Russian and Ukrainian Emergency Alert Apps Hacked, Fake Warnings Sent
November 3, 2026
Ukraine’s Air Alert app and Russia’s Emergency Ministry app were hacked to send fake nuclear, chemical and missile warnings, though
News
Russian and Ukrainian Emergency Alert Apps Hacked, Fake Warnings Sent
Ukraine's Air Alert app and Russia's Emergency Ministry app were hacked to send fake nuclear, chemical and missile warnings, though national alert systems held.
Unpatched CVSS 10.0 CryptoPayment Gateway Plugin Flaw Under Attack
Attackers are targeting CVE-2026-81648, an unpatched CVSS 10.0 flaw in the CryptoPayment Gateway WordPress plugin that exposes wallet credentials in cleartext.
Android November Bulletin Fixes 216 Flaws, Three Zero-Click RCEs
Google's November Android bulletin patches 216 vulnerabilities, including CVE-2026-58868 and two more zero-click critical RCE bugs; no exploitation reported.
Arista Patches Two CVSS 9.8 RCE Flaws Including HTTP2Shell
Arista fixed two CVSS 9.8 remote code execution flaws, HTTP2Shell in VeloCloud Orchestrator and a Linux kernel bug affecting access points and NDR devices.
Apache Fixes Eight Flaws in Syncope, Fineract and Arrow
Apache patched eight flaws in Syncope, Fineract and Arrow Rust, including CVE-2026-64618, a CVSS 9.8 SQL injection needing no login; no exploitation reported.
FBI Blames North Korea’s TraderTraitor for $6.3B Binance Theft
The FBI, Secret Service and IRS-CI attribute the roughly $6.3 billion Binance theft to North Korea's TraderTraitor and publish 628 addresses used to launder it.
Public Exploit Lets One SMS Crash Android Phones, Drop 911 Calls
A public proof-of-concept for CVE-2026-58882 shows one malformed WAP Push text can crash Android's phone process and loop devices; Android 12 and 13 lack a ...
Canonical Patches CVSS 10.0 LXD Flaw Letting Attackers Spoof Clients
Canonical fixed CVE-2026-112816, a CVSS 10.0 LXD and MicroCloud flaw that lets attackers authenticate as a trusted client using only its public certificate.
Rapid7 Releases Metasploit Module for BeyondTrust CVE-2026-102764
Rapid7 published a technical analysis and a working Metasploit module for CVE-2026-102764, a BeyondTrust Remote Support flaw already exploited in attacks.
Talos: VOLTA Infostealer Uses Claude and Gemini to Rank Victims
Cisco Talos details VOLTA-AUTODOXER, an infostealer that sends stolen victim data to Claude, Kimi or Gemini via OpenRouter to rank what each victim is worth.
Unpatched CVSS 10.0 CryptoPayment Gateway Plugin Flaw Under Attack
November 3, 2026
Attackers are targeting CVE-2026-81648, an unpatched CVSS 10.0 flaw in the CryptoPayment Gateway WordPress plugin that exposes wallet credentials in
Android November Bulletin Fixes 216 Flaws, Three Zero-Click RCEs
November 3, 2026
Google’s November Android bulletin patches 216 vulnerabilities, including CVE-2026-58868 and two more zero-click critical RCE bugs; no exploitation reported.
Arista Patches Two CVSS 9.8 RCE Flaws Including HTTP2Shell
November 3, 2026
Arista fixed two CVSS 9.8 remote code execution flaws, HTTP2Shell in VeloCloud Orchestrator and a Linux kernel bug affecting access
Apache Fixes Eight Flaws in Syncope, Fineract and Arrow
November 3, 2026
Apache patched eight flaws in Syncope, Fineract and Arrow Rust, including CVE-2026-64618, a CVSS 9.8 SQL injection needing no login;
FBI Blames North Korea’s TraderTraitor for $6.3B Binance Theft
November 2, 2026
The FBI, Secret Service and IRS-CI attribute the roughly $6.3 billion Binance theft to North Korea’s TraderTraitor and publish 628
Public Exploit Lets One SMS Crash Android Phones, Drop 911 Calls
November 2, 2026
A public proof-of-concept for CVE-2026-58882 shows one malformed WAP Push text can crash Android’s phone process and loop devices; Android
Canonical Patches CVSS 10.0 LXD Flaw Letting Attackers Spoof Clients
November 2, 2026
Canonical fixed CVE-2026-112816, a CVSS 10.0 LXD and MicroCloud flaw that lets attackers authenticate as a trusted client using only
Rapid7 Releases Metasploit Module for BeyondTrust CVE-2026-102764
November 2, 2026
Rapid7 published a technical analysis and a working Metasploit module for CVE-2026-102764, a BeyondTrust Remote Support flaw already exploited in
Talos: VOLTA Infostealer Uses Claude and Gemini to Rank Victims
November 2, 2026
Cisco Talos details VOLTA-AUTODOXER, an infostealer that sends stolen victim data to Claude, Kimi or Gemini via OpenRouter to rank
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.