The Matthew Chapman Podcast

Friday week in review: N-central's Tuesday hotfix didn't hold, the ScreenConnect toolkit goes after the technicians, and the exploited Outlook login leak is still waiting on unpatched machines. Plus an overnight warning on Check Point gateways.

Researcher Sean Bales disclosed 4EverAble2Shell (unauthenticated root RCE on N-central servers) and Agent2Shell (SYSTEM on managed Windows agents) that work against N-central 2026.4 Hotfix 2 (build 2026.4.1.26), released November 10 to fix Able2Shell. Huntback saw 157.20.241[.]16 chain an Apache Axis flaw with 4EverAble2Shell to drop an XMRig miner on 21 N-central servers, 19 of them already on Hotfix 2. N-able says the server issue needs the Legacy API enabled and exposed; it has disabled Legacy API and the Intune integration in hosted environments while remediation continues. Still unresolved: no fix yet for the new chains.

CVEs: CVE-2026-90436 (Apache Axis, CVSS 9.8)

Before the weekend: Disable Legacy API, remove N-central from the public internet, upgrade all Agents and Probes (2026.4 HF1+), block 157.20.241[.]16, and treat any hit as a full compromise.

Sources: The Hacker News: Hackers Exploit N-central Flaws to Infect 21 Servers · The Hacker News: New N-central Exploits Work Against Patched Servers

Blackpoint Cyber says the SCKit toolkit behind this week's ScreenConnect rogue-client campaign exploits a patched CVSS 9.9 flaw (on CISA KEV since September 11); a fully patched client blocks it. But SCKit also installs two unauthorized Access clients, uses RelayTrap to push its payload back to a connecting technician's workstation, and steals authenticated ScreenConnect sessions (.ASPXAUTH cookies) to spread across other customers. ConnectWise disabled five third-party extensions; Blackpoint found no link to SCKit. Still unresolved: a stolen operator session isn't fixed by patching.

CVEs: CVE-2026-84869

Before the weekend: Update every ScreenConnect server and client, remove unauthorized Access clients, block ns.mo7sen[.]dev, and investigate suspicious endpoints only from a clean workstation with a fresh session.

Source: The Hacker News: SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths

The only exploited bug in Microsoft's 1,259-fix November Patch Tuesday is an Outlook spoofing flaw where a crafted message makes Outlook connect to an attacker's server without the external-content warning, leaking the user's NTLMv2 hash. CISA's KEV deadline is November 24, 2026. Still unresolved: unpatched Office installs and any hashes already leaked.

CVEs: CVE-2026-124194

Before the weekend: Verify this month's Office and Microsoft 365 Apps update is installed everywhere, block outbound SMB (TCP 445) at the edge, and reset passwords for users who opened suspicious messages this week.

Source: The Hacker News: Microsoft Patches 1,259 Flaws

Check Point says attackers used PHP2Shell (CVE-2026-109618, CVE-2026-109619) on unpatched Mobile Access portals plus a Gaia OS DynamicCLI privilege escalation (CVE-2026-123039) to plant the TSGA backdoor, then pivoted to VMware ESXi and ran the destroy_v6 wiper. Patch your Check Point gateways.

Source: The Hacker News: Hackers Exploit PHP2Shell Flaws in Check Point Gateways

More from Matthew Chapman: https://www.mattchapman.net

https://mattchapman.net

Support the show

Thursday briefing: an attacker used 4,837 hijacked GitHub accounts to plant a CI secret stealer in 1,800+ repositories, compromised ScreenConnect panels push rogue clients worm-style across MSP customers, Apache HTTP Server patches a 9.8 HTTP/2 RCE, an AI agent ran a two-week telecom breach through an exploited Cisco BroadWorks flaw, and Krebs names the alleged admin of Qilin ransomware.

Since Tuesday, an attacker has used stolen credentials for 4,837 GitHub accounts to open test pull requests ("docs: dependency audit notes" from a wfx-docs branch) in 61,764 repositories, then push a secret stealer into CI workflows or npm postinstall hooks; Aikido says it ran in at least 1,806 repos and SafeDep counted 8,093 repos with malicious commits. Changes and workflow logs were usually deleted within minutes.

