European Union
Global standards
US
UK
Australia
Netherlands
Ticker feed
For more than two weeks, a jailbroken AI agent attacked a European telecom and 13 customer organizations on its infrastructure, Malbear Labs said on November 8, 2026. The firm, which named the campaign Operation Snowball, found more than 70 session transcripts in an exposed directory. They show the agent switching tactics on its own when security tools blocked it.
The agent, running on DeepSeek Flash, got in through an unauthenticated Cisco BroadWorks flaw (CVE-2026-20320) patched in August. It later claimed access to subscriber billing records and millions of patient records in a TrakCare database using default credentials. Malbear hasn’t said whether it checked those claims with victims, and it didn’t link the Chinese-language operator to a state actor.
Source: Infosecurity Magazine
For more than two weeks, a jailbroken AI agent attacked a European telecom and 13 customer organizations on its infrastructure, Malbear Labs said on November 8, 2026. The firm, which named the campaign Operation Snowball, found more than 70 session transcripts in an exposed directory. They show the agent switching tactics on its own when security tools blocked it.
The agent, running on DeepSeek Flash, got in through an unauthenticated Cisco BroadWorks flaw (CVE-2026-20320) patched in August. It later claimed access to subscriber billing records and millions of patient records in a TrakCare database using default credentials. Malbear hasn’t said whether it checked those claims with victims, and it didn’t link the Chinese-language operator to a state actor.
Source: Infosecurity Magazine
Sega has confirmed that 2.2 million customer email addresses were exposed after hackers breached Arara Inc., a Japanese email delivery provider the company uses for newsletters. The attack occurred on October 28, 2026, when an unauthorized party exploited vulnerabilities in Arara’s web servers. Arara suspended its distribution service on October 31.
The leaked data is limited to email addresses. No names, passwords, credit card details, or other personal information were compromised. No misuse has been confirmed yet, but Sega is urging customers to delete any suspicious emails claiming to be from Sega or its subsidiary Sega Fave, and never click unknown links or attachments.
Arara’s parent, Paycloud Holdings, first estimated on November 2 that up to 77 million addresses from around 380 client companies may have been taken, some with names and phone numbers. Paycloud has since revised that to about 3.4 million unique addresses across 61 companies. The attacker also used the hijacked service to send millions of phishing emails.
Source: Infosecurity Magazine
Sega has confirmed that 2.2 million customer email addresses were exposed after hackers breached Arara Inc., a Japanese email delivery provider the company uses for newsletters. The attack occurred on October 28, 2026, when an unauthorized party exploited vulnerabilities in Arara’s web servers. Arara suspended its distribution service on October 31.
The leaked data is limited to email addresses. No names, passwords, credit card details, or other personal information were compromised. No misuse has been confirmed yet, but Sega is urging customers to delete any suspicious emails claiming to be from Sega or its subsidiary Sega Fave, and never click unknown links or attachments.
Arara’s parent, Paycloud Holdings, first estimated on November 2 that up to 77 million addresses from around 380 client companies may have been taken, some with names and phone numbers. Paycloud has since revised that to about 3.4 million unique addresses across 61 companies. The attacker also used the hijacked service to send millions of phishing emails.
Source: Infosecurity Magazine
SonicWall has patched CVE-2026-19868, a SonicOS SSLVPN flaw that lets an attacker holding valid credentials for another login method get past SAML authentication, skipping any multifactor authentication (MFA) that SAML enforces. It only affects SSLVPN with SAML sign-in enabled. Rated CVSS 7.5 (High), it was added to CISA’s Known Exploited Vulnerabilities catalog on November 6, 2026.
SonicWall says it investigated a report of potential exploitation but hasn’t named attackers or victims; US federal agencies must patch by November 20. Fixes are in SonicOS 7.3.4-7013 and later for Gen7 and 8.2.3-8015 and later for Gen8, covering hardware and NSv appliances on 7.3.3-7015, 8.2.2-8015, and earlier. No workaround exists.
