Apple has revealed that it plans to start checking public iCloud links for harmful content starting with iOS 27.3, iPadOS 27.3, macOS 27.3, and visionOS 27.3. The change specifically applies to scenarios where users share iCloud content, such as photos in iCloud Photos or files in iCloud Drive, by sharing a link and making it accessible to "Anyone with the link." When users choose this option,
DreamHost is warning of a data breach after attackers gained access to its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords. This follows the American web hosting provider and domain registrar's announcement that it suffered a cybersecurity incident requiring users to reset their email and FTP/SFTP passwords. In a data breach notification, DreamHost now says the breach extended from August 2026 to October 23, 2026, the day it was discovered. "We discovered that an unauthorized third party accessed the server that runs our web-based File Manager at files.dreamhost.com," reads the notification. "The unauthorized third party exploited a vulnerability in that software and was able to access the FTP/SFTP usernames and passwords of individuals who logged into this File Manager between approximately August 2026 and October 23, 2026."
The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game's PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data. According to a notice published on X, a client update was issued on November 4 at 02:30 (UTC +9) to address the issue. "We have identified an issue indicating that the PC Launcher's script files may have been tampered with by a third party," reads the statement on X. "Accordingly, client fixes and an update were implemented on November 4 at approximately 02:30 (UTC+9). We are currently investigating the scope of the impact caused by this issue, and we will provide further details regarding follow-up measures in a separate notice." Goddess of Victory: NIKKE is a popular sci-fi shooter RPG developed by the South Korean firm Shift Up for Windows, iOS, and Android.
A large-scale watering hole attack associated with Russian hackers has been targeting iOS and Android users visiting compromised sites or fake ones impersonating legitimate portals. The campaign used multiple high-profile websites in the U.S., Ukraine, the Czech Republic, and Bulgaria that delivered the same payload for profiling visitors and their devices. This initial stage allows the attacker to determine the browser version to deploy "platform-specific n-day exploit chains without user interaction." Researchers at cybersecurity company Sekoia attribute the operation with moderate-to-high confidence to APT29 (aka Midnight Blizzard), a Russian threat group that was recently linked to hotel WiFi attacks. Based on their findings, compromised legitimate sites belong to a Ukrainian gas producer, a U.S. chemical industry trade association, and a Bulgarian military-related site.
Cybersecurity researchers have disclosed details of an OpenAI Codex jailbreak bundle that's designed to modify an artificial intelligence (AI) agent's trusted instructions to insert advertisements for a third-party AI gateway. The phenomenon has been codenamed prompt adware by Check Point Research. Called Haiou (meaning Seagull in Chinese), the jailbreak modifies OpenAI Codex's configuration
A critical Android flaw could allow an attacker to run code on a phone without any user action remotely, Google said in its November security bulletin. The flaw, CVE-2026-58868, affects Android 14 through 17. Phones get the fix with security patch level 2026-11-01 or later, which phone makers and carriers send on their own schedules. As of November 4, Google's bulletin did not report
Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day. Companies can record costs as high as $1 million due to fraudulent calls using stolen API keys, researchers at Google's Threat Intelligence Group (GTIG) and Mandiant in analyzed incidents. Based on their observations, there are "two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure." The researchers identified two categories of threat actors: those who scan for publicly exposed LLM endpoints and those who steal valid API keys from unprotected machines. After gaining initial access, the attackers sell it to services known as LLM mixers, which provide their subscribers with unauthorized access to LLMs.
Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward for high-impact architectural security flaws. Starting this month, researchers can earn $250,000 for Root-in-Cloud bugs, including tenant-isolation bypasses and complex cross-service logic flaws that let attackers gain full administrative control over arbitrary Google Cloud organizations. "To earn this premier reward, you must demonstrate full administrative control, the equivalent of 'roles/owner' or complete IAM control, over arbitrary Google Cloud organizations or projects with no prior access or special project setup," said Chris Betz, Google Cloud's Chief Information Security Officer (CISO). "Additionally, valid vulnerability reports demonstrating remote code execution (RCE) in underlying Google production infrastructure (Borg) or achieving root-in-prod will automatically be evaluated by the Google Cloud VRP panel for root-in-cloud eligibility."
Hackers who breached Harvard University's Alumni Affairs and Development systems in November 2025 stole data linked to more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned. Harvard is a private Ivy League research university with over 20,000 faculty and staff, over 24,500 undergraduate and graduate students, and more than 400,000 alumni worldwide. As the university discovered on November 18, 2025, the attackers gained access to the personal information of students, alumni, donors, staff, and faculty members, including email addresses, telephone numbers, home and business addresses, event attendance records, donation details, and "biographical information pertaining to University fundraising and alumni engagement activities." However, Klara Jelinkova, Harvard's Vice President and University Chief Information Officer (CIO), said the breached IT systems didn't store Social Security numbers, passwords, payment card information, or financial information.
