WaperA hijacked security-tool update channel delivered backdoors to Linux servers, while active exploitation hit Siemens industrial devices, Node-RED and Synology NAS systems.
Cybersecurity8 items
Other major developments include a breach affecting over 1.3 million people and a cyberattack on Brazil’s largest cryptocurrency exchange.
cPGuard update channel hijacked to backdoor Linux servers
An attacker compromised cPGuard’s update system on November 2 and distributed a malicious script to customers’ Linux servers. According to maker OPSSHIELD, the script installed a backdoor and collected password hashes and sensitive files, some of which the attacker subsequently took.
Why it matters: The compromise turned a security tool’s trusted update mechanism into a route for server intrusion and credential theft.
Attackers exploit maximum-severity Siemens IoT2050 flaw to plant backdoors
VulnCheck reported active exploitation of CVE-2026-58115 in Siemens SIMATIC IoT2050 Advanced devices. The missing-authentication vulnerability has a CVSS score of 10.0 and allows unauthenticated remote attackers to execute arbitrary code.
Why it matters: Organizations using these industrial devices face an active route to remote compromise without stolen credentials.
Mercado Bitcoin confirms cyberattack as more than $46 million leaves platform
Mercado Bitcoin, Brazil’s largest cryptocurrency exchange, confirmed a cyberattack. Blockchain security companies reported that more than $46 million flowed out of the platform.
Why it matters: The reported outflows indicate potentially substantial financial exposure, though the item does not establish the exchange’s confirmed losses.
Frontline Education breach affects over 1.3 million people
Hackers exploited a vulnerability in third-party software and stole personal information belonging to school district staff and students. The Frontline Education breach affects more than 1.3 million people.
Why it matters: The incident highlights how a third-party software flaw can expose sensitive information across school communities.
Critical Node-RED vulnerability exploited to deploy bots and webshells
A critical Node-RED vulnerability is being exploited in attacks. Multiple attempts from the same IP address sought to deploy payloads including a Linux bot and webshells.
Why it matters: Observed payload deployment makes this an immediate exposure-review priority for organizations running Node-RED.
Synology warns ransomware attackers are exploiting patched DSM vulnerability
Synology urged customers to update DiskStation Manager after observing ransomware attacks against NAS devices running outdated versions. Attackers are exploiting a vulnerability patched in December 2024 to encrypt data and demand ransom.
Why it matters: Unpatched NAS devices remain exposed to attacks that can directly disrupt access to stored data.
LLMjacking victims face cloud AI charges reaching $1 million
Google reported that LLMjacking attacks are generating fraudulent cloud AI charges, with some organizations losing more than $100,000 daily. Research describes criminals reselling cloud LLM access, with some victims incurring as much as $1 million before access was revoked.
Why it matters: Compromised cloud AI access can create substantial financial losses even without data theft or service disruption.
CrowdStrike reportedly paying $495 million for Fiddler and Dreadnode
CrowdStrike is reportedly paying $495 million to acquire AI security firms Fiddler and Dreadnode. The acquisitions would add AI agent observability and automated AI security testing capabilities to its Falcon platform.
Why it matters: The reported deals signal further consolidation of AI security capabilities into major cybersecurity platforms.