# hackers Published articles for hackers. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Amplifon Americas Data Breach Impacts 1.3 Million DevFeed: [Amplifon Americas Data Breach Impacts 1.3 Million]() Original publisher: [Read original article]() Author: Ionut Arghire Published: 2026-11-09T11:20:09Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [Cybersecurity](), [sensitive data]() Tags: [amplifon](), [breach](), [data-breach](), [data-breaches](), [hackers](), [health](), [healthcare](), [impact](), [information](), [insurance](), [personal](), [social](), [us]() ### AI overview Amplifon Americas disclosed that hackers accessed internal systems in January 2026 and copied files from January 18 through February 8. Its review found personal, government ID, hearing and medical, service, health, and insurance information potentially compromised; some people also had Social Security numbers and financial information stolen. A Texas filing reportedly lists 1,332,826 people affected nationwide. Amplifon says it is unaware of fraudulent use of the information. The company contained the incident and investigated, but took eight months to review the stolen data and determine potential impact. ### Source excerpt Hackers stole personal, health, and insurance information, including Social Security numbers, from the company's internal systems. The post Amplifon Americas Data Breach Impacts 1.3 Million appeared first on SecurityWeek. ## Over 3 Million People Hit by Frontline Education Data Breach DevFeed: [Over 3 Million People Hit by Frontline Education Data Breach]() Original publisher: [Read original article]() Author: Eduard Kovacs Published: 2026-11-09T10:09:02Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [data](), [sensitive data]() Tags: [administration](), [attack](), [central](), [data-breach](), [data-breaches](), [education](), [employees](), [frontline-education](), [government](), [hackers](), [health](), [id](), [ids](), [indiana](), [insurance](), [passport](), [personal-information](), [school](), [software](), [students](), [third-party](), [vulnerability]() ### AI overview Frontline Education reported that its August breach affected 3,085,266 people, more than twice the roughly 1.3 million counted in earlier filings with other states. The company said attackers exploited a vulnerability in an unnamed third-party product, accessed part of its environment, and stole personal information from Frontline Central and School Health Management. Frontline detected the intrusion on August 14 and said it contained the attack the next day. Exposed data varied by person and could include names, government ID numbers, dates of birth, health insurance information, and student IDs. US adults are being offered two years of credit monitoring and identity theft protection; eligible minors receive dark web monitoring. The company has not identified the exploited product or the attackers. ### Source excerpt Frontline Education told Indiana regulators that its August data breach affected over 3 million school district staff and students. The post Over 3 Million People Hit by Frontline Education Data Breach appeared first on SecurityWeek. ## Hackers pull off $133 million French bank heist via service provider DevFeed: [Hackers pull off $133 million French bank heist via service provider]() Original publisher: [Read original article]() Author: Bill Toulas Published: 2026-11-07T15:25:35Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [incident]() Tags: [account](), [bank](), [blockchain](), [business-email-compromise](), [computer-help](), [computer-security](), [computers](), [credit-mutuel-arkea](), [cryptocurrency](), [cyberattack](), [email](), [eu](), [exchange](), [faq](), [financial-theft](), [fraud](), [funds](), [hackers](), [heist](), [infosec](), [infosec-computer-security](), [law-enforcement](), [linux](), [mac](), [major](), [malware](), [malware-removal](), [security](), [service](), [spyware](), [support](), [systems](), [tech-support](), [technical-support](), [transactions](), [virus](), [virus-removal](), [windows]() ### AI overview Crédit Mutuel Arkéa said an attacker entered its network through a service provider's platform, then used the bank's own account to make transactions with other banking organizations and convert funds into cryptocurrency. Customer accounts were not used, and the bank said customer assets were unaffected, though some transfers were delayed. The bank described the attack as sophisticated, ruled out Fortuneo and human error, and said some funds were blocked. It did not confirm the reported EUR 118 million ($133 million) loss, validating only its order of magnitude; the exact origin and method remain under investigation with judicial authorities and police. Arkéa said the incident was under control and operations were returning to normal, and warned customers to verify suspicious messages directly with their bank adviser. ### Source excerpt French cooperative bank Crédit Mutuel Arkéa was targeted in a cyberattack that enabled fraudulent transactions of up to $133 million, forcing it to respond by suspending certain systems.v [...] ## Japan Announces Emergency Cybersecurity Package Following a Wave of Attacks DevFeed: [Japan Announces Emergency Cybersecurity Package Following a Wave of Attacks]() Original publisher: [Read original article]() Author: Associated Press Published: 2026-11-06T18:28:41Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [Cybersecurity](), [cyber resiliency](), [Incident response]() Tags: [ai](), [artificial-intelligence](), [breaches](), [cyberattack](), [cyberattacks](), [cybersecurity](), [data-breaches](), [emergency](), [government](), [hackers](), [japan](), [national-security](), [network](), [package]() ### AI overview Japan announced a 10 billion yen ($63 million) emergency cybersecurity package after unauthorized access and client data leaks affected dozens of companies and government agencies. It combines public-private information sharing and rapid assistance with stronger defenses: the government plans to access hackers' servers under its