Wednesday 4 November 2026

BlackX UEFI bootkit infects fully patched Windows machines

The BlackX UEFI bootkit exploits unclear Microsoft guidance on Secure Boot protections, so fully patched Windows PCs can still be infected.

Affects: Windows machines with Secure Boot

WordPress core race-condition flaw exploited, CISA sets 6 November deadline

CISA lists a WordPress core race-condition flaw (CVE-2026-119977) as actively exploited. Unauthenticated attackers may be able to run code on the server during the upgrade window.

Affects: WordPress core sites

cPGuard update channel hijacked to backdoor Linux servers

On 2 November an attacker broke into cPGuard's update system and pushed a malicious script. It installed a backdoor and collected password hashes and other sensitive files from customer servers.

Affects: Linux servers running cPGuard that updated since 2 November

Linux kernel TCP use-after-free flaw (9.8) patched on Red Hat, Ubuntu pending

A critical use-after-free in the kernel's IPv4 TCP code is fixed for RHEL 8, 9 and 10. Ubuntu's fixes for its three newest LTS releases are only in the opt-in testing channel, with no regular release date.

Affects: RHEL 8/9/10 and the three newest Ubuntu LTS releases

mSecure password manager tells users to reset passwords, 2FA and passkeys

mSecure emailed customers on 3 November after suspicious activity, urging them to change passwords, reset two-factor authentication and remove passkeys. The vendor hasn't said what was compromised.

Affects: mSecure password manager users

Synology NAS devices hit by ransomware via old DSM flaw

Synology says attackers are exploiting a DSM vulnerability patched in December 2024 to hit NAS devices with ransomware. Unpatched client NAS boxes are the target.

Affects: Synology NAS devices running outdated DSM

Cisco Secure Email Gateway flaw allows unauthenticated root command execution

A flaw in email parsing in Cisco AsyncOS lets a remote, unauthenticated attacker run commands as root on the underlying system. Cisco has published an advisory.

Affects: Cisco Secure Email Gateway (AsyncOS)

Barracuda flaws can be chained to gain root on devices

Barracuda disclosed two vulnerabilities, a pre-authentication authorisation bypass and a second flaw. Chained, they give an attacker root access to a vulnerable device. Barracuda is urging customers to patch.

Affects: Susceptible Barracuda appliances

Max-severity Siemens IoT2050 flaw exploited to plant backdoors

VulnCheck says attackers are exploiting a missing-authentication flaw (CVE-2026-58115, CVSS 10.0) in Siemens SIMATIC IoT2050 devices. It drops a Linux bot and backdoors, and also affects Node-RED.

Affects: Siemens SIMATIC IoT2050 Advanced and exposed Node-RED servers

LLMjacking: stolen cloud AI access racks up $100,000+ daily bills

Google warns criminals are hijacking cloud accounts to run LLMs at the victim's expense. Some organisations have lost more than $100,000 a day, up to $1 million in total.

Affects: Organisations with cloud AI services and exposed credentials

Chinese hackers use open-source ARTEX AI tool against 200+ organisations

Chinese hackers used ARTEX, an open-source multi-agent AI penetration-testing framework, against over 200 organisations in 14 countries. It has since spread to another China-linked group.

Affects: Organisations across 14 countries

Android TV box botnet hit Australia; Google cuts off vendor

Researchers say the Videostrong-linked XPCE botnet hit Android TV boxes in Australia. Google dismantled it, with over 1.3 million devices used as proxies and for ad fraud.

Affects: Android TV set-top boxes from Videostrong

Binance: fake job interviews and tampered Homebrew led to $6.4B theft

Binance says the record theft followed a multi-stage campaign using recruitment-themed social engineering and a tampered Homebrew install. The FBI blames North Korean hackers.

Affects: Developer and engineering staff targeted by fake recruiters