Cyber Threat Intel Daily Briefing — 2026-11-05

CYBER THREAT INTEL

DAILY BRIEFING · 2026-11-05 12:15 UTC · REPORT BRIEF-20261105-121542

OPEN // LE

01

Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day

Tracked as CVE-2026-107441, the out-of-bounds write flaw could allow attackers to execute OS commands via crafted HTTP requests. The post Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day appeared first on SecurityWeek.

SRC: SecurityWeek Thu, 05 Nov 2026 10:56:41 +0000 https://www.securityweek.com/zyxel-switch-hacks-blamed-on-patched-flaw-actually-exploited-a-zero-day/

02

Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes

The large-scale watering hole campaign has been targeting entities in the US and Europe, mainly in Ukraine. The post Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes appeared first on SecurityWeek.

SRC: SecurityWeek Thu, 05 Nov 2026 10:37:13 +0000 https://www.securityweek.com/russia-linked-hackers-hit-ios-android-devices-with-exploit-chains-via-watering-holes/

03

OpenAI Finds GPT-6 Astra Quietly Holding Back on Internal Red-Teaming, Exploit Tasks

OpenAI says its Critical-rated cyber model met fewer hidden task goals when work was framed as AI safety research, often silently. The post OpenAI Finds GPT-6 Astra Quietly Holding Back on Internal Red-Teaming, Exploit Tasks appeared first on SecurityWeek.

SRC: SecurityWeek Thu, 05 Nov 2026 10:02:00 +0000 https://www.securityweek.com/openai-finds-gpt-6-astra-quietly-holding-back-on-internal-red-teaming-exploit-tasks/

04

GhostMap Android flaw lets malicious app trigger persistent boot loop

Attackers can force Android devices into a continuous boot loop using a specially crafted app that requires no permissions and only needs to be installed. […]

SRC: BleepingComputer Thu, 05 Nov 2026 04:18:29 -0500 https://www.bleepingcomputer.com/news/security/ghostmap-android-flaw-lets-malicious-app-trigger-persistent-boot-loop/

05

Russian APT29 Targets Mobile Users with Watering Hole Attacks

Russia-linked group APT29 targeted iOS and Android users through hijacked websites and a compromised analytics service. Sekoia says a large-scale watering hole campaign is going after iOS and Android users, and it links the campaign to APT29 (aka SVR group, Cozy Bear, Nobelium, BlueBravo, Midnight B

SRC: Security Affairs Thu, 05 Nov 2026 10:00:52 +0000 https://securityaffairs.com/202473/apt/russian-apt29-targets-mobile-users-with-watering-hole-attacks.html

06

Want to Rent an Internet Address at the White House?

Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder's web hosting business was g

SRC: Krebs on Security Thu, 05 Nov 2026 04:36:17 +0000 https://krebsonsecurity.com/2026/11/want-to-rent-an-internet-address-at-the-white-house/

07

Building on open source AI? Hugging Face’s policy chief on the costs, risks, and trade-offs

Open source models are becoming more mainstream as enterprises, governments and startups alike rely on the promise of lower costs, more control, and more flexibility. But as increasingly capable models become more freely available, how do companies capture value? And with Chinese open models gaining

SRC: TechCrunch Security Wed, 04 Nov 2026 18:44:57 +0000 https://techcrunch.com/podcast/building-on-open-source-ai-hugging-faces-policy-chief-on-the-costs-risks-and-trade-offs/

08

Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root

A flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own. The attacker's code then runs as root, according to advisories that Debian, Ubuntu, and APT's developers published on November 4. The attack needs A

SRC: The Hacker News Wed, 04 Nov 2026 22:30:46 +0530 https://thehackernews.com/2026/11/debian-and-ubuntu-apt-flaw-lets-mitm.html

09

5 Active Cyber Threats That Put US Enterprises at Risk in October 2026

October 2026 brought another wave of cyber threats targeting US businesses, with attackers exploiting trusted platforms, legitimate authentication processes, and everyday business workflows. For enterprises, these campaigns raise the stakes beyond individual security incidents, increasing the risk o

SRC: The Hacker News Thu, 05 Nov 2026 15:36:19 +0530 https://thehackernews.com/2026/11/5-active-cyber-threats-that-put-us.html

10

Vercel rolls out new protection against stolen session cookie attacks

Vercel is gradually rolling out Device Bound Session Credentials (DBSC) on its platform as a key defense against information stealer malware. […]

SRC: BleepingComputer Wed, 04 Nov 2026 16:31:18 -0500 https://www.bleepingcomputer.com/news/security/vercel-rolls-out-new-protection-against-stolen-session-cookie-attacks/

11

DreamHost confirms data breach exposed FTP logins and webmail sessions

DreamHost is warning of a data breach after attackers gained access to its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords. […]

SRC: BleepingComputer Wed, 04 Nov 2026 14:05:19 -0500 https://www.bleepingcomputer.com/news/security/dreamhost-confirms-data-breach-exposed-ftp-logins-and-webmail-sessions/

12

NIKKE PC game launcher hacked to spread remote access, data-stealing malware

The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game's PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data. […]

SRC: BleepingComputer Wed, 04 Nov 2026 11:58:46 -0500 https://www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/

13

CISO Conversations: Ryan Davis – The Unknown Is Where Security Meets Reality

Ryan Davis went from hacking his school’s network to running security at New Charter Technologies. What worries him now is shadow AI. The post CISO Conversations: Ryan Davis – The Unknown Is Where Security Meets Reality appeared first on SecurityWeek.

SRC: SecurityWeek Thu, 05 Nov 2026 11:00:00 +0000 https://www.securityweek.com/ciso-conversations-ryan-davis-the-unknown-is-where-security-meets-reality/

14

Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content

Apple has revealed that it plans to start checking public iCloud links for harmful content starting with iOS 27.3, iPadOS 27.3, macOS 27.3, and visionOS 27.3. The change specifically applies to scenarios where users share iCloud content, such as photos in iCloud Photos or files in iCloud Drive, by

SRC: The Hacker News Thu, 05 Nov 2026 14:43:28 +0530 https://thehackernews.com/2026/11/apple-to-start-scanning-publicly-shared.html

15

CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access

The Indian Computer Emergency Response Team (CERT-In) has disclosed that an artificial intelligence (AI)-assisted threat actor it tracks as Crafty Falcon is targeting organizations in the Banking, Financial Services, and Insurance (BFSI) sectors in the country. Describing the threat as active and o

SRC: The Hacker News Thu, 05 Nov 2026 14:12:03 +0530 https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html

16

U.S. Charges Canadian Man in Alleged Hack of University Supercomputers

A Canadian man was extradited to the U.S. to face charges over hacking universities and hijacking their computers to mine cryptocurrency. A Canadian man, Ryan James Roach (35), has been extradicted to the United States to face charges tied to a hacking operation that targeted universities and other

SRC: Security Affairs Thu, 05 Nov 2026 06:20:56 +0000 https://securityaffairs.com/202449/cyber-crime/u-s-charges-canadian-man-in-alleged-hack-of-university-supercomputers.html

[ SOURCE ] OpenPhish (18 indicator(s))