IT Security News Roundup: 2026-11-02 Evening

IT Security News: Evening roundup, 2026-11-02

Summary

This period is marked by a significant escalation in the weaponization of artificial intelligence, with hackers utilizing AI for both automated penetration testing and target valuation. Simultaneously, major infrastructure vulnerabilities in the Linux kernel and AWS services highlight ongoing systemic risks, while massive cryptocurrency thefts underscore the continued volatility of digital assets. For the reader, these stories illustrate a shifting threat landscape where AI is rapidly accelerating the speed and precision of cyberattacks.

1. A critical remote use-after-free flaw, CVE-2026-98432, was identified in the Linux kernel TCP stack, posing significant root exploit risks.
2. Google dismantled a long-running botnet involving certified Android devices sold by Videostrong that had pre-installed malware.
3. Akamai and Skyfire introduced "Know Your Agent" (KYA) to securely verify AI shopping agents and facilitate agentic commerce.
4. Chinese hackers utilized the open-source ARTEX AI framework to conduct automated attacks against over 200 organizations worldwide.
5. AWS addressed CVE-2026-105811, an authorization bypass flaw in the Amazon Q Business Lambda hook sample within QnABot.
6. Mercado Bitcoin, Brazil's largest crypto exchange, confirmed a cyberattack resulting in the loss of over $46 million.
7. AWS patched CVE-2026-116635, a directory traversal flaw in the AWS Serverless MCP Server that could allow unauthorized file access.
8. Maple Networks warned at the International Cyber Expo 2026 about the lack of visibility and control over employee data shared with AI tools.
9. Business organizations are lobbying for the long-term renewal of the CISA 2015 information sharing law through defense authorization bills.
10. A campaign targeting Magento and Adobe Commerce stores used the StyleSmuggler exploit to deploy the PSK Agent RAT.
11. Microsoft published a data-driven analysis suggesting that real-world exploitation is concentrated in a small subset of high-impact CVEs.
12. The BYOD ransomware gang has claimed responsibility for a security incident at Michigan State University.
13. Abrigo restored its Sageworks risk management application after "irregular activity" forced a temporary offline status.
14. Apple notified German lawmakers and a filmmaker that their iPhones may have been compromised by spyware.
15. A new guide provides tips on how to secure and keep voice recordings private on iOS devices.
16. Law enforcement dismantled a botnet of 1.3 million Android TV boxes that were shipped with built-in backdoors by Videostrong.
17. Cisco Talos analyzed VOLTA, an infostealer that uses large language models to rank the value of its victims.
18. AWS fixed CVE-2026-120497, a stored XSS vulnerability in the HTML report generator of the aidlc-traceability tool.
19. Security experts Tom Uren and The Grugq discussed the role of AI in 2027 CISO budget priorities and expectations.
20. Google and partners disrupted the XCPE botnet, banning a TV box manufacturer for intentionally infecting devices to generate criminal revenue.
21. Researchers flagged over $40 million in suspicious transfers following a security breach at the Brazilian exchange Mercado Bitcoin.
22. A weekly summary highlights a trend of attackers using simple tricks, such as fake support calls and passwordless devices, to cause major breaches.
23. India-linked threat actors are utilizing the PapRAT malware and legitimate Windows functions for espionage in South Asia.
24. AWS provided technical guidance on understanding and mitigating email replay attacks that bypass DKIM verification.
25. A European Commission and Europol report warns that digital forensic capabilities are struggling to keep pace with the volume of modern e-evidence.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. CVE-2026-98432: A Remote Use-After-Free in the Linux Kernel's TCP Stack
2. Google shuts down global botnet running on certified Android devices
3. How Skyfire and Akamai Enabled 2.5 Million Agentic Transactions
4. Chinese hackers use ARTEX AI in automated attacks against 200 orgs
5. CVE-2026-105811 – Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS
6. Largest crypto exchange in Brazil confirms cyberattack as millions flow out of platform
7. CVE-2026-116635 – Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server
8. Maple Networks Highlights AI Data Security Risks at International Cyber Expo 2026
9. Business groups mount fresh campaign for long-term renewal of information sharing law
10. StyleSmuggler Exploitation Deploys PSK Agent RAT Against Magento Stores
11. What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks
12. Michigan State cyber incident claimed by ransomware gang behind recent hospital attack
13. Fintech platform Sageworks taken offline after suspected cyberattack
14. Germany says lawmakers’ iPhones may have been hacked with spyware
15. How to Keep Your Voice Recordings Private on iPhone
16. Cops bust botnet of 1.3M infected Android TV boxes
17. VOLTA, the infostealer that asks an AI which victims are worth the effort
18. CVE-2026-120497 – Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows
19. Between Two Nerds: Finding bugs does not mean security
20. Google disrupts million-device XCPE Android malware botnet, bans TV box maker
21. Mercado Bitcoin Suffers Cyberattack as Researchers Flag $40 Million in Suspicious Crypto Transfers
22. ⚡ Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, Android Spyware and More
23. PapRAT Cyber-Espionage Campaign Leaves a 'Bitter' Taste in South Asia
24. Beyond DKIM key rotation: understanding email replay attacks
25. Keeping pace with e-evidence: New report examines Europe’s digital forensic capabilities