AX·NEWS
Sign in

Cybersecurity

Cybersecurity news — Monday 02 November 2026

67 stories from 10 sources, every one in English. Each links to its publisher.

Open in the live feedRSS feedOn a TV

  1. Google shuts down global botnet running on certified Android devices
    USCyberScoop

    Google and an assortment of partners shut down a botnet that an approved Android device manufacturer purposefully deployed across more than 1.3 million TV set-top boxes, the company said Monday. Videostrong Technology Co., a China-based…

  2. Chinese hackers use ARTEX AI in automated attacks against 200 orgs
    USBleepingComputer

    Chinese hackers used ARTEX, an open-source, multi-agent AI penetration-testing framework, in attacks against more than 200 organizations across 14 countries. [...]

  3. Business groups mount fresh campaign for long-term renewal of information sharing law
    USCyberScoop

    Major industry groups are clamoring for Congress to include a 10-year extension of a law that they say is essential to cyber threat information sharing in the annual defense policy bill. Congress has mixed a series of short-term renewals…

  4. Fintech platform Sageworks taken offline after suspected cyberattack
    USBleepingComputer

    Financial technology company Abrigo has restored its Sageworks risk management application, except for borrower-facing capabilities, following an outage triggered by "irregular activity" in its environment. [...]

  5. Google disrupts million-device XCPE Android malware botnet, bans TV box maker
    USBleepingComputer

    Google and industry partners have dismantled the XCPE malware botnet consisting of more than 1.3 million Android TV streaming TV boxes that Google says its manufacturer intentionally infected with malware to generate revenue through…

  6. OpenAI will merge ChatGPT’s chat and work tabs – here’s when, and what to expect
    USZDNet Security

    On the heels of Anthropic’s similar move, the change will be tested among select users before being rolled out.

  7. Athenahealth patients can ask Claude about their medical records now
    USZDNet Security

    The partnership could provide one of the nation’s largest AI companies with a bevy of personal medical data.

  8. Don’t want a touchscreen? All premium MacBook Pros could have one soon, reports say
    USZDNet Security

    New reports indicate the touchscreens are to become the standard on premium MacBook Pros.

  9. Firefox’s new Mini Window is every multitasker’s dream – Chrome can’t do this
    USZDNet Security

    The open-source browser’s newest feature lets you pop out a page – or part of a page – into its own mini window. See why this is incredibly cool.

  10. ⚡ Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, Android Spyware and More
    INThe Hacker News

    Some attacks this week didn't need much of a trick. A fake support call, a trusted extension, a shared link, or a device with no password. Small things that people barely think about. Yet each was enough to cause serious trouble. Then…

  11. Samsung’s Privacy Display may be coming to more Galaxy phones – what we know
    USZDNet Security

    Privacy Display on the Galaxy S26 Ultra was a big hit in our hands-on. Now, we may see it roll out to more Galaxy phones.

  12. Apple’s HomeView may double as security camera – watch out Ring, Nest, and Wyze
    USZDNet Security

    HomeView settings reveal potential video recording and streaming options alongside privacy features.

  13. 50 AI agents tried to build a thriving Minecraft civilization – it didn’t end well
    USZDNet Security

    It turns out even bots can’t escape bureaucracy.

  14. Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access
    INThe Hacker News

    A botnet of more than 1.3 million Android devices, mostly TV set-top boxes, lost control of its servers in late October in a takedown led by Google. Google says it is highly confident that device maker Videostrong intentionally put a…

  15. BTCPay Server warns of hot wallet thefts targeting outdated instances
    USBleepingComputer

    The maintainer of BTCPay Server, an open-source cryptocurrency payment processor, has urged users to install the latest version as hackers have been draining "hot wallets" on instances running older versions. [...]

  16. Cybersecurity M＆A Roundup: 37 Deals Announced in October 2026
    USSecurityWeek

    Significant cybersecurity deals were announced by Absolute Security, Aikido, Anthropic, Cohere, Hex-Rays, and Proofpoint. The post Cybersecurity M&A Roundup: 37 Deals Announced in October 2026 appeared first on SecurityWeek .