Do this today: Search repos you can write to for that PR title and the wfx-docs, chore/xxxxxxxx, and ci-check-#### branches since Tuesday; if found, revoke the account's tokens, OAuth grants, SSH keys, and sessions, and rotate every secret and cloud role the workflows could read.

Source: The Hacker News

Huntress says attackers with access to cloud-hosted ScreenConnect panels (likely stolen credentials or hijacked sessions) used Run Command to install rogue clients carrying the SCKit toolkit on at least 288 endpoints across 48 organizations, spreading back to technician workstations and on to other panels. ConnectWise says there is no ScreenConnect vulnerability and disabled five third-party extensions (Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, RMM+ Password Link) in about 400 partner environments.

Do this today: Disable those extensions on on-premises servers, block the IPs and domains in ConnectWise's advisory, and audit panels for new admin accounts and unexpected Run Commands.

Source: The Hacker News

A critical mod_http2 flaw in Apache HTTP Server 2.4.55 through 2.4.70 lets an unauthenticated attacker run code on servers with HTTP/2 enabled; Red Hat cites a reliable public exploit, while Wiz reports no public exploit or in-the-wild attacks. Fixed in 2.4.71; RHEL 9 and 10 have packages, and the archived standalone mod_h2 (2.0.8–2.0.42) gets no fix. Reported by Anthropic's OSS Scanner and Google Cloud Vulnerability Research.

CVE: CVE-2026-119618

Do this today: Update to Apache 2.4.71 or your distro's patched package; where you can't, remove h2 and h2c from the Protocols directive (server-wide and every virtual host).

Source: The Hacker News

CISA added an unauthenticated XXE flaw in Cisco BroadWorks' OCI XML parser (fixed August 2026) and an Openwave Messaging Webtop Media Transcoder flaw to KEV. Malbear Labs says the BroadWorks bug was used in "Operation Snowball," where an autonomous agent framework built on a jailbroken DeepSeek model breached a European telecom and 13 hosted companies over two weeks, stealing keys, credentials, and subscriber records. Separately, Arctic Wolf linked the open-source AI pentesting platform AntiFox to intrusions that reached AWS production secrets.

CVEs: CVE-2026-20320 (BroadWorks), CVE-2026-111793 (Openwave)

Do this today: Confirm BroadWorks is on Cisco's August 2026 fix, block the OCI/XSP interface from the internet, and rotate keys stored on the XSP host.

Sources: The Hacker News: Cisco BroadWorks and Openwave · The Hacker News: AntiFox

Brian Krebs traces Qilin's administrator "Haise," whose ransomware-as-a-service program claimed at least 365 victims in three months, through old forum handles, reused email addresses, and leaked Gosuslugi records to a 36-year-old man in St. Petersburg, Russia.

Do this today: Test a restore from offline backups and require phishing-resistant MFA on every remote access and admin login.

Source: Krebs on Security

More from Matthew Chapman: mattchapman.net

https://mattchapman.net

Support the show

Wednesday briefing: Microsoft's November Patch Tuesday (1,259 fixes) includes an exploited Outlook bug that leaks NTLMv2 hashes, Xen Orchestra's empty-cookie auth bypass is under active attack, Railway's breach turns stolen AI keys into $740,000 in charges, a Git flaw runs code on recursive clones, and Grok Build share links expose 35,000 apps through passive DNS.

Microsoft patched 1,259 flaws this month; the one confirmed exploited is an Outlook spoofing bug where a crafted message file makes Outlook connect to an attacker's server without the external-content warning, exposing the user's NTLMv2 hash. CISA added it to KEV with a November 24, 2026 federal deadline. Other notable fixes cover RCE in Windows Search, LDAP, Schannel, and the Virtual Filtering Platform.

CVEs: CVE-2026-124194 (exploited), CVE-2026-116928, CVE-2026-119958, CVE-2026-119952, CVE-2026-95962, CVE-2026-112967, CVE-2026-119990

Do this today: Push this month's Office and Microsoft 365 Apps update, and block outbound SMB (TCP 445) at the firewall so leaked hashes have nowhere to go.

