Cybersecurity Briefing – Tuesday, Nov 3, 2026

Nothing new to report.

BYOD listed MSU on its leak site Sunday, claiming personal information on 1.3 million current and former students. MSU forced password resets for all student and employee accounts in early October after “suspicious cyber activity.” It calls this a potential credential compromise, and says it has no evidence of a successful breach of central Active Directory or of other data being accessed or stolen. The 1.3 million figure is unconfirmed, and MSU did not respond to The Record about the claim. BYOD emerged in September and is the group The Record says attacked the University of New Mexico last week, shutting down its hospital and diverting ambulances.

The Record →

CrowdStrike says Vapor Panda (also tracked as Storm-0940) has used the open-source Artex framework against more than 200 organizations in 14 countries since Oct 17. US targets were in pharmaceutical, defense, semiconductor, nuclear and financial sectors, and US telecom firms were compromised. At one US organization, an agent exploited SAML authentication and XML processing weaknesses to obtain cloud admin credentials. The BloodAlchemy backdoor was deployed at about nine organizations. No US victim is named, and I found no Texas link.

Action: Reduce internet exposure of admin interfaces, harden application management interfaces, and restrict identities and keys, as Google advises.

Cybersecurity Dive →    Check Point Research →

Google took down a botnet of more than 1.3 million Android devices, mostly set-top boxes. It says it is highly confident that Shenzhen-based Videostrong deliberately built the backdoor and sold access to criminals. The US had about 26,000 to 42,000 infected devices. Synthient links the MECOOL brand to Videostrong. TrendAI counted 1,472,554 infected devices overall.

Action: Keep unmanaged Android TV boxes off business and school networks.

The Hacker News →

The developer cloud platform told customers to treat all environment variables as decrypted after a Wiz alert on Oct 30, and users then reported unauthorized use of stored AI API keys. Its Nov 2 update says the attack was contained within an hour of the first alert, focused on control-plane secrets, and did not affect running workloads. Northflank also says it patched CVE-2026-98432 across its fleet, but has not said that flaw was the entry point. Root cause and customer count are not disclosed. Several components were still listed as major outages when checked. I did not confirm how many US customers are affected.

Action: Northflank customers should rotate all secrets, starting with AI provider, cloud, payment and database credentials, and review provider logs.

Northflank status →    teiss →

Included because it was not in earlier briefings and affected machines need cleanup. Version 2.1.313 of the extension sat on Cursor's VS Code Marketplace for about 11 hours and planted a persistent SSH backdoor on Windows, macOS and Linux while collecting usernames, Git emails and IP addresses. Up to 5,000 developers were allegedly infected. Cursor shut the marketplace down as a precaution. Anthropic says its own systems and official channels were not affected. How the package reached the marketplace is unexplained, and no attacker is named.

Action: Installing the latest version does not remove the persistence. Follow Cursor's advisory if 2.1.313 was installed.

The Register →

Overnight into Nov 2, attackers remotely changed refrigeration settings at stores in Belgium, Luxembourg, Sweden, Estonia, Ireland, the Netherlands, Finland, Portugal and Italy. Named chains are Delhaize, Carrefour, Intermarché, Spar (Colruyt Group), IKEA Mons, ICA, Coop, Musgrave/SuperValu, Selver, Kesko and Coop stores run by Radenza Group. Units were switched to defrost or had setpoints raised, with one freezer set to 50°C, and stores pulled or discarded food. No chain reported more than several dozen stores affected. Danfoss controllers are named, and CERT-FR's alert also covers Copeland and Dixell xweb devices. Entry points included internet-exposed controllers and default passwords. No one has claimed the attacks, and a link to the French attacks three weeks earlier is unproven. Belgium's federal prosecutor has opened a criminal investigation.

Action: Take refrigeration and building controllers off the public internet and change default passwords, including at US grocery, food and healthcare sites.

