# Today's Top Stories

North Korean hackers executed a months-long social engineering campaign against Binance engineers using fake job interviews and a tampered Homebrew installation to compromise the exchange's wallet infrastructure, stealing approximately $6.34 billion in digital assets — the largest crypto heist on record. The attack chain combined recruitment-themed phishing with AI tool abuse (ARTEX framework) across multiple stages, demonstrating the sophistication of DPRK-linked threat actors targeting crypto infrastructure. Security practitioners should review supply chain integrity for developer tooling and enforce strict controls on employee software installation.

Google and industry partners dismantled the XCPE botnet — a 1.3 million-device Android TV set-top box network that manufacturer Videostrong Technology intentionally pre-infected with malware to generate revenue via ad fraud and residential proxy services sold to cybercriminals. Google is 'highly confident' Videostrong deliberately backdoored devices that passed Google's certification process, raising serious questions about OEM supply chain security and Play Protect's ability to catch pre-installed malware. The takedown is expected to cut off access to more than 10 million additional compromised IoT devices.

Chinese threat actors deployed ARTEX, an open-source multi-agent AI penetration-testing framework, in automated attacks against over 200 organizations across 14 countries — the same tool identified in the WorkOS breach where it accessed business contact records and customer communication summaries. This marks a significant escalation in AI-assisted offensive operations, with a commercially available framework enabling scaled, low-cost intrusions against diverse targets. Defenders should audit exposure of internal sales and CRM systems to AI-driven credential-stuffing and reconnaissance.

Attackers remotely modified temperature settings on internet-exposed refrigeration controllers at over 100 supermarket locations across Belgium, Sweden, Ireland, Estonia, and other European countries overnight on November 2, forcing stores to discard spoiled chilled and frozen food. Danish manufacturer Danfoss confirmed its refrigeration control systems were among those targeted in this second wave of attacks following an earlier French incident, spotlighting critical OT/ICS exposure in cold-chain infrastructure. No authentication hardening or network segmentation appears to have prevented attackers from reaching operational controls.

A UEFI bootkit named BlackX was found infecting fully patched Windows machines by exploiting ambiguity in Microsoft's Secure Boot protection policies, allowing persistent firmware-level compromise that survives OS reinstallation. The attack vector centers on Microsoft's lack of clear enforcement boundaries around Secure Boot, enabling the bootkit to bypass standard defenses on current, fully updated systems. This represents a significant threat to enterprise endpoint integrity, as conventional EDR and antivirus tools are ineffective against firmware-resident malware.

A use-after-free vulnerability in the Linux kernel's IPv4 TCP code, tracked as CVE-2026-98432 with a CVSS score of 9.8, enables remote unauthenticated attackers to achieve RCE; Red Hat has released patched kernels for RHEL 8, 9, and 10, while Ubuntu's fixes for its three newest LTS releases remain in opt-in testing with no general availability date announced. The flaw's unauthenticated remote exploitability makes it critical for any internet-facing Linux system, and Ubuntu's delayed stable release creates an extended exposure window for a large portion of enterprise deployments. Administrators running Ubuntu LTS should manually opt into the testing channel or implement network-level mitigations immediately.

Barracuda disclosed two chained vulnerabilities — CVE-2026-116606 (pre-authentication authorization bypass, CVSS 9.3) and a command injection flaw — that together allow unauthenticated attackers to bypass authorization controls and gain root access on affected Barracuda devices. Given Barracuda's history of exploitation (notably the ESG zero-day campaign by Chinese state actors in 2023), these new critical flaws in network security appliances demand immediate patching priority across enterprise deployments. Organizations should treat any unpatched Barracuda appliance as a high-priority remediation target.

CVE-2026-58115, a maximum-severity (CVSS 10.0) missing-authentication flaw in Siemens SIMATIC IoT2050 Advanced devices, is being actively exploited in the wild to plant remote command backdoors, according to VulnCheck. The vulnerability allows unauthenticated remote attackers to execute arbitrary code on the industrial IoT gateway devices, which are deployed in manufacturing and critical infrastructure environments. ICS/OT security teams should prioritize isolation and patching of SIMATIC IoT2050 Advanced devices as exploitation is confirmed active.

Synology is urging customers to update DiskStation Manager (DSM) after threat actors exploited a vulnerability patched in December 2024 to launch ransomware attacks encrypting data on NAS devices running outdated DSM versions. The campaign targets internet-exposed Synology NAS systems still running unpatched software more than 10 months after the fix was available, underscoring persistent patch lag in SMB and prosumer storage environments. Administrators should immediately audit DSM versions and ensure all devices are updated and not directly internet-exposed.

Google has introduced a new $250,000 top-tier reward in its Cloud Vulnerability Reward Program (VRP) specifically for 'Root-in-Cloud' bugs — high-impact architectural vulnerabilities that demonstrate full administrative control over Google Cloud infrastructure. This represents a significant expansion of Google's bug bounty scope and signals the company's concern about architectural-level cloud security flaws that go beyond traditional application vulnerabilities. Security researchers focusing on cloud infrastructure attack surfaces now have a substantial financial incentive to investigate Google Cloud's core architecture.