Cybersecurity News: 4 November 2026

Japan Airlines, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines and Malaysia Airlines have reported data breaches traced to a vulnerability in Spanish IT provider Amadeus. The attack exposed booking-display data, including passenger names, flight details and travel documents, but Amadeus said there is no evidence that payment or financial data was accessed.

Japan Airlines said 92,000 customers had information stolen, while Singapore Airlines said 46,000 records were accessed.

Zyxel patched a zero-day in GS1900 switches that attackers exploited to compromise 996 devices in 48 countries and steal configuration files and credentials. The out-of-bounds write flaw, CVE-2026-107441, lets an unauthenticated network attacker run operating system commands through the web management interface. The attacks were initially attributed to an older flaw, but researchers found the exploit targeted a separate vulnerability.

DreamHost said attackers accessed its web-based File Manager from August 2026 until October 23, 2026, stealing FTP/SFTP usernames and passwords for users who logged in during that period. The company said the intruder may also have exposed webmail session information for a limited number of users, but found no evidence of access to control panel logins or billing details.

DreamHost has blocked access, invalidated passwords and stopped affected sessions.

Crédit Mutuel Arkéa confirmed a sophisticated cyberattack in which attackers used the bank's own account to make transfers after compromising an unnamed supplier. ZachXBT estimated the theft at more than $133 million, and the bank said it could validate the order of magnitude without confirming the figure. The bank said customer accounts were not accessed and that some converted cryptocurrency has been frozen.

Debian, Ubuntu and APT developers said a flaw in APT, CVE-2026-109518, can let an attacker who modifies package downloads swap a verified package for their own and run code as root. The attack requires APT to retry failed downloads, a default setting from Debian 12 and Ubuntu 22.04 onward. Debian has released fixed versions, while Ubuntu said updates are being released and rated the flaw high priority.

mSeven Software told current and former mSecure customers to change passwords, reset two-factor authentication and remove passkeys after suspicious activity. Customer-shared support responses said a hacker stole an encrypted customer database from mSecure Cloud. mSecure uses AES-256 encryption and a zero-knowledge architecture, which has caused confusion over why users should reset stored credentials.

A US government IT specialist with Top Secret clearance pleaded guilty to sending sensitive documents to Ethiopia and agreed to 120 to 262 months in prison. Abraham Teklu Lemma, 53, worked for the National Reconnaissance Office, State Department and Justice Department from 2019 to 2023. Prosecutors said he copied at least 133 intelligence reports, burned more than 100 documents to green discs and removed classification markings.

Material Security said a phishing operation dubbed Operation CloudFire has harvested live Google sessions from corporate users since mid-August 2026. The campaign used Google Calendar invites and links that appeared legitimate, then used a reverse proxy to relay passwords and second-factor codes. Nyasher builds the capture page in the browser after a Cloudflare Turnstile challenge, leaving little for scanners to inspect.

SonicWall warned that two flaws in end-of-life Global Management System 9.5.2 and earlier will not be patched, urging customers to upgrade to Network Security Manager. One flaw lets unauthenticated network attackers read internal files, while another allows high-privilege attackers to use SQL injection to access or modify the GMS database. The alert follows recent active exploitation of another SonicWall flaw.

A major Russian web hosting provider, Beget, is struggling to restore its services after a cyberattack destroyed data across its cloud infrastructure and disrupted hundreds of websites. The attackers gained access to systems used to manage the company's infrastructure, allowing them to execute scripts designed to erase data. The company said it had lost all binary backups of its virtual servers, although file-level backups remained intact.

Two Canadian men face federal prosecution in New York after allegedly orchestrating a multi-year cyber incursion campaign that hijacked computing resources across American universities to secretly mine cryptocurrency. The intrusions spanned from June 2016 through December 2019, compromising systems at academic institutions in New York, Massachusetts, North Carolina and Tennessee.

The men allegedly set up multi-country virtual private server infrastructure using fraudulent identities to manage the campaign.