Sources: The Hacker News · Krebs on Security: Microsoft Fixes Nearly 1,100 Security Vulnerabilities

Vates warns of an actively exploited authentication bypass (VSA-2026-062, no CVE yet): a cookie of authenticationToken=j:{} is parsed as an empty object that returns the first valid token, granting admin and leading to root on XCP-ng hosts. IoCs include 91.211.251[.]112:8001, a VM named "pivot2", "hvm_serial: file" configs, and /etc/cron.d/zz-ustar files.

Do this today: Update to Xen Orchestra 6.9.1 (stable) or 6.10.0 (latest) / xo-server 5.211.2 or 5.213.1, remove internet exposure, and hunt logs for empty authentication tokens.

Source: The Hacker News

Railway says an October 20–21 breach (build sandbox escape, over-trusted build credential, misconfigured OIDC binding, then a KMS-capable orchestration host) let an attacker decrypt environment variables in up to ~100,000 workspaces, hunting AI provider keys later used for an estimated $740,000 in charges. Railway now says it will cover charges providers won't refund.

Do this today: Revoke and reissue every secret stored on Railway before October 21 at the issuing provider, and set hard spending caps on every AI provider account.

Source: The Hacker News

An index integer truncation lets a malicious repo replace a submodule's .git file with a symlink to attacker hooks during recursive clones. Fixed in Git 2.56.1 and 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1; GitHub Enterprise Server 3.19.15, 3.20.11, 3.21.9, 3.22.4. Git for Windows had not shipped a fix as of Tuesday.

CVEs: CVE-2026-111760, CVE-2026-113408, CVE-2026-114467, CVE-2026-114469, CVE-2026-105437, CVE-2026-114466

Do this today: Update Git on every laptop and build runner, patch GitHub Enterprise Server, and stop recursively cloning untrusted repositories.

Source: The Hacker News

Claroc found 43,601 grok.me app links via passive DNS; more than 35,000 opened publicly, exposing medical exams, employee rosters, a Navy contractor roster, sales data, and 24 internal SpaceXSI apps (since removed). The random words sit in the subdomain, which DNS logs, rather than in the URL path.

Do this today: Switch every shared Grok Build (or Lovable, Bolt, Replit) app to "invited users" or "only you," and treat anything sensitive behind a public link as exposed.

Source: Ars Technica

More from Matthew Chapman: https://www.mattchapman.net

https://mattchapman.net

Support the show

Tuesday briefing: N-able takes N-central offline after 33 public zero-days, SAP patches four CVSS 10.0 flaws, Chrome fixes its eighth exploited zero-day of 2026, an attacker rides Qubole's trusted AWS access into customer clouds, and France pins the supermarket freezer sabotage on Iran's IRGC.

Researcher Sean Bales disclosed 30+ N-central flaws ("Able2Shell") with proof-of-concept exploits, including credential disclosure, file writes, traversal, XXE, and RCE that chain to admin access and root command execution. N-able took Hosted N-central offline and told on-prem customers to shut servers down until a hot fix ships; no exploitation seen yet.

Do this today: Power down or isolate on-prem N-central servers, rotate every credential stored in them, and review recent script and job history for anything unscheduled.

Source: The Hacker News

SAP's November Patch Day fixes four unauthenticated, no-interaction CVSS 10.0 bugs: memory corruption leading to code execution in the ICM and Web Dispatcher, a SAML 2.0 service provider flaw allowing login as any user on some SSO setups, and an SAP Gateway default ACL that lets an outsider impersonate an application server.

CVEs: CVE-2026-76964, CVE-2026-89126, CVE-2026-120017, CVE-2026-89103

Do this today: Plan one rollout updating the SAP kernel and all Web Dispatchers to this month's levels, and restrict network access to Web Dispatcher and the Gateway to known hosts until then.

Source: The Hacker News

Google patched nine Chrome bugs, including an XML use-after-free with an exploit in the wild, reported November 6. It is the eighth actively exploited Chrome zero-day of 2026, and other Chromium browsers need their own fixes.

CVE: CVE-2026-125350

Do this today: Push Chrome 157.0.8103.50/.51 (Windows, macOS) or 157.0.8103.50 (Linux), force relaunches, and update Edge, Brave, Opera, and Vivaldi as fixes land.

