# Cold chain attacks, compromised updates and credential recovery

Canonical: https://www.oktsec.com/radar/brief/2026-11-06
Publisher: Oktsec
Language: en
Reporting period: 2026-10-30T10:26:59Z to 2026-11-06T11:20:00Z
Updated: 2026-11-06T11:20:00Z

Refrigeration incidents continued in Europe, malicious software reached trusted distribution channels, and several providers required customers to replace exposed credentials. This edition covers changes since the October 30 cutoff, including the weekend, and separates released fixes from work still required to recover.

## Coverage at the cutoff

26 advisories covered: 20 new to Radar and 6 follow-ups. 16 Act now; 4 vulnerability advisories with known exploitation. Groups overlap. Counts describe editorial coverage, not incidents detected by Oktsec.

Cutoff: 2026-11-06T11:20:00Z. Linked advisories retain subsequent updates.

### All advisories

- [Cold chain attacks: protect refrigeration controls and monitoring](https://www.oktsec.com/radar/refrigeration-controller-attacks-europe-2026) — Act now; new to Radar.
- [Node-RED: exploitation attempts observed against unauthenticated interfaces](https://www.oktsec.com/radar/siemens-node-red-cve-2026-58115) — Act now; new to Radar.
- [cPGuard: malicious updates expose server credentials](https://www.oktsec.com/radar/cpguard-update-channel-compromise-2026) — Act now; new to Radar.
- [Cursor: malicious Claude Code extensions attempt persistent SSH access](https://www.oktsec.com/radar/cursor-claude-code-malicious-extension-october-2026) — Act now; new to Radar.
- [LiteLLM 1.107.0: check where it ran](https://www.oktsec.com/radar/litellm-1-107-0) — Act now; follow-up.
- [Northflank: rotate project and integration secrets after incident](https://www.oktsec.com/radar/northflank-secrets-incident-october-2026) — Act now; new to Radar.
- [Chainalysis confirms credential exposure and suspends KYT](https://www.oktsec.com/radar/chainalysis-user-data-incident-october-2026) — Act now; new to Radar.
- [Binance links wallet breach to a fake job interview and internal AI tooling](https://www.oktsec.com/radar/binance-hot-wallet-drain-october-2026) — Review this week; follow-up.
- [BTCPay Server: affected hosts need a fresh VM and wallet](https://www.oktsec.com/radar/btcpay-server-hot-wallet-incident-november-2026) — Act now; new to Radar.
- [Linux IPv4/TCP: check exposed kernels for CVE-2026-98432](https://www.oktsec.com/radar/linux-kernel-cve-2026-98432) — Review this week; new to Radar.
- [Brotli: patch runtimes and proxies that decode untrusted data](https://www.oktsec.com/radar/nodejs-brotli-cve-2026-111497) — Act now; follow-up.
- [eMudhra: replace affected certificates and review application trust](https://www.oktsec.com/radar/emudhra-chrome-root-removal) — Act now; follow-up.
- [Rails Active Storage: uploaded images can expose application secrets](https://www.oktsec.com/radar/rails-active-storage-ghsa-f3w6-w445-fwh9) — Act now; new to Radar.
- [n8n: update and migrate workflows using deprecated code nodes](https://www.oktsec.com/radar/n8n-cve-2026-119408) — Review this week; new to Radar.
- [GitLab issues an emergency code execution fix](https://www.oktsec.com/radar/gitlab-cve-2026-110264) — Review this week; follow-up.
- [BeyondTrust Remote Support: exploited appliance flaw](https://www.oktsec.com/radar/beyondtrust-bt26-05) — Act now; follow-up.
- [WordPress: patch the exploited core upgrade flaw](https://www.oktsec.com/radar/wordpress-core-cve-2026-119977) — Act now; new to Radar.
- [Drupal Commerce: patch active exploitation and audit orders](https://www.oktsec.com/radar/drupal-commerce-cve-2026-118539) — Act now; new to Radar.
- [CWP2Shell: update Control Web Panel and restrict panel access](https://www.oktsec.com/radar/control-web-panel-cwp2shell) — Act now; new to Radar.
- [Chrome 157: update and relaunch after seven critical fixes](https://www.oktsec.com/radar/google-chrome-157-security-update) — Act now; new to Radar.
- [Firefox: update to 159.0.1 and relaunch the browser](https://www.oktsec.com/radar/firefox-cve-2026-120572) — Review this week; new to Radar.
- [Node.js: prepare for security releases planned for November 11](https://www.oktsec.com/radar/nodejs-november-2026-security-releases) — Review this week; new to Radar.
- [Poisoned Source: mobile exploits target cookies and private data](https://www.oktsec.com/radar/poisoned-source-mobile-campaign) — Review this week; new to Radar.
- [Amatera in LATAM: fake verification prompts put business access at risk](https://www.oktsec.com/radar/amatera-stealer-latam-clickfix) — Review this week; new to Radar.
- [CyberStrikeAI: attackers compromised domain admins in 3–4 days](https://www.oktsec.com/radar/cyberstrikeai-education-latam-africa) — Review this week; new to Radar.
- [Amadeus booking data breach: airlines notify affected passengers](https://www.oktsec.com/radar/amadeus-airline-booking-data-breach-2026) — Review this week; new to Radar.

