The important things.
In fewer words.
54 stories · Most recent event first
Security
Authorities completed checks after separate bomb alerts involving passenger flights at Warsaw’s Modlin and Chopin airports on 3 November, Sky News and AFP reported. No device was found on either aircraft. Modlin reopened after a temporary halt, while Chopin continued operating with no significant disruption reported. The sources do not establish whether the alerts were connected or identify who made them.
Security · Developing
Russian regional governor Mikhail Yevrayev said an overnight drone attack damaged the Yaroslavl refinery, started a fire and injured two employees. Reuters reported the governor’s account that 124 drones were involved at the refinery; Russia’s Defense Ministry said it downed 856 Ukrainian drones nationwide, while Moscow Mayor Sergei Sobyanin said 493 were directed toward the capital. AP also reported the official counts and refinery damage. Ukraine had not commented in Reuters’ report. The attacker, drone totals and refinery’s operational status have not been independently established.
Security
India’s Ministry of Defence said its navy rescued all 20 crew members of the Iranian fishing vessel Al Azini after a more than 48-hour operation in the Arabian Sea. The vessel had been hijacked off Somalia on Oct. 29. The ministry said the crew were safe and the vessel was searched for explosives. AP reported that a Puntland official said suspected pirates and two Somali guards later came ashore, but the accounts differ on crew numbers and do not establish the identities or condition of everyone who landed.
Security · Developing
AFP/Euronews reported refrigeration incidents at grocery businesses in at least nine European countries on 2 November; Reuters separately reported an affected German Edeka store. Some retailers discarded food. The European Commission says it coordinated with ENISA, Europol and affected states but left attribution to national investigations; Agriculture Commissioner Christophe Hansen called the incidents a deliberate supply-chain disruption attempt. Italy’s government said only a few locations there were affected and no public-health risk from thawed food had emerged in Italy. A common attacker or linked campaign is not established.
Security · Developing
AP said a US official described limited strikes on Iranian targets in the Strait of Hormuz; Iranian state TV reported explosions on Qeshm. Reuters reported Iran’s Revolutionary Guards claimed to down a US MQ-9 drone east of the strait; Reuters did not independently confirm it or report a US response. A senior Iranian official said Tehran would respond forcefully and a deal was far off. AP quoted Qalibaf saying Iran gave a “firm and rational response,” but said its meaning was unclear. Iran’s conditional two-day plan to reopen Hormuz is not agreed; damage, casualties and further operations are unknown.
Security · Developing
India's Foreign Ministry said one Indian national died after an attack on the cargo vessel MSV Al Jusufi near Oman's coast on 2 November. Reuters reported that 13 other Indian crew members were rescued. India's shipping minister said the vessel was struck by an unidentified aerial object near Limah; the attacker and object have not been independently identified, and no group has claimed responsibility in the reports reviewed.
Security
Ukraine’s Air Force said its Air Alert application was likely compromised after false nuclear, chemical and street-fighting warnings appeared; it said there was no radiation threat. Hours later, Russia’s Emergencies Ministry said its separate mobile app was cyberattacked and sent false messages in 33 regions. The ministry said it isolated the app and that other national alert channels remained operational. Kyiv separately blamed Russia for the Ukrainian incident; neither side supplied technical evidence establishing attribution, and no link between the two app incidents is known.
Security · Developing
Malaysia Airlines has warned that some customer information may have been affected by an incident at reservation-technology provider Amadeus. Japan Airlines says Amadeus notified it on 23 October that reservation records had been accessed: about 90,000 customers had booking, name and itinerary fields exposed, while about 2,000 had additional contact, passport and other details; JAL reports a total of about 92,000. These are JAL-specific figures, not a combined count across carriers. JAL says no credit-card numbers or passwords were compromised; the overall incident scope remains unknown.
Security
Hong Kong’s privacy watchdog said on 30 October that Hospital Authority failures contributed to an April patient-data leak and violated the privacy ordinance. It cited weak contractor-access monitoring, missing role-based controls and inadequate security reviews, then issued an enforcement notice. The Authority accepted the findings. More than 56,000 people were affected, including over 55,000 patients and 482 current or former employees. Exposed information included identities, hospital and treatment details; further misuse was not established.
