US Cybersecurity Briefing – Monday, Nov 2, 2026 (includes weekend)

The online fashion retailer told Texas regulators that 127,200 people in the state had data stolen, with 1,328 more in Vermont. The total is not disclosed. Stolen data covers names, contact information, card numbers and expiration dates for customers who saved payment details. Its Oct 29 8-K reports no material impact expected. Attack date, method detail and attacker are not disclosed. The Record's headline spells the company “Resolve”; the SEC filing confirms Revolve.

SEC 8-K →    The Record →

The plant operator notified the Texas AG of a breach exposing names, Social Security numbers and birthdates for 1,173 Texans, who were told by email. The notice does not say whether operating or safety systems were touched. An NRC spokeswoman said the agency is satisfied the plant “continues operating safely and securely.” Cause, attacker, and intrusion and discovery dates are not disclosed. The plant's owners are CPS Energy, Austin Energy and Constellation South Texas.

GovTech / San Antonio Express-News →    Claim Depot (exact count; law-firm solicitation page) →

Included because individual notices began Oct 26 and the student-data picture changed. Named Texas districts: Austin ISD (44,652), Killeen ISD (about 45,000), Klein ISD (about 37,966), plus Lubbock, Waco, Fort Worth, Crowley and Laredo ISDs, and San Antonio ISD (count not stated). Activity ran Aug 14–15 through an unnamed third-party product; no attacker is named. Exposed data includes names, addresses and Social Security numbers. Frontline told Texas districts no student data was involved, but Cybernews reports student data was affected through School Health Management, citing districts outside Texas. I found no report of Texas student records being exposed.

Action: Texas districts using School Health Management should confirm directly with Frontline whether student records were involved.

Cybernews →    Killeen ISD →

Iran's Tasnim News Agency, citing Russian outlet Neftegaz and unnamed sources, claims the Marshall Islands-flagged Botan was hit Oct 22 after leaving Singapore, disrupting cargo monitoring and control systems, and that the incident was reported confidentially to the US Coast Guard. I found no independent confirmation, so treat this as a claim from an Iranian outlet. Confirmed background: the Coast Guard said it and the FBI boarded two US-bound tankers in the Gulf Aug 21–24 after signs of network compromise.

Tasnim →    TechCrunch →

FLDOE learned of the breach Oct 19. Potentially exposed data includes Social Security numbers, names, birthdates, addresses, phones, emails and gender codes. The site was taken offline, and FLDOE says aid disbursements are not affected. Vector and attacker are not disclosed; it is an open criminal investigation.

FLDOE →    The Record →

Researchers at Dream report a suspected China-nexus actor, using an AI-assisted platform, scanned about 19,000 firewalls and gained root on 25 PAN-OS firewall and management servers in the US, Japan, Taiwan and South Korea. At least two US government servers and a US government-linked cloud environment were hit, followed by Active Directory enumeration and credential theft. Those victims are not publicly named. Palo Alto says about 0.02% of its installed base was exposed and potentially affected. Attribution is suspected, not confirmed.

Action: Restrict management access to trusted IPs and apply PAN-OS fixes.

Cybersecurity Dive →

The blockchain analysis firm says an outside actor reached internal tools and accessed customer user IDs, names, emails and role labels. It found no evidence of access to investigation content, credentials or session tokens. Attacker and entry point are not disclosed. Chainalysis says this is unrelated to the Binance theft. Customers should expect a per-organization breakdown and watch for unexpected password resets.

Chainalysis →

New York-based Polymarket loaded a page-speed script from DebugBear that was swapped for wallet-draining code after DebugBear's DNS records were compromised through its registrar. About $2.7 million was taken from 726 wallets. Polymarket halted trading, reset sessions and says it is refunding users. Attacker is not identified.

Action: DebugBear RUM customers should remove its embed code, as the vendor advised.

The Hacker News →    The Record →

A searchable archive holds data on more than 40,000 DHS staff, including CBP and ICE personnel. DHS contractor ZeroFox sought a takedown; host FlokiNET refused. The site went offline when registrar CentralNic acted, then returned under a new domain. DHS says only that it is aware of a “potential breach,” so the origin is unconfirmed.

