The daily cybersecurity brief
No. 253
15 stories 4 critical 6 min read Updated 06:30 IST
Top stories
- CISA Adds Multiple Exploited Vulnerabilities to KEV Catalog CISA added multiple vulnerabilities in Ivanti, GitLab, and Cisco to the KEV catalog due to active exploitation. Do this today Review all assets for Ivanti Connect Secure and GitLab instances for immediate patching. Read the full story ↓
- FBI Links $6.3B Binance Crypto Heist to North Korean Hackers North Korean group TraderTraitor is alleged by the FBI and industry experts to have stolen $6.3 billion from Binance. Read the full story ↓
- Hackers Compromise Ukrainian and Russian Emergency Alert Applications Hackers compromised air raid alert apps in Ukraine and Russia, distributing fake nuclear warnings. Do this today Verify all emergency alerts through multiple, trusted, non-digital channels. Read the full story ↓
From the editor
Defenders should prioritize Ivanti, GitLab, and Cisco vulnerabilities added to the KEV catalog. Additionally, monitor for activity related to the Binance crypto heist involving North Korean actors. Review security controls surrounding emergency alert applications.
Anmol Singh YadavEditor, PwnSpectrum
No stories match your search.
Actively Exploited 4
-
CISA Adds Multiple Exploited Vulnerabilities to KEV Catalog CISA added multiple vulnerabilities in Ivanti, GitLab, and Cisco to the KEV catalog due to active exploitation.
CISA added CVE-2026-111357, CVE-2026-118527, CVE-2026-97229, CVE-2026-76418 to the Known Exploited Vulnerabilities Catalog. These vulnerabilities affect Ivanti Connect Secure, GitLab, and Cisco products.
Why it matters. These vulnerabilities are actively exploited and pose significant risk, requiring immediate prioritization for remediation efforts.
Do this today Review all assets for Ivanti Connect Secure and GitLab instances for immediate patching.
- Affected
- Ivanti Connect Secure, GitLab Community Edition, GitLab Enterprise Edition, Cisco Secure Firewall ASA Software, Cisco Secure FTD Software
- CVE
- CVE-2026-111357, CVE-2026-118527, CVE-2026-97229
- Sat 31 OctCISA Adds Multiple Vulnerabilities to Known Exploited Catalog
- Sun 1 NovCISA Adds Multiple Vulnerabilities to KEV Catalog: Ivanti, GitLab, Cisco
- TodayCISA Adds Multiple Exploited Vulnerabilities to KEV Catalog
Also covered by BleepingComputer
{"coverage":1,"evidence":1,"freshness":0.034,"importance":1,"novelty":0.6,"quality":0.95,"total":0.858} -
Ivanti Patches Two Connect Secure Flaws Chained in Zero-Day Attacks Ivanti released patches for two additional Connect Secure flaws exploited in zero-day chains since October 1.
Ivanti released updates to patch two Connect Secure flaws, CVE-2026-111357 and CVE-2026-118527. These flaws were exploited in chains alongside CVE-2026-104935 to achieve root access. Threat actors were observed chaining these vulnerabilities to gain root-level code execution.
Why it matters. Exploitation allows attackers to gain root access, steal credentials, and probe internal networks on fully patched devices.
Do this today Apply security updates from Ivanti addressing CVE-2026-111357 and CVE-2026-118527.
- Affected
- Ivanti Connect Secure (ICS) VPN appliances
- Sat 31 OctIvanti Connect Secure: Zero-Day Exploitation for Root Access
- TodayIvanti Patches Two Connect Secure Flaws Chained in Zero-Day Attacks
Summarised from BleepingComputer; also covered by GBHackers.
{"coverage":0.613,"evidence":0.9,"freshness":0.094,"importance":1,"novelty":0.6,"quality":0.95,"total":0.781} -
GitLab Vulnerability (CVE-2026-97229) Exploited in RCE Attacks Unpatched GitLab servers are vulnerable to an actively exploited RCE flaw via CI/CD regular expression parsing.
An integer overflow weakness in the CI/CD Regular Expression Compiler allows unauthenticated remote code execution. CISA added CVE-2026-97229 to the KEV Catalog due to active exploitation.
Why it matters. Exploitation allows unauthenticated users to execute arbitrary code on the GitLab server. Over 1,000 exposed servers have been tracked as vulnerable to this flaw.
Do this today Upgrade self-managed GitLab installations to versions 19.4.2, 19.3.5, or 19.2.8.
