IT Security News Roundup: 2026-11-03 Morning

IT Security News: Morning roundup, 2026-11-03

Summary

This morning's security landscape is dominated by the dual nature of artificial intelligence, which is simultaneously being weaponized for financial fraud and deployed as a critical defense tool. Supply chain compromises and the dismantling of large-scale botnets further highlight the persistent risks facing infrastructure and hosting environments. These stories underscore the urgent need for organizations to secure their cloud identities and update critical systems to avoid becoming the next entry point for sophisticated actors.

1. Attackers compromised the cPGuard update channel to deploy a backdoor and steal sensitive files from Linux hosting servers.
2. Kaspersky detailed how the MLEP technology in KICS for Networks 5.0 uses machine learning to detect anomalies in industrial networks.
3. The Russia-aligned Gorbag APT group used spearphishing and self-deleting malware to target Ukrainian local administrations and justice bodies.
4. A zero-day flaw in Adobe Commerce and Magento, dubbed StyleSmuggler, is being exploited to deploy the PSK Agent RAT.
5. Google dismantled the XCPE botnet, which allegedly used Videostrong set-top boxes as proxies for ad fraud.
6. CrowdStrike and Deloitte expanded their partnership to better integrate security planning with threat detection using Falcon IQ.
7. Police and tech companies collaborated with Google to shut down the XCPE botnet attributed to Videostrong.
8. CrowdStrike promoted its Falcon Next-Gen SIEM as a tool for gaining an intelligence advantage in threat detection.
9. Researchers found that "LLMJacking" allows criminals to use stolen cloud access to run expensive AI models at the victim's expense.
10. The UK's cyber chief warned that critical infrastructure will likely face AI-driven cyberattacks from state actors by 2028.
11. Europol coordinated a multi-country operation targeting violent extremist and terrorist role-playing within online gaming environments.
12. Harvard University revealed a breach of over 850,000 accounts involving alumni and donor data linked to ShinyHunters.
13. CrowdStrike shared technical details on how its Agent Graph monitors activity on endpoints.
14. Ubuntu released critical fixes for CVE-2026-98432, a Linux kernel flaw that could allow remote code execution.
15. CrowdStrike extended its Falcon Adversary OverWatch threat hunting capabilities to include AI and Google Cloud environments.
16. An espionage group is targeting South Asian organizations with PapRAT malware delivered via malicious VHDX files and WebDAV links.
17. BTCPay Server urged users to update software after a flaw allowed hackers to steal Bitcoin and Litecoin from hot wallets.
18. The Yoba campaign uses DLL sideloading with signed OpenAI and Anthropic binaries to deploy cryptocurrency-mining malware.
19. Google confirmed the takedown of the XCPE botnet, which comprised 1.3 million Android devices operated by Videostrong Technology.
20. A guide on cloud exit architecture emphasizes the importance of designing systems to avoid vendor lock-in and reduce business risk.
21. An analysis suggests that SMBs require more guided onboarding and supervised protection from security vendors to be effective.
22. A new "AI Kill Switch" concept is introduced to provide control when AI agents behave unpredictably or go rogue.
23. OpenAI significantly increased its bug bounty payouts, with top rewards reaching $172,000 to encourage vulnerability disclosure.
24. The Iran-linked DarkBlinders group stole over 1GB of data from government cloud systems in the Kurdistan Region of Iraq.
25. CrowdStrike announced the acquisition of Fiddler to enhance AI agent observability through Falcon Observe.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Hackers Hijacked Linux Hosting Server Security Tool cPGuard and Used It as a Backdoor
2. MLEP in KICS for Networks 5.0: how machine learning helps track network behavior of OT devices
3. Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware
4. Hackers Exploit Adobe Commerce Zero-Day to Deploy PSK Agent RAT and Remotely Control Servers
5. Inside XCPE, the botnet that turned set-top boxes into proxy servers
6. CrowdStrike and Deloitte Expand AI Security Partnership to Transform How Enterprises Detect Cyber Threats
7. Police and Tech Firms Team Up to Dismantle XCPE Botnet
8. Build an Intelligence Advantage with Falcon Next-Gen SIEM
9. Stolen AI access leaves companies with cloud bills of up to $1 million
10. UK Cyber Chief Says the UK Will Face AI Cyberattacks on Critical Infrastructure by 2028
11. Not a game: Europol and partners target terrorist role-playing online
12. Harvard – 850,537 breached accounts
13. CrowdStrike Agent Graph Shows How Agents Act on the Endpoint
14. Ubuntu Releases Security Fixes for Critical Linux Kernel Vulnerability Allowing Remote Code Execution
15. CrowdStrike Expands Falcon Adversary OverWatch Threat Hunting Across AI and Google Cloud
16. Hackers Use Malicious VHDX Files and WebDAV Links to Infect Windows Devices With PapRAT Malware
17. Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets
18. Hackers Exploit DLL Sideloading in Signed OpenAI and Anthropic Binaries to Deploy YobaLoader Malware
19. Google Dismantles XCPE Botnet of 1.3 Million Android Devices
20. How good is your cloud exit strategy?
21. When confusion reigns, trusted vendors must guide their SMB customers
22. Introducing AI Kill Switch: Taking Control When AI Agents Go Rogue
23. OpenAI raises top bug bounty payout to $172,000 with bonuses
24. Iran-Linked DarkBlinders Hackers Breach Government Cloud Systems and Steal Over 1GB of Data
25. CrowdStrike to Acquire Fiddler to Deliver Falcon Observe for AI Agent Observability