Cybersecurity briefing, 2026-11-04

Here's a thought for your standup.

• PHP2Shell chain now reaches root on firewalls
• WordPress upgrade window opens a path to server code
• Russian-linked hackers exploit routine iOS and Android browsing
• CryptoPayment Gateway flaw exposes stored wallet keys
• Binance's hiring lure reached wallet transaction systems
• cPGuard update hijack left Linux server credentials exposed
• Node-RED attacks add persistent command backdoors
• Copeland XWEB attacks reach British food suppliers
• LLM Mixers turn stolen AI access into costly resale
• Ivanti's second patch closes the chain, not prior exposure
• Gorbag shifts to WinRAR archives for quick credential theft
• Outdated BTCPay Server instances face hot-wallet theft
• Synology ransomware targets outdated DSM as flaw remains unknown
• 3AM ransomware crossed school domains from an unmanaged host
• Vapor Panda used ARTEX to spray passwords and plant backdoors

Recent editions

• Tuesday, November 3, 2026: Node-RED attacks add persistent command backdoors · 20 stories
• Monday, November 2, 2026: Ivanti's second patch closes the chain, not prior exposure · 20 stories
• Sunday, November 1, 2026: DebugBear snippet let attackers trade through Polymarket sessions · 6 stories
• Saturday, October 31, 2026: PAN-OS PHP2Shell chain stole Active Directory credentials · 16 stories
• Friday, October 30, 2026: Cisco VPN flaw reboots firewalls as Volt Typhoon targets control planes · 19 stories
• Thursday, October 29, 2026: DHS leak maps undercover work and application access · 18 stories
• Wednesday, October 28, 2026: Apple extends exploited CoreGraphics fix to iOS 18 · 18 stories