Security · Developing
At least eight people were killed and dozens injured in separate U.S. shootings across Halloween weekend, 30 October–1 November. Local reports give four deaths in Dallas and one each in Birmingham, Fairfield, Madison Heights and Bloomington. Dallas police reported 15 wounded; other cities gave their own injury counts, but no complete national total is available. AP’s initial roundup said at least six were killed; combining city-level counts gives a minimum of eight. The incidents are separate, with no reported link among them.
Security · Developing
CISA added CVE-2026-111357 and CVE-2026-118527 to its exploited-vulnerability catalog on 30 October. Researchers link them with an earlier Ivanti Connect Secure authentication bypass in attacks observed since early October. Additional patches were released on 29 October.
Security · Developing
Trezor warned customers on 30 October to move funds from wallets supplied by CryptoBilis after a reported implant in one Safe 5. It has not examined that device and says no customer has reported a related loss to it.
Security · Developing
The FBI attributes the 29 October theft of more than US$6 billion to North Korean TraderTraitor actors. North Korea, through a statement carried by KCNA, denied the allegation on 3 November; the competing claims do not independently establish responsibility. Reuters reported DeFiLlama’s US$4.72 billion net-outflow estimate through Monday and quoted Binance co-CEO Richard Teng saying flows had normalized and 95% of affected tokens were replenished. The recovery figure and flow assurances are company claims, not an independent audit.
Security · Developing
The Philippines' National Privacy Commission is reviewing St. Luke's Medical Center's notification of a data-security incident detected on 29 October. The hospital said unauthorised access occurred on a third-party platform supporting its mobile app and that some patients' and employees' personal information may have been affected. It said containment measures were taken and hospital operations were unaffected. The number of people or types of information involved, and whether data was taken, have not been disclosed.
Security · Developing
Hong Kong’s Examinations and Assessment Authority said personal data belonging to 16,900 mainland residents applying for two international examinations had been leaked. It discovered the incident on 29 October and reported it to police and the privacy commissioner. The leaked fields included names, dates of birth and email addresses. The authority said there was no evidence at the time that the Hong Kong Diploma of Secondary Education or other exams were affected, and that it was arranging to notify the applicants. The cause, exposure period and any access beyond the affected records were not established in the reports reviewed.
Security · Developing
Russia’s Federal State Statistics Service, Rosstat, said targeted destructive cyberattacks hit its information resources from 29 October through 1 November. It said monitoring systems flagged suspicious activity and that it found no database compromise or leak of legally protected information. Interfax and Vedomosti reported Rosstat said public access to its official website would be restored soon, while specialists and law enforcement worked to identify the attack vector and threat source. Those reports describe site availability at the time they were published on 1 November; the later recovery status was not established.
Security
A federal court in Virginia sentenced Ahmad Umar Agha to 42 months in prison on 29 October for a wide-ranging hacking conspiracy, the US Justice Department announced. His targets included Western news organizations and government-related systems.
Security · Developing
Archive of Our Own's operator says the fanworks site will remain offline while it investigates a security incident. The Organization for Transformative Works estimates two to four weeks of disruption, with a possible earlier partial return. It has not ruled out theft of account information.
Security · Developing
Cursor says up to 5,000 users were affected by a maliciously modified Claude Code extension distributed through its marketplace on 29 October. It removed the package and disabled the attacker's server. Affected machines may still require cleanup.
Security
TeamViewer has fixed a screen-processing flaw that can let a malicious or compromised remote host crash the connecting client and potentially execute code on it. CVE-2026-111585 requires the user to start a remote-control session to that host. The fix was released in version 15.83 on 27 October; detailed research followed on 29 October.
Security
CrowdStrike reported on 29 October that a China-linked group it calls VAPOR PANDA used the ARTEX AI framework against more than 200 organisations. It confirmed post-exploitation activity at nine. The larger targeting figure does not mean 200 confirmed breaches.
Security · Developing
Polymarket said a compromised third-party provider affected its international platform on 29 October. CNBC reported stolen user funds and a temporary trading halt, followed by resumption at 15:00 EDT (19:00 UTC). The US platform was reported unaffected.
Security · Developing
CISA added GitLab vulnerability CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on 29 October. The flaw can allow code execution on affected self-managed GitLab servers. Fixes have been available since 12 October.