CyberScoop →    this week in security →

Two anonymous sources say officials suspect Iran-linked hackers caused freezer malfunctions at around six commissaries, starting around late August. Cyber Command and Defense Department law enforcement are investigating. Attribution could change. Access method and freezer vendor are not disclosed.

Nextgov →

Honda took its iN portal offline as a precaution, leaving Honda and Acura dealers unable to submit credit applications, check recalls or order parts for about two days. Honda says it has no evidence customer data was accessed, and the investigation continues. Cause is not disclosed, and full recovery is unconfirmed.

DysruptionHub →

Included for the US attribution. The FBI, Secret Service and IRS-CI attribute the theft of more than $6 billion to TraderTraitor; published totals vary from $6.3 billion to $6.43 billion. About $2.85 billion has been frozen on-chain. I could not open the FBI notice itself, so this rests on The Hacker News' report of it.

The Hacker News →

CISA's pages and the Ivanti advisory would not open during this run, so KEV dates below come from secondary reporting, and any KEV addition made today is not reflected.

These join CVE-2026-104935 (KEV Oct 13) in a chain giving unauthenticated root. Threat actor UTA0576 used it to go after credentials, Active Directory metadata, admin passwords and BitLocker recovery keys, without deploying web shells or malware. No victims are named.

Action: Upgrade to 25.1.1.3 or 22.8R2.6. Because the actor leaves no malware, also review for credential exposure.

The Hacker News →    Security Affairs →

Unauthenticated code execution through a crafted regex in CI configuration. Named target: Alpine Linux, whose GitLab instance was attacked Oct 20–21. Alpine found no proof of compromise but could not rule it out, so it rebuilt the server and reset credentials.

Action: A newer GitLab alone may not be enough. If you supply your own Ruby, use 3.3.13, 3.4.12, 4.0.9 or later.

Alpine Linux →    The Hacker News →

Unauthenticated remote device reload via the Remote Access SSL VPN service where secondary authentication is configured in a tunnel group. Cisco confirms exploitation; no victims are named.

The Hacker News (fixed versions) →

Highly critical access bypass needing no authentication, with financial impact for merchants. No victims are named.

Action: Upgrade to 3.3.13 or 8.x-2.41, and audit orders for inconsistencies.

Drupal →

A race condition during core updates can lead to remote code execution. Wordfence blocked 62,969 attempts in 24 hours. Those are blocked attempts, not confirmed compromises, and no victims are named.

Action: Update to 7.1.4, released Oct 28, or the patched release on your older branch.

WordPress.org →    The Hacker News →

Certificate-chain flaw lets an attacker impersonate a trusted client using only its public certificate. Listed for severity, not exploitation. Incus has the same flaw, fixed in 7.6.0.

Action: Run snap refresh and verify the installed version. Restrict API network access until patched.

The Hacker News →

1. SEC – Revolve Group 8-K
2. The Record – Revolve payment card theft
3. GovTech – South Texas nuclear operator breach
4. Claim Depot – STP breach investigation
5. Cybernews – Frontline Education breach
6. Yahoo News – Austin ISD employee data
7. Killeen ISD – Frontline statement
8. KSAT – San Antonio ISD vendor breach
9. Texas Lawyer Referral Service – Frontline Texas districts
10. Tasnim – energy ship claims (unverified)
11. TechCrunch – FBI, Coast Guard tanker boardings
12. FLDOE – data breach notice
13. The Record – Florida financial aid breach
14. Cybersecurity Dive – Palo Alto PHP2Shell chain
15. Chainalysis – security incident
16. The Hacker News – Polymarket and DebugBear
17. The Record – Polymarket third-party attack
18. CyberScoop – DHS Icepick takedown
19. this week in security – Nov 1 edition
20. Nextgov – military base freezers
21. DysruptionHub – Honda dealer portal
22. The Hacker News – FBI Binance attribution
23. The Hacker News – Ivanti chain
24. Security Affairs – Ivanti KEV additions
25. Alpine Linux – GitLab incident
26. The Hacker News – GitLab and Cisco KEV
27. The Hacker News – Cisco ASA/FTD fixes
28. Drupal – SA-CONTRIB-2026-254
29. WordPress.org – version 7.1.4
30. The Hacker News – WordPress attack volume
31. The Hacker News – LXD and MicroCloud