newly legalized "active cyber defense" authority, and a cross-agency team may be deployed when national security is at stake. By the end of November, the Ministry of Economy, Trade and Industry is to establish a team of cybersecurity experts who will use AI to counter hackers and find network weaknesses, working with technology companies and AI developers in friendly nations. A separate public-private cyber rescue team will provide initial responses to affected companies, while another team will help vulnerable companies improve defenses. ### Source excerpt The emergency package comes after dozens of companies and government agencies were hit by unauthorized access to their systems and leaks of client data, prompting uneasiness across Japan. The post Japan Announces Emergency Cybersecurity Package Following a Wave of Attacks appeared first on SecurityWeek. ## QNAP says hackers breaching NAS devices in Plex2Shell attacks DevFeed: [QNAP says hackers breaching NAS devices in Plex2Shell attacks]() Original publisher: [Read original article]() Author: Bill Toulas Published: 2026-11-06T17:04:23Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [QNAP](), [Cybersecurity](), [Network Attached Storage (NAS)](), [Virtual Private Network]() Tags: [2026](), [actively-exploited](), [adaptive](), [app](), [app-center](), [attacks](), [computer-help](), [computer-security](), [computers](), [devices](), [hackers](), [hardware](), [infosec](), [infosec-computer-security](), [latest](), [linux](), [mac](), [malware](), [malware-removal](), [media](), [nas](), [plex](), [plex-media-server](), [plex2shell](), [qnap](), [security](), [server](), [spyware](), [support](), [tech-support](), [technical-support](), [the-latest](), [update](), [users](), [version](), [virus](), [virus-removal](), [vulnerability](), [windows]() ### AI overview QNAP reports suspected NAS compromises involving Plex Media Server exploited through the four-flaw Plex2Shell chain. The vulnerabilities affect Plex Media Server; QNAP says QTS, QuTS hero, and its other operating systems are not themselves affected. QNAP recommends updating Plex through the App Center to version 1.43.3.10861, currently listed there. For vulnerable Plex servers exposed publicly, users should treat the NAS and its contents as compromised: an update will not remove installed payloads. QNAP advises checking its bulletin for compromise signs, cleanly reinstalling the NAS operating system, and resetting Plex and NAS credentials. To reduce remote exposure, disable remote access and stop forwarding port 32400 if those features are unnecessary; otherwise, use a VPN. QNAP also offers log investigation through technical support. ### Source excerpt QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain. [...] ## FBI, CISA warn of cyberattacks targeting refrigeration systems DevFeed: [FBI, CISA warn of cyberattacks targeting refrigeration systems]() Original publisher: [Read original article]() Author: Lawrence Abrams Published: 2026-11-06T00:56:44Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [Security Attacks](), [Cybersecurity](), [cybersecurity and infrastructure security agency](), [Vulnerabilities](), [Critical Infrastructure]() Tags: [attacks](), [authentication-bypass](), [blood](), [cisa](), [code-injection](), [computer-help](), [computer-security](), [computers](), [controllers](), [critical](), [critical-infrastructure](), [cyberattack](), [cyberattacks](), [cybersecurity](), [devices](), [equipment](), [fbi](), [fire](), [food](), [hackers](), [industrial](), [infosec](), [infosec-computer-security](), [linux](), [mac](), [malware](), [malware-removal](), [monitoring](), [refrigeration](), [refrigeration-systems](), [security](), [spyware](), [support](), [tech-support](), [technical-support](), [virus](), [virus-removal](), [windows]() ### AI overview The FBI, CISA, HHS, USDA, and DOT warn that attackers are targeting unpatched or internet-accessible refrigeration controllers and management systems, including in grocery and cold-storage facilities. The advisory says attackers may exploit authentication bypasses, code injection flaws, or weak configurations to alter temperatures or trigger continuous heating and defrost cycles; reduced temperature visibility can also hinder detection. Reported consequences include spoiled inventory, equipment damage, fire hazards, and unsafe storage. The agencies recommend removing controllers from the public internet, securing required remote access, changing default passwords, applying available updates, isolating operational technology from business networks, and enforcing safe temperature limits. ### Source excerpt The FBI and CISA warn that hackers are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide, potentially causing food spoilage, equipment damage, and fire hazards. [...] ## Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts DevFeed: [Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts]() Original publisher: [Read original article]() Author: Lawrence Abrams Published: 2026-11-05T21:30:30Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [Credential theft](), [account takeover](), [Microsoft](), [Google]() Tags: [2026](), [account](), [adversary-in-the-middle](), [anthropic](), [attacks](), [authentication](), [computer-help](), [computer-security](), [computers](), [credentials](), [device-code](), [employees](), [events](), [fake](), [google](), [hackers](), [infosec](), [infosec-computer-security](), [kali365](), [linux](), [mac](), [malware](), [malware-removal](), [mfa](), [microsoft](), [openai](), [phaas](), [phishing](), [phishing-as-a-service](), [phishing-attacks](), [platforms](), [security](), [sessions](), [spacex](), [spyware](), [support](), [tech-support](), [technical-support](), [virus](), [virus-removal](), [voidproxy](), [windows]() ### AI overview Fake event invitations promising premium AI access or other rewards direct employees to registration pages that require corporate sign-in. The pages combine two phishing services: Kali365 uses Microsoft device-code authorization to obtain authentication