Vercel is gradually rolling out Device Bound Session Credentials (DBSC) on its platform as a key defense against information stealer malware. The new feature, announced by Vercel's CTO Malte Ubl on X, binds a login session to the user's device with a private key stored in a TPM, so even if the session cookie is stolen, it can't be reused on another device. Vercel is a cloud platform developers use to deploy and host websites, web applications, and AI agents. The company also develops the popular Next.js web framework. Its latest announcement concerns logins to Vercel's platform at vercel.com, where developers manage their projects and deployments. "DBSC works by storing a private key in your device's TPM (the same device that the fingerprint sensor or similar biometric devices on your laptop or phone uses) and using that key to sign your cookie," explained Ubl.
Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. The vulnerability, tracked as CVE-2026-107441, is an out-of-bounds write flaw in the switches' web management interface that allows an unauthenticated attacker with network access to execute operating system commands using specially crafted HTTP requests. The flaw affects ten GS1900 switch models, and Zyxel released security updates on October 22 and published a security advisory on November 3. However, the vulnerability was initially mistaken for an older flaw that Zyxel had already patched months before the attacks began. On June 16, 2026, Zyxel released security updates addressing CVE-2026-7273, a pre-authentication buffer overflow vulnerability affecting the same GS1900 switches.
DreamHost is warning of a data breach after attackers gained access to its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords. This follows the American web hosting provider and domain registrar's announcement that it suffered a cybersecurity incident requiring users to reset their email and FTP/SFTP passwords. In a data breach notification, DreamHost now says the breach extended from August 2026 to October 23, 2026, the day it was discovered. "We discovered that an unauthorized third party accessed the server that runs our web-based File Manager at files.dreamhost.com," reads the notification. "The unauthorized third party exploited a vulnerability in that software and was able to access the FTP/SFTP usernames and passwords of individuals who logged into this File Manager between approximately August 2026 and October 23, 2026."
Cyberattacks disrupted refrigeration monitoring systems at three French blood banks, amid similar attacks targeting European supermarkets. A cyberattack has hit three regional blood banks in France, disrupting systems used to monitor and control refrigerated storage facilities. The incident took place overnight between Sunday and Monday, at roughly the same time hackers were targeting supermarket refrigeration systems across several European countries. The attack is particularly concerning because it targeted infrastructure that plays a direct role in protecting public health. Blood products must remain within specific temperature ranges to preserve their quality and ensure they’re safe for medical use. A disruption to refrigeration systems can therefore have consequences that go well beyond a conventional IT outage. According to the French Health Ministry, the incident affected several facilities operated by the French Blood Establishment (EFS). “Several regional facilities of the French Blood Establishment (EFS) were affected by a cybersecurity incident that impacted certain cold storage room monitoring and control systems,” the health ministry said in a statement. “The incident had no impact on blood supplies,” Reuters reported, quoting EFS spokesperson Charley Dubois. Staff working around the clock received alerts about the problems and moved blood products to refrigerators that weren’t connected to the affected systems. This response helped prevent the incident from disrupting blood supplies, demonstrating how important operational procedures and contingency plans are when technology fails. “The situation was under control on Wednesday,” the French Health Ministry said, according to Reuters, which also reported that remote access to the affected refrigerators had been disabled. Investigations are now underway to establish how the attackers gained access, which equipment was affected and when the systems can safely return to normal operation. The timing is also significant. The French blood bank incident coincided with attacks against supermarket refrigeration systems in eight European countries, including Sweden and Belgium. Those attacks forced retailers to discard large quantities of food after hackers interfered with cooling and freezer systems. This wasn’t the first time French supermarkets had faced csxk cx incident. In October, police investigated an attack in which hackers allegedly seized control of cooling units at hundreds of supermarkets, causing fires and significant food losses. These incidents share similarities that deserve attention. They point to a security problem beyond traditional corporate IT systems: the growing exposure of operational technology (OT), including industrial control systems, refrigeration equipment, and the remote management platforms kdch operate them. These systems are often connected to corporate networks or accessible through remote management services. If attackers compromise those access points, they may be able to interfere with physical processes rather than simply steal information or encrypt business data. The consequences can be serious. In a supermarket, an attacker who manipulates refrigeration controls can cause food losses and potentially create safety risks. In a blood bank, the same type of interference could threaten the integrity of medical supplies and disrupt services that hospitals depend on. The French incident didn’t affect blood supplies, but the outcome shouldn’t lead organizations to underestimate the risk. Staff intervention and the availability of independent refrigerators helped contain the damage. Not every facility will have the same resources, response procedures or