Cybersecurity Briefing – Wednesday, Nov 4, 2026

New since Monday's item is the scale. State filings show 778,372 people in Texas, against 16,550 in Massachusetts, 7,475 in New Hampshire and 2,985 in Vermont, so Texas is about 97% of those four states. SecurityWeek's Nov 3 headline puts the total above 1.3 million; I could open only an index summary of that story, so how the total was built is unconfirmed. Frontline's notice says activity ran Aug 14–15, affected parts of Frontline Central and School Health Management, and may include Social Security, driver's license, passport, Medicaid and student ID numbers. Named Texas districts include Austin, Killeen, Klein, Lubbock, Waco, Fort Worth, Crowley, Laredo, San Antonio and Sherman ISDs. No attacker is named and the third-party product is not identified.

Action: Texas districts should confirm with Frontline whether student records were involved, and warn staff about follow-on phishing.

teiss →    Frontline notice →    IT Security News (SecurityWeek summary) →

Abrigo disabled Sageworks Oct 30 after “irregular activity” and on the evening of Nov 2 confirmed a data security incident. Sageworks Analyst, the Sageworks API and Online Portal Now were affected. Most service returned Nov 2, but borrower-facing features, including the online loan application portal, stayed offline, and the status page showed the incident as unresolved Tuesday morning. Abrigo says the access is contained. It has not said whether customer data was accessed or taken; the platform stores tax returns, financial statements, rent rolls and credit reports. Abrigo serves more than 2,400 institutions across all products. The number using Sageworks, and any named Texas banks, are not public.

Action: Banks and credit unions on Sageworks should ask Abrigo for scope, and rotate API credentials if the vendor advises it.

American Banker →    Accel-KKR (HQ) →

An unauthorized party accessed HCA IT systems on Aug 12 and copied files. Medical residents' HR data (Social Security numbers, birth dates, immigration information) and patient data at certain affiliated facilities and physician offices were exposed, including medical and insurance information. HCA has not released a total, and the affected facilities are not named. No attacker is identified. HCA says it has no indication the data was published or misused.

Becker's →    HIPAA Journal →

UTA told students and employees it is investigating possible unauthorized activity in some IT systems. MachForms, used for event registration, prospective student inquiries, service requests and surveys, went down Oct 27 and remains affected. UTA has not determined whether other systems are involved and gives no restoration date. Whether data was accessed is not reported, and no group has been named. This rests on one report; I could not find UTA's own notice.

The Cyber Express →

Malwarebytes found a total of 1,515,073 in data returned by the Texas AG breach site, alongside the 127,200 Texans already reported. The total is not on the public listing, and Revolve has not confirmed any nationwide count. The Texas record lists the incident as Sept 11, discovered Sept 29. No attacker is identified.

Malwarebytes →

The telepsychiatry provider (Blossom BH Opco Inc.) says an attacker phished a non-employee contractor in August and reached its electronic health record software, downloading a limited number of medical records and a patient spreadsheet. Blossom says Social Security numbers and financial data were not accessible. The total is not disclosed.

HIPAA Journal →

The 21-hospital system said Nov 2 that systems remain offline, including the MyChart portal, with no restoration timeline. Hospitals and emergency departments are open, but pre-authorizations are disrupted and some appointments and elective procedures have been rescheduled. Whether ransomware was involved is not disclosed, no group has claimed it, and the scope of patient data is undetermined.

HIPAA Journal →

A Nov 3 email to current and former customers told them to change passwords, reset 2FA and remove passkeys. It does not say what happened, whether vault data was exposed, or whether the activity has stopped. The text comes from a customer's post on the support forum; I found no formal vendor advisory.

Action: Any mSecure users should follow the email and treat stored credentials as potentially exposed until the vendor says more.

The Hacker News →

The blockchain infrastructure provider says an attacker reached a development environment Oct 26 and parts of production Oct 29, and was cut off Oct 31. Organization and account names, member emails and password hashes may be exposed. Chainstack says it links this to a broader AI-powered campaign; a tie to the China-linked Artex cluster is The Hacker News' reported assessment, not a confirmed attribution. Listed for US customers; I did not confirm the company's headquarters or customer count.

Action: Customers should rotate node credentials, regenerate API keys and change passwords.

Chainstack →    The Hacker News →

Included because it was not in earlier briefings. Schools closed for two days and reopened Oct 21 using non-digital teaching. The superintendent says some data from local machines was compromised, core systems stayed secure, and the district refused to pay on FBI guidance. The group is not named, and the forensic review continues.

