IT Security News Roundup: 2026-11-04 Evening

IT Security News: Evening roundup, 2026-11-04

Summary

The latest security updates highlight a concerning trend of AI being weaponized, from the emergence of "prompt adware" to warnings of AI-powered ransomware targeting critical infrastructure. Simultaneously, significant supply chain vulnerabilities and large-scale data breaches across the aviation and hosting sectors underscore the persistent risk of third-party dependencies. For readers, these stories emphasize that the attack surface is expanding rapidly into both emerging AI configurations and legacy hardware.

1. A critical bug in the Rails Active Storage ImageMagick integration could allow attackers to read sensitive files or write arbitrary files, potentially enabling lateral movement within servers.
2. The UK's cyber agency has warned that AI-powered ransomware is expected to target critical national infrastructure by 2028, urging organizations to upgrade outdated technology.
3. New guidance outlines the security risks and considerations users should evaluate before adopting cryptocurrency debit cards.
4. Researchers discovered that Kremlin-sponsored hackers used flaws in iOS and Android to infect phones, specifically targeting diplomatic figures.
5. Check Point Research identified "prompt adware," where hidden instructions in AI agents are modified to inject third-party advertisements.
6. Apple will begin scanning public iCloud share links for "harmful content," raising privacy concerns regarding the definition of such content.
7. Alpine Linux reset passwords and rebuilt its GitLab server after an attempted critical RCE attack that targeted a vulnerability in the Onigmo regular expression engine.
8. Barracuda released patches for two vulnerabilities in its Email Security Gateway that could be chained to grant attackers full root access.
9. Amazon addressed CVE-2026-122266, where improper isolation in the EKS network policy agent could let authenticated users bypass ingress enforcement.
10. Vercel is implementing Device Bound Session Credentials (DBSC) to protect users against session cookie theft by information-stealing malware.
11. The Russia-aligned group Gorbag is exploiting a WinRAR vulnerability to deploy data-stealing malware against Ukrainian defense and justice sectors.
12. Multiple Asian airlines, including Japan Airlines and Singapore Airlines, reported data breaches resulting from an attack on IT provider Amadeus.
13. Analysis suggests that highly capable AI systems could be used to discover and exploit "vulnerabilities" within the natural language of legal systems.
14. A new report argues that since fewer than 10% of vulnerabilities are actually exploited, organizations must prioritize exposure based on risk rather than urgency.
15. CISA has confirmed that a flaw in the WordPress Core upgrade process is being actively exploited in the wild.
16. Red Hat patched a high-severity Linux TCP RCE flaw (CVE-2026-98432), while Ubuntu's fixes remain in an opt-in testing channel.
17. Zyxel patched a zero-day vulnerability in its GS1900 switches that was used to compromise nearly 1,000 devices to steal credentials.
18. Malicious Claude Code extensions distributed via Cursor targeted developers on Windows and macOS to establish persistent remote access via SSH backdoors.
19. A discussion on electronic voting explains why cryptographic protocols cannot fully replace the security and trust provided by physical paper ballots.
20. German authorities seized over 100 servers used in a global investment scam that defrauded victims in 50 countries of over 4 million euros.
21. DreamHost revealed that a deliberate attack exploited a vulnerability to steal customer emails and files over several months.
22. The hacking group Leakers$ accessed remote management software for public billboards to display pornographic content.
23. General Motors agreed to a $220 million settlement regarding allegations that connected-car data was improperly shared.
24. The retailer Revolve reported a breach that may have exposed the saved credit card details of up to 1.5 million shoppers.
25. Google dismantled the XCPE botnet, which allegedly used a backdoor in Videostrong Android TV boxes to facilitate ad fraud.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Critical Rails Bug Threatens to Derail Vulnerable Servers
2. Britain on notice: AI-powered ransomware attacks to arrive by 2028
3. What to Know Before Getting a Crypto Debit Card
4. Hackers exploited iOS and Android flaws to infect phones
5. Prompt Adware: How Hidden AI Instructions Could Create a New Enterprise Security Risk
6. Apple turns iCloud into spy cloud, will start looking at public share links
7. Hackers Target Alpine Linux GitLab Server in Attempted Critical RCE Attack
8. Two Barracuda ESG Flaws Could Be Combined for Full Root Access; Patches Released
9. CVE-2026-122266 – Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS
10. Vercel rolls out new protection against stolen session cookie attacks
11. Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware
12. More Asian airlines announce data breaches after attack on Spanish IT provider Amadeus
13. AIs Hacking the Law
14. The 4 Elements of Exposure Prioritization and How to Operationalize Them
15. CISA Confirms Exploitation of WordPress Core Upgrade Flaw
16. Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing
17. Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
18. Cursor Distributed Claude Code Extensions With SSH Backdoor Code
19. The cryptography behind electronic voting (and why paper ballots are still essential)
20. Investment scams with potential victims in at least 50 countries: over 100 servers seized
21. Hackers stole DreamHost customer files and inboxes during months-long attack
22. Hackers put porn on public billboards and claim it was “far too easy”
23. GM’s $220 Million Data Privacy Settlement: What Drivers Need to Know
24. Revolve card breach: 1.5 million people may be affected
25. Inside XCPE, the botnet that turned 1.3M set-top boxes into proxy servers