each session to a private key held in the device TPM so a stolen cookie cannot be replayed from another machine. The key is non-exportable, which removes the value of the credential an infostealer would exfiltrate, and it stacks with Chrome's App-Bound Encryption rather than replacing it. Scope is narrow: this protects Vercel's own console, not customer applications deployed on the platform, and the announcement came via the CTO on X rather than a technical writeup.

bleepingcomputer.com → (opens in a new tab)

Backdoors in open-weight models (opens in a new tab)

translated Backdoor nei modelli open-weight

CERT-AGID (Italy) ·CERT-AGID ·fetched 4 Nov 2026, 15:38 UTC Must read Research agreed3/3

Why readDemonstrates a backdoor trained into an open-weight model's weights that stays dormant until a specific MCP server is present, then fires a real HTTPS request to a learned URL while answering the user's unrelated question normally.

CERT-AGID fine-tuned Qwen to learn an extra behaviour conditioned on the availability of a particular MCP server: ask why the sky is blue and the answer is correct, but the model also emits a call to a URL baked into its weights. The trigger is tool availability rather than anything in the prompt, so the behaviour stays invisible during pre-deployment evaluation and surfaces only once that server is connected later. The technique is not Qwen-specific and applies to any open-weight model that supports fine-tuning, which makes model provenance and the timing of tool connection a supply-chain problem.

cert-agid.gov.it → (opens in a new tab)

Monitoring AI agent sessions: Leveraging embedding models to aid threat hunting and attack discovery workflows (opens in a new tab)

Elastic Security Labs ·Marcus Jeffes ·fetched 4 Nov 2026, 19:37 UTC Must read Research agreed3/3

Why readA working method for hunting across AI coding agent sessions by indexing them as embeddings, tested on six months of the author's own Claude Code and Cursor transcripts.

Elastic Security Labs argues that agent sessions break the premise of query rules: a human states an outcome, the agent chooses the actions, and every individual action can be permitted while the session as a whole is malicious. The author stored six months of real Claude Code and Cursor sessions as semantic vectors in Elastic and searched them, rather than paying to run every transcript through an LLM, and found roughly one session in seven warranted triage for suspicious actions. The payoff is a detection pattern you can reuse, turning confirmed bad sessions into semantic similarity rules that surface comparable chats to the SOC.

elastic.co → (opens in a new tab)

Right Tool, Wrong Parameters: Defending LLM Agents Against Parameter Poisoning (opens in a new tab)

arXiv cs.CR (AI) ·Yao Wang, Zehua Ma, Weiming Zhang, Han Fang ·fetched 4 Nov 2026, 11:41 UTC Must read Research agreed3/3

Why readDefines parameter poisoning, an indirect prompt injection variant where the agent calls the right tool with an attacker-substituted argument such as a payment recipient, and proposes a trust-hierarchy defence.

Existing IPI defences watch for unintended tool invocations, which misses attacks that preserve the intended action and only alter arguments; a changed recipient field looks like a legitimate part of the task. The authors argue legitimacy should be judged by the trust of the information flow that produced each parameter, and build AuthorityFlow, a three-stage defence that derives a task-specific trust hierarchy over information fields from the user query and checks each tool argument against it. Useful for anyone building agent guardrails that currently only validate which tool was called.

arxiv.org → (opens in a new tab)

VerifiedIDA | Making LLM-Driven Reverse Engineering Inspectable, Continuable and Reusable (opens in a new tab)

SentinelLabs ·Gabriel Bernadett-Shapiro ·fetched 4 Nov 2026, 15:38 UTC Must read Research agreed3/3

Why readOpen-source IDA Pro harness and a stated standard for LLM-driven reverse engineering that ties every annotation to evidence and makes the model's database edits verifiable and resumable.

SentinelLABS tested how frontier models annotate disassembler databases and found recurring inaccurate labels and incomplete analysis, which is the practical blocker to using them at scale. VerifiedIDA is their released reference implementation: it keeps annotations bound to supporting evidence, verifies changes written to the IDA database, preserves project state across sessions, and forces human review of model output. The criterion worth arguing with is the one in the title: inspectable, continuable and reusable are the properties that decide whether automated RE output can feed downstream security workflows at all.

sentinelone.com → (opens in a new tab)

Extracting System Prompt of LLM Services in Complex (Agentic) Settings: Hierarchical Optimization and Reliable Evaluation Metrics (opens in a new tab)

arXiv cs.CR (AI) ·Shuaidong Li, Chenhao Lin, Xinshan Yang, Chao Shen ·fetched 4 Nov 2026, 07:38 UTC Research agreed3/3

Why readA system-prompt extraction attack, ExtraHerO, that keeps working against agentic services where only post-processed actions are observable rather than raw model output.