- Affected
- GitLab Community Edition (CE) and Enterprise Edition (EE) versions prior to 19.4.2, 19.3.5, and 19.2.8
Summarised from BleepingComputer.
{"coverage":0.387,"evidence":0.9,"freshness":0.712,"importance":0.75,"novelty":1,"quality":0.95,"total":0.774} -
Chainalysis Discloses Data Breach from Offensive Agentic Techniques Chainalysis experienced a data breach exposing customer names, emails, and user IDs via offensive agentic techniques.
Chainalysis disclosed unauthorized access to its internal systems using offensive agentic techniques. The exposed data includes customer names, email addresses, user IDs, and organizational role labels. The company stated there was no evidence of unauthorized access to investigation content or authentication credentials.
Why it matters. Defenders should treat credential exposure as a high risk, even if the vendor claims investigation content was safe. Monitor for impersonation attempts targeting customers of the affected firm.
Do this today Advise customers to enable two-factor authentication and monitor for unexpected password reset requests.
- Sun 1 NovChainalysis Discloses Data Breach from Offensive Agentic Techniques
- TodayChainalysis Discloses Data Breach from Offensive Agentic Techniques
Summarised from BleepingComputer; also covered by SecurityWeek, The Hacker News.
{"coverage":0.898,"evidence":0.9,"freshness":0.184,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.758}
commonly target cryptocurrency and financial organizations, information technology companies and software supply chains, government entities, and education-related organizations.
Vulnerabilities & Patches 3
-
Node-RED Vulnerability Exploited for Linux Malware Delivery Unauthenticated remote attackers exploit Node-RED to run system commands and deploy Linux malware.
Unknown actors exploited a maximum-severity vulnerability in Node-RED, a flow-based programming tool used in OT environments. The vulnerability allows unauthenticated access to programming nodes, enabling the execution of system commands. This was used to deploy a flow that downloads and runs a Linux bot.
Why it matters. Exploitation of this vulnerability allows remote attackers to compromise devices running Node-RED, potentially impacting physical processes in ICS/OT environments.
Do this today Check if Node-RED is reachable from outside the network and apply available updates.
- Affected
- Node-RED
Summarised from The Register.
{"coverage":0.387,"evidence":0,"freshness":0.944,"importance":0.75,"novelty":1,"quality":0.85,"total":0.562} -
INFINITT PACS System Manager: Code Execution via Update Manifest and URI Scheme System Manager versions 3.0.11.3 and 3.0.11.5 contain RCE flaws via update manifest and imodular URI.
Two vulnerabilities were identified in INFINITT PACS System Manager. CVE-2026-16305 allows a local, low-privileged attacker to execute administrative commands via an improperly protected update manifest. CVE-2026-16306 permits code execution via an unsafe command dispatch through the imodular:// URI scheme.
Why it matters. Exploitation of CVE-2026-16305 grants administrative code execution locally. Exploitation of CVE-2026-16306 may allow remote code execution with the affected user's privileges and unauthorized outbound connections.
Do this today Upgrade System Manager to version 3.0.12.3 or 3.0.12.5.
- Affected
- INFINITT PACS System Manager versions 3.0.11.3 and 3.0.11.5
- CVE
- CVE-2026-16305, CVE-2026-16306
{"coverage":0.387,"evidence":0,"freshness":0.771,"importance":0.75,"novelty":1,"quality":0.9,"total":0.55} -
Langflow Flaws Allow Unauthenticated Remote Code Execution Two critical flaws in Langflow allow unauthenticated remote code execution via the open-source AI agent tool.
Two critical flaws were identified in Langflow, an open-source tool for building AI agents and workflows. These flaws permit a remote attacker to run arbitrary code without authentication.
Why it matters. Exploitation allows unauthorized code execution on affected servers. This risk applies to all versions prior to the patched release.
Do this today Upgrade Langflow to version 1.13.0.
- Affected
- Langflow versions 1.0.0 through 1.12.8
{"coverage":0.387,"evidence":0,"freshness":0.694,"importance":0.75,"novelty":1,"quality":0.8,"total":0.532}
Threat Actors & Campaigns 4
-
Hackers Compromise Ukrainian and Russian Emergency Alert Applications Hackers compromised air raid alert apps in Ukraine and Russia, distributing fake nuclear warnings.
