Google Threat Intelligence Group said on 3 November 2026 that last week Google and industry partners dismantled the XCPE backdoor, which enrolled more than 1.3 million set-top boxes into a botnet, and that it assesses with high confidence the backdoor and botnet were intentionally developed, deployed and operated for financial gain by Videostrong Technology Co., an Android device manufacturer. Google says the malware was built directly into many device models and brands over multiple years, runs with Android system privileges, reinstalls itself from the /oem/ partition on reboot if a user removes it, and was used to sell access to criminal affiliates whose modules carried out ad fraud, silently enrolled devices into residential proxy networks and loaded further malware; it also says it observed Videostrong operators capturing live screenshots, injecting keystrokes, exfiltrating account information, device information and system logs, and establishing reverse shells on devices. Google says it took legal action to take down the domains and servers Videostrong used and the command-and-control domains of more than a dozen malware families loaded through the backdoor, which it assesses will sever access to at least 10 million additional compromised devices; banned Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors; and changed its review process after Videostrong used obfuscation to load malicious code after a device's first boot. Google says it worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. (source: Google Threat Intelligence Group) According to BleepingComputer, the takedown does not remove the malware from infected devices, so users would need to install clean firmware or disconnect the device from the internet. (source: BleepingComputer)
Google Threat Intelligence Group — Shutting the Door on the XCPE Botnet (3 Nov 2026)
Michigan State University told The Record that it became aware of suspicious cyber activity in early October 2026 and immediately began investigating. To protect accounts and systems, the university's IT team required everyone with an MSU NetID to reset their password to a new one of at least 15 characters, in an email sent to campus on 1 October, The Record reports. A spokesperson said that, based on the investigation to date, the activity appeared to be a potential credential compromise, that current evidence does not indicate a successful compromise of the university's central Active Directory environment, and that there is no evidence other MSU data was accessed, changed or stolen. According to The Record, the BYOD ransomware gang claimed responsibility. University officials said the claims were tied to the October incident, and the university did not respond to follow-up questions about them, The Record reports. MSU has not confirmed any data theft. (source: The Record)
The Textpattern CMS project released Textpattern 4.9.2 on 2 November 2026 as a patch release with security fixes, and says versions before 4.9.2 are affected unless stated. The issues, reported by third-party researchers, are: an authentication issue with concurrent logins and cookies; content sandboxing of preview frames (with a new admin-side Content Security Policy layer); unsanitised 'sort' attributes in the authors and file_download tags; inconsistent sanitising of the 'url_title' attribute; a user-privilege cross-site request forgery mitigated with CSP; cross-site request forgery in the theme import workflow; missing validation of administrative user status on the Users panel; and an arbitrary file write through XML-RPC, which the project links to CVE-2026-5344. The project gives no severity ratings and says it will update the post with CVE assignments. (source: Textpattern)
Textpattern — Textpattern 4.9.2 released: security fixes, patches and tweaks (2 Nov 2026)
Google published the Android Security Bulletin for November 2026 on 2 November 2026. It lists 208 vulnerabilities across two security patch levels: 113 at 2026-11-01 (Android runtime, Framework and System) and 95 at 2026-11-05 (kernel components and Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm components), and says devices on patch level 2026-11-05 or later are protected against all of them. Google says the most severe is a Critical flaw in the Framework component that could lead to remote code execution with no additional execution privileges and no user interaction; that entry is CVE-2026-58868 (Android 14 to 17). Of the 208, 23 are rated Critical: at 2026-11-01, CVE-2026-58868 (Framework, remote code execution) and, in System, CVE-2026-58876 and CVE-2026-58936 (remote code execution), CVE-2026-55275, CVE-2026-55283 and CVE-2026-58984 (privilege escalation) and CVE-2026-58814 and CVE-2026-58882 (denial of service); at 2026-11-05, six upstream Linux kernel flaws in Bluetooth (CVE-2026-53256, CVE-2026-89774), pKVM (CVE-2026-59044, CVE-2026-59045, CVE-2026-59048) and HID (CVE-2026-80604), eight MediaTek modem flaws (CVE-2026-20499, CVE-2026-20519, CVE-2026-20520, CVE-2026-20545 to CVE-2026-20549) and one Qualcomm closed-source flaw (CVE-2026-25285). Google says the most severe kernel-component issue could lead to remote escalation of privilege with no user interaction. Some fixes also ship as Google Play system updates (Media Codecs, MediaProvider, Profiling, Telephonycore and Wi-Fi). The bulletin does not flag any of these as exploited, and Google says AOSP source patches follow within 48 hours of publication. (source: Android Security Bulletin)
Android Security Bulletin — November 2026 (published 2 Nov 2026)