tokens, then VoidProxy can capture Microsoft credentials and session cookies; for Google, VoidProxy proxies sign-in to steal credentials, MFA responses, and session cookies. A Cloudflare CAPTCHA helps keep automated scanners from reaching the pages. The excerpt says Push Security detected and blocked visits in late October 2026, but does not establish how the links were initially distributed. It recommends avoiding unfamiliar device codes, treating reward-linked work-account sign-ins cautiously, restricting device-code authentication where unnecessary, and using phishing-resistant MFA such as FIDO2 keys. ### Source excerpt Hackers are using fake OpenAI, SpaceX, and Anthropic event invitations to lure employees into phishing attacks, using two different phishing-as-a-service platforms to steal Microsoft and Google account credentials and authentication sessions. [...] ## Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes DevFeed: [Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes]() Original publisher: [Read original article]() Author: Ionut Arghire Published: 2026-11-05T10:37:13Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [Vulnerabilities](), [Android Security](), [iOS](), [Android](), [Google Chrome](), [Cloaked Ursa]() Tags: [17](), [2016](), [2023](), [2025](), [2026](), [account](), [actor](), [android](), [campaign](), [europe](), [exploit](), [featured](), [first](), [hackers](), [ios](), [large](), [midnight-blizzard](), [mobile-wireless](), [nation-state](), [russia](), [scale](), [ukraine](), [us](), [watering-hole](), [with]() ### AI overview Sekoia reports that Russia-linked Midnight Blizzard used compromised, cloned, and reverse-proxied websites, plus a compromised analytics tracker, to fingerprint visitors and deliver three mobile exploit chains. The chains targeted already patched flaws: two for iOS, both drawing on the DarkSword kit, and one for Android using Chrome and Qualcomm vulnerabilities. The iOS payloads could steal cookies or broadly collect messages, credentials, contacts, browsing data, photos, and iCloud Drive content; the Android payload, AndroSnitch, targeted Chrome data including passwords and Wi-Fi credentials. Sekoia says repackaged exploits for known vulnerabilities can lower the cost and technical barrier to advanced mobile attacks. The excerpt does not establish the campaign's full scope or outcomes. ### Source excerpt The large-scale watering hole campaign has been targeting entities in the US and Europe, mainly in Ukraine. The post Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes appeared first on SecurityWeek. ## French Blood Banks Hit Alongside Cyberattack On European Supermarkets DevFeed: [French Blood Banks Hit Alongside Cyberattack On European Supermarkets]() Original publisher: [Read original article]() Author: BeauHD Published: 2026-11-04T19:00:00Z Content type: news Language: en Sources: [Slashdot]() Topics: [Cybersecurity]() Tags: [alerts](), [attack](), [banks](), [belgium](), [blood](), [control](), [cooling](), [cyberattack](), [cybersecurity](), [efs](), [equipment](), [facilities](), [france](), [french-blood-establishment](), [hackers](), [incident](), [investigations](), [monday](), [monitoring](), [security](), [supermarkets]() ### AI overview A cyberattack disrupted cold-storage monitoring and control systems at three regional French blood-bank facilities, but blood supplies were unaffected. Staff were alerted and moved blood to refrigerators that were not connected to the affected systems. Investigations are examining how the attack happened, which equipment was affected, and when the systems can safely return to service. The excerpt also notes a similar French supermarket cooling-unit incident the previous month, which caused fires and food losses. ### Source excerpt An anonymous reader quotes a report from Reuters: The refrigerators at three regional blood banks in France were hit by a cyberattack overnight between Sunday and Monday, at the same time hackers struck supermarkets from Sweden to Belgium. "Several regional facilities of the French Blood Establishment (EFS) were affected by a cybersecurity incident that impacted certain cold storage room monitoring and control systems," the health ministry said in a statement. The incident had no impact on blood supplies, EFS spokesperson Charley Dubois said. "We have staff round the clock since blood can be needed at any time. They were warned about the problems by alerts and moved the blood to other refrigerators that were not connected," she said. [...] Investigations are under way into how the attack was carried out, what equipment may have been affected and when systems can safely return to service. The attack followed a similar incident in France last month when police said hackers seized control of cooling units at hundreds of supermarkets, causing fires and food losses. Read more of this story at Slashdot. ## How hackers are turning grocery store freezers into heaters DevFeed: [How hackers are turning grocery store freezers into heaters]() Original publisher: [Read original article]() Author: Anne Barela Published: 2026-11-04T16:49:07Z Content type: news Language: en Sources: [Adafruit Industries]() Topics: [Embedded Systems]() Tags: [2025](), [attacks](), [belgium](), [carnegie-mellon](), [computers](), [control](), [control-system](), [finland](), [france](), [grocery-stores](), [hackers](), [history](), [iot-security](), [ireland](), [italy](), [luxembourg](), [netherlands](), [october](), [portugal](), [refrigeration](), [refrigeration-systems](), [reverse-engineering](), [security](), [supermarket](), [sweden]() ### AI overview Attackers reportedly exploited online freezer controls to keep defrost heating elements on, turning supermarket freezers into heaters. After attacks on hundreds of French grocery stores in October, a November 1 wave affected stores in 11 other European countries; some freezers reached 50°C overnight. Similar failures at U.S. military bases in August are suspected to be cyberattacks. Carnegie Mellon professor Swarun Kumar says the small computers in smart