Source: The Hacker News

Wiz says that from October 14 to 26 an attacker used credentials for the AWS account Qubole uses to reach customers, assumed customers' (often unused) Qubole IAM roles, harvested secrets from Lambda, Secrets Manager, and SSM Parameter Store, validated them with TruffleHog, and copied S3 buckets. A separate October 8–11 wave abused customers' own AWS access keys set up for Qubole.

Do this today: Delete unused Qubole trust roles, search CloudTrail from October 1 for AssumeRole calls from Qubole's account (805246085872) originating outside AWS, and rotate every secret those roles could read.

Source: The Hacker News

France attributes the October 11 attack on Danfoss and Dixell refrigeration controllers at about 700 retail sites to the IRGC's Shahid Kaveh unit. Attackers ran unlimited defrost cycles and disabled temperature alarms, causing tens of millions of euros in losses and about 20 fires; France is summoning Iran's ambassador and seeking arrest warrants.

Do this today: Take refrigeration and building controllers off the internet, change default passwords, and ensure safety alarms can't be disabled from the same web panel.

Source: The Hacker News

More from Matthew Chapman at mattchapman.net.

https://mattchapman.net

Support the show

Monday briefing: a SonicWall SSL-VPN flaw that skips SAML and MFA lands on CISA's exploited list, the Alpine OpenSSH "SSHole" bug is now exploited for root, attackers are overheating supermarket freezers, Claude Code's "don't ask again" file is leaking secrets to GitHub, and one hacker ran a dozen AI agents against emergency services.

SonicWall says a user with valid credentials for an alternate authentication method on the SonicOS SSL-VPN can bypass SAML authentication and SAML-enforced MFA, and it investigated a report of possible exploitation. CISA added it to KEV with a November 20, 2026 federal deadline. The same update fixes two 8.8-rated management interface flaws and a pre-auth SSL-VPN heap overflow (DoS).

CVEs: CVE-2026-19868, CVE-2026-107155, CVE-2026-107154, CVE-2026-82308

Do this today: Update every SonicWall firewall to the release in Friday's advisory, disable local or alternate login methods your VPN doesn't need, and review VPN logins since late October for accounts that skipped SSO.

Source: The Hacker News

Previdian saw the first SSHole exploitation attempt less than nine hours after disclosure and confirmed root access on an Alpine honeypot via an oversized password against a password-disabled account. By November 8 attempts reached 20 from 13 IPs in nine countries. Affects OpenSSH on musl with PAM disabled, Alpine's default.

CVE: CVE-2026-123158 (CVSS 8.1). Observed source IP: 89.116.89[.]18

Do this today: Install OpenSSH 10.6p2 or your distro's patched package and restart sshd, block 89.116.89.18, and treat any machine with an "Accepted password for" line on a key-only account as compromised.

Sources: The Hacker News, Ars Technica

CISA, FBI, HHS, USDA, and DOT warn attackers are targeting internet-exposed industrial refrigeration and cold-chain controllers to force heating and defrost cycles. Hundreds of European supermarkets saw temperatures pushed as high as 50°C, and the French Blood Establishment had plasma storage settings raised at three facilities. Censys still counts about 708 exposed Danfoss StoreView and 2,420 Copeland/Dixell XWEB instances.

Do this today: Find refrigeration and building controllers on your external attack surface, put them behind a VPN or take them offline, and change every default password.

Source: The Hacker News

Apiiro found that "Yes, and don't ask again" in Claude Code can save the exact approved command, secrets included, in .claude/settings.local.json. 1,122 public copies hold at least one secret, including 379 database passwords, 43 SSH logins, 42 GitHub/GitLab/npm tokens, and 23 AWS keys. Git history and forks keep the leaks alive after deletion.

Do this today: Search your GitHub org and history for .claude/settings.local.json and .claude/settings.json, rotate every secret they ever held, then run git rm --cached on the local file and add it to each repo's .gitignore.

Source: The Hacker News

Acronis traced the BOSSAI operation to a single attacker in Hualien City, Taiwan, running nine of twelve AI agents against hundreds of organizations in at least 11 countries. The agents pulled Taipei 119 dispatch records across seven districts, found a fire department platform exposing patient data without login, and stole data via SQL injection and default root credentials. Attack agents ran on abliterated local models after commercial models mostly refused.