Russia's federal statistics agency, Rosstat, confirmed that it had been targeted by a cyberattack, according to The Record. In a statement to Russian state news agency TASS, Rosstat said its security systems had detected suspicious activity in time for specialists to respond, that it had found no evidence that protected information had been leaked or its databases compromised, and that it was working with cybersecurity experts and law enforcement to identify the source of the attacks, according to The Record. The Record reports that groups claimed responsibility and that their claims could not be independently verified. (source: The Record) Correction (03 Nov 2026): the card date has moved from 3 to 2 November 2026, the date The Record shows on its report. (source: The Record)
Fortinet's FortiGuard Labs published research on 2 November 2026 on a campaign it attributes to BITTER, which it describes as a suspected South Asian cyberespionage group active since at least 2013 that has targeted the government, energy and engineering sectors. Over several months FortiGuard tracked attacks on South Asian organisations using PowerShell scripts and a custom remote access trojan it calls PapRAT, delivered through three infection chains: an LNK file that abuses the native Windows ftp.exe utility to run scripts and create scheduled tasks that keep in contact with the attacker's server; a VHDX disk image whose LNK opens a decoy spreadsheet while silently running an MSI installer that deploys PapRAT; and a RAR archive holding a .url shortcut that combines the first two. PapRAT poses as a Microsoft component (bruzsvc.exe) and supports remote shell commands, file upload, download, deletion and execution, directory and drive listing and screenshots; a newer Rust variant expands the command set from eight to eleven, adding PowerShell execution, a sleep directive and a clean exit command. FortiGuard says a secondary payload downloaded through PapRAT was WmRAT, which it cites as a further indicator linking the activity to BITTER, and that its telemetry shows targets concentrated in South Asia. Lure names include a request for a bilateral meeting during the 22nd HACGAM and a letter about the 11th Belt and Road Summit. (source: FortiGuard Labs)
FortiGuard Labs — BITTER Expands Its Arsenal with PapRAT (2 Nov 2026)
BTCPay Server, the open-source self-hosted cryptocurrency payment processor, said on 2 November 2026 that it received reports on 1 November of Bitcoin and Litecoin being stolen from hot wallets on BTCPay Server instances, and that its investigation found the attacks targeted servers running version 2.4.1 (released 23 July 2026) or earlier. The project says the attackers used a different method to exploit the vulnerability fixed in 2.4.2 (released 7 August 2026); it has not named a CVE. Its timeline, converted to Perth time, records a wallet drain at 21:46 on 1 November, the first theft report by email at 04:56 on 2 November, and a warning on X at 06:25 on 2 November asking operators to shut down their servers; it also asked VPS hosting providers, including LunaNode, to take BTCPay Server instances offline as a precaution. BTCPay says it has seen no impact on servers that were already running 2.4.2 or later when it issued that warning, that funds in wallets whose spending keys are held off the server, including hardware wallets, were unaffected, that it has not established when exploitation began, and that activity at the reported destination addresses should not be treated as a confirmed total of losses. (source: BTCPay Server) According to BleepingComputer, on 29 October BTCPay disclosed a critical vulnerability discovered through Anthropic's Frontier OSS scanner, which prompted the release of version 2.4.7 as an emergency security update, and BTCPay says it has no credible reports of hot wallet drains for users running 2.4.7. (source: BleepingComputer) Correction (02 Nov 2026): removed BTCPay Server's posts on X as a source; removed details no other source gives. (source: BTCPay Server; BleepingComputer)
BTCPay Server — Security Incident Affecting BTCPay Server 2.4.1 and Earlier (2 Nov 2026)
Apache's CVE record for CVE-2026-118636, published on 1 November 2026 (4:17 am Perth), is marked 'UNSUPPORTED WHEN ASSIGNED'. It says JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain remote code execution. The record lists Apache MINA 3.0.0 through 3.0.0-M2 as affected, describes the severity as critical and gives a CVSS 3.1 base score of 9.8. Apache says that as the 3.0.0 branch is inactive it does not plan to release a version that fixes the issue, and recommends users move to the latest Apache MINA 2.2.x branch; MINA's download page lists Apache MINA 2.2.10 as the stable release (Java 8+). (sources: CVE-2026-118636 record; Apache MINA downloads page)
CVE.org — CVE-2026-118636: Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder (CNA: Apache; published 1 Nov 2026, Perth)
Cisco Talos said in a blog post dated 31 October 2026 that a self-deleting Windows infostealer that names itself VOLTA-AUTODOXER (VOLTA) harvests browser passwords, cookies, payment cards, cryptocurrency wallet seed phrases, Discord, Telegram, Steam and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles and screenshots, then builds a structured evidence bundle about the victim and uses stolen session access to search the victim's Gmail for purchase receipts to corroborate a home address. Talos says the bundle is POSTed to OpenRouter with a system prompt telling the model to act as "a forensic intelligence analyst drafting a target assessment", with output sections ranking valuables by monetization and assessing the victim's security posture. Talos says the hardcoded default model is anthropic/claude-opus-4.6, with a fallback chain of moonshotai/kimi-k2 then google/gemini-2.5-flash if a response looks like a refusal. (source: Cisco Talos) Correction (02 Nov 2026): removed The Hacker News as a source. (source: Cisco Talos)