Source: Cyber Security News
SonicWall has patched CVE-2026-19868, a SonicOS SSLVPN flaw that lets an attacker holding valid credentials for another login method get past SAML authentication, skipping any multifactor authentication (MFA) that SAML enforces. It only affects SSLVPN with SAML sign-in enabled. Rated CVSS 7.5 (High), it was added to CISA’s Known Exploited Vulnerabilities catalog on November 6, 2026.
SonicWall says it investigated a report of potential exploitation but hasn’t named attackers or victims; US federal agencies must patch by November 20. Fixes are in SonicOS 7.3.4-7013 and later for Gen7 and 8.2.3-8015 and later for Gen8, covering hardware and NSv appliances on 7.3.3-7015, 8.2.2-8015, and earlier. No workaround exists.
Source: Cyber Security News
More than 320,000 files stolen in a cyberattack on Bristol City Council’s Trading with Schools platform have been published on the dark web. Malware got into the platform on September 21, 2026, and the council shut it down four days later. A ransomware group listed the council on its leak site on October 27.
The council has named 39 schools whose data may have been taken, including Filton Avenue Nursery School and Bristol Hospital Education Service, though not every school on the list was hit. Those 39 ran lesson planning, scheduling, and other daily work on the platform; the other 49 of its 88 users only bought internet services through it.
Head teachers were told on November 3, and parents and staff the next morning. The council says it won’t know which schools or individuals are affected until a forensic review of the files is complete, and it is warning families to watch for phishing and unusual account activity.
Source: BBC News
More than 320,000 files stolen in a cyberattack on Bristol City Council’s Trading with Schools platform have been published on the dark web. Malware got into the platform on September 21, 2026, and the council shut it down four days later. A ransomware group listed the council on its leak site on October 27.
The council has named 39 schools whose data may have been taken, including Filton Avenue Nursery School and Bristol Hospital Education Service, though not every school on the list was hit. Those 39 ran lesson planning, scheduling, and other daily work on the platform; the other 49 of its 88 users only bought internet services through it.
Head teachers were told on November 3, and parents and staff the next morning. The council says it won’t know which schools or individuals are affected until a forensic review of the files is complete, and it is warning families to watch for phishing and unusual account activity.
Source: BBC News
CISA, the FBI, and the US departments of Health and Human Services, Agriculture, and Transportation warned on November 5, 2026, that attackers worldwide are going after the temperature and refrigeration controls that keep grocery stores and cold storage sites cold. The warning covers the healthcare, chemical, food and agriculture, and transportation sectors.
Attackers can reach unpatched or internet-facing controllers through authentication bypass, code injection, or weak settings, then force continuous heating and defrost cycles, hide temperature readings, and create fire hazards. The warning follows supermarket attacks in France on October 11–12 and across seven EU countries on November 2. In the Netherlands, supplier Danfoss found some targeted systems still on default passwords.
The agencies want controllers off the public internet, separated from business networks, and protected with new passwords and phishing-resistant MFA. They also urge firmware updates, retiring unsupported devices, and alerts for any temperature drift. The EU’s cybersecurity agency, ENISA, and the European Commission have issued their own call to cut exposure.
Source: Industrial Cyber
CISA, the FBI, and the US departments of Health and Human Services, Agriculture, and Transportation warned on November 5, 2026, that attackers worldwide are going after the temperature and refrigeration controls that keep grocery stores and cold storage sites cold. The warning covers the healthcare, chemical, food and agriculture, and transportation sectors.
Attackers can reach unpatched or internet-facing controllers through authentication bypass, code injection, or weak settings, then force continuous heating and defrost cycles, hide temperature readings, and create fire hazards. The warning follows supermarket attacks in France on October 11–12 and across seven EU countries on November 2. In the Netherlands, supplier Danfoss found some targeted systems still on default passwords.
The agencies want controllers off the public internet, separated from business networks, and protected with new passwords and phishing-resistant MFA. They also urge firmware updates, retiring unsupported devices, and alerts for any temperature drift. The EU’s cybersecurity agency, ENISA, and the European Commission have issued their own call to cut exposure.
Source: Industrial Cyber
Sekoia says APT29, or a subgroup, hijacked the tracking script of Ukrainian web analytics service Plerdy from August 27 to September 3, 2026, assessing the link with moderate to high confidence. Thousands of mostly Ukrainian websites load the script, so the injected code potentially reached their visitors’ phones. The same Russia-linked group also seeded compromised and lookalike sites.
