# Archive
Browse past daily curated stories
Thursday, November 05, 2026
-
1The Hacker News generalBinance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft
Binance disclosed that the record-setting $6.43 billion theft was executed via a months-long campaign targeting two engineers through fake job interviews and a tampered Homebrew installation, combined with AI tool abuse. The attack chain involved compromising internal tooling and leveraging social engineering recruitment lures attributed to North Korean threat actors. Security practitioners should note the supply-chain vector via developer tooling (Homebrew) and the sustained, multi-stage nature of the compromise as key TTPs to defend against.
-
2The Record threat-intelFrench blood service hit by Europe-wide cyberattacks on refrigeration
A coordinated wave of cyberattacks targeting internet-connected refrigeration systems altered temperature and defrost settings at three French national blood service (EFS) facilities, threatening stored blood products critical for transfusions. A second, broader wave then hit supermarkets and grocery chains across the UK and broader Europe, spoiling food stock. The incidents expose critical gaps in OT/IoT security for cold-chain infrastructure where remote access systems lack adequate authentication controls.
-
3The Hacker News generalAPT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
APT29 (Cozy Bear) conducted a large-scale watering hole campaign targeting iOS and Android users by compromising legitimate websites, registering fake domains, and hijacking the Plerdy SEO Tracker supply chain — a Ukrainian web analytics service. Injected JavaScript collected browser and device fingerprints to serve n-day exploits for CVE-tracked iOS and Android vulnerabilities against likely diplomatic targets. Sekoia researchers Amaury-Jacques Garçon attributed the campaign to Russia's SVR-linked group.
-
4The Hacker News generalXen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory
Two newly disclosed flaws in Xen hypervisor (all versions from 4.6 onward) allow a malicious guest VM to read and write memory belonging to any other VM on the same host, including the privileged dom0 management domain. No known mitigations exist; patches are available as of November 3. This is a critical issue for cloud providers and enterprises running multi-tenant Xen-based virtualization infrastructure.
-
5The Hacker News generalCISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades
CISA added CVE-2026-119977 — a Time-of-check Time-of-use (TOCTOU) race condition in WordPress Core with a CVSS score of 8.1 — to its Known Exploited Vulnerabilities catalog following confirmed active exploitation in the wild. The flaw enables arbitrary code execution and is being triggered during software upgrade processes. Federal agencies face a mandatory remediation deadline, and all WordPress administrators should prioritize patching immediately.
-
6The Hacker News generalcPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes
On November 2, an attacker compromised OPSSHIELD's cPGuard update channel and pushed a malicious script via version 5.88.25 that installed a backdoor and harvested password hashes and sensitive files from customer Linux servers. The attacker used compromised credentials to access the update infrastructure, making this a classic supply-chain attack affecting any server that applied the poisoned update. Administrators running cPGuard should audit affected systems and rotate all credentials immediately.
-
7The Hacker News generalGoogle Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction
Google's November 2026 Android security bulletin discloses CVE-2026-58868, a critical zero-click RCE vulnerability affecting Android versions 14 through 17 that requires no user interaction to exploit. The fix is included in security patch level 2026-11-01 and later, though distribution depends on individual OEM and carrier patch schedules. Security teams managing Android device fleets should track patch deployment status given the severity and remote exploitability of this flaw.
-
8The Hacker News generalGoogle Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges
Google warned that LLMjacking — where attackers steal cloud API keys via phishing, source code leaks, or misconfigured environments and resell access to AI computing resources — is costing some enterprises up to $1 million in fraudulent cloud charges, with some victims losing over $100,000 per day before access is revoked. The threat leverages exposed credentials to run high-volume LLM inference at victim expense, creating a thriving criminal resale market for stolen AI access. Organizations should audit cloud IAM permissions and monitor for anomalous LLM API usage spikes.
-
9BleepingComputer generalZyxel fixes zero-day exploited to hack nearly 1,000 network switches
Zyxel patched a zero-day vulnerability in its GS1900 series network switches that attackers actively exploited to compromise nearly 1,000 devices globally, stealing configuration files and plaintext credentials. The flaw was used in targeted attacks before a patch was available, making it a true zero-day exploitation event affecting enterprise and SMB network infrastructure. Administrators with GS1900 switches should apply the patch immediately and audit stolen configs for credential reuse.
-
10The Record threat-intelMore Asian airlines announce data breaches after attack on Spanish IT provider Amadeus
A breach at Amadeus IT Group — a Spanish company providing flight reservation, ticketing, and check-in platforms — has cascaded into disclosed data breaches at six major Asian carriers: Japan Airlines, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines, and Malaysia Airlines, all reporting incidents within a single week. The incident illustrates systemic third-party supply chain risk in the airline sector, where a single IT provider's compromise exposes passenger data across multiple carriers simultaneously. Security teams at travel and transportation verticals should review their Amadeus integrations and third-party data-sharing agreements.