Cyber Morning Brief

Daily brief

Wednesday, 4 November 2026

Binance says a fake job interview opened the door to its $6.3B heist, CISA confirms WordPress core exploitation, and a poisoned cPGuard update backdoored hosting servers.

Top stories

  • Binance: fake job interview led to the $6.3B heist #breach UPDATE — North Korean attackers ran a months-long campaign, using a rigged coding assignment and abused AI tooling to compromise an employee and then the wallet infrastructure; Pyongyang denies involvement. Why it matters: the same DPRK playbook (fake recruiters, malicious take-home tests) targets developers everywhere. BleepingComputer · SecurityWeek · The Record
  • CVE-2026-119977 — WordPress Core in KEV #vuln HIGH EXPLOITED KEV — TOCTOU race condition (CVSS 8.1) exploitable during software upgrades for code execution; federal deadline 6 Nov. Why it matters: WordPress runs a huge share of the web; make sure auto-updates actually completed. BleepingComputer · CISA alert
  • cPGuard update channel hijacked #breach #supply-chain — Using compromised credentials, attackers poisoned OpsShield’s update servers on 2 Nov to push a backdoor and steal password hashes from Linux hosting servers. Why it matters: a security tool became the delivery mechanism. BleepingComputer · SecurityWeek
  • Android November bulletin: zero-click RCE (CVE-2026-58868) #vuln CRITICAL PATCH — Framework flaw in Android 14–17 among 200+ fixes; fixed in patch level 2026-11-01. The Hacker News · SecurityWeek

Breaches & incidents

  • Fridge attacks reach Germany and the UK #breach #germany #ot — First German cases in Bavaria and NRW; British businesses also hit, and blood-bank cooling is now in focus. heise · The Record · Dark Reading
  • UK school estate hit by 3AM ransomware in suspected AI-assisted attack #breach #ransomware — About 37 of ~50 reachable machines were encrypted from an unmanaged host; commands looked model-generated. BleepingComputer
  • ARTEX-linked breaches: WorkOS and Chainstack #breach #ai — WorkOS says an attacker using ARTEX accessed a sales app; Chainstack reports a production breach exposing customer data and password hashes, linked to a large AI-powered campaign. BleepingComputer · The Hacker News
  • mSecure password manager: change passwords, reset 2FA and passkeys #breach — The Hacker News
  • Frontline Education (1.3M) and Harvard (851K accounts) #breach — SecurityWeek · BleepingComputer

Vulnerabilities & patches

  • Barracuda: chainable flaws give root CRITICAL PATCH — Pre-auth authorization bypass plus a second bug leads to root on devices including Email Security Gateway. BleepingComputer · heise
  • Xen hypervisor: guest can read/write other VMs incl. dom0 CRITICAL PATCH — All versions since 4.6; no mitigation besides patching. The Hacker News
  • Rails Active Storage + ImageMagick: arbitrary file write CRITICAL PATCH — Unauthenticated upload of a crafted file; fixed in 8.1.4.1 and 8.0.5.2. The Hacker News
  • Node-RED critical flaw exploited CRITICAL EXPLOITED — SecurityWeek
  • Chrome 157: 213 security fixes, 7 critical PATCH — SecurityWeek
  • Linux TCP CVE-2026-98432: Red Hat ships fix UPDATE — Ubuntu fixes are still in testing. The Hacker News

Threat intel & red team

  • Russian-linked watering holes use n-day zero-click exploits on iOS and Android #threat — Compromised and fake portals target mobile users. Keep phones patched. BleepingComputer
  • German lawmakers among Apple spyware-warning recipients #threat #germany — The Record · heise
  • Calif.io breaks iOS Lockdown Mode with update-persistent attack #threat — Reported as a first. heise
  • SlippyNunchucks hijacks Sogou IME DNS to plant DarkVigil #threat — Abuses plain-HTTP traffic from the Windows input method. The Hacker News
  • Gorbag exploits WinRAR to deploy stealer #threat — Russia-aligned group. The Hacker News
  • LLMjacking costs some firms up to $1M #threat #ai — Google says stolen cloud credentials are used to run expensive AI workloads, sometimes $100K+/day. BleepingComputer
  • Hackers lock out and extort Li Auto EV owners in Russia #threat — Risky Bulletin

Blue team & defense

  • Fake-download campaign with trojanized Inno installers #defense — Microsoft provides detection and investigation guidance across the whole installer session. Microsoft Security
  • Ghostunnel: open-source mTLS proxy #defense — Adds mutual TLS in front of services that can’t do it themselves. Help Net Security
  • rsync 3.5.2 fixes a CPU-exhaustion flaw PATCH — Help Net Security
  • NIST guide for one-person businesses #defense — Help Net Security

Industry, policy & developments

  • Europol op seizes 100+ servers of investment-fraud “crime-as-a-service” provider #industry #germany — Seven arrests; the company supplied fake trading sites to criminal gangs. BleepingComputer · heise
  • Russia arrests three VasyGrek (Fluffy Wolf) suspects #industry — The Record
  • CrowdStrike buys Fiddler and Dreadnode (~$495M) #industry #ai — AI agent observability and automated AI security testing for Falcon; also launched an “AI Kill Switch”. SecurityWeek · CrowdStrike
  • Google Cloud VRP adds $250,000 “Root-in-Cloud” tier #industry — BleepingComputer

Worth reading

  • What AI-generated malware looks like under the microscope #learning — Help Net Security
  • Gartner: SOCs will have 50% more engineers than analysts by 2028 #learning — Useful for thinking about career direction. BleepingComputer

Sources