🚨 ACTIVE EXPLOITATION
- Attackers exploit critical Node-RED flaw CVE-2026-58115 to deploy Linux bot and webshells
Attackers are exploiting the critical Node-RED flaw CVE-2026-58115 to deploy a Linux bot and webshells on unprotected servers.- Applies to Node-RED instances without adminAuth, including those embedded in commercial ICS/OT products such as Siemens SIMATIC IoT2050 Advanced devices running Industrial OS before V4.3.4.1.
- CVE-2026-58115 (CVSS 10.0) is a missing authentication flaw on the Node-RED HTTP admin API, allowing unauthenticated remote attackers to create malicious flows and execute arbitrary code with maximum privileges.
- Exploitation requires a single HTTP POST /flows request: an inject node triggers an exec node that downloads a binary (bot-linux-amd64) from an attacker-controlled server behind three layers of encoding.
- VulnCheck canaries caught the first exploitation on October 30, 2026, followed by 15 more attacks from the same IP (in Microsoft's AS8075, geolocating to Brazil) delivering webshells and additional payloads.
- The same source IP hit 8 different CVEs across Apache Solr, Camunda, Gitea, MLflow, Traefik and Joomla in VulnCheck's wider canary data, indicating opportunistic mass scanning.
💥 BREACHES & INCIDENTS
3AM ransomware hits UK school estate in suspected AI-assisted attack, ~37 machines encrypted
A 3AM ransomware affiliate attacked a UK school estate using what Bitdefender assesses was a hybrid human-plus-AI agentic loop, encrypting about 37 of nearly 50 machines.- Applies to UK schools and education networks; the victim estate had 47 systems including ~21 servers, eight domain controllers, and Windows 10 workstations.
- Attack spanned September 10–19, 2026; initial access method unknown. Attackers used a modified public Veeam script to steal backup credentials from three Veeam servers, Mimikatz, and a Chrome credential database.
- Attackers created backdoor domain admin accounts 'library' and 'svc_bkpmon', built two-way trusts between three separate Active Directory domains using netdom/dnscmd, exfiltrated 40 finance files via registry keys (HKLM\SOFTWARE\VC31, FIN001–FIN040), then deployed the 3AM Rust-based encryptor host.exe, deleting system-state backups.
- Bitdefender assesses an AI agentic loop was likely involved: retries every 40–101 seconds, numbered script revisions (av_remove, av_remove2, av_remove3), probe files like 'psexec-ok' and 'da_proof.txt', and model-style errors such as wrong Veeam REST API port and Bash-style escapes in Windows commands; the vendor could not confirm which model was used.
- IOCs include renamed sysmon64.exe and svcstat.exe (Mimikatz), Veeam-Get-Creds.ps1, scheduled task VEEAMPROBE, exfiltration endpoint path rcv.aspx, and wbadmin delete systemstatebackup commands.
Sources 📄 Source: businessinsights.bitdefender.com · 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer, Dark Reading (+1)Frontline Education breach exposes data of over 1.3 million school district staff and students
A breach at K-12 software provider Frontline Education compromised the personal information of more than 1.3 million people.- Affects users of Frontline Central and School Health Management products across K-12 school districts; Frontline serves over 80,000 schools.
- Stolen data may include names, Social Security numbers, dates of birth, driver's license and government ID numbers, health insurance details like Medicaid IDs, and Student IDs.
- Attackers exploited a vulnerability in a third-party software product to access Frontline's environment on August 14, 2026; the intrusion was contained by August 15.
- State AG filings show at least 1,298,917 affected individuals, with the true total likely higher given filings in states without breach portals.
- Affected adults receive two years of credit monitoring and identity-theft protection via TransUnion; qualified minors get dark-web monitoring.
ZachXBT flags suspected $106M crypto theft from unnamed EU entity, tracks laundering
Blockchain investigator ZachXBT reported a suspected $106 million theft from an unidentified EU entity's exchange accounts.- On-chain investigator ZachXBT flagged a suspected theft of over $106 million on November 1, 2026 from multiple centralized exchange accounts belonging to an unnamed EU-based entity; no victim or exchange has confirmed the loss.
