Stay Safe OnlineDaily cyber news

Today's briefing

Thursday 5 November 2026

French bank Crédit Mutuel Arkéa confirms hackers moved an estimated $133 million out of its own account, Zyxel fixes a switch flaw that was hacked on nearly 1,000 devices while everyone thought it was already patched, Russian state hackers rig popular websites to break into phones, plus a hosting company wiped in Russia, French blood stores hit by the freezer hackers, DreamHost and NIKKE breaches, a Debian and Ubuntu package flaw and an extradition over university cryptomining.

9 stories

French bank Crédit Mutuel Arkéa confirms a 'sophisticated' cyber heist, with an estimated $133 million stolen
Image: The Record
Breach

French bank Crédit Mutuel Arkéa confirms a 'sophisticated' cyber heist, with an estimated $133 million stolen

Crédit Mutuel Arkéa says attackers got in through the systems of one of its suppliers and then used the bank's own account to send money to other banks, where it was turned into cryptocurrency. Blockchain investigator ZachXBT first flagged the theft and put it at more than $133 million; the bank wouldn't confirm the exact figure but said the order of magnitude was right. Some of the money has been frozen, and the bank says customer accounts weren't touched.

Why it matters: It's another big theft that started with a trusted supplier rather than the bank itself. Arkéa customers don't need to do anything, according to the bank, but it's a reminder that a company is only as secure as the partners connected to it.

Sources
Zyxel fixes a hidden zero-day used to hack nearly 1,000 network switches, after attacks were blamed on an older, already-patched bug
Image: BleepingComputer
Vulnerability

Zyxel fixes a hidden zero-day used to hack nearly 1,000 network switches, after attacks were blamed on an older, already-patched bug

Hackers broke into 996 Zyxel GS1900 office switches in 48 countries and stole their settings and passwords. Researchers first thought the attacks used a flaw Zyxel had fixed in June, but firmware security firm Binarly found the attack tool worked even on patched switches. Zyxel released new firmware on October 22 for the new flaw, CVE-2026-107441, which lets someone take over the switch without logging in.

Why it matters: If you run a Zyxel GS1900 switch, the June update wasn't enough: install the October firmware, and don't leave the management page reachable from the internet.

Sources
Russian state hackers rigged real and fake websites to break into iPhones and Android phones just by visiting them
Image: BleepingComputer
Threat

Russian state hackers rigged real and fake websites to break into iPhones and Android phones just by visiting them

Security firm Sekoia says the Russian group APT29 planted code on hacked websites in the US, Ukraine and Bulgaria, on lookalike sites, and in a web analytics tool used by thousands of Ukrainian sites. The code checked each visitor's phone and browser, then used known, already-fixed bugs to steal cookies, passwords and chat app data without any tap from the user. The US cyber agency CISA has now added one of the Apple flaws to its list of bugs being actively exploited.

Why it matters: Every flaw used has a fix, so the defence is simple: keep your phone and browser updated. A restart also cleared the malware, because it didn't stay on the device.

Sources
Cyberattack wipes cloud servers at Beget, one of Russia's biggest web hosts, knocking hundreds of sites offline
Image: The Record
Outage

Cyberattack wipes cloud servers at Beget, one of Russia's biggest web hosts, knocking hundreds of sites offline

Attackers got into the systems Beget uses to manage its infrastructure and ran scripts that erased data, hitting its virtual servers, cloud storage and Kubernetes services hardest. Beget says it lost all whole-server backups of its virtual servers, though file backups survived, and that more than 1,000 servers must be checked by hand before coming back. Nobody has claimed the attack.

Why it matters: It shows how much damage a single break-in to a provider's management tools can do. Keeping your own backups somewhere separate from your host is what saves you when the host itself is hit.

Sources
Freezer hacks update: attackers turn up the temperature on blood storage at France's national blood service
Image: BleepingComputer
Outage

Freezer hacks update: attackers turn up the temperature on blood storage at France's national blood service

France's blood service, EFS, says a cyberattack on its refrigeration supplier raised temperature and defrost settings at three of its sites on November 2. Alarms caught it quickly, staff moved the plasma and other products, and no blood was lost. It follows the attacks on supermarket fridges across Europe over the past few weeks.

Why it matters: The fridge attacks have moved from shop food to medical supplies. Anyone running internet-connected cooling or building controls should take them off the open internet and check for updates.

Sources
Web host DreamHost says hackers sat in its File Manager for two months and took customers' FTP logins
Image: BleepingComputer
Breach

Web host DreamHost says hackers sat in its File Manager for two months and took customers' FTP logins

DreamHost says attackers used a software flaw to get into the server behind its web-based File Manager and grabbed the FTP and SFTP usernames and passwords of people who used it between August and October 23. Some webmail sessions may also have been exposed. It found no sign that control panel logins or payment details were taken.

Why it matters: If you host with DreamHost, check your website files for changes, review your email forwarding rules, and change any other account that shared the same password.

Sources
Hackers tampered with the PC launcher of hit game NIKKE to plant password- and crypto-stealing malware
Image: BleepingComputer
Supply chain

Hackers tampered with the PC launcher of hit game NIKKE to plant password- and crypto-stealing malware

The makers of Goddess of Victory: NIKKE confirmed the PC launcher's script files were tampered with and pushed a fix on November 4. A security researcher says the scripts on the official download network were changed in late September to fetch a backdoor that could run commands, take screenshots and steal browser data; BleepingComputer found it could also target crypto wallets. It isn't yet known how many players were affected.

Why it matters: If you play NIKKE on PC, update the launcher, run a full antivirus scan and follow the publisher's instructions for checking your computer; change important passwords from a clean device if anything turns up.

Sources
Flaw in Debian and Ubuntu's software installer could let someone on the network swap in a booby-trapped package
Image: The Hacker News
Vulnerability

Flaw in Debian and Ubuntu's software installer could let someone on the network swap in a booby-trapped package

A bug in APT, the tool Debian and Ubuntu use to install software, lets an attacker who can tamper with downloads, such as a bad mirror or proxy, replace a verified package with their own and run code as the all-powerful root user. It relies on APT retrying failed downloads, which is on by default from Debian 12 and Ubuntu 22.04. Debian has fixes out and Ubuntu is rolling them out now.

Why it matters: Linux servers and PCs on Debian or Ubuntu should update APT itself as soon as the fix arrives. No attacks have been reported yet.

Sources
Canadian man extradited to the US, accused of hacking university supercomputers to mine cryptocurrency
Image: The Record
Law & order

Canadian man extradited to the US, accused of hacking university supercomputers to mine cryptocurrency

US prosecutors have charged two Canadian men with breaking into schools and universities in New York, Tennessee, North Carolina and Massachusetts between 2016 and 2019, stealing logins and using the computers to mine cryptocurrency. One was extradited last week and appeared in court in Rochester, New York; the US is still seeking the other.

Why it matters: It shows cybercrime cases can catch up with suspects years later as more countries agree to hand them over.

Sources