OSINT / CyberSec report 05.11.2026 00:15

1. Google and partners disrupted the XCPE botnet, which infected 1.3 million Android TV set-top boxes and IoT devices via a backdoor, with manufacturer Videostrong allegedly running the operation (Dark Reading).

2. Google issued patches for critical Android flaw CVE-2026-58868, which allows remote code execution without user interaction on Android 14 through 17 (The Hacker News).

3. CISA added WordPress Core flaw CVE-2026-119977 to its Known Exploited Vulnerabilities catalog, citing active exploitation during software upgrades (The Hacker News).

4. Russian hackers used n-day exploits in zero-click attacks on iOS and Android devices via watering hole attacks on compromised and fake websites (BleepingComputer).

5. Binance revealed that a fake job interview and tampered Homebrew installation led to a 6.43 billion dollar theft of assets, attributed to North Korean hackers (The Hacker News).

6. Google warned that LLMjacking attacks are costing some enterprises up to 1 million dollars in fraudulent cloud AI charges (The Hacker News).

7. Russian police arrested three suspected VasyGrek hackers, also known as Fluffy Wolf, and dismantled their criminal infrastructure (The Hacker News).

8. Attackers exploited a critical Siemens SIMATIC IoT2050 flaw, CVE-2026-58115, to plant remote command backdoors on unpatched devices (The Hacker News).

9. Synology NAS devices are being targeted in ransomware attacks exploiting a DSM flaw patched in December 2024 (The Hacker News).

10. A 3AM ransomware affiliate hit a UK school estate, encrypting around 37 machines in a suspected AI-assisted attack (BleepingComputer).

11. The cPGuard update channel was hijacked to backdoor Linux servers and collect password hashes from customers (The Hacker News).

12. Barracuda disclosed two chained flaws, CVE-2026-116606 and a command injection, that could allow root access to devices (The Hacker News).

13. Red Hat patched a 9.8-rated Linux TCP RCE flaw, CVE-2026-98432, while Ubuntu fixes remain in testing (The Hacker News).

14. A Philippine government breach likely leaked migrant worker data in a 69GB exfiltration from the Overseas Employment Administration (Dark Reading).

15. Harvard University data breach exposed information of 851,000 accounts, according to Have I Been Pwned (BleepingComputer).

16. Chainstack reported a production systems breach exposing customer data and password hashes, linked to an AI-powered attack campaign (The Hacker News).

17. mSecure warned users to change passwords and reset 2FA after suspicious activity linked to its password manager app (The Hacker News).

18. European police arrested seven suspects and seized over 100 servers in an investment scam crackdown targeting fraudulent trading websites (BleepingComputer).