ability to move critical products at short notice. Organizations operating critical infrastructure need to treat the security of connected equipment as a core operational requirement. This means identifying exposed systems, restricting remote access, enforcing strong authentication, segmenting operational networks and monitoring changes to equipment settings. They also need tested manual procedures that allow essential services to continue when digital systems become unavailable or untrustworthy. The European Union has already raised concerns about vulnerabilities in connected infrastructure amid heightened security tensions following Russia’s invasion of Ukraine in 2022. These latest incidents reinforce the need to consider cyberattacks against physical systems as a real operational and public safety risk, not simply an IT problem. “Investigations are under way into how the attack was carried out, what equipment may have been affected and when systems can safely return to service.” concludes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, French Blood Banks)
France's national blood service has confirmed that a cyberattack targeting a refrigeration equipment provider raised temperature and defrost settings at three of its facilities, threatening stored blood products. The French Blood Establishment (Établissement français du sang or EFS), which manages blood collection, processing, and distribution across France, said the incident occurred on November 2 and affected systems used to monitor and control cold-storage chambers. According to a statement published on November 3, EFS was not directly targeted in the cyberattack, but was instead its refrigeration supplier. While EFS has not named the affected supplier, European refrigeration equipment provider Coolworld Rentals confirmed in a statement that a cybersecurity incident involving remote monitoring software had affected a limited number of its refrigeration units.
The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game's PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data. According to a notice published on X, a client update was issued on November 4 at 02:30 (UTC +9) to address the issue. "We have identified an issue indicating that the PC Launcher's script files may have been tampered with by a third party," reads the statement on X. "Accordingly, client fixes and an update were implemented on November 4 at approximately 02:30 (UTC+9). We are currently investigating the scope of the impact caused by this issue, and we will provide further details regarding follow-up measures in a separate notice." Goddess of Victory: NIKKE is a popular sci-fi shooter RPG developed by the South Korean firm Shift Up for Windows, iOS, and Android.
mSeven Software is warning current and former mSecure password manager customers to change passwords, reset two-factor authentication, and remove passkeys following a cyberattack in which a hacker reportedly stole an encrypted customer database.. In a security notification sent to customers on November 3 and shared with BleepingComputer, the company said it recently discovered suspicious activity involving its mSecure password management application. "mSeven Software (“mSeven”) recently learned of suspicious activity associated with the mSecure password management application," reads the mSecure security notification. "In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist. You are receiving this email because you are a current or former mSecure customer."
SonicWall warned customers of two security flaws affecting end-of-life Global Management System (GMS) systems that will not be patched. Global Management System (GMS) helps IT admins deploy and manage thousands of SonicWall security appliances from a single interface, but SonicWall has officially replaced it with the Network Security Manager (NSM) management platform. The two vulnerabilities were found and reported by Pentest-Tools security researchers and affect systems running SonicWall GMS 9.5.2 and earlier. The first GMS flaw disclosed this week is tracked as CVE-2026-109593, and it enables unauthenticated attackers with network access to vulnerable instances (running GMS 9.5.2 and earlier versions) to steal sensitive information by reading internal files. SonicWall also flagged a second security issue (CVE-2026-109594) that can let threat actors with high privileges access or modify information stored in the GMS database through low-complexity SQL Injection attacks.
A federal grand jury indicted two Canadians suspected of hacking multiple US universities and using the compromised systems to mine for cryptocurrency. 35-year-old Ryan James Roach and 41-year-old Mathiew James Stubbings now face a maximum penalty of 10 years in prison and a $250,000 fine each if found guilty of conspiracy to obtain information from a protected computer and to cause damage to a protected computer, obtaining information from a protected computer, and intentionally damaging a protected computer. According to court documents, the two accomplices used virtual private servers in multiple countries (registered under fake names) between June 2016 and December 2019 to infect systems on the networks of multiple unnamed educational institutions in New York, Tennessee, North Carolina, and Massachusetts with malware.
The US Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress vulnerability in the wild. Tracked as CVE-2026-119977, this high-severity WordPress Core flaw stems from a Time-of-check Time-of-use (TOCTOU) race condition and was reported by Picus Security researcher Umut Bayram. Successful exploitation can let remote threat actors without privileges execute code on the server in high-complexity attacks due to predictable, web-accessible staging paths used during full-package core upgrades. "A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window," the WordPress security team said on October 28 when it released WordPress 7.1.4 with patches to address this security issue. "Because this is a security release, it is recommended that you update your sites immediately."
Confirm this action.
Leaving now will discard your changes.