Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog

Attackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539

Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries

U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog

$6.3 Billion Stolen from Binance in Attack Attributed to North Korea

How to prioritize remediation after a pentest: a practitioner workflow

Hacker leaks data on more than 40,000 Homeland Security employees

Binance Investigates Suspicious Crypto Transfers Worth Up to $5.8 Billion

US Probes Suspected Hack Behind Military Base Freezer Failures

484,142 Exposed Cloud Buckets Contain 18 Billion Files

U.S. CISA adds Linux Kernel and Broadcom VMWare ESX  flaws to its Known Exploited Vulnerabilities catalog

Volt Typhoon Used Silent Train to Hide Zero-Day Attacks

Election Website Security: 42% of US County Sites Still Lack .gov Domains

ENGIE Data Breach Exposes Customer Details and Energy Contracts

Virtualine Domain Seized, but Allegedly Abusive Website Remains Online

Hive and Nefilim Ransomware Affiliate Gets 70 Months In Jail

Ads or Surveillance? Researchers Flag Suspicious Targeting of Starlink Users

CVE-2026-97631: 16-Year-Old UEFI Flaw Threatens Servers

U.S. CISA adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog

Three Japan-Focused Cyberattacks Show How Hackers Use AI

Italy ’s Parliament Under Cyber Pressure: Why the Attack on the Chamber Matters

Australia’s Cyber Spy Chief: Expect More Disruption as AI Accelerates Hacking

U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog

Attackers Take Control of Dahua Cameras and Video Recorders Via Easy4IP

Cohere Finds Qwen AI Model Contacting a Server in China

Magento Campaign Infects 953 Online Stores Across Five Domains

AI-Generated Fake Bank Calls and NFC App Enabled €380,000 Fraud, Dutch Police Say

Researchers Uncover Rentable Android Spyware uCreater Targeting WeChat and Telegram

PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts

Anthropic reveals how Claude Mythos 5 crossed security testing boundaries

OpenAI Paused Frontier AI Training After a Security Incident

International Press – Newsletter

Cybercrime

Binance Says User Funds Are ‘Completely Safe’ After $3.5 Billion Drains From Its Hot Wallets  

Police arrest two suspects in AI-powered bank fraud that cost victims €380,000   

M365 Token Spray and Replay Campaign Compromises Business Email Accounts 

Chinese National Extradited for Alleged Role in Multimillion-Dollar Cryptocurrency Scam Targeting U.S. Citizens  

Ukrainian National Sentenced to 70 Months in Prison for Multi-Million Dollar Ransomware Conspiracies  

Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents 

deepveindrilling.com: Magento CMS block loader hits 953 stores

“Bulletproof” website domain seized in international law enforcement operation  

Trezor warns of suspected crypto-theft implant in hardware wallet

Polymarket halts trading after crypto-draining script breach, $2.5M traced

Malware

uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps  

CLAUDE CODE FOUND SPYWARE ON MY FAMILY’S PHONES AND A BACKDOOR ON MY MAC

Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace  

Tricks from the Past deployed via signed ChatGPT and Claude binaries

Hacking

PHP2Shell exploitation observed: packet-to-process RCE evidence  

CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure  

Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access  

Not Only ARTEX: The Different Levels AI is Used in Attacks Targeting Japan  

Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability  

Discovering and exploiting vulnerabilities in critical, real-world software with Claude

Putting Claude Code in a box: a sandboxed dev container for Zed

Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch

The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!  

Pentagon treating military base freezer malfunctions as suspected cyberattack, officials say  

GitLab security incident: attempted exploitation of CVE-2026-97229  

Intelligence and Information Warfare  

Alibaba’s Qwen AI caught trying to contact server in China

Hackers can gain control of cameras and DVRs through cloud access      

Disruptions ‘inevitable’ as AI-powered cyber threats grow, Australian Signals Directorate says

Operation FlashHole: Lazarus breaks security, defies control 

Hackers Sympathetic to Russia Are Hitting Utilities and Factories  

Alleged Israeli spy company heavily targeted Starlink users, sources say

Silent Train: uncovering Volt Typhoon’s operational framework for zero-day exploitation and strategic access  

North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History  

Mapping the Political Influencer Industry and the Problems it Causes for Democracy  

Cybersecurity

NIS 2 Italy: Key Deadlines, Board Duties and What ACN Expects From Companies  

The Two Things CISOs Should Be Thinking About In The Wake Of The PHP Nightmare

Code-execution flaw in UEFI firmware affects most servers on planet Earth     

2026 County Election Website Security Census: Key Findings  

Cloud Exposure Index 2026: 484,142 open buckets mapped  

ENGIE: Data leak via a tool belonging to its business partners 

Beyond Framework Signatures: Understanding AI-Driven Intrusions 

I Think The Military Commissary’s Freezers Were Hacked  

Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning 

Passkeys Are Better Than Passwords. But They Are Not Enough

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Source: Security Affairs · 2026-11-01