Do this today: Hunt your public apps for default admin credentials and injectable endpoints, and rate limit or block noisy automated scanning.

Source: The Hacker News

More from Matt: mattchapman.net

https://mattchapman.net

Support the show

Week in review: WordPress Core's upgrade race hits its federal deadline today, Zyxel's June switch fix still leaves root open, and Alpine remote login accepts a too-long fake password. Overnight, Chainalysis disclosed an agentic breach that exposed credentials for every user.

CISA added WordPress Core CVE-2026-119977 (CVSS 8.1), a TOCTOU race during full-package upgrades via predictable web-accessible staging paths, to the Known Exploited Vulnerabilities catalog. Wordfence recorded 18,500+ probes in the first day. Federal civilian agencies have until November 6, 2026 to finish. Patches shipped late last month.

Before the weekend: Confirm every WordPress site is on the latest Core build, schedule upgrades behind a locked-down maintenance window, and watch for unexpected setup-config hits.

Source: The Hacker News — CISA confirms WordPress Core exploitation

Binarly found GS1900 switches on 2.90 Patch 2 remain open to unauthenticated root command execution via the web management interface. CVE-2026-107441 (separate from CVE-2026-7273) is fixed in 2.90 Patch 3 for ten models. GreyNoise saw data pulled from 996 switches, many still on factory defaults.

Before the weekend: Take every GS1900 off the open network until Patch 3, change default admin passwords, and rotate credentials any exposed switch could have seen.

Source: The Hacker News — Zyxel GS1900 Patch Fails to Block Zero-Day

OpenSSH rated a critical flaw affecting Alpine (and other musl) systems where password authentication runs without PAM: a 257–1024 byte password can authenticate accounts with no password set (including key-only users). Fixed in OpenSSH 10.6p2; Alpine published packages for 3.16+. Ars Technica covered the issue as "sshole."

Before the weekend: Upgrade openssh-server and restart sshd, or set PasswordAuthentication no after confirming key login works; hunt logs for Accepted password on accounts that should never have one.

Sources: The Hacker News — OpenSSH Emergency Fix for Alpine · Ars Technica Security

Chainalysis said an ongoing agentic cyber attack exposed names, usernames, password hashes, and live tokens for all users, forcing Reactor, Data Solutions, KYT, and address-screening products offline. Customers must reset passwords and rotate API keys when access returns.

Source: The Hacker News — Chainalysis Breach Exposes All Users' Credentials

Also noted: Barracuda Email Security Gateway unauth root chain (CVE-2026-116606 + CVE-2026-111560; fixed in ESG 9.4.0.030+).

More at mattchapman.net.

https://mattchapman.net

Support the show

Thursday briefing: Cozy Bear (APT29) watering holes reuse patched Apple and Android bugs as CISA adds an Apple PAC bypass to KEV; Zyxel GS1900 Patch 2 still falls to the same unauth root exploit; a critical Debian/Ubuntu APT retry flaw lets MitM swap verified packages for root code; OpenAI's agentic pipeline produces 948 working Linux LPE exploits in 30 hours; and a backdoored ARTEX Docker image exposes 62 consoles to unauthenticated root.

Sekoia attributes the Poisoned Source watering-hole campaign (compromised sites, lookalike domains, and a brief Plerdy SEO Tracker supply-chain hit) to APT29/Cozy Bear with moderate-to-high confidence. Zero-click chains steal cookies and, on some builds, Wi-Fi passwords or full device data. CISA added Apple CVE-2024-27834 (Pointer Authentication bypass, patched May 2024) to KEV after reuse alongside WebKit CVE-2025-43529; FCEB deadline is November 18, 2026. Related Android chain uses CVE-2026-3910 and CVE-2025-27038.

Do this today: Update every managed iPhone, iPad, Mac, and Android device; review third-party analytics scripts loaded by your sites.

Sources: The Hacker News (CISA KEV) · The Hacker News (Poisoned Source) · Ars Technica

Binarly found Zyxel GS1900 switches on 2.90 Patch 2 (the June fix for actively exploited CVE-2026-7273) still vulnerable to the same unauthenticated root command execution via the web management interface. The incomplete fix left an out-of-bounds write now tracked as CVE-2026-107441 (CVSS 9.8 researcher / 8.8 vendor). Patch 3 closes it on 10 models. GreyNoise earlier observed data theft from 996 GS1900s; CISA had listed CVE-2026-7273 on KEV with a three-day FCEB window.