GovTech →

Overnight Nov 1–2, attackers reached EFS cold rooms through its service provider Coolworld, notably in Bourgogne-Franche-Comté, changing setpoints from -30°C to 110°C. That is the programmed setting; the peak temperature reached is not disclosed. A technician caught the rise, no losses are reported, and the health ministry says patients and the transfusion chain were unaffected. In the UK, wholesaler Langridge Organic and three unnamed meat suppliers were attacked; none lost stock, and those suppliers used Copeland XWEB controllers (firmware 1.12.1 and earlier, fix available since August). The NCSC calls national impact “minimal” so far. The European Commission convened its cyber task force Tuesday. No one has claimed the attacks, and no link between the EFS and supermarket incidents is established.

Action: Texas hospitals, blood centers and grocers should find internet-exposed refrigeration controllers, and ask maintenance vendors how they reach them remotely.

L'Express via Orange →    The Record →

Binance described a months-long campaign. An engineer downloaded malware posing as an AI coding tool in June, another engineer's device was compromised in September through a fake job interview with a malicious code repository, and attackers reached critical wallet tools Oct 29. They used an internal wallet signing service and stolen employee credentials across 50-plus transactions; about $2.85 billion was frozen. North Korea denied involvement Monday.

Action: Warn engineers about take-home coding assignments from recruiters, and review who can reach signing and deployment tools.

The Record →

Apple's threat notifications reached targets in 99 countries. In Germany, Spiegel reports they went to members of a delegation of ministry staff, lawmakers and journalists who traveled with Chancellor Friedrich Merz to South Korea, Japan and Singapore. Green Party co-leader Franziska Brantner says she was a target. Germany's BSI told recipients to assume their devices are infected and replace them. How many devices were actually infected is unknown.

The Record →

CISA's site would not open during this run, so the KEV details below come from secondary reporting. A GitHub copy of the catalog showed nothing newer than Oct 30, so it looked out of date and I cannot rule out other additions.

This is the update-window race condition listed Monday, now with a CVE. An unauthenticated attacker must hit a short window during a full core update, using predictable staging paths, to run code. Wordfence reported 12,632 blocked attacks in 24 hours. CVSS is 8.1, though WordPress's own advisory rates it Low. Those are blocked attempts, and no victims are named.

Action: Update to 7.1.4 or your branch's patched release (backported to 4.7.39).

WordPress advisory →    The Hacker News →

On Nov 2 an attacker used stolen credentials on the update CDN to push a backdoor and data-collection script for the Linux web-server security suite. It targeted /etc/shadow, root MySQL configuration, shell history and SSH files. OPSSHIELD told BleepingComputer 2,946 servers were affected; its billing database was also copied. No customers are named, and I found no Texas link.

Action: Update to 5.88.25 or later. If an affected version ever installed, treat the server as compromised and rotate root, database and cloud credentials and SSH keys.

OPSSHIELD →    BleepingComputer →

Bitquery counted 682 sweeps worth about $1.62 million, most on Nov 1. Whether the attacks use the August credential-theft flaw fixed in 2.4.2 is not confirmed. No victims are named.

Action: Upgrade to 2.4.7 and move funds out of hot wallets on older instances.

The Hacker News →

A pre-authentication bypass in Email Security Gateway (CVSS 9.3) can chain with command injection (CVSS 8.6) across ESG, Load Balancer ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway to reach root. Both need administrative interface access.

Action: Install the latest firmware and restrict admin interfaces to trusted internal networks.

Barracuda →

A use-after-free that can lead to remote code execution. The kernel CVE team and Red Hat rate it 9.8; Amazon Linux rates it 8.1. A private root exploit exists against servers with an MPTCP listener, per Anthropic; public proof-of-concept code does not achieve code execution. Red Hat shipped fixes Nov 1. Ubuntu's are still in testing.

Action: Patch and reboot RHEL systems. Track Ubuntu's release.

The Hacker News →

1. teiss – Frontline state filing figures
2. Frontline Education – breach notice
3. IT Security News – summary of SecurityWeek's 1.3M report
4. Sherman ISD – security notice
5. American Banker – Abrigo incident
6. Accel-KKR – Abrigo profile
7. Becker's – HCA breach
8. HIPAA Journal – HCA and Blossom Health
9. The Cyber Express – UTA MachForms
10. Malwarebytes – Revolve total
11. HIPAA Journal – University Hospitals
12. The Hacker News – mSecure
13. Chainstack – incident report
14. The Hacker News – Chainstack
15. GovTech – Jerome School District
16. L'Express via Orange – EFS cold rooms
17. The Record – UK fridge attacks
18. Cybersecurity Dive – European refrigerator probe
19. The Record – Binance post-mortem
20. The Record – German Apple spyware warnings
21. WordPress – GHSA-4w3m-c66w-69mg
22. The Hacker News – WordPress KEV addition
23. OPSSHIELD – cPGuard notice
24. BleepingComputer – cPGuard
25. The Hacker News – BTCPay Server
26. Barracuda – security advisory
27. The Hacker News – Linux TCP flaw