devices may not recognize misuse. No group has claimed responsibility or sought ransom. One targeted control system had a security advisory dating to May 2025, and retailers reported millions of euros in food losses. ### Source excerpt Peter Hall, writing for Scientific American, reports on a run of attacks that turned supermarket freezers into ovens. In October, attackers hit refrigeration systems at hundreds of grocery stores in France. On the night of November 1, a second wave struck stores in Belgium, Sweden, the Netherlands, Ireland, Estonia, Finland, Luxembourg, Italy, Portugal, Romania and [...] ## Russian hackers target iOS and Android users with n-day exploits DevFeed: [Russian hackers target iOS and Android users with n-day exploits]() Original publisher: [Read original article]() Author: Sinisa Markovic Published: 2026-11-04T14:38:37Z Content type: news Language: en Sources: [Help Net Security]() Topics: [Cloaked Ursa](), [Android Security](), [Android](), [iOS](), [Google Chrome]() Tags: [adversary](), [adversary-in-the-middle](), [android](), [android-phones](), [apt29](), [chrome](), [code-injection](), [compromised-websites](), [cookies](), [cyber-espionage](), [exploits](), [hackers](), [ios](), [iphone](), [mobile-devices](), [n-day](), [news](), [passwords](), [patched](), [russia](), [russian-federation](), [watering-hole](), [websites](), [wi-fi]() ### AI overview Sekoia reports that APT29-linked watering holes used three web delivery routes--scripts injected into compromised sites, lookalike domains and a hijacked Ukrainian analytics service--to profile visitors and serve platform-specific exploits without user interaction. The chains targeted iOS 16.7 and 18.5 and Android phones running Chrome 139-145 except 143, stealing data that ranged from browser cookies to messages, passwords, location and health information. The payloads did not persist after exfiltration. The vulnerabilities were patched before the operation began; Sekoia says devices with up-to-date operating systems are safe. Attribution is based on infrastructure traces, campaign similarities and the victim list, and the attackers' targeting intent remains unclear. ### Source excerpt Russia's APT29 has been using compromised websites, lookalike domains and a hijacked web analytics service to target iOS and Android users with exploits for patched flaws and steal their cookies, messages and Wi-Fi passwords, according to Sekoia. APT29 watering holes target mobile devices with n-day exploits (Source: Sekoia) The company's Threat Detection & Research (TDR) team spotted the operation in mid-October 2026. "This watering hole campaign, which we assess with moderate to high confidence to ... More -> The post Russian hackers target iOS and Android users with n-day exploits appeared first on Help Net Security. ## French blood banks hacked in latest cyber-attack on Europe DevFeed: [French blood banks hacked in latest cyber-attack on Europe]() Original publisher: [Read original article]() Author: Jon Henley in Paris Published: 2026-11-04T13:22:28Z Content type: news Language: en Sources: [The Guardian | Technology]() Topics: [Cybersecurity](), [cyber resiliency](), [national security]() Tags: [2022](), [alarm](), [anssi](), [attack](), [attacks](), [banks](), [blood](), [control](), [cyber](), [cyber-attack](), [cyber-attacks](), [cybercrime](), [cyberwar](), [europe](), [france](), [hacked](), [hackers](), [hacking](), [hacking-cybercrime-cyberwar-internet-technology-france-europe-world-news](), [internet](), [products](), [service](), [systems](), [technology](), [temperature](), [world-news]() ### AI overview Hackers raised temperature and defrosting thresholds at three contractor-run cold stores holding blood products for France's EFS, but alarm systems enabled technicians to intervene before products were compromised. EFS moved affected plasma and other products to different sites, alerted France's cybersecurity agency and health ministry, and reinforced equipment monitoring. The incident occurred amid attacks on supermarket refrigeration systems across Europe; the excerpt says no motive or perpetrator was known and gives possible attribution scenarios, not a confirmed one. ### Source excerpt Temperature and defrosting thresholds raised to 'very high levels' at three cold stores stocking vital blood products Europe live - latest updates France's national blood service has said hackers accessed control systems and boosted temperatures at three cold stores stocking vital blood products, in an apparent escalation of recent cyber-attacks on fridges and freezers across Europe. The French blood service (EFS) said temperature and defrosting thresholds had been raised to "very high levels" in the attack, adding that its alarm systems had allowed technicians to intervene before the products were compromised. Continue reading... ## AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks DevFeed: [AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks]() Original publisher: [Read original article]() Author: Ionut Arghire Published: 2026-11-04T12:43:20Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [ai-assisted attacks](), [Cybersecurity](), [Credential theft](), [Secrets Management](), [pii](), [Vulnerabilities](), [LLM security]() Tags: [access-tokens](), [agent](), [agents](), [ai](), [ai-agent](), [ai-agents](), [ai-assisted](), [ai-tools](), [artificial-intelligence](), [attacks](), [automate](), [breaches](), [featured](), [hackers](), [hacks](), [malware-threats](), [northflank](), [offensive](), [offensive-tools](), [tokens](), [tools](), [trigger-dev](), [workos]() ### AI overview Recent attacks on AI developer platforms appear to share a motive--stealing stored AI credentials for resale or abuse--but the excerpt says the incidents are not linked and initial access varied, including compromised credentials, third-party components, and exploited vulnerabilities. WorkOS and Chainstack disclosed attacks involving the open-source AI penetration-testing framework Artex. Chainstack said attackers entered through a third-party component and accessed