Security
Wordfence says it blocked 62,969 attack attempts in a 24-hour period against a WordPress upgrade-process flaw, The Hacker News reported on 30 October. WordPress patched the weakness in version 7.1.4 on 28 October. Exploitation requires a brief, conditional update window; the request count is not a count of compromised sites.
Security · Developing
Drupal says attackers are actively exploiting CVE-2026-118539 in Commerce Core. Its 28 October advisory urges affected sites to update and check orders for inconsistencies. Fixed releases are3.3.13 for the 3.x branch and 8.x-2.41 for earlier versions.
Security · Developing
DHS asked an Icelandic hosting provider, through contractor ZeroFox, to remove a site carrying leaked personnel records. FlokiNET said on 29 October that it refused, but the registrar suspended the original domain. The underlying disclosure identified more than 41,000 records, WIRED previously reported.
Security · Developing
Cisco Talos reported on 28 October that an actor it calls UAT-11473 installed KeyDrift malware after exploiting CVE-2026-20127 in Cisco SD-WAN controllers. Observed targets included space and satellite services, defence and aerospace technology, and policy research.
Security · Developing
CISA added VMware ESX flaw CVE-2026-41709 to its Known Exploited Vulnerabilities catalog on 28 October. Broadcom rates it low severity, with a CVSS score of 2.7: an attacker who already has administrative access can perform certain operations without those operations being logged. Vendor fixes are available.
Security · Developing
Cisco has released fixes for CVE-2026-76418, a vulnerability it says attackers are exploiting to crash certain ASA and Firepower Threat Defense VPN devices. Successful exploitation can force a reload and interrupt service.
Security · Developing
Cisco’s Talos researchers reported on 28 October that an intrusion campaign stole encryption-key material from SD-WAN systems. They assessed with high confidence that its infrastructure overlapped Silent Train, the network Lumen linked to Volt Typhoon. The overlap does not establish that the operators were the same.
Security
Juniper disclosed critical flaws in Session Smart Router and Session Smart Conductor on 28 October. Fixed releases are available. One router flaw permits administrative access only before the device is onboarded to Mist or a Conductor.
Security
Tailscale says version 1.104.4 fixes confirmed SSH and Serve vulnerabilities disclosed during the Tailworm investigation. Exploitation requires particular access and feature configurations.
Security · Developing
On 24 October, GMO said customer information was taken in the Onamae Desktop Cloud intrusion and some clients reported unrecognized trades. BleepingComputer cited a company estimate of up to 26,739 potentially affected servers, not a confirmed customer count. On 27 October, GMO said a threat actor posted material purporting to be company or customer data; authenticity remained under review and ransomware was unconfirmed. On 30 October, GMO began contacting contracted users about a ¥5,000 payment and an opt-in, six-month replacement on separate cloud infrastructure. The customer total and authenticity of posted files remain unknown.
Security · Developing
Anthropic’s 27 October security report described remote root command execution against a Linux server with a multipath TCP listener using CVE-2026-98432. The flaw has upstream fixes, but distribution availability varies. This does not establish that every Linux TCP service can be taken over.
Security · Developing
US authorities announced a court-authorized seizure of Virtualine’s main domain on October 27. Dutch police said October 28 that related action seized dozens of physical servers and took hundreds of virtual servers offline.
Security · Developing
Security researchers said a card-stealing script affecting Convertr-powered online shops was removed on 27 October after compromising a tracker shared by dozens of Brazilian fashion merchants.
Security · Developing
Sony Network Communications disclosed on 27 October that an intrusion exposed 2,585,481 So-net and plala S Course membership records, including some former customers.
Security
CISA disclosed four EPICS Base vulnerabilities on 27 October affecting version 7.0.10 and earlier. Operators should update to 7.0.11 and test compatibility before production deployment.
Security · Developing
SecurityWeek reports that Defused’s Oracle E-Business Suite decoys observed exploratory attacks on 27 October against CVE-2026-101767. Oracle patched the critical Application Object Library flaw in its 20 October update.
Security · Developing
CISA added CVE-2026-48356, affecting Adobe Commerce and Magento, to its Known Exploited Vulnerabilities catalog on 27 October. Adobe’s July security releases address the flaw.