Hackers compromised the Ukrainian Air Alert app, sending false radiation and chemical hazard warnings. Subsequently, a group claimed responsibility for breaching Russia's EMERCOM mobile app to distribute false nuclear launch warnings.
Why it matters. These incidents demonstrate the risk of critical public warning systems being used for disinformation campaigns, potentially causing public panic.
Do this today Verify all emergency alerts through multiple, trusted, non-digital channels.
- Affected
- Ukrainian Air Alert app, Russian EMERCOM mobile app
Also covered by GBHackers, r/netsec
{"coverage":0.613,"evidence":0,"freshness":0.686,"importance":0.75,"novelty":1,"quality":0.95,"total":0.581} -
Threat Actors Hijack LLMs via Credential Theft (LLMJacking) Threat actors are stealing cloud identity tokens and LLM API keys to generate massive fraudulent cloud charges.
Threat actors are executing LLMJacking by targeting backend LLM resources rather than front-end chatbots. Initial access is predominantly achieved through stolen cloud identity tokens, such as IAM credentials or Service Account keys. These credentials allow attackers to generate large spikes in fraudulent cloud charges.
Why it matters. This activity can result in rapid, high-volume financial loss from cloud providers. Attackers are using stolen credentials to bypass MFA and establish persistence.
Do this today Review and restrict permissions on all LLM API keys and cloud identity tokens; enforce MFA and monitor for unusual API request volume spikes.
{"coverage":0.387,"evidence":0,"freshness":0.737,"importance":0.75,"novelty":1,"quality":0.95,"total":0.552} -
India-linked Group Uses Windows Functionality in South Asia Espionage An India-linked threat group is conducting cyber espionage campaigns in South Asia using legitimate Windows functionality.
An India-linked threat group is conducting cyber espionage campaigns targeting organizations in South Asia. The group utilizes legitimate Windows functionality across three distinct attack chains.
Why it matters. Defenders should monitor for indicators of compromise related to the misuse of native Windows system features for espionage activities.
{"coverage":0.387,"evidence":0,"freshness":0.737,"importance":0.75,"novelty":1,"quality":0.85,"total":0.542} -
DarkBlinders Compromises Israeli and Iraqi Kurdish Government Cloud Environments An Iran state-aligned actor compromised Israeli and Iraqi Kurdish government cloud environments between August and October 2026.
Researchers disclosed a cyber espionage campaign conducted by an Iran state-aligned actor. The campaign targeted Israel and the Kurdistan Region of Iraq. Compromises affected a high-profile individual and a government cloud environment.
Why it matters. Defenders should monitor for indicators of compromise related to state-sponsored espionage activity in these regions.
- Affected
- Israeli and Iraqi Kurdish government cloud environments
{"coverage":0.387,"evidence":0,"freshness":0.752,"importance":0.75,"novelty":1,"quality":0.8,"total":0.538}
Breaches & Incidents 4
-
FBI Links $6.3B Binance Crypto Heist to North Korean Hackers North Korean group TraderTraitor is alleged by the FBI and industry experts to have stolen $6.3 billion from Binance.
Binance confirmed a $6.3 billion cyber heist attributed to North Korea. The FBI linked the theft to state-sponsored hackers known as TraderTraitor. Binance traced the breach to a compromised laptop belonging to a company engineer.
Why it matters. The incident confirms North Korea's ongoing, large-scale targeting of the cryptocurrency sector. The attack vector involved internal system access via a compromised endpoint.
- Sat 31 OctBinance Hacked: $6.3 Billion Theft Linked to North Korea
- Mon 2 NovBinance Hack Linked to North Korean Group TraderTraitor
- TodayFBI Links $6.3B Binance Crypto Heist to North Korean Hackers
Summarised from The Record; also covered by BleepingComputer.
{"coverage":1,"evidence":0,"freshness":0.068,"importance":1,"novelty":0.6,"quality":0.95,"total":0.612} -
Binance Breach Linked to Compromised DevOps Laptop A compromised employee laptop enabled access leading to a significant cryptocurrency loss event at Binance.
Binance attributed a $6.3 billion loss to a compromised DevOps laptop. The incident reportedly allowed access to a service container involved in withdrawals. Binance froze assets and began phased withdrawal restoration.
Why it matters. The incident demonstrates that weak system separation and inadequate internal controls can lead to systemic financial loss from a single endpoint compromise.
Do this today Review and segment access controls for DevOps and administrative workstations.