Do this today: Move every GS1900 to Patch 3 for its model, rotate any default admin password, and assume exposed switches may already be harvested.

Source: The Hacker News

Critical APT package-manager flaw CVE-2026-109518 lets an attacker who can alter downloads swap a verified package for their own; the payload runs as root on install. Requires APT retries (default on Debian 12+ and Ubuntu 22.04+). Debian and Ubuntu shipped fixes November 4. Attack path described over HTTP via malicious mirror/proxy/MitM; no public exploitation reported yet.

Do this today: Update APT on every Debian/Ubuntu host, prefer HTTPS mirrors, and scrutinize hosts that installed packages through untrusted proxies.

Source: The Hacker News

OpenAI detailed an agentic cyber pipeline that, in a mid-October run, dynamically reproduced 1,724 Linux vulnerabilities in ~30 hours and produced 948 working local privilege-escalation exploits (~$1.21M API cost, ~$1,279 per LPE), using at least 10 novel techniques. UK NCSC and Google TI warn AI is accelerating both discovery and attacker reuse; OpenAI says a low-privilege account on an unpatched OS is functionally root for a well-resourced actor.

Do this today: Accelerate Linux privilege-boundary patching, assume local footholds escalate, and require human review before any AI agent writes or runs exploit code.

Source: The Hacker News

CERT-In warns Crafty Falcon is using AI offensive tools (ARTEX, PentAGI, Cairn, CyberStrikeAI) against Indian BFSI and crypto targets. After the original ARTEX repo was pulled, copycat GitHub projects pointed Docker Compose at backdoored Hub images (e.g. tomicdd/artex, ~9,000 downloads) that grant an unauthenticated root shell via a captcha-field marker. Researchers found 62 consoles serving the backdoor Nov 2–4 (26 in the U.S.) out of 1,645 ARTEX hosts observed.

Do this today: If you pulled an ARTEX image, rebuild the host, rotate every secret it could touch, and stop running unvetted offensive AI stacks as root on open ports.

Source: The Hacker News

More at mattchapman.net

https://mattchapman.net

Support the show

https://mattchapman.net

Support the show

Overnight briefing: a hosting security tool's update channel was hijacked, BTCPay hot wallets are being drained, Siemens IoT boxes are taking remote backdoors, Synology NAS devices are getting ransomware, and Langflow still ships critical unauthenticated flaws.

Attackers compromised OPSSHIELD's cPGuard update CDN starting Nov 2, 2026 ~02:06 UTC and distributed a malicious script via versions 5.88.12–5.88.19. The script collected /etc/shadow, database configs, root shell history, and SSH keys, staging loot on OPSSHIELD's licensing server. OPSSHIELD estimated 32 customer servers had files retrieved. Fix: 5.88.25+.

Do this today: Update cPGuard to 5.88.25 or later, hunt advisory indicators, and rotate root passwords, DB secrets, and SSH keys.

Source: Cyber Security News — cPGuard supply chain

BTCPay Server reports Bitcoin and Litecoin thefts from hot wallets on 2.4.1 and earlier, exploiting a different path into a flaw patched in 2.4.2 (Aug 7, 2026). Reports began Nov 1. No credible drains reported on 2.4.7. Rebuild on a fresh server with a new wallet; updating in place is insufficient if already compromised.

Do this today: Check your version; if 2.4.1 or older, sweep funds, rebuild fresh, rotate credentials.

Sources: The Hacker News · BTCPay Server advisory

VulnCheck observed active exploitation of CVE-2026-58115 (CVSS 10.0) against Siemens SIMATIC IoT2050 Advanced devices: missing authentication on the Node-RED HTTP interface enables unauthenticated RCE. Attackers deploy botnet downloaders or durable HTTP command backdoors. Fixed in Industrial OS 4.3.4.1+.

Do this today: Upgrade to 4.3.4.1+, or uninstall Node-RED; lock editor/HTTP nodes behind auth.