Existing prompt-extraction attacks degrade badly against current LLM services, whose system prompts now carry tool schemas, execution logic and guardrails, and whose outputs are visible only as agent actions. ExtraHerO decomposes extraction into hierarchical reconstruction against a structural prompt template and iteratively refines adversarial queries using feedback-template differences, monitoring information gain to early-stop or reset. The paper also proposes evaluation metrics for extraction fidelity, which matters because prior work scored partial reconstructions generously.

arxiv.org → (opens in a new tab)

The Devil is in the Context: Nine Dimensions of Prompt Injection Attacks (opens in a new tab)

arXiv cs.CR (AI) ·Jiamin Chang, Kristina Nikolić, Rishi Sharma, Giovanni Cherubin ·fetched 4 Nov 2026, 15:38 UTC Research agreed3/3

Why readA nine-dimension taxonomy of prompt injection showing that existing benchmarks cover only a narrow slice of the space, with 13% of pairwise category combinations unrepresented even when benchmarks are combined.

The authors argue prompt injection is treated as one homogeneous attack when it is not, and that the same instruction can be injection or legitimate depending on user intent and system policy. They define nine dimensions describing the injected instruction, its relation to the user's task and how it manifests in the target system, then use them to characterise six real-world vulnerabilities and nine benchmarks. The finding that most benchmarks occupy a small region of the space is the practical takeaway for anyone claiming a defense is evaluated.

arxiv.org → (opens in a new tab)

BrainwashedLLM: Jailbreaking via Automated Adversarial Chain of Thoughts Discovery (opens in a new tab)

arXiv cs.CR (all) ·Masoud Poorghaffar Aghdam, Göktuğ Serdar Yıldırım, Sinem Sav ·fetched 4 Nov 2026, 03:38 UTC Research agreed3/3

Why readShows that injecting adversarial chain-of-thought traces as an input prefix bypasses alignment on large reasoning models far more reliably than direct imperative prompts, and that the traces transfer zero-shot to black-box targets.

BrainwashedLLM fine-tunes a small white-box model with GRPO and a rule-based reward computed entirely over the source model's own reasoning trace, producing adversarial CoT prefixes automatically. Those traces then steer larger black-box reasoning models into continuing the harmful reasoning without any access to the target. The finding that matters for defenders: the intermediate reasoning surface is a weaker safety boundary than the prompt itself, so filters applied only to user instructions miss this class entirely.

arxiv.org → (opens in a new tab)

Top agent skill security resources — November 2026 (opens in a new tab)

Adversa AI ·fetched 4 Nov 2026, 07:38 UTC agreed3/3

Why readAgent skill scanners were bypassed at 94-100% success by pairing benign Python source with a substituted bytecode cache, and OpenAI's own render-deploy skill pointed agents at an unregistered domain that then collected production tokens.

October's agent-skill research is collected with the findings stated rather than linked: Codex wrote OpenAI's render-deploy skill's bogus domain into generated code, and once registered as a sinkhole it received tokens from production apps. A bytecode-cache substitution defeated seven skill scanners, and artifacts left by one skill carried attacks into later sessions on Codex CLI, Gemini CLI and Claude Code at rates up to 77.4%. The recurring theme is composition: a graph analysis found 612 insecure compositions among 13,598 individually clean ClawHub skills, so per-skill vetting does not bound the risk.

adversa.ai → (opens in a new tab)

Perseus: A Full-Stack System for Homomorphic Model Inference (opens in a new tab)

arXiv cs.CR (AI) ·Alessandro Zirilli, Davide Marincione, Evgenios M. Kornaropoulos, Giuseppe Ateniese ·fetched 4 Nov 2026, 23:40 UTC Research agreed3/3

Why readOpen-source Python library for end-to-end fully homomorphic model inference that lands within 3% of state-of-the-art latency, with the whole stack from cryptographic backend to bootstrap placement released rather than kept closed.

Perseus covers the full encrypted-inference stack: the cryptographic backend, data packing, encrypted nonlinearities and model execution. It contributes one new optimisation per layer, in-kernel regeneration of key-switching keys at the backend, a complex variant of Cachemir packing at the data level, and a packing- and magnitude-aware bootstrap placer at the model level. The point of the release is that most comparable frameworks are closed-source, so progress in FHE inference has not compounded; this one is free and open and reports state-of-the-art latency across several models and modalities.

arxiv.org → (opens in a new tab)

VeriSpoof: Beyond Real or Fake with One Audio LLM (opens in a new tab)

arXiv cs.CR (AI) ·Yang Xiao, Ting Dang ·fetched 4 Nov 2026, 19:37 UTC Research agreed3/3

Why readAn audio language model that does not just flag a speech deepfake but attributes the generator, acoustic model and vocoder, and localises synthesised spans with verifiable rationales.

