November 2026 in review
Review the tracked stories and available summary evidence for the archived period shown.
Across the tracker, 7 claims carry no disclosure date and are counted in no month.
Prior-month comparison withheld until this month is complete.
Most-covered stories this month (top 10)
- Breaches and Incidents14 sources
Second wave of suspected cyberattacks hits supermarket freezers across Europe
Refrigeration systems at supermarkets and grocery stores across Europe were compromised early Monday, marking the second incident in recent weeks where attackers manipulated temperature controls to spoil inventory. The attacks demonstrate an emerging targeting pattern against critical retail infrastructure.
Why it matters: Supermarket operators and facilities managers need to audit refrigeration system security and network segmentation immediately, as repeated attacks suggest attackers are exploiting accessible control interfaces that can cause inventory loss and customer safety risks.
Grouped: similar headlines.
- Threat Intelligence10 sources
Shutting the Door on the XCPE Botnet
Google and partners dismantled the XCPE botnet, which infected over 1.3 million Android set-top boxes through pre-installed malware created by Videostrong Technology. The backdoor enabled Videostrong to sell access to criminal affiliates who deployed ad-fraud, residential proxy, and additional malware modules onto compromised devices. Google has banned Videostrong from the Android ecosystem, taken down command and control infrastructure affecting at least 10 million additional devices, and implemented stronger firmware integrity checks to prevent similar attacks.
Why it matters: Device manufacturers, retailers, and distributors must audit Android TV and set-top box suppliers for supply-chain backdoors; security teams should monitor for XCPE indicators of compromise and block associated domains and infrastructure; consumers purchasing connected devices face persistent malware infection risks from unvetted manufacturers.
Grouped: similar summaries.
- Breaches and Incidents8 sources
French blood storage units targeted in cyberattack
Cold-storage facilities operated by France's national blood service were targeted in a cyberattack on November 3, with attackers programming blood storage units to reach 110 degrees Celsius. The incident occurred overnight and was reported by French media outlets.
Why it matters: Healthcare organizations and blood banks face direct operational and safety risk from cyberattacks on temperature-controlled medical infrastructure; practitioners managing OT and healthcare systems should review access controls and monitoring on critical equipment.
Grouped: similar headlines.
- Threat Intelligence7 sources
The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources
Mandiant and Google's Threat Intelligence Group documented a campaign in 2026 in which threat actors compromised enterprise cloud and large language model (LLM) infrastructure to monetize stolen resources through tactics known as LLMJacking. Initial access typically leveraged exposed or stolen cloud identity tokens, service account keys, and LLM application programming interface (API) keys, with attackers then escalating privileges and establishing persistence to abuse LLM services at scale. The criminal ecosystem includes specialized threat clusters and intermediaries called LLM Mixers that resell unauthorized LLM access through underground channels, generating fraudulent charges exceeding $1 million at some victims before detection.
Why it matters: Organizations using cloud LLM services in finance, retail, technology, and transportation face immediate financial exposure from compromised API keys and misconfigured cloud identity, with threat actors able to accumulate six-figure charges in hours; defenders must enforce credential hygiene, least privilege access, rate limiting, and patch CVE-2026-40217 in LiteLLM gateways to prevent privilege escalation to admin access.
Grouped: the same names (API. THE, GIVEN JET NIGHT, GOOGLE THREAT INTELLIGENCE GROUP).
- Threat Intelligence6 sources
Hackers use n-day exploits in zero-click attacks on iOS, Android devices
Russian-linked hackers are conducting a large-scale watering hole attack targeting iOS and Android users through compromised websites and fake portals mimicking legitimate services. The campaign exploits n-day vulnerabilities in zero-click attack chains to compromise mobile devices without user interaction.
Why it matters: iOS and Android users face compromise when visiting legitimate or spoofed websites, making this attack vector relevant to anyone managing mobile security and to organizations whose users access web services on mobile devices.
Grouped: similar headlines.
- Vulnerabilities and Patches6 sources
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2026-119977, a WordPress Core time-of-check time-of-use race condition vulnerability with a CVSS score of 8.1, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The vulnerability allows attackers to gain total control of affected systems and poses significant risk to federal agencies, which must prioritize its remediation under Binding Operational Directive 26-04.
Why it matters: Federal Civilian Executive Branch agencies must prioritize patching CVE-2026-119977 on publicly exposed assets immediately, and all organizations should treat KEV Catalog vulnerabilities as high-priority remediation targets given active exploitation in the wild.
Grouped: the same Common Vulnerabilities and Exposures (CVE) record (CVE-2026-119977) and the same name (KNOWN EXPLOITED VULNERABILITIES).
- Breaches and Incidents5 sources
US charges two Canadians accused of hacking US universities
A federal grand jury indicted two Canadian nationals for hacking multiple US universities and exploiting the compromised systems to conduct cryptocurrency mining operations. The charges underscore law enforcement focus on intrusions targeting educational institutions for illicit computational resources.
Why it matters: University IT teams and security staff face criminal targeting; practitioners should review access logs, monitor for unauthorized resource consumption, and ensure incident reporting protocols to law enforcement are current.
Grouped: similar headlines.
- Breaches and Incidents5 sources
Police seizes over 100 servers in investment scam crackdown
European law enforcement arrested seven suspects and seized more than 100 servers in an operation against a company allegedly supplying fraudulent trading websites to criminal organizations. The action targeted infrastructure used to facilitate investment scams across multiple jurisdictions.
Why it matters: Organizations managing fraud detection and incident response should monitor takedown patterns targeting investment scams; this indicates law enforcement operations against financial crime infrastructure that may affect customer reports or phishing campaigns.
Grouped: similar headlines.
- AI Security5 sources
Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years
The National Cyber Security Centre (NCSC) warns that UK organisations face artificial intelligence (AI)-powered attacks on critical infrastructure within two years, citing inadequate cyber security investment as a key vulnerability. The agency attributes this exposure to cost-cutting practices that have left longstanding weaknesses unaddressed and calls for urgent investment in organisational resilience.
Why it matters: UK critical infrastructure operators and government agencies must prioritise cyber defence spending now, as AI-enhanced attackers will exploit neglected security gaps within a near-term window.
Grouped: similar headlines.
- Threat Intelligence5 sources
Gorbag: Orcs at the border harvesting intelligence from Ukraine
ESET researchers identified Gorbag, a Russia-aligned threat group deploying simple infostealers against Ukrainian organizations in border regions. The group focuses on data harvesting from targets near active conflict zones, using straightforward malware tooling rather than sophisticated techniques.
Why it matters: Ukrainian organizations and government entities in frontline areas face immediate risk of credential theft and intelligence loss; security teams in the region should enhance monitoring for infostealer activity and credential compromise.
Grouped: the same event, confirmed by the daily automated review.
CISA KEV additions
- CVE-2026-119977WordPress WordPress Corefederal fix deadline
- CVE-2024-27834Apple Multiple Productsfederal fix deadline
Most active ransomware groups (leak-site claims, unverified)
| N0n | 30 claims |
|---|---|
| The Gentlemen | 26 claims |
| Soul | 25 claims |
| Medusalocker | 17 claims |
| Qilin | 15 claims |
| Akira | 12 claims |
| Brain Cipher | 11 claims |
| Braincipher | 11 claims |
| Safepay | 9 claims |
| Orova | 7 claims |
Leak-site claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).