customer account data, password hashes, and systems storing node credentials; it urged customers to rotate node credentials. WorkOS said attackers compromised an internal sales application and accessed business contact details, account histories, sales and customer relationship information, communications, and product-use information. Wiz attributed rising demand for stolen keys to LLM-jacking, broker infrastructure, and model distillation, and reported multiple threat actors using some of the same compromised keys. ### Source excerpt Hackers have been harvesting AI access tokens and have been using AI-assisted offensive tools to automate attacks. The post AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks appeared first on SecurityWeek. ## China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor DevFeed: [China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor]() Original publisher: [Read original article]() Author: The Hacker News Published: 2026-11-04T11:24:31Z Content type: news Language: en Sources: [Cyber Newsroom]() Topics: [Domain Name System (DNS)](), [DLL hijacking]() Tags: [2021](), [2026](), [actor](), [backdoor](), [china](), [communications](), [cve](), [cve-2026-120422](), [cyber-espionage](), [deploy](), [dns](), [dns-hijacking](), [domain](), [domain-name](), [domain-name-system](), [hackers](), [hijack](), [hijacking](), [http](), [input](), [malware](), [name](), [nation-state](), [supply-chain](), [vulnerability]() ### AI overview ESET attributed a surveillance campaign active from July 2026 to SlippyNunchucks, which hijacked DNS requests from Windows versions of Sogou Input Method to deploy the DarkVigil backdoor. SGTool.exe normally fetches a vocabulary promotion configuration over HTTP; tampered DNS redirected that request to staging servers, whose malicious configuration instructed the app to download a legitimate Adobe executable and a rogue DLL containing DarkVigil, then launch it through DLL sideloading. DarkVigil uses DMTP for command and control and can orchestrate plugins for persistence or data collection. ESET reported targeting in six countries and said it found no tactical overlap with Mustang Panda activity. Tencent fixed the issue, CVE-2026-120422, in version 16.10 on October 29, 2026, by moving the affected requests to HTTPS. ### Source excerpt China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Meth ... Read more Published Date: Nov 04, 2026 (5 hours, 37 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-120422 CVE-2026-51990 CVE-2021-38003 ## Hackers use n-day exploits in zero-click attacks on iOS, Android devices DevFeed: [Hackers use n-day exploits in zero-click attacks on iOS, Android devices]() Original publisher: [Read original article]() Author: Bill Toulas Published: 2026-11-04T09:39:54Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [Cybersecurity](), [Android Security](), [Credential theft](), [Android](), [iOS]() Tags: [ai](), [ai-agents](), [android](), [apple](), [apt29](), [attacks](), [c2](), [chrome](), [command-and-control](), [computer-help](), [computer-security](), [computers](), [cookies](), [credentials](), [cve](), [darksword](), [devices](), [exploits](), [hackers](), [infosec](), [infosec-computer-security](), [ios](), [iphone](), [linux](), [mac](), [malware](), [malware-removal](), [mobile](), [n-day](), [russia](), [security](), [spyware](), [support](), [tech-support](), [technical-support](), [virus](), [virus-removal](), [watering-hole](), [windows](), [zero-click]() ### AI overview Sekoia attributes a large watering-hole campaign to APT29 with moderate-to-high confidence. Compromised sites and lookalike portals used JavaScript to profile visitors' devices and browser versions, then served platform-specific exploit chains without user interaction. The reported chains targeted older iOS versions to steal Safari cookies or harvest messaging databases, credentials, location data, and photos; Android Chrome versions 139-145 except 143 were targeted to collect cookies, login data, browsing history, and saved Wi-Fi credentials. The analyzed payloads did not establish persistence, so rebooting stopped activity until the device revisited a compromised site. Apple and Google have patched the flaws; the excerpt recommends installing the latest available security updates. ### Source excerpt A large-scale watering hole attack associated with Russian hackers has been targeting iOS and Android users visiting compromised sites or fake ones impersonating legitimate portals. [...] ## As LLMs Devour the Storage Market, Fujifilm Bets on Tape DevFeed: [As LLMs Devour the Storage Market, Fujifilm Bets on Tape]() Original publisher: [Read original article]() Author: Tyler August Published: 2026-11-04T06:00:13Z Content type: news Language: en Sources: [Hackaday]() Topics: [save](), [recording](), [DRAM price increase]() Tags: [ai](), [compress](), [compression](), [data-storage](), [datacenter](), [datasette](), [demand](), [fujifilm](), [generation](), [gpus](), [hackers](), [hdd](), [linear-tape-open](), [llms](), [lto](), [news](), [optical-media](), [production](), [ram](), [ssds](), [storage](), [tape](), [tape-backup]() ### AI overview Fujifilm says it will increase production of LTO-10 tape fivefold by 2028, investing 10 billion yen (about $63 million) to meet rising demand for archival storage associated with AI. Ultrium 10 cartridges hold 30 TB or 40 TB uncompressed; the advertised 75 TB and 100 TB capacities assume 1.5:1 compression. The excerpt gives an uncompressed transfer rate of 400 MB/s and notes tape is slower than modern SSDs and HDDs, while framing the expansion as a response to growing demand for cold storage. ### Source excerpt One of the interesting things about the slow-moving AI apocalypse we seem to be trapped in is watching the knock-on effects reverberate through communities and economies. We've seen how -- ...read more ## CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades DevFeed: [CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades]() Original publisher: [Read original article]() Author: The Hacker News