Source: The Hacker News — Siemens IoT2050

Synology warns ransomware (including C3RB3R / .L0CK3D) is hitting NAS devices still running DSM versions vulnerable to flaws patched Dec 2024 (Synology-SA-24:20), including CVE-2024-10441 (CVSS 9.8 RCE).

Do this today: Update DSM to the patched build for your branch, enable automatic updates, verify backups restore.

Sources: The Hacker News — Synology ransomware · Synology SA-24:20

IBM reports critical Langflow flaws (CVE-2026-93680 auth bypass CVSS 9.8; CVE-2026-110186 RCE CVSS 9.8) affecting 1.0.0 through 1.12.8. Only 1.13.0 fixes them. One path involves MCP tool enumeration; a Metasploit module exists for the auth bypass. LANGFLOW_AUTO_LOGIN remains default-on in 1.12.8.

Do this today: Upgrade to Langflow 1.13.0, disable auto-login, pull public agent endpoints offline until verified.

Source: The Hacker News — Langflow

More at mattchapman.net.

https://mattchapman.net

Support the show

Monday briefing: attackers chain three Ivanti Connect Secure flaws into unauthenticated root, the FBI pins the record $6.43 billion Binance heist on North Korea's TraderTraitor, a hijacked DebugBear script drains Polymarket traders, a CVSS 10.0 flaw hits Canonical's LXD and MicroCloud, and the VOLTA infostealer uses AI to rank its victims.

CISA added two more Ivanti Connect Secure flaws to KEV on Friday. They complete the chain Volexity tied to UTA0576, which pairs an authentication bypass with a predictable-file-upload bug and a privilege escalation for unauthenticated root. The actor pulls credentials and Active Directory metadata and hunts for admin passwords and BitLocker recovery keys. The federal deadline for the privilege escalation fix is November 2.

CVEs: CVE-2026-104935 (CVSS 8.6), CVE-2026-111357 (CVSS 8.8), CVE-2026-118527 (CVSS 4.3)

Do this today: Upgrade Connect Secure to 25.1.1.3 or 22.8R2.6 (or newer), then rotate credentials and BitLocker recovery keys that could have passed through the gateway.

Source: The Hacker News

The FBI, Secret Service, and IRS-CI attributed the theft of $6.43 billion from Binance to TraderTraitor (Jade Sleet), the largest crypto theft on record. About $2.85 billion has been frozen, and the FBI published laundering wallet addresses. The group uses recruiter lures and trojanized Terraform providers to drop cross-platform backdoors. Binance has resumed withdrawals.

Do this today: Add the FBI's published laundering wallets to your blocklists, and make sure no recruiter's take-home test runs on a work machine.

Source: The Hacker News

After DebugBear's DNS was hijacked at its registrar, Polymarket's copy of the DebugBear real-user-monitoring script was replaced with code that abused signed-in trading sessions to move or sell positions. About $2.7 million left 726 wallets in under an hour on October 29; Polymarket is refunding traders, and DebugBear told customers to remove its embed code.

Do this today: Remove third-party scripts from login, checkout, and signing pages, or pin them with Subresource Integrity.

Source: The Hacker News

LXD and MicroCloud checked every certificate a client presented against the trust store, but TLS only proves ownership of the leaf, so an attacker with a trusted client's public certificate could impersonate it, up to root on the host. MicroCloud is exposed when members join a cluster. Reported by the Incus project; no known exploitation.

CVE: CVE-2026-112816 (CVSS 10.0)

Do this today: Run sudo snap refresh lxd and sudo snap refresh microcloud, confirm the installed version actually changed, and restrict network access to the HTTPS API. Incus users should move to 7.6.0.

Source: The Hacker News

Cisco Talos found VOLTA-AUTODOXER, a Windows infostealer that harvests passwords, cookies, cards, crypto wallets, and Microsoft OAuth tokens, uses stolen Gmail sessions to confirm home addresses from receipts, and sends a dossier through OpenRouter to Claude, falling back to Kimi and Gemini on refusals, to rank what each victim is worth.

Do this today: Revoke and reissue Microsoft and Google sessions on machines that ran cracked or unknown software, and flag OpenRouter traffic from endpoints that shouldn't use it.

Sources: The Hacker News, WIRED

More from Matthew Chapman at mattchapman.net.

https://mattchapman.net

Support the show