  17. Your Mobile Carrier Stores Your Call Logs for Years
    USBleepingComputer

    Mobile carriers can retain years of call and text metadata, exposing sensitive details about customers' relationships, locations, and daily routines if breached. Cape examines the privacy risks of long-term telecom data retention and how…

  18. Mutipath TCP: Use and Detection, (Mon, Nov 2nd)
    USSANS ISC

    Last week, an often-ignored TCP option, introduced in 2020, made the news due to a new vulnerability in Linux's implementation (RFC 8684, CVE-2026-98432)

  19. DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment
    INThe Hacker News

    Cybersecurity researchers have disclosed details of a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026. According to a report published by…

  20. Florida Student Aid Website Hack Puts Data of 4.9 Million People at Risk
    USSecurityWeek

    The Florida Department of Education says SSNs and other personal data may have been exposed in a breach of its financial aid website. The post Florida Student Aid Website Hack Puts Data of 4.9 Million People at Risk appeared first on…

  21. Hackers disrupt refrigeration systems at European supermarkets
    USBleepingComputer

    A cyberattack on refrigeration systems has disrupted stores run by multiple supermarket chains across several European countries after hackers remotely changed temperature settings on freezers and cooling systems. [...]

  22. 5 stars for sale: Inside the underground fake review trade
    USMalwarebytes Labs

    Recently, our team exposed sophisticated scam kits designed to steal sensitive data and trick consumers. But underground marketplaces are not just for malware and stolen passwords. They also offer services designed to manipulate your…

  23. Applebee’s customer data exposed by password left in app
    USMalwarebytes Labs

    Applebee’s has fixed a security flaw that exposed customers’ personal information after a researcher discovered a database password embedded in the restaurant chain’s Android app. The researcher, Robert Wiggins, found the password with…

  24. Microsoft fixes Smart App Control broken by October Windows update
    USBleepingComputer

    Microsoft has resolved a known issue that prevented some users from activating the Smart App Control security feature after installing the October 2026 KB5127648 Windows 11 security update. [...]

  25. Revolve Data Breach Impacts at Least 180,000 People
    USSecurityWeek

    Hackers accessed its online shopping platform and stole customers’ personal and payment card information. The post Revolve Data Breach Impacts at Least 200,000 People appeared first on SecurityWeek .

  26. Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward
    USSecurityWeek

    The top payout is for high-impact architectural research demonstrating full administrative control. The post Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward appeared first on SecurityWeek .

  27. Over 1,000 GitLab servers vulnerable to ongoing RCE attacks
    USBleepingComputer

    Over 1,000 Internet-exposed GitLab servers are still unpatched against a maximum-severity flaw actively exploited in remote code execution attacks. [...]

  28. AI Vulnerability Finding
    USSchneier on Security

    A comment : 3% of ‘critical’ software security bugs, in all of recorded history, have been found in the last month. This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total Do…

  29. Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers
    INThe Hacker News

    Two critical flaws in Langflow could let a remote attacker with no account bypass authentication or run arbitrary code, IBM said last week. Langflow is an open-source tool for building AI agents and workflows, and its vulnerability reports…

  30. Is Your SOC Ready for AI Agents? A Maturity Check Before You Deploy
    INThe Hacker News

    Forty percent of security teams now use AI every day, and another 56% are testing it. Only 4% have no plans to adopt it, according to Prophet Security's State of AI in Security Operations 2026 survey of more than 250 CISOs, SOC leaders and…

  31. Malicious Claude Code Extension Served in Cursor Supply Chain Attack
    USSecurityWeek

    The extension performed host reconnaissance and attempted to create a reverse SSH tunnel. The post Malicious Claude Code Extension Served in Cursor Supply Chain Attack appeared first on SecurityWeek .

  32. Synology warns of C3RB3R ransomware attacks targeting NAS devices
    USBleepingComputer

    Taiwanese network-attached storage (NAS) appliance maker Synology warned customers to update their devices immediately due to a surge in C3RB3r ransomware attacks. [...]

  33. Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data
    INThe Hacker News

    Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged…

  34. Could Nick Andersen’s leadership outlast the clock on his acting role?
    USCyberScoop

    The clock is running out on Nick Andersen’s time to serve as acting director of the Cybersecurity and Infrastructure Security Agency, but there appear to be efforts afoot to keep him in the role for longer, with no permanent nominee in…

  35. Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts
    INThe Hacker News

    Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed by Palo Alto…

  36. Chainalysis Discloses Data Breach Following AI-Driven Cyberattack
    USSecurityWeek

    The attackers used offensive agentic techniques to access the company’s systems and internal tools. The post Chainalysis Discloses Data Breach Following AI-Driven Cyberattack appeared first on SecurityWeek .

  37. Ivanti patches two more Connect Secure zero-days chained in attacks
    USBleepingComputer

    Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1. [...]