Published: 2026-11-04T05:43:11Z Content type: news Language: en Sources: [Cyber Newsroom]() Topics: [WordPress](), [known exploitable vulnerabilities](), [cybersecurity and infrastructure security agency](), [bug](), [cve remediation](), [vulnerability management]() Tags: [2026](), [active-exploitation](), [attacks](), [cisa](), [code](), [code-execution](), [condition](), [core](), [cve-2026-119977](), [cvss](), [cyber-attack](), [cybersecurity-and-infrastructure-security-agency](), [exploited](), [exploited-vulnerabilities](), [hackers](), [kev](), [kev-catalog](), [security](), [upgrades](), [vulnerabilities](), [vulnerability](), [web-security](), [wordpress]() ### AI overview CISA added WordPress Core flaw CVE-2026-119977 (CVSS 8.1) to its KEV catalog, confirming active exploitation. The TOCTOU race condition involves predictable, web-accessible staging paths during full-package core upgrades and can let unauthenticated attackers execute code during the brief upgrade window. Patches were released in late October. Wordfence reported more than 18,500 requests targeting staged setup-config.php paths in the first 21 hours after disclosure; Previdian observed three attempts against its honeypot sensors on October 30, and the excerpt says 12,632 attacks were blocked in the prior 24 hours. CISA set November 6, 2026, as the deadline for FCEB agencies to apply fixes. ### Source excerpt CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitatio ... Read more Published Date: Nov 04, 2026 (5 hours, 31 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-119977 ## Hackers hijack cPGuard autoupdate to deploy backdoor, steal data DevFeed: [Hackers hijack cPGuard autoupdate to deploy backdoor, steal data]() Original publisher: [Read original article]() Author: Bill Toulas Published: 2026-11-03T22:18:50Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [Security](), [network security](), [Credential theft](), [data](), [Authorization]() Tags: [backdoor](), [cdn](), [compromise](), [computer-help](), [computer-security](), [computers](), [cpguard](), [credentials](), [data](), [database](), [distribution](), [hackers](), [healthcare](), [hijack](), [infosec](), [infosec-computer-security](), [infrastructure](), [initial-access](), [linux](), [mac](), [malicious](), [malicious-update](), [malware](), [malware-removal](), [mariadb](), [script](), [security](), [security-software](), [spyware](), [supply-chain](), [supply-chain-attack](), [support](), [tech-support](), [technical-support](), [update](), [virus](), [virus-removal](), [web-security](), [windows]() ### AI overview Attackers used compromised credentials to breach OpsShield's update infrastructure on November 2, 2026, and distribute a malicious script through cPGuard versions 5.88.12-5.88.19. It targeted password hashes, database configuration, shell history, and SSH authorization and known-hosts files, then uploaded collected data to OpsShield's licensing server. OpsShield says it stopped distribution within 12 hours; it identified 2,946 affected servers and reported that attackers retrieved 32 files per customer, though it could not establish what was collected from each server. Administrators are advised to update to version 5.88.25 or later, which the vendor says removes the backdoor and staged files, and promptly reset passwords and rotate database credentials, cloud secrets, and SSH keys. OpsShield also plans an update to remove previously installed support-access keys. ### Source excerpt Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script. [...] ## Binance says fake job interview led to $6.3 billion crypto heist DevFeed: [Binance says fake job interview led to $6.3 billion crypto heist]() Original publisher: [Read original article]() Author: Lawrence Abrams Published: 2026-11-03T20:05:50Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [Cybercrime](), [Social engineering](), [Cryptocurrency](), [Remote Access Trojan](), [malware scanners]() Tags: [assets](), [binance](), [company](), [compromise](), [computer-help](), [computer-security](), [computers](), [contagious-interview](), [crypto](), [crypto-heist](), [crypto-theft](), [cryptocurrency](), [digital-assets](), [employee](), [exchange](), [hackers](), [heist](), [infosec](), [infosec-computer-security](), [infrastructure](), [interview](), [job](), [job-interview](), [korean](), [linux](), [mac](), [malware](), [malware-removal](), [north](), [operation-dream-job](), [security](), [spyware](), [support](), [tech-support](), [technical-support](), [virus](), [virus-removal](), [wallet](), [windows]() ### AI overview Binance says attackers posing as recruiters used a fake job interview and malicious coding assignment to compromise an engineer's Mac with custom malware that antivirus tools did not detect. The malware enabled remote command execution; attackers then used the engineer's device and an internal AI tool to compromise two more wallet infrastructure employees and obtain credentials and a deployment token. Those credentials were used to access the wallet signing service and steal about $6.34 billion across multiple blockchains. Binance says the attackers also abused Ethereum's EIP-7702 authorization mechanism to keep stealing after withdrawals were suspended. The company reports rebuilding affected systems, replacing devices, and revoking credentials; by November 3, about $2.85 billion had been frozen or intercepted, and 98% of impacted token assets had been replenished as of October 31. Binance says its investigation continues with independent security firms reviewing its findings. ### Source excerpt Cryptocurrency exchange Binance says North Korean hackers used a fake job interview to trick an employee into installing malware that ultimately let them compromise the company's wallet infrastructure and steal about $6.34 billion in digital assets. [...] ## Binance Says Hackers Used Fake Job Interviews, AI Tool to Steal $6.3 Billion In Crypto DevFeed: [Binance Says Hackers Used Fake Job Interviews, AI Tool to Steal $6.3 Billion In Crypto]() Original publisher: [Read original article]() Author: BeauHD Published: 2026-11-03T20:00:00Z Content type: news Language: en Sources: [Slashdot]() Topics: [Binance](), [Artificial Intelligence](), [Secrets Management]() Tags: [ai-tools](), [binance](), [bitcoin](), [crypto](), [developer-tool](), [fake-job-interviews](), [hackers](), [infrastructure](), [security]() ### AI overview Binance says attackers spent months preparing for the Oct. 29 theft of $6.34 billion in crypto, using fake job interviews, a tampered Homebrew installation sought to install an AI coding tool, and compromised internal AI tools. Binance detected suspicious activity, replaced an engineer's device, and rotated credentials, but says the engineer's role and colleagues on the wallet infrastructure team had already been exposed. Co-CEO Richard Teng says Binance has replenished 98% of affected assets and is purchasing remaining, less liquid assets. The company says it rebuilt the affected wallet system and internal AI tool, replaced compromised devices, decommissioned related credentials and tokens, expanded device scans, and is arranging an independent review while working with law enforcement and industry partners to trace and freeze funds. ### Source excerpt Binance says hackers spent months infiltrating its systems through fake job interviews, a tampered developer tool and compromised internal AI tools before stealing $6.34 billion in crypto in the Oct. 29 attack. Co-CEO Richard Teng said Binance has replenished 98% of the affected assets, and that it is still in the process of purchasing outstanding, more illiquid assets. CNBC reports: Preparations for the attack began in June, when a Binance Wallet DevOps engineer downloaded a tampered Homebrew installation "to install a popular AI coding tool after searching for it on a search engine," according to a security report published by Binance Tuesday. It said it detected the suspicious activity, replaced the engineer's device and rotated credentials as a precaution, but that by then the employee's "role and his related colleagues on our wallet infrastructure team was exposed to the hacker." [...] As of Tuesday Binance has rebuilt the affected wallet system and internal AI tool, replaced compromised devices, decommissioned credentials and tokens associated with the affected engineers and expanded security scans across employee devices, Teng told "Squawk on the Street." "We're also getting an independent expert to review everything that we have done, and we'll keep strengthening our defenses as the investigation continues," Teng said. "We're working around the clock with law enforcement agencies and with industry partners to trace and freeze the stolen funds for that front." Read more of this story at Slashdot. ## Hackers behind $6.3bn Binance heist 'used malware and bogus job interviews' DevFeed: [Hackers behind $6.3bn Binance heist 'used malware and bogus job interviews']() Original publisher: [Read original article]() Author: Dan Milmo Global technology editor Published: 2026-11-03T19:00:23Z Content type: news Language: en Sources: [The Guardian | Technology]() Topics: [Binance](), [Malware](), [ai-assisted attacks](), [infection chain]() Tags: [ai](), [ai-artificial-intelligence](), [ai-tool](), [attack](), [binance](), [binance-business-cryptocurrencies-e-commerce-internet-technology-ai-artificial-intelligence-comput](), [business](), [computing](), [crypto](), [cryptocurrencies](), [cryptocurrency](), [e-commerce](), [exchange](), [hackers](), [heist](), [internet](), [interviews](), [job](), [june](), [led](), [malicious](), [malware](), [raid](), [recruitment](), [scam](), [software](), [technology](), [tool](), [world-news]() ### AI overview Binance says the $6.34bn wallet theft followed a months-long intrusion that combined malware, recruitment deception and access to an internal AI tool. An engineer first downloaded malware inadvertently in June; in September, another engineer was lured through fake job interviews into downloading malware. Binance says the attacker later used the compromised systems, stolen credentials and its AI tool to take control of two wallet developers' computers and trigger a malicious script on 29 October. The company reported that $2.85bn had been frozen or intercepted. The FBI attributed the hack to North Korea; Pyongyang denied responsibility. These details are from the supplied excerpt. ### Source excerpt Firm reveals details about how its cryptocurrency exchange was compromised, saying operation began in June The hackers behind the $6.3bn (GBP 4.7bn) Binance heist used bogus job interviews, malicious software and an internal AI tool, the company has revealed. The world's largest cryptocurrency exchange was compromised in an operation that began with an inadvertent download of malware in June, led to a recruitment scam in September and then a raid last week of "hot wallets" where billions of dollars worth of crypto-assets were taken. Continue reading... ## Privacy's Defenders Podcast: The Secret Room DevFeed: [Privacy's Defenders Podcast: The Secret Room]() Original publisher: [Read original article]() Author: Josh Richman Published: 2026-11-03T15:00:01Z Content type: news Language: en Sources: [Deeplinks]() Topics: [podcasting](), [national security]() Tags: [2005](), [at-t](), [communications](), [company](), [court](), [customer](), [customers](), [department](), [digital](), [eff](), [government](), [hackers](), [hidden](), [how-to-fix-the-internet-podcast](), [internet](), [justice-department](), [lawsuit](), [nsa-spying](), [podcast](), [privacy](), [room](), [secret]() ### AI overview After EFF received documents from retired AT&T technician Mark Klein in January 2006, it filed Hepting v. AT&T less than two weeks later, alleging surveillance affecting the phone company's customers. This podcast episode recounts that sequence through conversations with former EFF lawyer Kevin Bankston, Klein, former Justice Department lawyer Tony Coppolino, and Carolyn Jewel, an AT&T customer who became lead plaintiff in EFF's related case against the NSA. Coppolino warned EFF that filing Klein's documents could cause serious