NIS2 Article 20 makes management bodies answerable for the access controls they approve, and boards are starting to ask for proof that those controls work. NIS2 board accountability gives directors a more direct role in cybersecurity. Under Article 20, the management bodies of essential and important entities must approve the cybersecurity risk-management measures required by the directive, oversee their implementation, and can be held liable for infringements, subject to national law. That obligation is live across most of the EU, with four member states going to the Court of Justice in July for failing to notify full transposition. Access control is one of the required measures. Directors are not expected to decide who gets administrator rights or review individual user accounts. They do, however, need to know that access is being controlled, that someone has responsibility for managing the risk, and that problems are being addressed. An estimated 160,000 entities fall within the scope of NIS2 across the EU. Approval is only part of the job Article 20 requires management bodies to both approve cybersecurity risk-management measures and oversee their implementation. It also requires the members of those bodies to undergo cybersecurity training, and to offer comparable training to employees on a regular basis. The measures themselves are set out in Article 21. They include access control policies and asset management, along with the use of multi-factor authentication or continuous authentication solutions where appropriate. Many organizations have traditionally left these decisions to security and IT teams. Under NIS2, the board still needs to know whether the measures it approved are being implemented. Day-to-day responsibility can remain with the CISO and IT teams. The difficulty comes when the person responsible for a risk does not control the budget, systems, or people needed to address it. Greece’s implementation goes further in defining who carries that responsibility. Its NIS2 law requires essential and important entities to appoint a suitably qualified member of their organization as an Information and Communication Systems Security Officer. The officer coordinates compliance, must have the resources needed to do the job, and operates independently of the company’s data protection officer. Access problems also need to reach the board in terms that it can act on. If an MFA rollout has failed or administrators have more access than they need, the board needs to understand the risk of leaving it unresolved. The CISO may be responsible for the risk without controlling the budget or teams needed to fix it. The board needs evidence Board reports often show what the access control policy requires, rather than whether it is being followed. For example, a company policy will likely require MFA and the removal of accounts when employees leave. However, the board also needs to know about the exceptions, including old accounts that remain active, excessive privileges, MFA exemptions that have never been reviewed, and suppliers whose access has outlasted their contracts. The board needs information about how the controls are working in practice. In a NIS2 access management report from European password and secrets manager Passwork, regulators from two national cybersecurity authorities and independent security leaders describe boards that have absorbed the liability change and now ask for proof that controls work, where they once accepted a summary of the policy. Organizations should be able to show who can access critical systems, why that access was granted, who approved it, how long it is valid, and when it was changed or revoked. The board needs to know whether that evidence exists and what it says about material access risk. Personal liability raises the stakes Implementation is still catching up in parts of Europe. In July 2026, the European Commission referred Ireland, Spain, France, and the Netherlands to the Court of Justice of the European Union for failing to notify full transposition of NIS2 into national law. The Commission also asked the Court to impose financial sanctions. For organizations in countries where NIS2 has been transposed, regulators have significant enforcement powers. For essential entities, member states must set a maximum fine of at least €10,000,000 or 2% of the global annual turnover, whichever is higher. Important entities are subject to a lower maximum threshold, of at least €7,000,000 or 1.4% of their global annual turnover, in a similar capacity. Article 32 also allows competent authorities, in specific circumstances, to seek the temporary prohibition of someone at CEO or legal representative level from exercising managerial functions in an essential entity. This can happen where enforcement action has failed to produce the required response. It is not an automatic consequence of a cyber incident. Article 20 separately requires member states to ensure that management bodies can be held liable for infringements of Article 21, subject to the applicable rules under national law. Approving the policy is not the end of the board’s involvement. It also needs information on whether the policy is being followed and what is happening with known problems. Verizon’s 2026 Data Breach Investigations Report found credential abuse somewhere in the chain of 39% of breaches, more than any other vector. Stolen credentials also circulate at scale, as the exposed database of 24 billion credential records reported in June showed. Directors should expect an answer on which accounts and credentials reach critical systems, who is responsible for them, and whether that access is being controlled. Give access risk an owner with authority CISOs briefing their boards should be able to say who owns access-control risk and whether that person has the authority to address it. The board also needs evidence of what is happening. When an access problem is identified, someone needs to be responsible for getting it fixed. That might mean removing unnecessary privileges or dealing with an MFA exception that has remained in place. If the fix depends on another team’s budget or resources, the board needs to know. Board reporting should show whether the controls it approved are working, flag significant exceptions that remain unresolved, and who is accountable for closing them. Author the author: Kirsten Doyle has spent 27 years writing about technology and has covered the industry through some of its most significant shifts. Her focus areas include cybersecurity, cloud, channel, enterprise IT, and data centre operations. She works across many formats: news, features, white papers, eBooks, and thought leadership. Kirsten has many years of experience in journalism and editing for both print and digital media, and has supported plenty of go-to-market and PR programmes with technically grounded writing that holds up to scrutiny. She is also a regular writer at Bora. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, NIS2)
Confirm this action.
Leaving now will discard your changes.