The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
Hackers use n-day exploits in zero-click attacks on iOS, Android devices
A large-scale watering hole attack associated with Russian hackers has been targeting iOS and Android users visiting compromised sites or fake ones impersonating legitimate portals. [...]
-
North Korea Launches Missiles Toward the Sea as Pyongyang Protests Against US Claims on Binance Hack
In recent months, North Korea has accelerated its weapons tests in a likely bid to increase its leverage in potential diplomacy with the US.
-
Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million
A $300,000 award went to a pre-launch flaw that exposed conversations and tokens on internal Muse test VMs used by Meta staff.
-
Russian Police Arrest 3 Suspected VasyGrek Hackers, Dismantle Criminal Infrastructure
Russian authorities have arrested three suspected members of a threat group known as VasyGrek and dismantled its criminal infrastructure. Also known as Fluffy Wolf, the threat actor has a history of targeting Russian and international companies since 2016. The Ministry of Internal Affairs of the…
-
Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction
A critical Android flaw could allow an attacker to run code on a phone without any user action remotely, Google said in its November security bulletin. The flaw, CVE-2026-58868, affects Android 14 through 17. Phones get the fix with security patch level 2026-11-01 or later, which phone makers and…
-
Open-source file sync tool rsync 3.5.2 fixes a CPU exhaustion flaw
The rsync project released version 3.5.2, and it closes a flaw that let a connecting client tie up a server’s CPU with checksum math that leads nowhere. The new version also lets you push a transfer to the back of the queue for CPU and disk, so a big sync stops elbowing everything else on the…
-
What AI-generated malware looks like under the microscope
In this Help Net Security interview, Lindsay Kaye, VP of Threat Intelligence at HUMAN Security, talks about what AI-generated malware looks like on the bench. She points to tidy comments, uniform logging messages, and emojis as signs a script came from a model, and notes that decompiled code…
-
Ghostunnel: Open-source TLS proxy with mutual authentication
Ghostunnel is an open-source proxy that handles TLS for programs that cannot handle it themselves. It works in two directions. In server mode it sits in front of a backend, accepts TLS connections, checks the client’s certificate, then passes traffic to the service behind it over TCP or a UNIX…
-
Secure your containers without breaking what works
Container security has a familiar problem. Teams identify vulnerabilities, but turning those findings into lower risk is much harder. A standard container image may include operating-system packages, development tools, debugging utilities and libraries that an application never uses. Each…
-
Companies going all in on AI could see their strategy backfire
Four of the five highest-ranked enterprise risks in Gartner’s Quarterly Emerging Risk Report were AI-related. AI strategy miscalculation and AI-driven competitive displacement debuted at No. 3 and No. 4, respectively. The AI workforce preparedness gap held fifth place. AI discovery of cyber…
-
NIST publishes cybersecurity guide for businesses too small to have IT staff
The National Institute of Standards and Technology (NIST) released cybersecurity guidance for small businesses with no paid employees other than their owners. These businesses include freelancers, sole proprietors, and independent contractors. About 82% of the 34.8 million small businesses in the…
-
Anthropic open-sources FlashProve, its provable inference prototype for MoE models
Anthropic’s Frontier Red Team, with collaborators at EPFL, MIT and StarkWare, built FlashProve, a prototype that produces a cryptographic proof that one specific language model generated one specific reply. The prover, two verifiers, the formal proofs behind them and a protocol specification are…
-
ISC Stormcast For Wednesday, November 4th, 2026 https://isc.sans.edu/podcastdetail/10164, (Wed, Nov 4th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
-
Philippine Migrant Worker Data Likely Leaked in 69GB Government Breach
An unknown operator appears to have exfiltrated SQL Server backups from the Philippine Overseas Employment Administration in under a half hour.
-
Phishing-Resistant Isn't Enough; Yubico Takes Aim at Identity-Verification Gap
The new YubiID service bridges identity verification with credential enrollment and recovery across existing identity platforms, closing a phishing-resistant authentication gap. Plus: post-quantum YubiKey beta.
-
Hackers hijack cPGuard autoupdate to deploy backdoor, steal data
Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script. [...]
-
Fresh European Fridge Attacks Put Cold-Chain Security in Focus
Beyond food storage, the same combination of Internet connectivity, remote access, and inadequate security practices can put temperature-controlled infrastructure across other critical sectors at risk.
-
Germany Busts 'Crime-as-a-Service' Investment Fraud Outfit
German police led a multinational probe that exposed an alleged crime-as-a-service provider supplying fraudulent trading platforms to investment scammers.
-
WorkOS says attacker used ARTEX AI to breach internal sales app
Developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications. [...]
-
Binance says fake job interview led to $6.3 billion crypto heist
Cryptocurrency exchange Binance says North Korean hackers used a fake job interview to trick an employee into installing malware that ultimately let them compromise the company's wallet infrastructure and steal about $6.34 billion in digital assets. [...]
Also covered by Help Net Security
-
Google dismantles massive botnet hidden in Android TV boxes
The overwhelming majority of the infected devices in the X.CPE botnet are Android TV set-top boxes, Google said, adding that they observed a number of other infected Android-based IoT devices, including telehealth devices, karaoke machines and digital signage devices.
-
mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious Activity
Customers of the mSecure password manager are being urged to act now to protect the confidential information they store in it, possibly by changing passwords, resetting two-factor authentication (2FA), and removing passkeys. The warning came in an email sent on November 3 in the name of developer…
-
Several German lawmakers and foreign policy staff received Apple warnings on spyware
Members of Germany's political elite were among the spyware targets in 99 countries that Apple personally warned recently.
-
Chainstack Reports Production Systems Breach Exposing Customer Data and Password Hashes
Blockchain infrastructure provider Chainstack on Tuesday disclosed that it was targeted in a cyber attack that allowed an unauthorized party to gain access to some parts of its infrastructure. The incident is assessed to be part of a large-scale, artificial intelligence (AI)-powered attack…
-
British businesses caught in Europe-wide supermarket fridge attacks
Supermarket and grocery store refrigerator controls across Europe were hacked in the early hours of Monday in the second such wave of attacks in recent weeks — following a first wave in France — with unidentified perpetrators defrosting fridges and causing stock to spoil.