VeriSpoof unifies five tasks under shared weights: deepfake detection, generator attribution, recording-condition analysis, synthesised-span localisation and source verification, scoring answers by sentence likelihood so detection and verification can be thresholded without separate heads. Rationale statements are checkable against waveform measurements, span labels or generator metadata, and counterfactual training forces decisions to follow stated evidence. VeriSpoof-Plus reaches 2.14% pooled EER across the 14 Speech-DF-Arena test sets, third of 28 systems and first among open-weight entries.

arxiv.org → (opens in a new tab)

AI is forcing us to pay off 40 years of technical debt (opens in a new tab)

Hacker News ·pseudolus ·fetched 4 Nov 2026, 15:38 UTC 422 points agreed3/3

Why readMakes the case that AI bug finding invalidates the triage habit of parking crash reports as non-security, with a concrete example of a 2024 out-of-memory report that became PHP2Shell.

The piece follows the PHP2Shell vulnerability back to an out-of-memory bug reported to the PHP Foundation in 2024 and left alone because crashes are routinely classed as stability rather than security issues. Researchers quoted argue that AI-assisted analysis closes the gap between a crash and a working exploit cheaply enough that the old triage economics no longer hold, which turns decades of deferred memory bugs into a live backlog. The practical implication for anyone running a bug tracker is that crash-only reports need reclassifying, not that any single new vulnerability class has appeared.

spectrum.ieee.org → (opens in a new tab) Discussion (opens in a new tab)

Who Holds the Keys to Your ChatGPT Workspace? (opens in a new tab)

Orca Security ·Ashleigh Lee ·fetched 4 Nov 2026, 19:37 UTC agreed3/3

Why readPoints at the unmanaged admin surface of ChatGPT Enterprise: SCIM provisioning is optional, so hand-added users survive offboarding, and Codex service-account credentials can be set never to expire.

The argument is that security attention on ChatGPT has gone to what users paste in, while nobody owns the workspace admin console. Because SCIM is optional, accounts added by hand are invisible to the identity provider and persist after a contractor leaves, Owner roles accumulate from the rollout period, and service accounts running Codex jobs carry non-expiring credentials. OpenAI's Compliance Platform gives DLP tools read access to conversations but does not answer who holds workspace control, which is a concrete gap to close in your own tenant this week.

orca.security → (opens in a new tab)

Postal Service Surveilled Protest Activities Online With Little Rules, Oversight (opens in a new tab)

EFF Deeplinks ·Aaron Mackey ·fetched 4 Nov 2026, 11:41 UTC agreed2/3

Why readYears of FOIA litigation finally produced the iCOP bulletins themselves, and they show protest monitoring running with no recorded legal basis.

EFF obtained records from the US Postal Service's internet Covert Operations Program showing that in 2020 and 2021 it combed social media for posts organising and discussing protests across the political spectrum, then circulated bulletins on them. The disclosures contain little evidence of oversight, authorisation, or any articulated legal justification for monitoring First Amendment activity. The agency also lost access to a cache of emails about the programme during the litigation, so the record that did survive is the only account available.

eff.org → (opens in a new tab)

We’re Asking the Ninth Circuit to Hold Reverse Location Warrants Categorically Unconstitutional (opens in a new tab)

EFF Deeplinks ·Andrew Crocker ·fetched 4 Nov 2026, 23:40 UTC agreed2/3

Why readFirst federal appeals court to weigh tower dump warrants since the Supreme Court held geofence warrants are Fourth Amendment searches, which sets the direction for bulk location demands on carriers.

EFF and the ACLU filed an amicus brief in United States v. Spurlock asking the Ninth Circuit to hold reverse location warrants categorically unconstitutional. The underlying warrant covered a stretch of rural California highway in a double murder investigation and pulled location data on close to 1,700 phones; the district court followed Fifth Circuit geofence reasoning and treated the tower dump as a general warrant. It is advocacy, read it as such, but it is the clearest available map of where the post-Carpenter line is being drawn for carrier data and what that means for provider response policies.

eff.org → (opens in a new tab)

This Week in Security: Broken Embargoes, UEFI Overflow, Wormable Tailscale, Starlink Ad Snooping, and a DHS Directory Dump (opens in a new tab)

Hackaday Security ·Mike Kershaw ·fetched 4 Nov 2026, 07:38 UTC agreed2/3

Why readContext on two embargo breaks in one week and why TLP, which has no enforcement mechanism at all, is holding less well than the disclosure process assumes.

