France's national blood service has confirmed that a cyberattack targeting a refrigeration equipment provider raised temperature and defrost settings at three of its facilities, threatening stored blood products. The French Blood Establishment (Établissement français du sang or EFS), which manages blood collection, processing, and distribution across France, said the incident occurred on November 2 and affected systems used to monitor and control cold-storage chambers. According to a statement published on November 3, EFS was not directly targeted in the cyberattack, but was instead its refrigeration supplier. While EFS has not named the affected supplier, European refrigeration equipment provider Coolworld Rentals confirmed in a statement that a cybersecurity incident involving remote monitoring software had affected a limited number of its refrigeration units.
The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game's PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data. According to a notice published on X, a client update was issued on November 4 at 02:30 (UTC +9) to address the issue. "We have identified an issue indicating that the PC Launcher's script files may have been tampered with by a third party," reads the statement on X. "Accordingly, client fixes and an update were implemented on November 4 at approximately 02:30 (UTC+9). We are currently investigating the scope of the impact caused by this issue, and we will provide further details regarding follow-up measures in a separate notice." Goddess of Victory: NIKKE is a popular sci-fi shooter RPG developed by the South Korean firm Shift Up for Windows, iOS, and Android.
A phishing campaign used Google Calendar invites, trusted redirects, and fake login pages to hijack corporate Google sessions and bypass MFA protections. Material Security examines how Operation CloudFire tracked the attacks, blocked malicious messages, and helped take down nearly 900 domains used by the attackers.
SonicWall warned customers of two security flaws affecting end-of-life Global Management System (GMS) systems that will not be patched. Global Management System (GMS) helps IT admins deploy and manage thousands of SonicWall security appliances from a single interface, but SonicWall has officially replaced it with the Network Security Manager (NSM) management platform. The two vulnerabilities were found and reported by Pentest-Tools security researchers and affect systems running SonicWall GMS 9.5.2 and earlier. The first GMS flaw disclosed this week is tracked as CVE-2026-109593, and it enables unauthenticated attackers with network access to vulnerable instances (running GMS 9.5.2 and earlier versions) to steal sensitive information by reading internal files. SonicWall also flagged a second security issue (CVE-2026-109594) that can let threat actors with high privileges access or modify information stored in the GMS database through low-complexity SQL Injection attacks.
A federal grand jury indicted two Canadians suspected of hacking multiple US universities and using the compromised systems to mine for cryptocurrency. 35-year-old Ryan James Roach and 41-year-old Mathiew James Stubbings now face a maximum penalty of 10 years in prison and a $250,000 fine each if found guilty of conspiracy to obtain information from a protected computer and to cause damage to a protected computer, obtaining information from a protected computer, and intentionally damaging a protected computer. According to court documents, the two accomplices used virtual private servers in multiple countries (registered under fake names) between June 2016 and December 2019 to infect systems on the networks of multiple unnamed educational institutions in New York, Tennessee, North Carolina, and Massachusetts with malware.
The US Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress vulnerability in the wild. Tracked as CVE-2026-119977, this high-severity WordPress Core flaw stems from a Time-of-check Time-of-use (TOCTOU) race condition and was reported by Picus Security researcher Umut Bayram. Successful exploitation can let remote threat actors without privileges execute code on the server in high-complexity attacks due to predictable, web-accessible staging paths used during full-package core upgrades. "A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window," the WordPress security team said on October 28 when it released WordPress 7.1.4 with patches to address this security issue. "Because this is a security release, it is recommended that you update your sites immediately."
