Cyber Morning Brief

Daily brief

Tuesday, 3 November 2026

Google takes down a 1.3-million-device Android TV box botnet, hackers warm supermarket fridges across Europe, and Siemens IoT2050 and Synology NAS flaws are exploited.

Top stories

  • Google dismantles 1.3M-device X.CPE Android botnet #threat — Mostly TV set-top boxes; Google says it is highly confident maker Videostrong deliberately backdoored them and sold access to criminals, and banned the vendor. Why it matters: cheap IoT boxes on home networks are being sold as residential proxies. The Hacker News · BleepingComputer · KrebsOnSecurity
  • Second wave of supermarket fridge attacks across Europe #breach #ot — Attackers changed refrigeration controller settings overnight in Belgium, Sweden, Estonia and elsewhere, forcing stores to pull food. Why it matters: internet-exposed building/OT controllers now cause real-world physical damage. The Hacker News
  • Siemens SIMATIC IoT2050 flaw exploited (CVE-2026-58115, CVSS 10) #vuln CRITICAL EXPLOITED — Missing authentication lets unauthenticated attackers run code; VulnCheck sees backdoors being planted. The Hacker News

Breaches & incidents

  • notebooksbilliger.de and Pÿur (Tele Columbus) report data theft #breach #germany — Both German companies are emailing customers about data stolen in IT attacks. heise
  • Fintech platform Sageworks offline after “irregular activity” #breach — Abrigo restored most of the risk-management app except borrower-facing features. BleepingComputer

Vulnerabilities & patches

  • Synology DSM exploited in ransomware attacks HIGH EXPLOITED — Attackers use a flaw patched in December 2024 against NAS devices running outdated DSM. The Hacker News
  • CVE-2026-81648 — CryptoPayment Gateway (WordPress plugin) CRITICAL EXPLOITED — CVSS 10.0, unpatched, can expose wallet credentials; exploitation attempts seen by Defused Cyber. Remove or disable the plugin. The Hacker News
  • Langflow: two critical flaws CRITICAL — Unauthenticated auth bypass and code execution in the AI-agent builder, all releases from 1.0.0 onward affected per IBM. The Hacker News
  • Progress WS_FTP: several critical flaws CRITICAL PATCH — heise
  • Veeam Management Pack for System Center: code execution HIGH PATCH — Fixed in 13.1. heise

Threat intel & red team

  • SysGoRAT targets government Linux servers #threat — Unit 42 describes an espionage campaign against government Linux infrastructure, with suspected AI-generated scripts. The Hacker News
  • DarkBlinders hits Israeli and Iraqi Kurdish government cloud #threat — Iran-aligned espionage between August and October 2026. The Hacker News
  • PapRAT: Bitter APT’s three attack chains in South Asia #threat — Heavy use of living-off-the-land Windows features. Dark Reading

Blue team & defense

  • What exploited vulnerabilities have in common #defense — Microsoft’s data-driven look at the small subset of CVEs that actually get exploited, and how to prioritise by exploitation likelihood, exposure and blast radius. Microsoft Security
  • Multipath TCP: use and detection #defense — How MPTCP can split traffic across paths and what that means for network monitoring. SANS ISC

Industry, policy & developments

  • US government refuses to release its AI security test rules #industry #ai — heise
  • One robots.txt directive to block all AI trainers #industry #ai — A proposal for a single entry that all AI crawlers would honour. heise
  • Hundreds of everyday AI apps hide abusive deepfake features #industry — Wired

Worth reading

  • AI vulnerability finding #learning — Schneier on the claim that ~3% of all critical bugs ever recorded were found in the last month. Schneier on Security
  • THN weekly recap #learning — A quick catch-up on last week. The Hacker News

Sources