Today's briefing

Monday 2 November 2026

Ukraine's and Russia's air raid apps are hijacked to send fake nuclear and radiation alerts, the FBI officially blames North Korea for the record Binance theft, the Amadeus booking breach spreads to Cathay Pacific, Qantas and other airlines, plus hackers deface Russia's statistics agency, a perfect-10 flaw in Canonical's LXD, malware that uses AI chatbots to size up its victims, Alpine Linux rebuilding its GitLab, Polymarket refunds and a KDDI customer data leak.

9 stories

Threat1 Nov 2026

Ukraine's and Russia's air raid warning apps hijacked to send fake nuclear and radiation alerts

Shortly before 11pm local time on Sunday, Ukraine's widely used Air Alert app sent false red-level air raid warnings across the country, with extra fake warnings of radiation, chemical attacks and street fighting for some people, including in Kyiv. Ukraine's air force said there was no radiation threat, the alerts were cancelled within an hour, and the digital ministry took the app offline for maintenance after it was apparently compromised. Kyiv blamed Russia. Hours later Russia's emergencies ministry said its own warning app had been hit by a 'massive cyberattack' that pushed false information to the public, while a Ukrainian partisan group claimed fake nuclear strike warnings had gone out inside Russia. The attacks came minutes before a local ceasefire in the Kherson region ended.

Why it matters: Hacking an emergency alert app can cause panic, or teach people to ignore real warnings. Moscow stressed that sirens, text messages and broadcasts were unaffected, which is a useful reminder for anyone: an app should never be your only source of emergency alerts, and official channels are the place to check before acting on a frightening message.

Sources

Threat31 Oct 2026

Binance update: the FBI officially blames North Korean hackers for the record $6.3 billion crypto theft

The FBI says North Korea's TraderTraitor group, also known as Lazarus, was behind the theft of more than $6 billion in crypto from the Binance exchange around 29 October, confirming earlier findings by blockchain analysts. Binance has linked the break-in to a hacked laptop belonging to one of its engineers, and most of the money was moved within about 20 minutes. The FBI says the hackers are mainly converting the funds into Ethereum and published 628 crypto addresses tied to the theft, asking exchanges and other crypto firms to block transactions linked to them.

Why it matters: It is now officially the largest crypto theft on record, and the money is likely to fund North Korea's weapons programmes. The same group often gets in by posing as recruiters and sending fake job tests to developers, so anyone working in tech or crypto should be wary of unexpected job offers that ask you to download or run code.

Sources

Breach1 Nov 2026

Amadeus booking breach update: Cathay Pacific says 53,000 bookings affected, and Qantas, Malaysia Airlines and others are checking theirs

The break-in at Amadeus, the travel technology company that runs reservation systems for hundreds of airlines, is now known to reach well beyond Japan Airlines. Cathay Pacific says about 53,000 of its bookings were affected, with someone using login details for an Amadeus system account to access reservation data between August 2023 and September 2026. Most records held booking references, passenger names and flight details, and a smaller number also included email addresses, phone numbers, travel document or frequent flyer numbers. Malaysia Airlines has confirmed customer data was involved, and Qantas says it is working with Amadeus to understand the impact on its bookings. Amadeus says it has reset passwords and found no sign of payment data being taken or the data being misused.

Why it matters: Real booking details make scam emails, texts and calls about your trip very convincing. If you have flown with an affected airline, be suspicious of any unexpected message about a booking, change or refund, and check directly through the airline's own app or website rather than through links or phone numbers in the message.

Sources

Outage1 Nov 2026

Hackers deface Russia's statistics agency websites and claim to have stolen 23 terabytes, including war casualty data

Russia's state statistics agency Rosstat confirmed that its systems were hit by targeted cyberattacks between 29 October and 1 November, and its main and regional websites were changed overnight to show messages in Belarusian, including 'No one will escape accountability'. The Belarusian Cyber Partisans and Silent Crow hacking groups claim they controlled around 25,000 computers and took 23 terabytes of data, including information on Russian military losses in Ukraine. Rosstat says no databases or protected information were leaked, and the hackers' claims have not been independently verified. The agency's website was unstable or offline for part of Sunday.

Why it matters: Government statistics agencies hold huge amounts of census and personal data, which makes them a prized target in a cyber conflict. The gap between the hackers' claims and the official denial is common after attacks like this, which is why it is worth waiting for evidence before treating either side's numbers as fact.