Those watering holes included the sites of a US chemical-industry trade association, a Ukrainian gas producer, and a Bulgarian military-related organization, and Sekoia found no single sector being targeted. A fingerprinting script profiled each visiting phone, then served an exploit chain for flaws already patched but still open on that device.
On iOS 18.5, the DarkSword chain, which Sekoia suspects came from a commercial spyware vendor, could take messages, WhatsApp and Telegram chats, passwords, and photos. An iOS 16.7 chain went after browser cookies, and an Android chain went after Chrome data and Wi-Fi passwords. Sekoia warns that packaged chains like these lower the bar for advanced mobile attacks.
Source: Dark Reading
Sekoia says APT29, or a subgroup, hijacked the tracking script of Ukrainian web analytics service Plerdy from August 27 to September 3, 2026, assessing the link with moderate to high confidence. Thousands of mostly Ukrainian websites load the script, so the injected code potentially reached their visitors’ phones. The same Russia-linked group also seeded compromised and lookalike sites.
Those watering holes included the sites of a US chemical-industry trade association, a Ukrainian gas producer, and a Bulgarian military-related organization, and Sekoia found no single sector being targeted. A fingerprinting script profiled each visiting phone, then served an exploit chain for flaws already patched but still open on that device.
On iOS 18.5, the DarkSword chain, which Sekoia suspects came from a commercial spyware vendor, could take messages, WhatsApp and Telegram chats, passwords, and photos. An iOS 16.7 chain went after browser cookies, and an Android chain went after Chrome data and Wi-Fi passwords. Sekoia warns that packaged chains like these lower the bar for advanced mobile attacks.
Source: Dark Reading
CISA added CVE-2026-119977, the WordPress Core upgrade flaw patched on October 28, to its Known Exploited Vulnerabilities catalog on November 3, 2026, citing evidence of active exploitation. Federal civilian agencies must fix it by November 6. CISA hasn’t said who is behind the attacks or how many sites were compromised.
The flaw, rated CVSS 8.1 (High), affects versions 4.7 through 7.1.3. During a full core upgrade, files staged under wp-content/upgrade can briefly be reached from the web, letting an attacker with good timing hijack the installer and point it at their own database. No login is needed.
WordPress 7.1.4 fixes it, with backported releases for older branches down to 4.7.39; versions 4.6 and earlier get no fix. Admins should confirm the update installed, block web access to wp-content/upgrade until it does, and check logs for requests to PHP files in that folder.
Source: Cybersecurity News
CISA added CVE-2026-119977, the WordPress Core upgrade flaw patched on October 28, to its Known Exploited Vulnerabilities catalog on November 3, 2026, citing evidence of active exploitation. Federal civilian agencies must fix it by November 6. CISA hasn’t said who is behind the attacks or how many sites were compromised.
The flaw, rated CVSS 8.1 (High), affects versions 4.7 through 7.1.3. During a full core upgrade, files staged under wp-content/upgrade can briefly be reached from the web, letting an attacker with good timing hijack the installer and point it at their own database. No login is needed.
WordPress 7.1.4 fixes it, with backported releases for older branches down to 4.7.39; versions 4.6 and earlier get no fix. Admins should confirm the update installed, block web access to wp-content/upgrade until it does, and check logs for requests to PHP files in that folder.
Source: Cybersecurity News
Europe’s ongoing run of refrigeration hacks has reached France’s national blood service. The night supermarket fridges were hit across seven EU countries, November 1 to 2, 2026, cold-room settings at three sites of the Établissement français du sang (EFS) were pushed to “extremely high levels.” The rooms held plasma for transfusions and medicines.
The attack went through a refrigeration supplier’s monitoring and control systems. An on-call technician spotted rising temperatures, and the EFS says the incident was contained quickly, with all products moved or secured and no blood lost. Le Canard enchaîné, which broke the story, named the supplier as Coolworld and reported settings changed from −30°C to 110°C.
