European Union
Global standards
US
UK
Australia
Netherlands
Ticker feed: Cyberattacks
More than 320,000 files stolen in a cyberattack on Bristol City Council’s Trading with Schools platform have been published on the dark web. Malware got into the platform on September 21, 2026, and the council shut it down four days later. A ransomware group listed the council on its leak site on October 27.
The council has named 39 schools whose data may have been taken, including Filton Avenue Nursery School and Bristol Hospital Education Service, though not every school on the list was hit. Those 39 ran lesson planning, scheduling, and other daily work on the platform; the other 49 of its 88 users only bought internet services through it.
Head teachers were told on November 3, and parents and staff the next morning. The council says it won’t know which schools or individuals are affected until a forensic review of the files is complete, and it is warning families to watch for phishing and unusual account activity.
Source: BBC News
More than 320,000 files stolen in a cyberattack on Bristol City Council’s Trading with Schools platform have been published on the dark web. Malware got into the platform on September 21, 2026, and the council shut it down four days later. A ransomware group listed the council on its leak site on October 27.
The council has named 39 schools whose data may have been taken, including Filton Avenue Nursery School and Bristol Hospital Education Service, though not every school on the list was hit. Those 39 ran lesson planning, scheduling, and other daily work on the platform; the other 49 of its 88 users only bought internet services through it.
Head teachers were told on November 3, and parents and staff the next morning. The council says it won’t know which schools or individuals are affected until a forensic review of the files is complete, and it is warning families to watch for phishing and unusual account activity.
Source: BBC News
CISA, the FBI, and the US departments of Health and Human Services, Agriculture, and Transportation warned on November 5, 2026, that attackers worldwide are going after the temperature and refrigeration controls that keep grocery stores and cold storage sites cold. The warning covers the healthcare, chemical, food and agriculture, and transportation sectors.
Attackers can reach unpatched or internet-facing controllers through authentication bypass, code injection, or weak settings, then force continuous heating and defrost cycles, hide temperature readings, and create fire hazards. The warning follows supermarket attacks in France on October 11–12 and across seven EU countries on November 2. In the Netherlands, supplier Danfoss found some targeted systems still on default passwords.
The agencies want controllers off the public internet, separated from business networks, and protected with new passwords and phishing-resistant MFA. They also urge firmware updates, retiring unsupported devices, and alerts for any temperature drift. The EU’s cybersecurity agency, ENISA, and the European Commission have issued their own call to cut exposure.
Source: Industrial Cyber
CISA, the FBI, and the US departments of Health and Human Services, Agriculture, and Transportation warned on November 5, 2026, that attackers worldwide are going after the temperature and refrigeration controls that keep grocery stores and cold storage sites cold. The warning covers the healthcare, chemical, food and agriculture, and transportation sectors.
Attackers can reach unpatched or internet-facing controllers through authentication bypass, code injection, or weak settings, then force continuous heating and defrost cycles, hide temperature readings, and create fire hazards. The warning follows supermarket attacks in France on October 11–12 and across seven EU countries on November 2. In the Netherlands, supplier Danfoss found some targeted systems still on default passwords.
The agencies want controllers off the public internet, separated from business networks, and protected with new passwords and phishing-resistant MFA. They also urge firmware updates, retiring unsupported devices, and alerts for any temperature drift. The EU’s cybersecurity agency, ENISA, and the European Commission have issued their own call to cut exposure.
Source: Industrial Cyber
Sekoia says APT29, or a subgroup, hijacked the tracking script of Ukrainian web analytics service Plerdy from August 27 to September 3, 2026, assessing the link with moderate to high confidence. Thousands of mostly Ukrainian websites load the script, so the injected code potentially reached their visitors’ phones. The same Russia-linked group also seeded compromised and lookalike sites.
Those watering holes included the sites of a US chemical-industry trade association, a Ukrainian gas producer, and a Bulgarian military-related organization, and Sekoia found no single sector being targeted. A fingerprinting script profiled each visiting phone, then served an exploit chain for flaws already patched but still open on that device.
On iOS 18.5, the DarkSword chain, which Sekoia suspects came from a commercial spyware vendor, could take messages, WhatsApp and Telegram chats, passwords, and photos. An iOS 16.7 chain went after browser cookies, and an Android chain went after Chrome data and Wi-Fi passwords. Sekoia warns that packaged chains like these lower the bar for advanced mobile attacks.