Sources

Vulnerability1 Nov 2026

Maximum-severity flaw in Canonical's LXD and MicroCloud let attackers pose as a trusted computer without its secret key

Canonical has fixed a flaw, rated 10 out of 10 and tracked as CVE-2026-112816, in LXD and MicroCloud, its tools for running virtual machines and containers. The servers checked the wrong part of the security certificate a client presented, so an attacker who could reach the management interface over the network and had a copy of a trusted client's public certificate could log in as that client, and possibly gain full control of the host. The bug was first reported by the Incus project, a community offshoot of LXD, which has fixed it too. There is no sign it has been used in attacks so far.

Why it matters: Anyone running LXD with its network interface turned on, or a MicroCloud cluster, should update now with snap refresh and confirm the new version actually arrived, because Canonical said the fixes were still rolling out. Until then, limiting who can reach the interface is the only protection, as there is no settings-based workaround.

Sources

The Hacker News

Threat2 Nov 2026

New password-stealing malware hands victims' data to AI chatbots to work out how much each person is worth

Researchers at Cisco Talos have found a new Windows info-stealer called VOLTA. Like similar malware it grabs browser passwords and cookies, payment cards, crypto wallet phrases, chat app sessions and cloud keys, but it also builds a profile of the victim, even searching their Gmail for delivery receipts to confirm a home address. It then sends that profile to commercial AI models, with Claude, Kimi and Gemini as fallbacks, and asks for a ranked report on the victim's most valuable assets and weakest security habits, which is sent to the criminal over Telegram. Talos thinks it may be sold as a kit to other criminals.

Why it matters: AI is making it quicker for criminals to pick out the victims worth targeting and exploit them. The basic defences still work: don't run cracked software or unexpected downloads, use a password manager and passkeys, turn on two-step sign-in, and keep crypto recovery phrases off your computer.

Sources

The Hacker News

Supply chain1 Nov 2026

Alpine Linux rebuilds its GitLab server and resets every password after attackers tried the maximum-severity GitLab flaw

The team behind Alpine Linux, a small operating system used as the base of a huge number of Docker containers, says attackers repeatedly tried to exploit the critical GitLab flaw CVE-2026-97229 against its development server on 20 and 21 October. Alpine had first installed an unpatched version, and a later upgrade still left it exposed because the fix also needed a Ruby update that its custom setup lacked. It found no evidence that code was run or that packages were tampered with, but missing logs meant it could not rule it out, so it rebuilt the server from scratch and reset all passwords.

Why it matters: A tampered Alpine build could have spread into countless apps, so this is the kind of supply-chain target that matters to everyone. It's also a lesson for anyone running GitLab: check that the patch really took effect, especially on custom or self-built installs, and keep logs long enough to answer the question 'were we hacked?'

Sources

BleepingComputer

Supply chain1 Nov 2026

Polymarket update: about $2.7 million to be refunded to 726 wallets after the hijacked website script attack

Prediction market Polymarket says it is refunding about $2.7 million to 726 wallets hit when malicious code replaced a page-speed monitoring script from the company DebugBear on its site on 29 October. The code used traders' open, signed-in sessions to move positions to the attackers, or sell them and move the money out. DebugBear says its web address records were taken over through its domain registrar and that the attack appears to have targeted just this one customer's site.

Why it matters: This shows how one outside script loaded by a website can be turned against its users. Sites that handle money should limit and lock down third-party code, and users of crypto platforms should review what their wallet asks them to sign and sign out when they're not trading.

Sources

The Hacker News

Breach30 Oct 2026

Japanese telecoms giant KDDI warns up to 22,541 customers' details may have leaked through a partner insurer's system

KDDI says hackers exploited a weakness in a system run by Lifenet Life Insurance that connects to KDDI for its 'au' life insurance service, and may have taken customer details held on KDDI's side. The data may include names, postcodes, phone numbers, email addresses and member IDs, and for some people sex and date of birth, but not passwords, card or bank details. Lifenet spotted the intrusion on 23 October and KDDI cut the connection the next day. Parts of the insurance service, including new applications, are paused for maintenance.

Why it matters: It's another example of a company's data being exposed through a partner's system rather than its own. Affected customers should watch for convincing scam emails, texts and calls; KDDI says it will never ask for passwords or PINs.

Sources