trouble if they were classified. The episode presents the case as part of efforts to expose post-September 11 mass surveillance; the supplied text is an episode description, not a transcript. ### Source excerpt The government's surveillance powers grew rapidly after Sept. 11, 2001, some in public view and some in secret. EFF suspected but couldn't prove that the National Security Agency was spying on Americans' communications. The New York Times sat on a story about it for over a year, finally publishing it in December 2005. Then, in January 2006, a retired AT&T technician named Mark Klein walked into EFF's office with a manila folder of documents that blew the story wide open. Welcome to the third episode of "Privacy's Defenders," a podcast about the people - lawyers, journalists, hackers, and others - who've fought to secure your digital liberties since before most people even knew what the internet was. %3Ciframe%20height%3D%2252px%22%20width%3D%22100%25%22%20frameborder%3D%22no%22%20scrolling%3D%22no%22%20seamless%3D%22%22%20src%3D%22https%3A%2F%2Fplayer.simplecast.com%2Fe7dd937c-3319-4a9a-9245-f9ed34b9419d%3Fdark%3Dtrue%26amp%3Bcolor%3D000000%22%20allow%3D%22autoplay%22%3E%3C%2Fiframe%3E Privacy info. This embed will serve content from simplecast.com (You can also find this episode on YouTube.) In this episode, former EFF Executive Director Cindy Cohn talks with former EFF lawyer Kevin Bankston, who was at his desk drafting a lawsuit against AT&T when Klein showed up. Less than two weeks later, EFF sued the phone company on behalf of its own customers in Hepting v. AT&T. Cindy speaks again with now-retired Justice Department lawyer Tony Coppolino, who asked for the opportunity to defend the case. He called EFF with a warning after Klein's documents were filed in court: If they were classified, EFF would be in big trouble. You'll also hear from Klein himself, and from Carolyn Jewel, a romance novelist and AT&T customer who became the lead plaintiff in EFF's related case against the NSA. It's the story of a secret room in a San Francisco phone company building, a heroic whistleblower, and the people who refused to let mass surveillance stay hidden. The "Privacy's Defend ## Freezers of UK meat suppliers heat up after cyber-attacks in Europe DevFeed: [Freezers of UK meat suppliers heat up after cyber-attacks in Europe]() Original publisher: [Read original article]() Author: Dan Milmo and Robert Booth Published: 2026-11-03T14:29:37Z Content type: news Language: en Sources: [The Guardian | Technology]() Topics: [Cybersecurity](), [Vulnerabilities](), [Threat Hunting & Intel](), [Threat monitoring]() Tags: [ai](), [ai-systems](), [association](), [attack](), [attacks](), [authentication](), [cyber](), [cyber-attacks](), [cyber-security](), [cybercrime](), [cybercrime-uk-news-internet-technology](), [cybersecurity](), [europe](), [experts](), [food-drink-industry](), [food-safety](), [hackers](), [impact](), [internet](), [it](), [meat-industry](), [ncsc](), [russia](), [security](), [supermarket](), [suppliers](), [technology](), [uk](), [uk-news]() ### AI overview Hackers raised refrigeration temperatures at retailers across several European countries, and some UK meat suppliers also reported attacks. The NCSC said it was working with affected organisations and that the national impact was minimal; no UK grocery chain had been directly affected, and reported UK losses involved empty units. The French incidents involved legacy equipment exposed to the internet with default passwords. Researchers recorded 256 attempts from 91 sources against dummy Danfoss controls, mostly using factory-default credentials, and noted overlap with infrastructure previously associated with Russian-linked operations, without identifying a group. The NCSC said the attacks used long-known vulnerabilities and urged organisations to find and close similar gaps; its leaders warned that connected domestic devices can also be vulnerable and called for safer products. ### Source excerpt Cybersecurity experts say incidents had minimal effect but may represent the 'foothills' of a wider threat Meat suppliers in the UK have been hit by cyber-attacks after hackers raised the temperatures of supermarket freezers across Europe. The UK's National Cyber Security Centre (NCSC) said it was working with the affected companies but that the national impact was minimal. Continue reading... ## Hackers put porn on public billboards and claim it was "far too easy" DevFeed: [Hackers put porn on public billboards and claim it was "far too easy"]() Original publisher: [Read original article]() Author: Pieter Arntz Published: 2026-11-03T12:01:55Z Content type: news Language: en Sources: [Malwarebytes]() Topics: [Digital signage](), [Zero Trust](), [identity and access management]() Tags: [attack](), [attacks](), [authentication](), [automated](), [billboard](), [brazil](), [bugs](), [channel](), [china](), [compromise](), [computer](), [content](), [content-management](), [easy](), [hackers](), [hacking](), [leaker](), [management](), [news](), [porn](), [public](), [remote-management](), [software]() ### AI overview Reports from Egypt, Malaysia, and Brazil described explicit footage appearing on digital billboards after attackers accessed the software used to publish content, rather than hacking each display individually. Leakers$ claimed automated scanning found thousands of exposed systems and cited weaknesses in content-transmission software and web interfaces; that account is not independently established here, and its claims about Iraq and China are less firmly corroborated. The article recommends treating billboards as remotely managed computer systems: restrict management access from the public internet, replace default or reused passwords, enable multifactor authentication, secure remote connections with a VPN, update software and equipment, review supplier access, monitor systems, and rehearse a rapid response. ### Source excerpt A hacking group called Leakers$ gained access to remote management software for billboards and used it to show porn. [Next page]()