- Affected
- Binance
Also covered by CSO Online
{"coverage":0.613,"evidence":0,"freshness":0.707,"importance":0.75,"novelty":1,"quality":0.85,"total":0.573} -
Hackers Claim Cyberattack on Russia's Federal Statistics Agency (Rosstat) Belarusian and pro-Ukrainian hackers claimed to conduct a destructive cyberattack on Rosstat, stealing data.
An alliance of Belarusian and pro-Ukrainian hackers claimed responsibility for a cyberattack on Rosstat. The groups stated they spent months inside the network before launching an operation that wiped servers and disrupted systems. Rosstat confirmed being targeted but disputed claims of data leakage or database compromise.
Why it matters. The claimed scope of the breach involves sensitive government data, including demographic records and information from occupied territories. Independent verification of the alleged theft and destruction is not possible.
- Affected
- Rosstat
{"coverage":0.387,"evidence":0,"freshness":0.789,"importance":0.75,"novelty":1,"quality":0.95,"total":0.557} -
Binance Cyberattack: Theft of $6.3 Billion in Digital Assets Binance suffered a cyberattack resulting in the theft of approximately $6.3 billion in digital assets.
Attackers compromised a DevOps engineer’s laptop and abused internal wallet infrastructure. This activity was used to authorize unauthorized withdrawals from the exchange.
Why it matters. The incident represents one of the largest recorded cryptocurrency thefts. The activity is linked to a North Korean group.
{"coverage":0.387,"evidence":0,"freshness":0.778,"importance":0.75,"novelty":1,"quality":0.9,"total":0.551}
CVE spotlight
| CVE | Affects | CVSS | EPSS | Status |
|---|---|---|---|---|
| CVE-2026-111357 | Ivanti Connect SecureIvanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege e… | 7.0 | 1% | Exploited (KEV)CISA due 2 Nov (passed) |
| CVE-2026-97229 | GitLab Community Edition and Enterprise EditionGitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 th… | 10.0 | 27% | Exploited (KEV)CISA due 1 Nov (passed) |
Quiz
Yesterday's answer
According to the news story, what action was taken to address the critical RCE flaw in WordPress Core?
WordPress released version 7.1.4 on October 28, 2026.
The story explicitly states that WordPress released version 7.1.4 to address the flaw.
Today's question
According to the text, which products are affected by the newly added vulnerabilities in the KEV Catalog?
Locked in. The answer is in tomorrow's brief.
On the radar tomorrow
- Patch Tuesday in 7 daysTuesday 10 November
- WatchingMalicious Claude Code extension on Cursor planted SSH backdoors
- WatchingCritical Linux kernel flaw allows remote root attacks on MPTCP servers
Also worth your time
Tools
- agent-infra/sandboxProvides a unified, containerized environment combining browser, shell, file system, and code execution for testing AI a…
- QuantumNous/new-apiProvides a self-hosted gateway to manage and route requests across multiple large language model APIs.
- fush520/fush-vue-mcpProvides a framework for Vue frontend reverse engineering and web security testing via a Chrome extension and backend se…
- Jamalofski/php-eol-securityProvides unofficial Windows builds of end-of-life PHP versions with backported security fixes for testing.
Community
- CPGuard / OPSSHIELD LLP Breach
- Jailbreaking my car's navigation system just so I can change the time
- Fake Nuclear Alert Sent Through Russian Emergencies Ministry App After Hack
- Securing Internet-Critical Software: How We Could Have Backdoored Bash
- Remote code execution on Linux systems with multipath TCP
- WordPress pingback and Brotli RCE
Podcasts
- 181: Ricky
- Snake Oilers: Minimal.dev, Request Rocket and TRM Labs
- SN 1102: A Strategic Plug Pull - Lessons From a Global Patch-and-Panic Fire Drill
- SANS Stormcast Monday, November 2nd, 2026: OneNote Bulk Extraction; Trojanized Claude Code Extension in Cursor Marketplace; Ivanti Connect Secure Zero-Days (CVE-2026-111357); Android SMS of Death
And finally
Exploitation Trends: Analyzing Common Vulnerabilities in Real-World Attacks
Microsoft analyzed real-world attacks, showing exploitation concentrates on a small subset of CVEs. This suggests a focus for vulnerability prioritization efforts.
Microsoft Security
End of No. 253
That's today's brief.
On the radarPatch Tuesday in 7 days: Tuesday 10 November
The next brief lands at 06:30 IST.