Daily briefTuesday 3 November
Everything that broke in the last 48 hours
Researched by Valyu DeepResearch from 81 sources, 3 Nov 2026 at 05:34 UTC. Counts are live.
The past 48 hours were dominated by a record cryptocurrency theft at Binance that the FBI has formally attributed to North Korea, and by a cluster of actively exploited edge and enterprise vulnerabilities - Ivanti Connect Secure, GitLab, Cisco firewalls, Brotli and the Linux kernel - where CISA's Known Exploited Vulnerabilities catalog is the priority queue and several federal deadlines have already passed.
49in 17 countries
- Confirmed
- 30
- Reported
- 2
- Claimed
- 17
- Added to CISA's exploited list
- 1
- Other flaws in the news
- 0
- Malicious packages published
- 40
- Connectivity drops in progress
- 1
Critical7
Ivanti Connect Secure zero-days CVE-2026-111357, CVE-2026-118527 added to KEV
CISA added these two zero-day flaws to KEV on 30 October 2026 after they were exploited alongside CVE-2026-104935; federal deadlines are 2 November and 13 November.
What to do
Patch to Connect Secure 25.1.1.3 or 22.8R2.6 and hunt for compromise, not just patch.
GitLab CVE-2026-97229: CVSS 10.0, in KEV, actively exploited
CISA added this integer overflow flaw to KEV on 29 October 2026 after an attacker attempted to exploit it against Alpine Linux's GitLab instance.
What to do
Upgrade to GitLab 19.5.1, 19.4.3, 19.3.6, 19.2.9 or later, which covers both CVEs, and rotate tokens and deploy keys.
Cisco Secure Firewall ASA/FTD CVE-2026-76418: KEV, denial of service
CISA added this flaw to KEV on 29 October 2026 citing active exploitation that can force unexpected firewall reloads when secondary authentication is configured.
What to do
Match the installed train to its first fixed release and upgrade.
Brotli CVE-2026-111497: KEV, actively exploited, very wide reach
CISA added this buffer overflow flaw to KEV on 27 October 2026 with a federal deadline of 10 November; EPSS is 82.6% (100th percentile).
What to do
Patch to the fixed version for your release line; note that bundled copies need the runtime rebuilt and redeployed, not just the OS updated.
European supermarket refrigeration attack: seven countries, OT disruption
Overnight into 2 November, temperatures were raised at more than 115 stores across Belgium, Sweden, Ireland, Estonia, Luxembourg, Netherlands and Finland.
What to do
Keep refrigeration and OT management interfaces off the internet and segment OT from corporate networks.
Florida Department of Education: 4.9 million people's records, including SSNs
FLDOE confirmed unauthorized access to the Florida Student Financial Aid website discovered on 19 October 2026 and disclosed on 29 October 2026.
What to do
Affected Floridians should freeze credit and monitor accounts themselves.
High10
Amadeus breach: airline reservation data read for 37 months
An unauthorized party used credentials assigned to an Amadeus system account to read reservation data between August 2023 and September 2026, affecting JAL, Cathay Pacific, ANA and others.
What to do
Watch for booking-reference phishing; verify schedule changes through official airline channels.
DHS 'Icepick' leak: 41,191 staff records published
DDoSecrets published work records for 41,191 DHS employees and contractors on 28 October 2026, including names, job titles, offices, work emails and phones.
What to do
DHS staff and contractors should assume their work identity and reporting line are public and expect targeted phishing and phone pretexting.
VMware ESX CVE-2026-41709: KEV, used as a zero-day by WARP PANDA
CISA added this insufficient-logging flaw to KEV on 28 October 2026 with a federal deadline of 11 November; CrowdStrike reports WARP PANDA used it as a zero-day.
What to do
Patch by 11 November, and note that patching cannot restore logs that were never written - compare host logs against network and identity-layer evidence.
Linux kernel CVE-2026-98432: CVSS 9.8, no exploitation reported
Red Hat shipped fixed kernels for RHEL 8, 9 and 10 on 1 November 2026; Ubuntu still has no fixed kernel, and there is no report of exploitation in the wild.
What to do
RHEL fleets should install the fixed kernel and reboot; Ubuntu fleets are still in a before-patch window.