Source: Dark Reading
Sekoia says APT29, or a subgroup, hijacked the tracking script of Ukrainian web analytics service Plerdy from August 27 to September 3, 2026, assessing the link with moderate to high confidence. Thousands of mostly Ukrainian websites load the script, so the injected code potentially reached their visitors’ phones. The same Russia-linked group also seeded compromised and lookalike sites.
Those watering holes included the sites of a US chemical-industry trade association, a Ukrainian gas producer, and a Bulgarian military-related organization, and Sekoia found no single sector being targeted. A fingerprinting script profiled each visiting phone, then served an exploit chain for flaws already patched but still open on that device.
On iOS 18.5, the DarkSword chain, which Sekoia suspects came from a commercial spyware vendor, could take messages, WhatsApp and Telegram chats, passwords, and photos. An iOS 16.7 chain went after browser cookies, and an Android chain went after Chrome data and Wi-Fi passwords. Sekoia warns that packaged chains like these lower the bar for advanced mobile attacks.
Source: Dark Reading
Europe’s ongoing run of refrigeration hacks has reached France’s national blood service. The night supermarket fridges were hit across seven EU countries, November 1 to 2, 2026, cold-room settings at three sites of the Établissement français du sang (EFS) were pushed to “extremely high levels.” The rooms held plasma for transfusions and medicines.
The attack went through a refrigeration supplier’s monitoring and control systems. An on-call technician spotted rising temperatures, and the EFS says the incident was contained quickly, with all products moved or secured and no blood lost. Le Canard enchaîné, which broke the story, named the supplier as Coolworld and reported settings changed from −30°C to 110°C.
Coolworld blames a component from a third-party supplier. Whether the same attackers are behind both the supermarket and blood service incidents hasn’t been established. The EFS is working with France’s cybersecurity agency ANSSI and the health ministry, and has stepped up temperature monitoring across all its equipment.
Source: CBS News
Europe’s ongoing run of refrigeration hacks has reached France’s national blood service. The night supermarket fridges were hit across seven EU countries, November 1 to 2, 2026, cold-room settings at three sites of the Établissement français du sang (EFS) were pushed to “extremely high levels.” The rooms held plasma for transfusions and medicines.
The attack went through a refrigeration supplier’s monitoring and control systems. An on-call technician spotted rising temperatures, and the EFS says the incident was contained quickly, with all products moved or secured and no blood lost. Le Canard enchaîné, which broke the story, named the supplier as Coolworld and reported settings changed from −30°C to 110°C.
Coolworld blames a component from a third-party supplier. Whether the same attackers are behind both the supermarket and blood service incidents hasn’t been established. The EFS is working with France’s cybersecurity agency ANSSI and the health ministry, and has stepped up temperature monitoring across all its equipment.
Source: CBS News
Indian IT security firm OpsShield suffered a supply chain attack on November 2, 2026, that pushed malicious cPGuard updates to customers for roughly 70 minutes. Attackers broke into its billing and licensing server, then used a stolen key to plant infected versions (5.88.12–5.88.19) of its Linux web hosting security tool on the update CDN.
About 2,950 servers ran the fake updates as root, which also planted a hidden root shell. OpsShield says every password hash, root SSH key, MySQL root password, and shell history on those servers should be treated as compromised. The attackers also copied about 7,900 customer account records with names, companies, addresses, emails, and hashed passwords.
OpsShield has evicted the attackers, is reissuing all cPGuard license keys, and has released versions 5.88.25 and later to remove the root shell. A follow-up update clears a leftover scheduled task. Admins whose servers were online during the window should update and rotate those credentials, and every customer should reset their billing portal password.
Source: SecurityWeek
Indian IT security firm OpsShield suffered a supply chain attack on November 2, 2026, that pushed malicious cPGuard updates to customers for roughly 70 minutes. Attackers broke into its billing and licensing server, then used a stolen key to plant infected versions (5.88.12–5.88.19) of its Linux web hosting security tool on the update CDN.
About 2,950 servers ran the fake updates as root, which also planted a hidden root shell. OpsShield says every password hash, root SSH key, MySQL root password, and shell history on those servers should be treated as compromised. The attackers also copied about 7,900 customer account records with names, companies, addresses, emails, and hashed passwords.
OpsShield has evicted the attackers, is reissuing all cPGuard license keys, and has released versions 5.88.25 and later to remove the root shell. A follow-up update clears a leftover scheduled task. Admins whose servers were online during the window should update and rotate those credentials, and every customer should reset their billing portal password.