  38. Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack
    USSecurityWeek

    DebugBear says its DNS records were compromised via its domain registrar, and early findings show a single customer was targeted. The post Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack appeared first on…

  39. FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist
    USSecurityWeek

    The FBI has officially pinned the $6 billion Binance hack on North Korea’s TraderTraitor as the attackers launder the stolen crypto. The post FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist appeared first on SecurityWeek .

  40. A week in security (October 26 – November 1)
    USMalwarebytes Labs

    Last week on Malwarebytes Labs: Fake PDF and search tools hijacked searches for 13.4 million Chrome users Photo ID, bank checks, face scan? The UK’s age-check options Binance hit by largest-ever crypto theft, with $6.3 billion stolen…

  41. Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
    USSecurityWeek

    CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks. The post Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain appeared first on…

  42. What Makes a Good Security Agent? 5 Lessons from the AgentWorks Hackathon
    USCrowdstrike Blog
  43. New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value
    INThe Hacker News

    Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value. Like other typical…

  44. Towards Elastic Least Privilege for Agent Planning
    USarXiv cs.CR (Security)

    arXiv:2610.40981v1 Announce Type: new Abstract: General-purpose AI agents require authority that changes between tasks and during execution. Common deployments trade broad permissions that expose unnecessary authority and narrow…

  45. An Incentive-Aligned Trust-Centric Coordination Layer for Heterogeneous Blockchain Interoperability
    USarXiv cs.CR (Security)

    arXiv:2610.41032v1 Announce Type: new Abstract: The interoperability between permissioned and public blockchains is hampered by asymmetric privacy, trust, and governance assumptions. We propose a coordination architecture that decouples…

  46. AgentShield: Fortifying Web Applications Against AI Agents and Agentic Browsers
    USarXiv cs.CR (Security)

    arXiv:2610.41181v1 Announce Type: new Abstract: LLM-powered browser agents are transforming web automation by autonomously interacting with websites and executing complex workflows. However, the effectiveness of existing anti-bot defenses…

  47. Efficient cross-domain multi-factor authentication
    USarXiv cs.CR (Security)

    arXiv:2610.41342v1 Announce Type: new Abstract: Secure cross-domain authentication is crucial for protecting information exchange across terminals in different security domains. However, existing cross-domain authentication models suffer…

  48. GESIS Surf: An Open-Source Infrastructure for Privacy-Preserving Longitudinal Web Browsing Data Collection
    USarXiv cs.CR (Security)

    arXiv:2610.41441v1 Announce Type: new Abstract: Understanding how people navigate digital media environments requires behavioral data beyond survey self-reports. However, existing infrastructures for collecting such data reproducibly…

  49. Fooling Relying Parties of the EUDI Wallet Architecture: Credential Pooling Attacks and CRESTA, a Standard-Compliant Countermeasure
    USarXiv cs.CR (Security)

    arXiv:2610.41655v1 Announce Type: new Abstract: The European Digital Identity (EUDI) Wallet will let millions of EU citizens prove who they are and what they are entitled to, disclosing only what is needed. Many services need several…

  50. Beyond Smart Homes: Characterizing IoT Vulnerabilities Across Sectors, Vendors, and Products
    USarXiv cs.CR (Security)

    arXiv:2610.42032v1 Announce Type: new Abstract: The Internet of Things (IoT) has expanded beyond consumer smart homes to sectors, such as industrial systems, healthcare, and smart cities, broadening the IoT attack surface. Prior empirical…

  51. Reparo: Synthesizing and Validating Access Control Policies
    USarXiv cs.CR (Security)

    arXiv:2610.41800v1 Announce Type: cross Abstract: Writing correct access control policies for software applications is difficult because it requires expertise in the authorization language and a thorough understanding of the application's…

  52. From Concept to Measurement: A Survey of How the Blockchain Trilemma Can Be Analyzed
    USarXiv cs.CR (Security)

    arXiv:2505.03768v5 Announce Type: replace Abstract: The blockchain trilemma provides an analytical lens for examining trade-offs among degree of decentralization (DoD), scalability, and security in blockchain systems. However, different…

  53. Watermark Robustness and Radioactivity May Be at Odds in Federated Learning
    USarXiv cs.CR (Security)

    arXiv:2510.17033v2 Announce Type: replace Abstract: Federated learning (FL) enables fine-tuning large language models (LLMs) across distributed data sources. As these sources increasingly include LLM-generated text, provenance tracking…

  54. Multimodal User Authentication via Keystroke-Triggered Fusion of Glove-Based Finger Pressure and Hand Kinematics
    USarXiv cs.CR (Security)

    arXiv:2607.24747v2 Announce Type: replace Abstract: Keystroke dynamics constitute a cost-effective behavioral biometric, but their timing features degrade under environmental and hardware variation. We replace these features with 19…