- Stolen funds were held in USDC and USDT stablecoins, withdrawn from the exchange accounts, and aggressively swapped into Ether — about $80 million in USDC reached 11 wallets over 11 hours.
- The attacker laundered proceeds through instant exchanges WellWallet and Kyrrex, bridged funds across multiple chains, and converted some value into Monero via the non-custodial cross-chain exchange Wagyu.
- ZachXBT published 11 wallet addresses tied to the activity and said multiple laundering indicators give him high confidence the North Korean Lazarus Group was not involved.
- Separately, Brazilian exchange Mercado Bitcoin suspended deposits and withdrawals after Hypernative flagged over $40 million in suspicious outflows across 10 networks; the exchange said customers were unaffected.
mSecure password manager warns users to secure all credentials after suspicious activity
mSeven Software notified mSecure password manager customers of suspicious activity and urged them to change stored passwords, reset 2FA, and remove passkeys.- Affects current and former mSecure password manager customers (mSeven Software); the app has 500,000+ Google Play installs and roughly 250,000 estimated users
- mSeven detected unspecified 'suspicious activity' associated with the mSecure app on Nov 3, 2026, launched an investigation, and engaged external cybersecurity experts
- The advisory provides no details on what occurred or whether vault data was exposed, but recommends changing passwords, resetting 2FA, and removing passkeys — implying stored vault contents could be at risk despite advertised AES-256, E2EE, zero-knowledge design
- Customers flooded mSecure's support forums demanding specifics; the notice email passed SPF/DKIM/DMARC checks and was confirmed genuine
- Germany's BSI previously flagged mSecure as a password manager whose manufacturer could theoretically access user data
European police arrest seven, seize 100+ servers in investment scam takedown
European law enforcement arrested seven suspects and seized over 100 servers in a crackdown on a company providing fraudulent trading websites to criminal gangs.- Targets investors across at least 50 countries; over 100 victims from 11 countries lost several million euros to fake investment platforms
- The scheme used deceptive ads luring victims to fraudulent forex, stock, and crypto trading platforms to harvest personal data
- Stolen data was sold to call centers in Albania, Kosovo, and North Macedonia, which showed victims fake accounts with fictitious profits to push larger transfers
- A Cyprus- and Israel-based company allegedly ran the 'crime-as-a-service' model supplying fraudulent trading websites
- Action by authorities from Albania, Cyprus, Finland, Germany, Kosovo, and North Macedonia, supported by Europol and Eurojust, followed four years of investigation and earlier interventions in 2022 and 2025
🔓 CVEs & KEV
CVE-2026-121448 — Finsys dockhand — CVSS 8.7 — Dockhand before 1.0.54 Path Traversal via Stack Environment RoutesDockhand be...
CVE-2026-121449 — Finsys dockhand — CVSS 7.1 — Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack WebhookDockhand...
CVE-2026-121439 — bytecodealliance wasmtime — CVSS 6.9 — Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splittin...
CVE-2026-121441 — bytecodealliance wasmtime — CVSS 6.3 — Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-...
CVE-2026-121440 — bytecodealliance wasmtime — CVSS 6.3 — Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Hea...
🕵️ RESEARCH & DEEP DIVES
- Google warns LLMjacking attacks are costing enterprises up to $1 million in fraudulent cloud charges
Google warns that threat actors hijacking enterprise LLM access are generating fraudulent cloud charges exceeding $100,000 per day and up to $1 million per victim.- Organizations across North America, South America, and Asia Pacific in financial services, retail, technology, and transportation sectors are affected.
- Attackers target cloud-hosted LLM resources by obtaining valid API keys or finding publicly exposed LLM endpoints, leaving victims to cover consumption costs.
- Dominant initial access vectors are exposed or stolen cloud identity tokens — IAM credentials, Service Account keys, GitHub Personal Access Tokens, and active session tokens.
- Threat actor UNC6993 breached a cloud instance via a misconfigured Service Account key and hosted a session hijacking page that tricked users into pasting active access tokens to bypass MFA.
- Attackers escalate privileges, harvest credentials from code repositories and secret managers, and exploit LLM routing software flaws like CVE-2026-40217 in LiteLLM; some use 'burn and rotate' short-lived service accounts to evade rate limits.
- A maturing underground