Videostrong sold TV set-top boxes and other devices with pre-installed malware. The yearslong operation evaded Google’s security tests and established a…
How Skyfire and Akamai Enabled 2.5 Million Agentic Transactions
Discover how Akamai and Skyfire verify AI shopping agents with Know Your Agent (KYA) to securely enable agentic commerce and prevent checkout friction.
Chinese hackers use ARTEX AI in automated attacks against 200 orgs
Chinese hackers used ARTEX, an open-source, multi-agent AI penetration-testing framework, in attacks against more than 200 organizations across 14…
CVE-2026-105811 – Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS
Read this article Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Largest crypto exchange in Brazil confirms cyberattack as millions flow out of platform
Blockchain security companies said more than $46 million left the Mercado Bitcoin platform.
CVE-2026-116635 – Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server
Bulletin ID: 2026-164-AWS Publication Date: 11/02/2026 13:30 PM PST Description: We identified CVE-2026-116635. Under certain conditions, improper…
IT Security News Hourly Summary 2026-11-02 23h : 5 posts
5 posts published in the last hour 21:32Maple Networks Highlights AI Data Security Risks at International Cyber Expo 2026 21:31Business groups mount fresh campaign for long-term renewal of information sharing law 21:31StyleSmuggler Exploitation Deploys PSK Agent RAT Against Magento Stores…
Maple Networks Highlights AI Data Security Risks at International Cyber Expo 2026
As the industry continues to embrace artificial intelligence, questions are being raised about how much visibility and control they have over the…
Business groups mount fresh campaign for long-term renewal of information sharing law
Their target for extending CISA 2015 is the annual “must-pass” defense authorization bill, but a more than year-long standoff persists.
StyleSmuggler Exploitation Deploys PSK Agent RAT Against Magento Stores
TL;DR: Between September 9 and September 13, 2026, we detected a coordinated campaign exploiting Magento and Adobe Commerce stores across Western Europe,…
What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks
Real-world exploitation concentrates in a small, high-impact subset of CVEs. Learn how defenders can prioritize vulnerabilities based on exploitation…
IT Security News Hourly Summary 2026-11-02 22h : 4 posts
4 posts published in the last hour 20:31Michigan State cyber incident claimed by ransomware gang behind recent hospital attack 20:02Fintech platform Sageworks taken offline after suspected cyberattack 20:02Germany says lawmakers’ iPhones may have been hacked with spyware 20:00IT Security News…
Michigan State cyber incident claimed by ransomware gang behind recent hospital attack
A recent post by the BYOD gang appears to line up with a security incident that prompted campus-wide action at Michigan State University. BYOD drew…
Fintech platform Sageworks taken offline after suspected cyberattack
Financial technology company Abrigo has restored its Sageworks risk management application, except for borrower-facing capabilities, following an outage…
Germany says lawmakers’ iPhones may have been hacked with spyware
German lawmakers and a filmmaker are among the people who received notifications from Apple warning that their phones may have been hacked.
IT Security News Hourly Summary 2026-11-02 21h : 9 posts
9 posts published in the last hour 19:32How to Keep Your Voice Recordings Private on iPhone 19:32Cops bust botnet of 1.3M infected Android TV boxes 19:32VOLTA, the infostealer that asks an AI which victims are worth the effort 19:31CVE-2026-120497 –…
How to Keep Your Voice Recordings Private on iPhone
What did you last record on your iPhone? A lecture, perhaps, a call with your landlord, or notes…
Cops bust botnet of 1.3M infected Android TV boxes
Videostrong accused of shipping devices with a backdoor baked in
VOLTA, the infostealer that asks an AI which victims are worth the effort
VOLTA is an AI-powered infostealer that steals personal data, then uses LLMs to assess victims’ value and rank targets for attackers. Cisco Talos has…
CVE-2026-120497 – Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows
Bulletin ID: 2026-163-AWS Publication Date: 11/02/2026 11:00 AM PST Description: aidlc-traceability is an open source command-line tool, formerly…
Between Two Nerds: Finding bugs does not mean security
In this edition of Between Two Nerds Tom Uren and The Grugq discuss CISO’s expectations and priorities regarding budgets and what they will spend their…
Google disrupts million-device XCPE Android malware botnet, bans TV box maker
Google and industry partners have dismantled the XCPE malware botnet consisting of more than 1.3 million Android TV streaming TV boxes that Google says…
Mercado Bitcoin Suffers Cyberattack as Researchers Flag $40 Million in Suspicious Crypto Transfers
Brazilian cryptocurrency exchange Mercado Bitcoin suspended deposits and withdrawals on November 2, 2026, after detecting a security incident in one of…
⚡ Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, Android Spyware and More
Some attacks this week didn’t need much of a trick. A fake support call, a trusted extension, a shared link, or a device with no password. Small things…