  55. LiHA: Worse is Better for Lightweight Hash-based Source Authentication
    USarXiv cs.CR (Security)

    arXiv:2610.40928v1 Announce Type: new Abstract: The omission of source IP authentication remains a fundamental vulnerability in the Internet. Existing approaches rely on routing plausibility, topology assumptions, per-flow state, or wide…

  56. Adaptive Dynamic Security for Operational Technology Against AI-Powered Attacks
    USarXiv cs.CR (Security)

    arXiv:2610.41007v1 Announce Type: new Abstract: Operational technology now faces attackers whose tempo is set by AI. We present ADS-OT, an adaptive dynamic security framework modelling defensive posture as a partially observable decision…

  57. Closing the Applied Cybersecurity Gap in Critical Infrastructure: A Cyber-to-Physical Security Assessment Framework for Water Systems
    USarXiv cs.CR (Security)

    arXiv:2610.41050v1 Announce Type: new Abstract: The integration of information technology and operational technology in water infrastructure creates pathways through which cyber compromise may affect physical service delivery. This study…

  58. Evaluating Structural and SAT Attack Resilience in Cryptographic Dynamic Logic Locking via Keystream Capping
    USarXiv cs.CR (Security)

    arXiv:2610.41083v1 Announce Type: new Abstract: Untrusted third-party entities throughout the semiconductor supply chain expose proprietary hardware intellectual property to reverse engineering, piracy, and overproduction. While logic…

  59. Who Swept My ETH? Uncovering EIP-7702-Based Ether Redirection Attacks on Ethereum
    USarXiv cs.CR (Security)

    arXiv:2610.41153v1 Announce Type: new Abstract: EIP-7702 introduces a new transaction type that allows Externally Owned Accounts (EOAs) on major EVM-compatible chains to delegate execution to arbitrary contract codes temporarily. While…

  60. PP-Mark: Provable and Publicly Verifiable Watermarking for Generative AI
    USarXiv cs.CR (Security)

    arXiv:2610.41170v1 Announce Type: new Abstract: Generative AI models now produce images indistinguishable from real data, making publicly verifiable provenance essential; however, existing watermarking methods become vulnerable to…

  61. OrionLink: Single Sign-On with Oblivious Identity Brokers
    USarXiv cs.CR (Security)

    arXiv:2610.41323v1 Announce Type: new Abstract: Single Sign-On (SSO) is a federated authentication mechanism that improves user experience by enabling access to multiple services, or Relying Parties (RPs), through a single authentication…

  62. BlindStep: A Secure One-Step Kernel for Privacy-Preserving Collaborative Reasoning
    USarXiv cs.CR (Security)

    arXiv:2610.41369v1 Announce Type: new Abstract: A recurring step in two-party collaborative workflows combines a private candidate frontier with a partner's compatible evidence, scores the resulting candidates, and retains only a small…

  63. Poly Versus Polyval
    USarXiv cs.CR (Security)

    arXiv:2610.41565v1 Announce Type: new Abstract: We revisit the basic construction of polynomial evaluation based hash function, which we call Poly, over binary extension fields over $GF(2^n)$, where $n=64k$ and $k\geq 2$. Unlike GHASH, the…

  64. Coupled or Independent? Fault Coupling in Agentic Medical Vision Systems
    USarXiv cs.CR (Security)

    arXiv:2610.40913v1 Announce Type: cross Abstract: Vision-language agents equipped with tools expose intermediate outputs for inspection and comparison with the model's reasoning, which may offer safety benefits over single-shot models…

  65. Group Physical-Layer Authentication and Confidential Beamforming in Non-Terrestrial Networks
    USarXiv cs.CR (Security)

    arXiv:2610.41579v1 Announce Type: cross Abstract: Coordinated high-altitude platform station (HAPS) networks need to authenticate group responses and protect private data under shared power constraints. This paper studies joint group…

  66. Does Showing Agents the Privilege of Their Tools Reduce Over-Privileged Tool Selection?
    USarXiv cs.CR (Security)

    arXiv:2610.40975v1 Announce Type: new Abstract: When several tools can complete a task, an agent that picks the most powerful one holds more authority than the task needs. Recent work demonstrates that language-model agents do this often…

  67. ISC Stormcast For Monday, November 2nd, 2026 https://isc.sans.edu/podcastdetail/10160, (Mon, Nov 2nd)
    USSANS ISC