Node-RED CVE-2026-58115: CVSS 10.0, exploited in the wild, not in KEV
VulnCheck warned on 2 November 2026 that attackers are actively exploiting this missing-authentication flaw on exposed hosts, including Siemens SIMATIC IoT2050 Advanced devices.
What to do
Restrict web administration access, enforce authentication, and update to V4.3.4.1.
Linux kernel CVE-2026-46300 'Fragnesia': KEV, chained with PHP2Shell
CISA added this local privilege escalation flaw to KEV on 28 October 2026 with a federal deadline of 31 October 2026 under BOD 26-04.
What to do
Patch, and check for pre-patch compromise - CISA's directive tells agencies to check whether threat actors compromised a system before the patch landed.
PHP2Shell CVE-2026-109618 and CVE-2026-109619: KEV
CISA added these critical unauthenticated remote-code-execution flaws to KEV on 26 October 2026 and urged organizations to inventory PHP installations.
What to do
Inventory PHP installations and patch immediately.
Abrigo/Sageworks outage: more than 2,400 banks and credit unions
Abrigo took the Sageworks risk-management application offline around 11:25 am ET on 30 October 2026 after irregular activity; most functionality was restored by 2 November.
What to do
Banks and credit unions using Sageworks were advised to rotate platform API keys as a precaution.
UNM Health ransomware: ambulances diverted at New Mexico's only Level I trauma centre
UNM Health detected a cybersecurity threat around 11 a.m. on 26 October 2026; a group calling itself BYOD claimed responsibility but UNM says core systems were not penetrated.
What to do
Treat BYOD's compensation offers as a potential scam vector.
Belgium FPS Finance: MyMinfin and Tax-on-web offline for three days
An attack on Belgium's Federal Public Service Finance IT systems in the night of 27–28 October 2026 led to services being taken offline as a precaution.
What to do
File by 16 November, and treat messages about 'restoring your MyMinfin account' or 'tax regularisation' after the incident as suspect.
Watch9
Cisco SD-WAN KeyDrift malware (UAT-11473, CVE-2026-20127)
Cisco Talos detailed on 28 October 2026 that actor UAT-11473 exploited CVE-2026-20127 to place multi-part KeyDrift implants inside management processes.
What to do
Install Cisco fixes, review controllers against published indicators of compromise, and check for service changes and unusual vdaemon process access.
N0n leak-site postings, 2–3 November: claims only, not confirmed breaches
N0n posted Companies #117–#122 on 2–3 November 2026, all marked 'pending exposure' with no compromise date, no data detail, no ransom amount and no screenshots.
UK NCSC: AI-powered malware in a CNI ransomware attack judged highly likely by 2028
The UK NCSC published its annual State of the Cyber Nation report on 3 November 2026, judging it highly likely that AI-powered malware will feature in a ransomware attack on UK critical national infrastructure before the end of 2028.
GOLD OGRE / Aur0ra ransomware using AI agents
Sophos recovered artifacts from the Cursor AI coding assistant showing attackers handing AI agents VPN logins, proxy access, targets and objectives to map networks and move laterally.
What to do
Prioritise behavioural detections on identity and control-plane bursts rather than IOC feeds.
VOLTA-AUTODOXER infostealer: AI-ranked victims
Cisco Talos detailed a new Windows infostealer that sends a structured 'evidence bundle' to OpenRouter, defaulting to Anthropic's Claude Opus 4.6, to rank victims by financial value.
What to do
Treat detection as a credential-theft emergency and rotate everything the host could reach.
Frontline Education: K-12 staff and student records
Frontline says attackers used a vulnerability in third-party software to enter part of its environment on 14–15 August 2026, touching Frontline Central and School Health Management.
What to do
Districts should check their own exposure rather than wait for letters.
Garden Valley School Division (Manitoba) and La Laguna Town Hall (Tenerife)
The Garden Valley School Division began experiencing network disruptions on 25 October 2026; separately, the City Council of La Laguna in Tenerife reported a cybersecurity incident affecting its technological infrastructure.
Russia and Ukraine emergency alert apps compromised
In the night of 2 November 2026, Russia's Ministry of Emergency Situations mobile app was hacked and attackers used it to distribute false alerts to the population.
What to do
Verify emergency alerts through multiple official channels.