Waper
Use on the web

Cybersecurity

Major breaches and actively exploited vulnerabilities, threat research worth reading, and the policy and business moves in security.

  • Official
  • Public
  • 0 followers
Sign up to followCustomize it
You're reading the brief from Mon, Nov 2.
Back to the latest brief

Google and partners disrupted a 1.3 million-device Android botnet, while active attacks continued against Ivanti gateways, GitLab servers and outdated BTCPay Server installations.

Cybersecurity6 items

New developments included Binance theft tracing and Polymarket’s reimbursement pledge.

New4

Breaches & attacks

Google disrupts Android botnet spanning more than 1.3 million devices

Google and industry partners dismantled the XCPE botnet, composed mostly of Android TV boxes. Google says manufacturer Videostrong intentionally installed a backdoor and sold criminals access for activities including ad fraud and routing traffic through owners’ home connections.

Why it matters: The case highlights supply-chain compromise in consumer devices that can turn ordinary home connections into criminal infrastructure.

Breaches & attacks

Suspected cyberattacks again disrupt supermarket refrigeration across Europe

Supermarket and grocery-store refrigerators across Europe appear to have been hacked early Monday. It was the second such incident in recent weeks involving manipulated temperature controls and spoiled stock.

Why it matters: Repeated interference with refrigeration demonstrates how suspected cyberattacks can produce immediate physical losses and operational disruption.

Threat research

Microsoft details Teams impersonation attacks exploiting certificate services

Microsoft investigated two intrusions in which attackers posed as IT support on Teams to obtain remote PC control. They exploited insecure Active Directory Certificate Services settings to obtain privileged login certificates, including one for a domain controller.

Why it matters: The findings connect employee impersonation with certificate-based privilege escalation, identifying a consequential path from remote support access to privileged accounts.

Follow-ups2

VulnerabilitiesFollows up on Sat, Oct 31:Attackers chain Ivanti Connect Secure flaws for unauthenticated root access

Ivanti patches two additional Connect Secure zero-days used in attack chains

Ivanti patched two more Connect Secure vulnerabilities chained in zero-day attacks since at least October 1. CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog.

Why it matters: Organizations running these remote-access gateways face confirmed exploitation and need to prioritize the additional fixes.

Ask Kiki about this brief

Sign in to ask questions about this brief.

Recent briefs

  1. Tue, Nov 38 itemsA hijacked security-tool update channel delivered backdoors to Linux servers, while active exploitation hit Siemens industrial devices, Node-RED and Synology NAS systems. Other major developments include a breach affecting over 1.3 million people and a cyberattack on Brazil’s largest cryptocurrency exchange.
  2. Mon, Nov 26 itemsGoogle and partners disrupted a 1.3 million-device Android botnet, while active attacks continued against Ivanti gateways, GitLab servers and outdated BTCPay Server installations. New developments included Binance theft tracing and Polymarket’s reimbursement pledge.
  3. Sun, Nov 15 itemsThe FBI attributed the Binance crypto theft to North Korea-linked TraderTraitor, while a hijacked third-party script cost Polymarket traders about $2.7 million. Alpine Linux rebuilt its GitLab server after an attempted exploit, and newly detailed vulnerabilities affect Canonical infrastructure and Android phones.
  4. Sat, Oct 318 itemsActive exploitation of Ivanti Connect Secure flaws and a remote-root Linux kernel vulnerability lead this edition. Northflank and Chainalysis disclosed breaches, while OpenAI fixed a flaw that could expose private ChatGPT conversations.
  5. Fri, Oct 308 itemsBinance reported a $6.3 billion theft, while Florida disclosed a financial-aid breach exposing 4.9 million people’s Social Security numbers. A compromised coding extension and active exploitation of GitLab, Drupal and PHP flaws add immediate priorities for security teams.
  6. Thu, Oct 296 itemsActive exploitation of Cisco firewall, PHP and Brotli vulnerabilities makes patch prioritization urgent. Major data exposures affected DHS personnel and Sony ISP customers, while a cyberattack forced Moldova to take more than 80 public services offline.
  7. Wed, Oct 288 itemsCISA confirmed active exploitation affecting Brotli and Adobe Commerce, while a Sony subsidiary disclosed a breach involving approximately 2.5 million customer records. Other major developments include widespread public-service disruption in Moldova and new details of PHP2Shell attacks.

Who and what it tracks

  • CISAOrganization8
  • GoogleCompany5
  • MicrosoftCompany4
  • CrowdStrikeCompany2
  • Palo Alto NetworksCompany1