Ruby on Rails said a critical Active Storage flaw could let an unauthenticated attacker write arbitrary files on a server by uploading a crafted file processed by ImageMagick. The flaw is fixed in Rails 8.1.4.1 and 8.0.5.2, and apps using the Disk service may also allow reading files such as secret_key_base. Rails rated it 9.8 on the CVSS scale and said one attack chain was reported, without confirming exploitation.

Attackers compromised a refrigeration supplier used by France's EFS and changed cold-room settings from -30C to 110C, although safeguards prevented loss of blood samples or plasma. The EFS said three of its sites were affected and moved products to other facilities, while notifying ANSSI and the Health Ministry. The incident followed a wider European wave of attacks on refrigeration controls.

The Xen Project said two flaws, CVE-2026-102703 and CVE-2026-102704, let a malicious guest virtual machine read and write memory of other VMs on the same host, including dom0. All Xen versions from 4.6 onward are affected, and patches are available under advisory XSA-523 with no known mitigation. Qubes OS said every supported release is affected, with fixes for Qubes 4.3 in security testing.

A China-aligned threat actor known as SlippyNunchucks has been using DNS hijacking to deploy the DarkVigil backdoor to users of Sogou Input Method. The campaign, observed starting July 1, 2026, targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka.

ESET said the group abused the app's brand-promotion mechanism to serve a malicious configuration, which made the app download the DarkVigil implant.

OpsShield said attackers used compromised credentials to upload malicious cPGuard updates, versions 5.88.12 to 5.88.19, to its update infrastructure on November 2. The fake updates ran as root on about 2,950 customer servers for roughly 70 minutes, collecting password hashes, SSH keys, database credentials and shell history. The company said attackers also copied about 7,900 billing account records and three cloud servers.

Google has promoted Chrome 157 to the stable channel with fixes for 213 vulnerabilities, including seven critical memory safety bugs. The most notable is a buffer overflow in Dawn, the open source WebGPU implementation, for which the researcher received a $10,000 reward. Google said it paid $31,000 in bounties but has not determined rewards for 39 flaws, and it did not say any were exploited in the wild.

Sekoia attributed a large-scale watering hole campaign to Russian group APT29, targeting iOS and Android users through compromised or lookalike websites. The campaign used sites in the U.S., Ukraine, the Czech Republic and Bulgaria, and a compromised Plerdy tracker to profile visitors before pushing n-day exploit chains without user interaction. Apple and Google have patched the flaws, and no payload established persistence.

Meta has paid about $1.2 million in bug bounties for its Muse AI agent, including $300,000 for a pre-launch flaw that exposed data on internal test systems. The top bug let outside requests carry a trusted header after a migration added a second proxy layer, allowing access to conversations and tokens on pre-release virtual machines. Meta said the program received more than 630 reports, of which 64 were valid.

Google said a critical Android flaw, CVE-2026-58868, could let an attacker run code on a phone remotely without user interaction. The out-of-bounds write affects Android 14 through 17 and is fixed by security patch level 2026-11-01 or later, which manufacturers and carriers deliver on their own schedules. Google had not reported exploitation as of November 4, and the flaw was not in CISA's Known Exploited Vulnerabilities catalog as of November 3.

Binance said attackers used a fake job interview, a tampered software download and zero-day malware to reach engineers and steal $6.3 billion in crypto on October 29. The exchange said the campaign began in June, used compromised internal AI tooling, and that it is repaying all affected customers. The FBI attributed the theft to North Korea's TraderTraitor group, a claim North Korea rejected.

CISA added a WordPress Core race condition, CVE-2026-119977, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The high-severity flaw lets unauthenticated attackers run code during a full core upgrade by using predictable staging paths. Wordfence logged more than 18,500 exploit requests in the first 21 hours after disclosure, and FCEB agencies have until November 6, 2026, to apply fixes.

Hunt.io says an unknown attacker copied 27 SQL Server backup databases, nearly 69GB of data, from the Philippine Overseas Employment Administration in under a half hour. The logs on a Singapore staging server show the theft included overseas-employment case records, accreditation, contracts, cashier and LandBank records. The firm said the data left the agency's control, making it a breach, but has not found it for sale or attributed the attack.