Today's briefing

Wednesday 4 November 2026

CISA confirms hackers are exploiting the WordPress flaw that opens during site upgrades, Binance reveals its record theft began with a fake job interview, attackers hijack the cPGuard server tool's updates to plant backdoors, password manager mSecure tells customers to reset everything, plus Linux and Barracuda patches, Android's November fixes, an AI-assisted ransomware attack on UK schools, a European investment-scam crackdown and a school software breach affecting 1.3 million.

10 stories

Vulnerability3 Nov 2026

WordPress update: US cyber agency CISA confirms hackers are exploiting the flaw that opens during site upgrades

CISA has added a WordPress Core bug, CVE-2026-119977, to its list of vulnerabilities known to be used in real attacks. The flaw is a race condition: during a full WordPress core update, the new files are briefly unpacked into a predictable folder on the website, and in that short window an attacker with no account can reach the installer and run code on the server. Wordfence says it saw more than 18,500 attempts to hit those staging paths in the first 21 hours after the bug was made public, and attackers are scanning sites constantly hoping to catch an update in progress. Fixed versions were released on 28 October, and US federal agencies have been given until 6 November to patch.

Why it matters: WordPress runs a huge share of the web, so this affects a lot of small business, charity and personal sites. Make sure your site is on WordPress 7.1.4 or the fixed release for your branch. Belgium's cyber agency also advises blocking web access to the wp-content/upgrade folder while updating and checking your logs for unusual activity there, because patching does not undo a break-in that has already happened.

Sources

Threat3 Nov 2026

Binance update: the record $6.3 billion theft started with a fake job interview and a booby-trapped coding test

Binance has published its own report on the 29 October theft, which the FBI has already blamed on North Korean hackers. It says that in September a software engineer was approached on a genuine job-hunting site by a fake recruiter, went through two staged interviews, and was then asked to download a coding assignment that secretly installed new malware his security tools did not catch. By 20 October the attackers had used that computer and an internal AI tool to compromise two more staff working on Binance's wallet systems, and on 29 October they used stolen credentials to get into the service that signs crypto transfers. Binance says about $2.85 billion of the stolen assets had been frozen or intercepted by 3 November.

Why it matters: Fake job offers with a 'take-home test' are a well-known North Korean trick aimed at developers and crypto workers. If a recruiter asks you to download and run code as part of an interview, treat it as a red flag and only ever run it in a throwaway, isolated environment, never on a work machine.

Sources

BleepingComputer

Supply chain3 Nov 2026

Hackers hijack the update system of server security tool cPGuard to plant a backdoor on nearly 3,000 servers

OpsShield, the maker of the cPGuard Linux web server security suite, says an unknown attacker used stolen login details to get into its update distribution system on 2 November and pushed out a malicious script in versions 5.88.12 to 5.88.19. The script installed a backdoor and gathered sensitive files such as password hashes, database admin settings, root command history and SSH key files, which the attacker then collected. The company told BleepingComputer that 2,946 servers were affected and that its billing database was also copied. It stopped the malicious updates within about 12 hours.

Why it matters: cPGuard is widely used by hosting companies and server owners, so this could reach many websites indirectly. Anyone running it should update to version 5.88.25 or later, which removes the backdoor, and then change passwords and replace database credentials, cloud secrets and SSH keys, because anything copied may still work after the update.

Sources

BleepingComputer

Breach3 Nov 2026

Password manager mSecure tells customers to change their passwords and reset two-factor logins, without saying why

mSeven Software, which makes the mSecure password manager, emailed current and former customers on 3 November saying it had spotted 'suspicious activity' linked to the app. It says it has investigated, taken steps to contain the problem and called in outside experts, and it recommends that customers protect everything stored in the app, which may include changing passwords, re-doing two-factor authentication and removing passkeys. The email does not say what happened, when, which systems were involved or whether stored data was exposed. mSecure says vaults are encrypted on the user's device before syncing.

Why it matters: A password manager holds the keys to everything else, so even a vague warning deserves action. If you use mSecure, start with your email account, then banking, payment and Apple or Google accounts, and set up two-factor again for any account whose codes were kept in the app. Watch out for fake 'mSecure breach' emails, and only act through the app or websites you type in yourself.

Sources

Vulnerability3 Nov 2026

Linux kernel flaw update: Red Hat ships fixes for the 9.8-rated networking bug, while Ubuntu's are still in testing

Fixed kernels are now out for Red Hat Enterprise Linux 8, 9 and 10 for CVE-2026-98432, a use-after-free bug in how Linux sets up IPv4 TCP connections that a remote attacker with no login could use to run code. Red Hat has raised its rating from moderate to critical, 9.8 out of 10, in line with the Linux kernel's own CVE team. Canonical has put fixes for Ubuntu 22.04, 24.04 and 26.04 in its opt-in '-proposed' testing channel, which does not install automatically, and has not given a date for a normal update; older Ubuntu releases are still waiting. No attacks using the bug have been reported so far.