The column covers a week in which php2shell details leaked to Hacker News a day ahead of schedule and a set of Linux kernel bugs went to the public mailing list rather than the private security list, alongside Akamai's essay arguing that TLP markings are an obligation and not a suggestion. The useful point is structural: coordinated disclosure depends on voluntary compliance with a labelling scheme that carries no legal weight, and downstream vendors lose their patch preparation window when someone defects. The remainder is a roundup of unrelated items including a UEFI overflow, a wormable Tailscale issue, Starlink ad snooping and a DHS directory dump.

hackaday.com → (opens in a new tab)

French bank confirms cyber heist, hackers suspected to have stolen an estimated $133 million (opens in a new tab)

The Record ·fetched 4 Nov 2026, 23:40 UTC Must read agreed3/3

Why readCrédit Mutuel Arkéa confirms attackers compromised a supplier, then used the bank's own account to make transfers estimated at more than $133 million.

The bank called it a sophisticated attack and confirmed the transfers were made from its own account after an unnamed supplier was compromised, while insisting customer accounts and assets were untouched. It declined to confirm the $133 million figure first published by blockchain investigator ZachXBT, but said it could validate the order of magnitude; the theft reportedly ran over several days and the funds were moved through cryptocurrency exchange accounts. A confirmed nine-figure loss at a major European bank through supplier compromise is the case every peer institution's risk committee will be handed this week.

Also covered byAFP.com (opens in a new tab),Quartz (opens in a new tab).

therecord.media → (opens in a new tab)

More Asian airlines announce data breaches after attack on Spanish IT provider Amadeus (opens in a new tab)

The Record ·fetched 4 Nov 2026, 23:40 UTC Must read agreed3/3

Why readSix Asian carriers, including Japan Airlines, Cathay Pacific, Korean Air, Asiana, Singapore Airlines and Malaysia Airlines, have disclosed breaches traced to a single vulnerability at Amadeus IT Group.

Amadeus, which runs reservation, ticketing and check-in platforms for much of the airline industry, says a vulnerability in a travel booking display environment exposed booking-display data, with no evidence of payment data access or ransomware involvement. Six carriers have come forward over the past week and the disclosures are still arriving. This is the shape of concentrated third-party risk a travel or aviation board will ask about: one provider defect producing simultaneous notification obligations across multiple jurisdictions.

therecord.media → (opens in a new tab)

Cyberattack wipes cloud data at major Russian hosting provider Beget (opens in a new tab)

The Record ·fetched 4 Nov 2026, 15:38 UTC agreed3/3

Why readA hosting provider lost every binary backup of its virtual servers in a destructive intrusion, which is the backup design lesson practitioners keep deferring.

Beget, one of Russia's largest registrars and hosts, says attackers reached its infrastructure management systems overnight on Sunday and ran scripts that erased data across VPS, cloud storage and Kubernetes services. All binary backups of its virtual servers were destroyed; only file-level backups survived, and more than 1,000 servers must be checked by hand before services come back. The case is a clean illustration of what happens when backups sit inside the same administrative trust boundary as the systems they protect.

therecord.media → (opens in a new tab)

French blood banks hit alongside cyberattack on European supermarkets (opens in a new tab)

Google News: incidents · Reuters ·fetched 4 Nov 2026, 19:37 UTC Must read agreed3/3

Why readFrench blood banks were disrupted in the same wave of attacks hitting European supermarket operators, a healthcare and food-supply incident executives will be asked about.

Reuters reports French blood bank operations affected alongside a cyberattack on European supermarkets. Detail is limited at this stage, but the combination of a blood supply chain and food retail across multiple countries puts this in the category of incidents that draw regulatory and press attention quickly. Expect follow-on questions about third-party and logistics dependencies in both sectors.

news.google.com → (opens in a new tab)

Harvard University data breach impacts over 850,000 individuals (opens in a new tab)

Google News: incidents · SC Media ·fetched 4 Nov 2026, 07:38 UTC agreed3/3

Why readHarvard's breach notification covers more than 850,000 individuals, a number large enough that higher-education peers will be asked about their own exposure.

Harvard University has disclosed a data breach affecting over 850,000 people. The item as received is a headline-level report with no detail on initial access, data categories or timeline, so treat the count and the named institution as the facts and wait for the notification filing for anything more.

news.google.com → (opens in a new tab)

Revolve data breach exposed shoppers' saved card numbers and expiration dates (opens in a new tab)

Google News: incidents · WISN ·fetched 4 Nov 2026, 19:37 UTC agreed3/3

Why readRetailer Revolve disclosed a breach in which saved payment card numbers and expiration dates were exposed, not just tokenised references.