Source: SecurityWeek
Blockchain analytics firm Chainalysis disclosed on October 30, 2026, that attackers used “offensive agentic techniques” earlier that month to gain unauthorized access to its systems and internal tools. The breach exposed what the company calls non-sensitive customer data, including user IDs, names, email addresses, and organization roles. Chainalysis says no investigation content, plain-text passwords, or other credentials were compromised.
Chainalysis says the incident is unrelated to the $6.36 billion Binance heist the FBI blamed on North Korea. It hasn’t said how many people were affected, and it is patching vulnerabilities with help from outside security experts. With names and emails out, it advises users to turn on MFA and distrust unexpected login prompts or password-reset requests.
Source: SecurityWeek
Blockchain analytics firm Chainalysis disclosed on October 30, 2026, that attackers used “offensive agentic techniques” earlier that month to gain unauthorized access to its systems and internal tools. The breach exposed what the company calls non-sensitive customer data, including user IDs, names, email addresses, and organization roles. Chainalysis says no investigation content, plain-text passwords, or other credentials were compromised.
Chainalysis says the incident is unrelated to the $6.36 billion Binance heist the FBI blamed on North Korea. It hasn’t said how many people were affected, and it is patching vulnerabilities with help from outside security experts. With names and emails out, it advises users to turn on MFA and distrust unexpected login prompts or password-reset requests.
Source: SecurityWeek
A cyber-espionage group called Bitter, also tracked as TA397, is targeting organizations across South Asia with an upgraded version of its custom remote access Trojan, PapRAT, FortiGuard Labs reported on November 2, 2026. Active since at least 2013 and linked to India, Bitter has historically gone after government, energy, and engineering targets.
Bitter rewrote PapRAT in Rust, moving it off C++ and adding PowerShell execution plus sleep and exit commands for 11 in total. The group runs three infection chains built on legitimate Windows features. One abuses ftp.exe and scheduled tasks without deploying any malware binary. In another, PapRAT pulls down a second implant, WmRAT.
Sectigo senior fellow Jason Soroko notes that wiping PapRAT from that chain’s victims may leave the attackers inside, so defenders should also hunt for leftover scripts, scheduled tasks, and extra payloads.
Source: Dark Reading
A cyber-espionage group called Bitter, also tracked as TA397, is targeting organizations across South Asia with an upgraded version of its custom remote access Trojan, PapRAT, FortiGuard Labs reported on November 2, 2026. Active since at least 2013 and linked to India, Bitter has historically gone after government, energy, and engineering targets.
Bitter rewrote PapRAT in Rust, moving it off C++ and adding PowerShell execution plus sleep and exit commands for 11 in total. The group runs three infection chains built on legitimate Windows features. One abuses ftp.exe and scheduled tasks without deploying any malware binary. In another, PapRAT pulls down a second implant, WmRAT.
Sectigo senior fellow Jason Soroko notes that wiping PapRAT from that chain’s victims may leave the attackers inside, so defenders should also hunt for leftover scripts, scheduled tasks, and extra payloads.
Source: Dark Reading
Hackers remotely raised fridge and freezer temperatures, in some cases to 50°C, at supermarkets in seven EU countries overnight on November 1 to 2, 2026, three weeks after a similar attack hit about 700 stores in France. Affected chains include Carrefour, Intermarché, Delhaize, Ikea, ICA, Coop, Kesko, and SuperValu, which pulled chilled and frozen food from 13 stores.
EU Agriculture Commissioner Christophe Hansen called the attacks “a deliberate attempt to disrupt our food supply chain.” No group has claimed responsibility, and it isn’t established whether the incidents are connected. Sophos threat intelligence director Rafe Pilling sees state-backed signaling or a lone hacker as the likeliest explanations.
The attack needed no malware, leaving investigators little to trace. ICA says its systems came from Danfoss, whose end-of-life controllers were hit in France, and Coop says some fridges ran over a more exposed 4G link. Belgian refrigeration firm Sabcobel says patching since the French attack kept the damage from being worse.
Source: The Guardian
Hackers remotely raised fridge and freezer temperatures, in some cases to 50°C, at supermarkets in seven EU countries overnight on November 1 to 2, 2026, three weeks after a similar attack hit about 700 stores in France. Affected chains include Carrefour, Intermarché, Delhaize, Ikea, ICA, Coop, Kesko, and SuperValu, which pulled chilled and frozen food from 13 stores.