Why it matters: TCP is used by almost every networked service, so the exposure is broad. Red Hat users should install the update and reboot. Ubuntu server admins should decide whether to install the testing-channel kernel now or wait, and Canonical warns that simply disabling Multipath TCP, a workaround suggested elsewhere, is not enough on its own.

Sources

Vulnerability3 Nov 2026

Barracuda tells customers to patch two flaws that together could give attackers full control of its email and web security devices

Barracuda Networks has released patches for two vulnerabilities. The first, CVE-2026-116606, is a critical login-check weakness in its Email Security Gateway that can let an attacker change the device's settings. The second, CVE-2026-111560, lets someone with admin access inject commands that run with full 'root' control, and it affects several products including its Web Application Firewall, Load Balancer, Message Archiver and Web Security Gateway. Barracuda says an attacker would need to reach the device's admin interface, and that chaining the two bugs could bypass its access controls and gain root.

Why it matters: Barracuda email gateways were heavily targeted by state-backed hackers in 2023, so these devices are attractive to attackers. Install the patches, and make sure admin pages are only reachable from trusted internal networks, never from the open internet.

Sources

BleepingComputer

Vulnerability3 Nov 2026

Android's November update fixes more than 200 security holes, including a critical one that needs no tap from the user

Google's November Android security bulletin fixes more than 200 vulnerabilities, around two dozen of them rated critical. The worst, CVE-2026-58868, is in the Android Framework and could let an attacker run code remotely without the user doing anything. The fixes come in two parts: the 2026-11-01 patch level covers 119 issues in core Android, and the 2026-11-05 level adds 97 more in the kernel and in chip components from makers such as Qualcomm, MediaTek and Arm, including critical bugs in Bluetooth. There is no sign that any of these flaws have been used in attacks yet.

Why it matters: Check your phone's security patch level in Settings and install the update as soon as your manufacturer offers it, aiming for 2026-11-05 or later. Some fixes also arrive through Google Play system updates, so install those too. Phones that no longer get updates will stay exposed.

Sources

Ransomware3 Nov 2026

Ransomware attack on a group of UK schools looks like it was driven by an AI assistant, researchers say

Security firm Bitdefender says an affiliate of the 3AM ransomware gang broke into a UK school group's network between 10 and 19 September and encrypted about 37 of the nearly 50 machines it could reach. The attacker pulled saved passwords out of backup servers and a web browser, created hidden administrator accounts, linked previously separate school networks together, stole financial data and tried to switch off security software and delete backups. Bitdefender believes an AI model may have been generating the commands in an automated loop, because similar commands were repeated with small changes at regular 40 to 100 second intervals, though it could not confirm which tool was used.

Why it matters: It lines up with the NCSC's warning this week that AI is helping attackers move faster. Schools and small organisations should keep backups offline or locked down, avoid storing passwords in backup tools and browsers, and watch for unexpected new admin accounts.

Sources

BleepingComputer

Law & order3 Nov 2026

Seven arrested and over 100 servers seized in a European crackdown on fake investment websites

Police in Albania, Cyprus, Finland, Germany, Kosovo and North Macedonia, supported by Europol and Eurojust, have arrested seven suspects and seized more than 100 servers. They targeted a company suspected of supplying fake trading websites as a service to criminal call centres, which used adverts promising quick profits from currency, shares or crypto. Victims were shown fake accounts with made-up gains to push them into paying more, then cut off when they tried to withdraw. The investigation began in 2022 after a German couple could not get their money back, and has linked the scam to victims in at least 50 countries.

Why it matters: Investment scams cause some of the biggest losses to ordinary people. Be wary of online adverts or cold calls promising fast, easy returns, and check that any investment firm is properly authorised (in the UK, on the FCA register) before sending money.

Sources

BleepingComputer

Breach3 Nov 2026

US school software firm Frontline Education says over 1.3 million staff and students had personal data stolen

Frontline Education, which makes administration software for US schools, is notifying people that hackers got into its systems on 14 and 15 August by exploiting a flaw in a third-party product. Data taken from its Frontline Central and School Health Management products may include names, Social Security numbers, dates of birth, driving licence and passport numbers, Medicaid IDs and student IDs. Frontline has not given a total, but filings in five US states add up to 1,298,917 people, and it has notified other states too, so the real number is likely higher.

Why it matters: Children's identity details are especially valuable to fraudsters because misuse can go unnoticed for years. Affected families should take up the free monitoring on offer, and parents can consider freezing their child's credit file where that is possible.

Sources