The digest for 3 November 2026
Download it as an EPUB, or keep a permanent link to it
Researchers found a critical remote code execution (RCE) vulnerability in GNU Savannah, allowing attackers to gain root access and potentially compromise projects like Bash. The FSF fixed the issues after a 30-day disclosure window.
From Lobsters
A comment highlights that 3% of critical software security bugs discovered in all of history have been found in the last month, suggesting a dramatic increase in vulnerability discovery.
From Schneier on Security
Expat 2.10.0 addresses four vulnerabilities, including improvements to billion laughs and parameter entity attacks, and memory allocation tracking. The release includes fixes for denial of service and signed integer overflow issues.
From Lobsters
Attackers compromised cPGuard's update system to distribute a backdoor and steal sensitive data from affected servers. OpsShield has released a fix and advises users to update and reset credentials.
From BleepingComputer
LLMjacking attacks are generating massive fraudulent cloud charges, with some organizations losing over $1 million. Attackers exploit stolen API keys to resell access to LLMs, leading to unauthorized usage and billing.
From BleepingComputer
Barracuda Networks has identified two critical vulnerabilities in its products that could allow attackers to gain root access if they have administrative access. Patches are available for affected devices.
From BleepingComputer
Google and industry partners have dismantled a botnet of over 1.3 million infected Android TV boxes, which were used for cybercrime. The manufacturer was banned for intentionally infecting devices.
From BleepingComputer
Google released Android security updates for November 2026, addressing over 200 vulnerabilities, including critical-severity issues in the Framework and System components. The updates are delivered in two phases, with the second phase targeting hardware and subcomponents.
From SecurityWeek
A critical vulnerability in Node-RED (CVE-2026-58115) has been exploited in the wild to deploy payloads, including Linux bots and webshells. Vulnerability intelligence firm VulnCheck observed multiple attacks from Microsoft’s network.
From SecurityWeek
Google has dismantled a botnet of 1.3 million Android devices, operated by Videostrong, which was used for ad fraud and data exfiltration. The takedown involved legal action and collaboration with multiple security firms.
From SecurityWeek
Microsoft's analysis of over 383,000 disclosed vulnerabilities shows that only about 2,000 are exploited in the wild, with remote code execution and privilege escalation being the most common. Patching is slow, especially on critical systems, and defenders must prioritize based on impact and exposure.
Cloudflare introduces Zero Wire, a public vulnerability intelligence feed that provides concise, actionable briefings on critical Internet vulnerabilities. It aims to help security teams quickly understand and respond to new disclosures.
From The Cloudflare Blog
ATrust is a new defense mechanism designed to secure large language model (LLM) agents by dynamically expanding trust boundaries during runtime. It reduces attack success rates while improving utility compared to existing solutions.
From arXiv
This paper introduces a three-tier framework to classify and mitigate vulnerabilities in the OWASP MCP Top 10, highlighting architectural limitations in MCP security. The framework was validated on a real-world MFT server, showing that some vulnerabilities cannot be fully addressed at the server level.
From arXiv
Trigger.dev experienced a security incident where an attacker gained unauthorized access to environment variables for some customers. The company has blocked the exploit and is notifying affected users.
From Hacker News
Binance CEO Richard Teng described a months-long attack by North Korean hackers that led to a $6.3 billion theft, involving social engineering, compromised devices, and internal tools. North Korea denied responsibility.
From The Record
Binance claims North Korean hackers used a fake job interview to install malware, leading to a $6.34 billion crypto theft. The attack began with a malicious coding assignment that compromised an employee's device and eventually allowed access to Binance's wallet infrastructure.
From BleepingComputer
Google has introduced a $250,000 reward for critical security flaws in its Cloud infrastructure, specifically targeting Root-in-Cloud bugs that could compromise entire systems.
From BleepingComputer
Chinese hackers have used ARTEX, an open-source AI penetration-testing framework, to conduct automated attacks against over 200 organizations in 14 countries.
From BleepingComputer
Gitbook confirmed a breach involving unauthorized access to infrastructure credentials and API tokens, likely due to an AI-driven attack. The company has taken steps to secure its systems and advises users to rotate tokens and secrets.
From Hacker News