Critical Android flaw CVE-2026-58868 could allow remote code execution without user interaction on devices running Android 14 through 17. Google has fixed CVE-2026-58868, a critical Android vulnerability affecting versions 14 through 17. The flaw is a critical Android vulnerability caused by a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp. The flaw can trigger an out-of-bounds write, potentially allowing a remote attacker to execute arbitrary code on a vulnerable device. Exploitation requires neither user interaction nor additional execution privileges, making it a potential zero-click attack. “cve-2026-58868 In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow.” reads the advisory. “This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.” Devices receive the fix through security patch level 2026-11-01 or later, depending on manufacturers and carriers. Google is now aware of active exploitation of the flaws in its November 2026 bulletin. Google’s November 2026 Android security bulletin addresses 216 vulnerabilities, including 23 rated Critical. Two of these flaws, CVE-2026-58876 and CVE-2026-58936, affect the System component and could allow remote code execution without user interaction. The bulletin also lists five other Critical flaws in the System component. Three could lead to privilege escalation, while two could cause denial-of-service conditions. Another Critical vulnerability affects the Framework component and could also allow remote code execution. Six Critical vulnerabilities affect the Android kernel. Two involve Bluetooth code, three affect the protected Kernel-based Virtual Machine (pKVM), and one is in the Human Interface Device (HID) component. The most severe kernel flaw could allow a remote attacker to gain elevated privileges without user interaction. The November 5 patch level also addresses Critical vulnerabilities in MediaTek modem code and a closed-source Qualcomm component. Google’s bulletin lists eight Critical MediaTek modem flaws, while MediaTek’s own November security bulletin details six of them: CVE-2026-20499 and CVE-2026-20545 through CVE-2026-20549. MediaTek describes these six vulnerabilities as out-of-bounds write flaws caused by missing bounds checks, integer overflow or improper input validation. The company says it is not aware of any active exploitation in the wild. The Qualcomm issue is tracked as CVE-2026-25285 and affects a closed-source component. Google does not provide further technical details in its bulletin. One of the critical issues fixed by Google is CVE-2026-58882 (aka SMS of Death), which could allow attackers to remotely disable a phone by sending a specially crafted SMS message. The flaw affects decodeWapPdu, a function responsible for processing WAP Push messages, a type of content delivered through the SMS infrastructure. The vulnerability is particularly concerning because exploitation reportedly requires no user interaction. An attacker only needs the victim’s phone number to send a malicious message. The message doesn’t appear in the SMS inbox, so the victim may have no indication of what caused the problem. The issue also raises concerns about the reliability of mobile communications during an attack. According to a technical analysis published on October 29 by security researcher Mark B, a malformed WAP Push message can crash com.android.phone, the Android system component responsible for handling telephony functions. The crash can terminate ongoing calls, including emergency calls. Tests on several Android phone models reportedly reproduced the crash consistently. The phone can also become stuck in a crash loop because Android retries processing the malicious message whenever the device starts. As a result, the device may continue crashing until the offending message is removed. There is an important distinction, however. Google’s security bulletin and the CVE record identify the vulnerable decodeWapPdu function, but neither explicitly confirms that CVE-2026-58882 is the same issue described in the researcher’s SMS of Death report. The technical overlap is worth investigating, but the two reports shouldn’t be treated as definitively describing the same vulnerability without further confirmation. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CVE-2026-58868)
A large-scale watering hole attack associated with Russian hackers has been targeting iOS and Android users visiting compromised sites or fake ones impersonating legitimate portals. The campaign used multiple high-profile websites in the U.S., Ukraine, the Czech Republic, and Bulgaria that delivered the same payload for profiling visitors and their devices. This initial stage allows the attacker to determine the browser version to deploy "platform-specific n-day exploit chains without user interaction." Researchers at cybersecurity company Sekoia attribute the operation with moderate-to-high confidence to APT29 (aka Midnight Blizzard), a Russian threat group that was recently linked to hotel WiFi attacks. Based on their findings, compromised legitimate sites belong to a Ukrainian gas producer, a U.S. chemical industry trade association, and a Bulgarian military-related site.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds WordPress flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a WordPress flaw, tracked as CVE-2026-119977 (CVSS score of 8.1), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-119977 is a high-severity remote code execution vulnerability affecting WordPress versions 4.7 through 7.1.3. It stems from predictable, web-accessible staging directories used during core updates. Unauthenticated attackers could exploit a race condition to execute malicious code on the server while an update is in progress, potentially compromising the website. WordPress addressed the flaw in version 7.1.4. Threat actors began scanning for CVE-2026-119977 shortly after WordPress released the security update. Wordfence recorded more than 18,500 requests targeting vulnerable staging installer paths within the first 21 hours. However, these figures document exploitation attempts, not confirmed successful compromises. “Wordfence telemetry shows that threat actors are already actively attempting to exploit the vulnerability. The first match for our new firewall rule arrived nine minutes after deployment. During the first 21 hours, we recorded more than 18,500 requests targeting staged setup-config.php installer paths.” reads the report published by Wordfence. “Two of the largest sources repeatedly polled small groups of sites for roughly 14.5 hours, behavior consistent with trying to catch the brief upgrade window. Other sources tested many staging-directory and version-name variations.” According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by November 6, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CVE-2026-119977)
A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick. The Rails project disclosed the flaw in an advisory and fixed it in versions 8.1.4.1 and 8.0.5.2. The flaw is in Active Storage, the part of Rails that handles file uploads. Some apps store
Confirm this action.
Leaving now will discard your changes.