Weekly recap: Week of 2 to 8 November 2026

Most covered

• threat intel7 sources
  The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSource ↗

  Mandiant and Google's Threat Intelligence Group documented a campaign in 2026 in which threat actors compromised enterprise cloud and large language model (LLM) infrastructure to monetize stolen resources through tactics known as LLMJacking. Initial access…

  Grouped: the same names (API. THE, GIVEN JET NIGHT, GOOGLE THREAT INTELLIGENCE GROUP).

• vulnerabilities6 sources
  CISA Adds One Known Exploited Vulnerability to CatalogSource ↗

  CISA added CVE-2026-119977, a WordPress Core time-of-check time-of-use race condition vulnerability with a CVSS score of 8.1, to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. The vulnerability allows attackers to gain total…

  Grouped: the same Common Vulnerabilities and Exposures (CVE) record (CVE-2026-119977) and the same name (KNOWN EXPLOITED VULNERABILITIES).

• vulnerabilities4 sources
  SonicWall security advisory (AV26-1133)Source ↗

  SonicWall disclosed that CVE-2026-19868 affects SonicOS versions prior to 7.3.4-7013 and 8.2.2-8015, with active exploitation confirmed. The Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities…

  Grouped: the same event, confirmed by the daily automated review.

• vulnerabilities4 sources
  Max-severity bug in widely used OT programming tool exploited to deliver Linux malwareSource ↗

  Attackers are exploiting CVE-2026-58115, a critical vulnerability in Node-RED that affects industrial control systems and operational technology environments, to deliver a Linux bot. The flaw allows unauthenticated remote code execution on Siemens devices…

  Grouped: the same event, confirmed by the daily automated review.

• breaches incidents2 sources
  More Asian airlines announce data breaches after attack on Spanish IT provider AmadeusSource ↗

  Six Asian carriers including Japan Airlines, Cathay Pacific, and Korean Air disclosed data breaches connected to a compromise of Amadeus IT Group, which operates reservation and ticketing systems for airlines worldwide. The incidents emerged over the course…

  Grouped: the same names (CATHAY PACIFIC, SINGAPORE AIRLINES).

• vulnerabilities2 sources
  Barracuda Networks security advisory (AV26-1112)Source ↗

  Barracuda Networks issued a security advisory on November 2, 2026, disclosing pre-authentication authorization bypass and command injection vulnerabilities affecting six products: Email Security Gateway prior to 9.4.0.030, Load Balancer ADC prior to 6.4.0…

  Grouped: similar headlines and the same name (THE CYBER CENTRE).

• regulatory2 sources
  FedRAMP Authorization Is the Easy Part: How to Stay Authorized with Qualys Policy AuditSource ↗

  FedRAMP authorization requires ongoing continuous compliance monitoring rather than point-in-time validation. The Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive (BOD) 26-04 on June 10, 2026, shifting federal…

  Grouped: the same names (BINDING OPERATIONAL DIRECTIVE, CISA BOD, KNOWN EXPLOITED VULNERABILITIES).

• vulnerabilities
  November 2026 Patch Tuesday forecast: Old software continues to biteSource ↗

  Microsoft released a record 1,407 CVEs in October 2026 Patch Tuesday, arriving nearly two and a half hours late. CVE-2026-96951, a zero-day vulnerability with a CVSS score of 8.8, was among the patches requiring immediate attention. The article notes that…

• vulnerabilities
  HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress SitesSource ↗

  Google disclosed CVE-2026-111497, a critical vulnerability in Brotli compression library with a CVSS v4.0 score of 9.2, which allows unauthenticated remote code execution through specially crafted compressed streams. Wordfence confirmed code execution against…

• vulnerabilities
  PHP2Shell on Windows and macOS: Automating the PHP Upgrade, With or Without an AgentSource ↗

  PHP2Shell (CVE-2026-109618 and CVE-2026-109619) enables unauthenticated remote code execution on exposed PHP servers. While Linux distribution packages carry the fix, Windows and macOS require manual in-place PHP upgrades since neither Microsoft nor Apple…

Most active ransomware groups (leak-site claims, unverified)

Leak-site claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).