Cisco Talos — Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer (31 Oct 2026)
Abrigo, which provides cloud software to US community banks and credit unions, said on its status page on 30 October 2026 that it identified irregular activity in its environment and, out of an abundance of caution, disabled the Sageworks application at about 11:25 am US Eastern time (11:25 pm Perth). The incident covers Sageworks Analysis, the Sageworks API and Online Portal Now. Abrigo's updates over 30 October to 1 November said its team continued to investigate and that notices were going to Product and IT & Security contacts at customer institutions; on 2 November at 07:11 US Eastern time (8:11 pm Perth) it said the Sageworks platform was available again with the exception of borrower-facing capabilities, and that it was monitoring. Abrigo's status updates do not say what the irregular activity was or whether any data was accessed. (source: Abrigo status page) BleepingComputer reported on 2 November that Abrigo serves more than 2,400 institutions, that Sageworks handles sensitive information including banking customer details, and that Abrigo had not responded to its request for details, so it is unclear whether the outage was caused by a breach or a technical issue. (source: BleepingComputer)
Abrigo status — Sageworks Analysis, Sageworks API and Online Portal Now Unplanned Maintenance (updates 30 Oct to 2 Nov 2026)
Microsoft Threat Intelligence published an investigation of two human-operated intrusions on 30 October 2026 (US time). In both, threat actors used Microsoft Teams messages and calls to impersonate IT or help desk personnel and socially engineered users into granting interactive remote access, primarily through Quick Assist, using organisation-themed onmicrosoft.com tenant names and support-oriented display names. During the remote session they placed an archive in the user's Downloads folder, extracted it into a KB-prefixed staging directory under the user profile and ran the payload with a portable Python, Bun (JavaScript) or Java runtime, then ran host and network discovery and assessed Active Directory Certificate Services (AD CS). In Case 1 the attacker abused an ESC1-vulnerable certificate template to obtain certificates for three highly privileged accounts, then, after a second Teams-phishing wave targeting 16 users about 90 minutes later, for eight more, and performed DCSync within seconds of obtaining one privileged certificate. Microsoft Defender attack disruption restricted the covered identities and blocked more than 1,000 subsequent SMB file-access attempts, but one privileged account excluded from automated response stayed usable and was later used to reach a file server and copy data to an external SFTP destination with a renamed copy of Rclone (SearchApp.exe). In Case 2 the attacker used PetitPotam to make the domain controller authenticate to an attacker-controlled system, relayed that NTLM authentication to AD CS Web Enrollment (ESC8), obtained a certificate using the Domain Controller template and used it for Kerberos PKINIT to get a ticket-granting ticket for the domain controller; after Defender ESC8-related alerts the customer isolated the workstation and no further progression was observed. Microsoft says the activity did not exploit a vulnerability in Microsoft Teams but relied on social engineering and insecure or overly permissive AD CS configurations, that resetting the user's password or reimaging the first workstation does not revoke an issued certificate or invalidate Kerberos tickets already issued, and that the activity is not attributed to a specific threat actor. (source: Microsoft Security Blog)
Microsoft Security Blog (Microsoft Threat Intelligence) — From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths (30 Oct 2026, US time)
Blockchain analytics firm Chainalysis says in a security incident post dated 30 October 2026 that it was recently the target of a cybersecurity incident, similar to many other tech platforms in recent weeks. In the text of the email it sent to impacted customers, which it publishes in the post, Chainalysis says that this month it detected an external actor using offensive agentic techniques to gain unauthorised access to Chainalysis systems and internal tools, and that its teams have been working to investigate the activity, patch vulnerabilities and harden its systems. It says some non-sensitive customer data, such as user IDs, full names, email addresses and organisation role labels for users provisioned on its platform, was accessed, and that it is working out which records were accessed for each organisation. It says it has found no indication that investigation content (such as graphs, notes or cases), transaction or query results, passwords in clear text, MFA secrets or user session tokens were accessed. Chainalysis says it has engaged third-party cybersecurity experts, has proactively notified all of its customers (some had been notified earlier), and that the incident is not related to the recent crypto theft at Binance. It has not said when the access began, how the attacker got in, or how many users are affected. (source: Chainalysis)
Chainalysis — Chainalysis Security Incident Information (30 Oct 2026)