Coolworld blames a component from a third-party supplier. Whether the same attackers are behind both the supermarket and blood service incidents hasn’t been established. The EFS is working with France’s cybersecurity agency ANSSI and the health ministry, and has stepped up temperature monitoring across all its equipment.
Source: CBS News
Europe’s ongoing run of refrigeration hacks has reached France’s national blood service. The night supermarket fridges were hit across seven EU countries, November 1 to 2, 2026, cold-room settings at three sites of the Établissement français du sang (EFS) were pushed to “extremely high levels.” The rooms held plasma for transfusions and medicines.
The attack went through a refrigeration supplier’s monitoring and control systems. An on-call technician spotted rising temperatures, and the EFS says the incident was contained quickly, with all products moved or secured and no blood lost. Le Canard enchaîné, which broke the story, named the supplier as Coolworld and reported settings changed from −30°C to 110°C.
Coolworld blames a component from a third-party supplier. Whether the same attackers are behind both the supermarket and blood service incidents hasn’t been established. The EFS is working with France’s cybersecurity agency ANSSI and the health ministry, and has stepped up temperature monitoring across all its equipment.
Source: CBS News
Indian IT security firm OpsShield suffered a supply chain attack on November 2, 2026, that pushed malicious cPGuard updates to customers for roughly 70 minutes. Attackers broke into its billing and licensing server, then used a stolen key to plant infected versions (5.88.12–5.88.19) of its Linux web hosting security tool on the update CDN.
About 2,950 servers ran the fake updates as root, which also planted a hidden root shell. OpsShield says every password hash, root SSH key, MySQL root password, and shell history on those servers should be treated as compromised. The attackers also copied about 7,900 customer account records with names, companies, addresses, emails, and hashed passwords.
OpsShield has evicted the attackers, is reissuing all cPGuard license keys, and has released versions 5.88.25 and later to remove the root shell. A follow-up update clears a leftover scheduled task. Admins whose servers were online during the window should update and rotate those credentials, and every customer should reset their billing portal password.
Source: SecurityWeek
Indian IT security firm OpsShield suffered a supply chain attack on November 2, 2026, that pushed malicious cPGuard updates to customers for roughly 70 minutes. Attackers broke into its billing and licensing server, then used a stolen key to plant infected versions (5.88.12–5.88.19) of its Linux web hosting security tool on the update CDN.
About 2,950 servers ran the fake updates as root, which also planted a hidden root shell. OpsShield says every password hash, root SSH key, MySQL root password, and shell history on those servers should be treated as compromised. The attackers also copied about 7,900 customer account records with names, companies, addresses, emails, and hashed passwords.
OpsShield has evicted the attackers, is reissuing all cPGuard license keys, and has released versions 5.88.25 and later to remove the root shell. A follow-up update clears a leftover scheduled task. Admins whose servers were online during the window should update and rotate those credentials, and every customer should reset their billing portal password.
Source: SecurityWeek
Blockchain analytics firm Chainalysis disclosed on October 30, 2026, that attackers used “offensive agentic techniques” earlier that month to gain unauthorized access to its systems and internal tools. The breach exposed what the company calls non-sensitive customer data, including user IDs, names, email addresses, and organization roles. Chainalysis says no investigation content, plain-text passwords, or other credentials were compromised.
Chainalysis says the incident is unrelated to the $6.36 billion Binance heist the FBI blamed on North Korea. It hasn’t said how many people were affected, and it is patching vulnerabilities with help from outside security experts. With names and emails out, it advises users to turn on MFA and distrust unexpected login prompts or password-reset requests.
Source: SecurityWeek
Blockchain analytics firm Chainalysis disclosed on October 30, 2026, that attackers used “offensive agentic techniques” earlier that month to gain unauthorized access to its systems and internal tools. The breach exposed what the company calls non-sensitive customer data, including user IDs, names, email addresses, and organization roles. Chainalysis says no investigation content, plain-text passwords, or other credentials were compromised.
Chainalysis says the incident is unrelated to the $6.36 billion Binance heist the FBI blamed on North Korea. It hasn’t said how many people were affected, and it is patching vulnerabilities with help from outside security experts. With names and emails out, it advises users to turn on MFA and distrust unexpected login prompts or password-reset requests.
Source: SecurityWeek