Takedowns and arrests

• FBI agent pleads guilty to stealing $2.4 million in crypto from nation-state hackersSeizure · Guilty Plea · The Record

  An FBI agent pleaded guilty to wire fraud and money laundering after stealing more than $2.4 million in cryptocurrency from seized assets during a nation-state hacking investigation. Patrick Steven Yaroch, 37, used his position on an FBI investigative squad to cover personal debts and faces up to 20 years in prison.

• Cryptohack Roundup: $37M Chinese Scam Suspect ExtraditedExtradition · HealthcareInfoSecurity

  A Chinese national suspected of a 37 million dollar scam was extradited this week. Multiple cryptocurrency and payment platforms reported security incidents, including BTCPay wallet drains, Trezor tampering warnings, a 46 million dollar Mercado breach, and Polymarket refunds following an attack. Separately, thieves who stole 8 million dollars were sentenced, and a phone theft resulted in 14,000 dollars in losses.

• Former FBI agent pleads guilty to Cryptocurrency theftGuilty Plea · U.S. Department of Justice

  Former FBI agent Patrick Steven Yaroch, 37, of Ashburn, pled guilty today to wire fraud and money laundering related to using his access to steal cryptocurrency.

• US charges two Canadians accused of hacking US universitiesIndictment · BleepingComputer

  A federal grand jury indicted two Canadian nationals for hacking multiple US universities and exploiting the compromised systems to conduct cryptocurrency mining operations. The charges underscore law enforcement focus on intrusions targeting educational institutions for illicit computational resources.

• Europol reports cyber enforcement: seizureSeizure · Europol
• Canadian man extradited to the U.S. for his role in computer hacking scheme targeting universitiesIndictment · Extradition · U.S. Department of Justice

  U.S. Attorney Michael DiGiacomo announced today that a federal grand jury has returned an indictment charging Ryan James Roach, 35 of Saskatchewan, Canada, and Mathiew James Stubbings, 41, of Ontario, Canada, with conspiracy to obtain information from a protected computer and to cause damage to a protected computer, obtaining information from a protected computer, and intentional damage to a protected computer, which carry a maximum penalty of 10 years in prison and a $250,000 fine.

• Federal grand jury indicts fourteen defendants in $370 million nationwide bank account takeover conspiracyIndictment · U.S. Department of Justice

  United States Attorney for the Northern District of Texas Ryan Raybould today announced that a federal grand jury indicted fourteen defendants, including allegedly corrupt insiders at major banking and telecommunication institutions, for allegedly orchestrating a sweeping nationwide bank‑account‑takeover conspiracy that targeted victims across the U.S.

All takedowns and arrests

CISA KEV additions

Vulnerabilities on the move, 2026-11-02 to 2026-11-09 (the 7 days before this recap was generated)

Ransomware leak-site claims (20 of 337 shown, unverified)

• claimStaples, Inc. / SBD Inc.Unverified claim. Claimed by N0n.
• claimLampenwelt GmbHUnverified claim. Claimed by N0n.
• claimInfutor Data SolutionsUnverified claim. Claimed by N0n.
• claimHigginbothamUnverified claim. Claimed by N0n.
• claimDompé Farmaceutici S.p.A.Unverified claim. Claimed by N0n.
• claimCogent Biosciences, Inc.Unverified claim. Claimed by N0n.
• claimChartboost LLCUnverified claim. Claimed by N0n.
• claimCentrepointUnverified claim. Claimed by N0n.
• claimMKG KirchrodeUnverified claim. Claimed by The Gentlemen.
• claimCustoms SupportUnverified claim. Claimed by The Gentlemen.
• claimMitsubishi Motors UkraineUnverified claim. Claimed by The Gentlemen.
• claimEuropean MotorcarsUnverified claim. Claimed by The Gentlemen.
• claimMegChemUnverified claim. Claimed by The Gentlemen.
• claimTransLogWestUnverified claim. Claimed by The Gentlemen.
• claimNeighborhood House AssociationUnverified claim. Claimed by The Gentlemen.
• claimAirdrie Christian AcademyUnverified claim. Claimed by The Gentlemen.
• claimNoble Inc.Unverified claim. Claimed by Soul.
• claimUnited Medical DoctorsUnverified claim. Claimed by Soul.
• claimMETO SystemsUnverified claim. Claimed by Soul.
• claimNephrology AssociatesUnverified claim. Claimed by Soul.

Ransomware claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).

All leak-site claims and confirmed breaches