EU Agriculture Commissioner Christophe Hansen called the attacks “a deliberate attempt to disrupt our food supply chain.” No group has claimed responsibility, and it isn’t established whether the incidents are connected. Sophos threat intelligence director Rafe Pilling sees state-backed signaling or a lone hacker as the likeliest explanations.
The attack needed no malware, leaving investigators little to trace. ICA says its systems came from Danfoss, whose end-of-life controllers were hit in France, and Coop says some fridges ran over a more exposed 4G link. Belgian refrigeration firm Sabcobel says patching since the French attack kept the damage from being worse.
Source: The Guardian
A pre-authentication flaw in TightVNC Viewer lets a malicious VNC server execute code on a Windows PC during connection setup, before the viewer ever reaches a password check. SeongJoon Cho of SSD Labs Korea found the bug, and SSD Secure Disclosure published proof-of-concept exploit code on October 29, 2026, tested against version 2.8.88 x64. TightVNC Server isn’t affected.
The viewer stores the remote screen’s memory size in a 32-bit integer, so an oversized screen gets a buffer far too small, and later screen updates overwrite neighboring memory. Attackers get in two ways: a user connects to their server, or a viewer sits in Listening Mode on TCP port 5500, where any server can connect.
TightVNC 2.8.89 and 2.8.90 fix the flaw, and the vendor recommends 2.8.90. Install it wherever the viewer runs. Until then, keep Listening Mode off unless a session needs it, firewall port 5500 from untrusted networks, and connect only to VNC servers you know.
Source: Cybersecurity News
A pre-authentication flaw in TightVNC Viewer lets a malicious VNC server execute code on a Windows PC during connection setup, before the viewer ever reaches a password check. SeongJoon Cho of SSD Labs Korea found the bug, and SSD Secure Disclosure published proof-of-concept exploit code on October 29, 2026, tested against version 2.8.88 x64. TightVNC Server isn’t affected.
The viewer stores the remote screen’s memory size in a 32-bit integer, so an oversized screen gets a buffer far too small, and later screen updates overwrite neighboring memory. Attackers get in two ways: a user connects to their server, or a viewer sits in Listening Mode on TCP port 5500, where any server can connect.
TightVNC 2.8.89 and 2.8.90 fix the flaw, and the vendor recommends 2.8.90. Install it wherever the viewer runs. Until then, keep Listening Mode off unless a session needs it, firewall port 5500 from untrusted networks, and connect only to VNC servers you know.
Source: Cybersecurity News
Cursor says maliciously modified versions of Anthropic’s Claude Code extension, 2.1.312 and 2.1.313, sat in its VS Code Extension Marketplace for just over 11 hours on October 29, 2026, affecting at most 5,000 Windows and macOS users. Anthropic didn’t build them, and Cursor has no evidence that other versions or the official distribution were hit.
The code sent the attacker host details such as username, Git email, and public IP, then added an attacker-controlled SSH key and installed scripts that keep retrying the connection. The step that would let the attacker log in failed except where Cursor ran with admin rights. Cursor has since helped take the attacker’s server offline.
Cursor pulled the packages and rebuilt the marketplace. Users who installed either version should update to 2.1.314 and check their SSH authorized keys for one labeled svc-telemetry. Where it appears, isolate the machine, run Cursor’s cleanup script, since uninstalling may leave scripts running, and rotate credentials from a trusted system.
Source: Cyber Security News
Cursor says maliciously modified versions of Anthropic’s Claude Code extension, 2.1.312 and 2.1.313, sat in its VS Code Extension Marketplace for just over 11 hours on October 29, 2026, affecting at most 5,000 Windows and macOS users. Anthropic didn’t build them, and Cursor has no evidence that other versions or the official distribution were hit.
The code sent the attacker host details such as username, Git email, and public IP, then added an attacker-controlled SSH key and installed scripts that keep retrying the connection. The step that would let the attacker log in failed except where Cursor ran with admin rights. Cursor has since helped take the attacker’s server offline.
Cursor pulled the packages and rebuilt the marketplace. Users who installed either version should update to 2.1.314 and check their SSH authorized keys for one labeled svc-telemetry. Where it appears, isolate the machine, run Cursor’s cleanup script, since uninstalling may leave scripts running, and rotate credentials from a trusted system.
Source: Cyber Security News