The Hacker News →    Security Affairs →

Late Nov 1, Kyiv residents received false Air Alert notifications warning of radiation, a chemical threat and street fighting. Ukraine's Air Force said the app had likely been compromised by the enemy. The developers disabled push notifications and suspended the service, and the threat map was still off Monday. The app had 6.6 million active users as of January, but the number who got the alerts is not reported. A group called DC8044 then said it breached Russia's EMERCOM app through its API and sent fake nuclear launch warnings. The ministry confirmed the hack but said its sirens, broadcasts and texts were unaffected, and Ukrainian officials said their national warning system was unaffected too. Both group claims are unverified, and how Air Alert was breached is unknown.

The Record →

The platform, which reports about 4.5 million customers, suspended all deposits and withdrawals Monday after a cyberattack. Blockchain security firms say more than $46 million left late Sunday, a figure the company has not confirmed. Tether froze about $4.5 million and other platforms about $2 million. Mercado Bitcoin says customers were not harmed and no data was breached, but several security experts dispute that, citing on-chain evidence that customer wallets were drained. Method and attacker are not disclosed.

The Record →

CISA's KEV catalog would not open during this run. I found no KEV addition dated Nov 2 or 3 in secondary reporting, but I cannot rule one out.

Missing authentication in the Node-RED HTTP interface lets an unauthenticated attacker run code with maximum privileges. VulnCheck saw attacks on its honeypots as of Oct 30, dropping a botnet binary or a persistent HTTP command backdoor. Those are honeypot observations, and no victims are named.

Action: Update to V4.3.4.1 or later. If you cannot, uninstall or harden Node-RED.

Siemens SSA-834709 →    The Hacker News →

Synology tied ransomware attacks on outdated NAS devices to advisory Synology_SA_24_20, which lists CVE-2024-10441 (CVSS 9.8), CVE-2024-50629 and CVE-2024-10445, without saying which one is being used. Owners report files locked with a .L0CK3D extension. No victim count or named organizations.

Action: Update DSM to at least 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 or 6.2.4-25556-8.

The Hacker News →

Versions 1.2.1 through 1.2.2 lack an authorization check on an AJAX endpoint, allowing unauthenticated file deletion, configuration overwrite and recovery of stored wallet credentials in cleartext. The plugin was closed on the WordPress directory on Aug 28. No victims are named.

Action: Remove the plugin, rotate wallet keys and audit for suspicious changes.

The Hacker News →

New since Monday's item: Volexity reports the UTA0576 activity evades Ivanti's Integrity Checker Tool, so a clean result does not rule out compromise. CISA also required agencies to do forensic triage for CVE-2026-111357. Victims are not named.

Action: After patching, hunt with Volexity's indicators and Rapid7's guidance, and preserve memory and logs before rebooting where feasible.

Help Net Security →

Listed for severity, not exploitation. These are an unauthenticated authentication bypass and unauthenticated code execution in versions 1.12.8 and earlier. A public Metasploit auxiliary module cites CVE-2026-93680, and six other Langflow flaws are already in KEV. IBM offers no workaround.

Action: Upgrade to 1.13.0.

The Hacker News →

1. The Record – Michigan State BYOD claim
2. Cybersecurity Dive – Artex espionage campaigns
3. Check Point Research – Nov 2 threat intelligence report
4. The Hacker News – Google disrupts Android botnet
5. Northflank – status page
6. teiss – Northflank incident
7. The Register – Cursor extension compromise
8. The Hacker News – European refrigeration attacks
9. Security Affairs – European supermarket fridge attacks
10. The Record – Air Alert and EMERCOM apps
11. The Record – Mercado Bitcoin
12. Siemens – SSA-834709
13. The Hacker News – Siemens IoT2050 exploitation
14. The Hacker News – Synology ransomware
15. The Hacker News – CryptoPayment Gateway
16. Help Net Security – Ivanti KEV additions
17. The Hacker News – Langflow flaws