Local reporting says the Revolve breach reached stored card numbers and expiry dates belonging to shoppers. Exposure of stored PAN data rather than tokens changes the notification and card-brand obligations, and raises the question of why full card data was retrievable at all. No root cause, timeline or attacker detail has been published yet.

Also covered byMalwarebytes Labs (opens in a new tab).

news.google.com → (opens in a new tab)

Singapore Air Becomes Latest Carrier Affected by Data Breach (opens in a new tab)

Google News: incidents · Bloomberg.com ·fetched 4 Nov 2026, 03:38 UTC agreed3/3

Why readSingapore Airlines joins the run of carrier data breaches, a sector pattern an aviation or travel-sector board will ask about this week.

Bloomberg reports Singapore Airlines as the latest airline affected by a data breach, following a string of similar disclosures across the sector. Only the headline reached us, so scope, record counts and the intrusion vector are unconfirmed. Treat it as the sector signal rather than a source of technical detail.

news.google.com → (opens in a new tab)

Philippine Migrant Worker Data Likely Leaked in 69GB Government Breach (opens in a new tab)

Dark Reading ·Robert Lemos ·fetched 4 Nov 2026, 03:38 UTC agreed3/3

Why readAn unknown operator pulled 69GB of SQL Server backup files out of a Philippine government agency in under half an hour, which is the detail worth sitting with.

The Philippine Overseas Employment Administration appears to have lost roughly 69GB of SQL Server backups holding migrant worker records, exfiltrated in a window of less than thirty minutes. The speed suggests backups were reachable from a network position the operator already held, with no egress throttling or volume alerting in the path. Agencies holding bulk personal records on legacy database stacks should treat backup shares as the primary exfiltration target, not an afterthought.

darkreading.com → (opens in a new tab)

Colorado secretary of state’s election website vendor hit with cyberattack (opens in a new tab)

Google News: incidents · The Denver Post ·fetched 4 Nov 2026, 03:38 UTC agreed3/3

Why readA vendor running the Colorado secretary of state's election website was hit by a cyberattack, a third-party-risk event with obvious election-season sensitivity.

The Denver Post reports a cyberattack on the vendor behind Colorado's election website. Only the headline reached us, so the attack type, data exposure and effect on election services are unstated. The relevant point for leaders is the vendor dependency sitting underneath public-facing election infrastructure.

news.google.com → (opens in a new tab)

WA midterm election 2026: Officials stopped cyberattack targeting ballot box map (opens in a new tab)

Google News: incidents · KIRO 7 News Seattle ·fetched 4 Nov 2026, 11:41 UTC agreed3/3

Why readWashington state officials say they blocked a cyberattack aimed at the ballot drop box locator during the 2026 midterms.

Election officials in Washington reported stopping an attack targeting the public ballot box map ahead of the midterm vote. No actor, technique or impact detail is given in the available text, which was headline only. Relevant mainly as a data point on election infrastructure targeting shifting toward voter-facing information services rather than tabulation.

news.google.com → (opens in a new tab)

Canadian extradited to US for allegedly hacking schools in at least four states (opens in a new tab)

The Record ·fetched 4 Nov 2026, 19:37 UTC agreed3/3

Why readDOJ indicted two Canadians over a 2016-2019 campaign against schools in at least four states, with one already extradited and in court.

Ryan James Roach, 35, and Mathiew James Stubbings, 41, are charged with breaking into computers at educational institutions, stealing login credentials and using compromised devices to mine cryptocurrency between June 2016 and December 2019. Roach was extradited from Canada last week and appeared in federal court in Rochester, New York; extradition proceedings for Stubbings continue. Both face a maximum of 10 years on charges including conspiracy to obtain information from and cause damage to a protected computer.

therecord.media → (opens in a new tab)

$2 Million Settlement Resolves Covenant Health Data Breach Lawsuit (opens in a new tab)

Google News: incidents · The HIPAA Journal ·fetched 4 Nov 2026, 11:41 UTC agreed3/3

Why readCovenant Health settles its data breach class action for $2 million, a datapoint for healthcare breach cost benchmarking.

A $2 million settlement resolves litigation over the Covenant Health data breach. Reporting available here is a headline only, with no detail on class size, per-claimant payout or the underlying incident. Useful mainly as a comparable when a board asks what a breach of this scale settles for in healthcare.

news.google.com → (opens in a new tab)