### Act now at cutoff

- [Cold chain attacks: protect refrigeration controls and monitoring](https://www.oktsec.com/radar/refrigeration-controller-attacks-europe-2026) — Act now; new to Radar.
- [Node-RED: exploitation attempts observed against unauthenticated interfaces](https://www.oktsec.com/radar/siemens-node-red-cve-2026-58115) — Act now; new to Radar.
- [cPGuard: malicious updates expose server credentials](https://www.oktsec.com/radar/cpguard-update-channel-compromise-2026) — Act now; new to Radar.
- [Cursor: malicious Claude Code extensions attempt persistent SSH access](https://www.oktsec.com/radar/cursor-claude-code-malicious-extension-october-2026) — Act now; new to Radar.
- [LiteLLM 1.107.0: check where it ran](https://www.oktsec.com/radar/litellm-1-107-0) — Act now; follow-up.
- [Northflank: rotate project and integration secrets after incident](https://www.oktsec.com/radar/northflank-secrets-incident-october-2026) — Act now; new to Radar.
- [Chainalysis confirms credential exposure and suspends KYT](https://www.oktsec.com/radar/chainalysis-user-data-incident-october-2026) — Act now; new to Radar.
- [BTCPay Server: affected hosts need a fresh VM and wallet](https://www.oktsec.com/radar/btcpay-server-hot-wallet-incident-november-2026) — Act now; new to Radar.
- [Brotli: patch runtimes and proxies that decode untrusted data](https://www.oktsec.com/radar/nodejs-brotli-cve-2026-111497) — Act now; follow-up.
- [eMudhra: replace affected certificates and review application trust](https://www.oktsec.com/radar/emudhra-chrome-root-removal) — Act now; follow-up.
- [Rails Active Storage: uploaded images can expose application secrets](https://www.oktsec.com/radar/rails-active-storage-ghsa-f3w6-w445-fwh9) — Act now; new to Radar.
- [BeyondTrust Remote Support: exploited appliance flaw](https://www.oktsec.com/radar/beyondtrust-bt26-05) — Act now; follow-up.
- [WordPress: patch the exploited core upgrade flaw](https://www.oktsec.com/radar/wordpress-core-cve-2026-119977) — Act now; new to Radar.
- [Drupal Commerce: patch active exploitation and audit orders](https://www.oktsec.com/radar/drupal-commerce-cve-2026-118539) — Act now; new to Radar.
- [CWP2Shell: update Control Web Panel and restrict panel access](https://www.oktsec.com/radar/control-web-panel-cwp2shell) — Act now; new to Radar.
- [Chrome 157: update and relaunch after seven critical fixes](https://www.oktsec.com/radar/google-chrome-157-security-update) — Act now; new to Radar.

### Known exploitation at cutoff

- [Brotli: patch runtimes and proxies that decode untrusted data](https://www.oktsec.com/radar/nodejs-brotli-cve-2026-111497) — Act now; follow-up.
- [BeyondTrust Remote Support: exploited appliance flaw](https://www.oktsec.com/radar/beyondtrust-bt26-05) — Act now; follow-up.
- [WordPress: patch the exploited core upgrade flaw](https://www.oktsec.com/radar/wordpress-core-cve-2026-119977) — Act now; new to Radar.
- [Drupal Commerce: patch active exploitation and audit orders](https://www.oktsec.com/radar/drupal-commerce-cve-2026-118539) — Act now; new to Radar.

## Refrigeration controls and exposed Node-RED interfaces

EU authorities confirmed another wave of refrigeration incidents on November 1–2. US agencies describe targeting of controllers and cold chain monitoring, where changed settings can damage inventory or remove temperature visibility. Separately, VulnCheck observed malicious Node-RED flow deployments against canaries; those observations do not establish compromised industrial sites.

What to check: Remove public access to refrigeration administration, secure necessary maintenance access and verify actual temperatures, setpoints and alarm delivery with operations. For the affected SIMATIC IoT2050 models running Industrial OS with Node-RED, install V4.3.4-1 or later, enforce authentication and inspect deployed flows.

Advisory details (updated separately):

[Cold chain attacks: protect refrigeration controls and monitoring](https://www.oktsec.com/radar/refrigeration-controller-attacks-europe-2026)

[Node-RED: exploitation attempts observed against unauthenticated interfaces](https://www.oktsec.com/radar/siemens-node-red-cve-2026-58115)

## Compromised updates leave credentials and persistence behind

OpsShield reports that a malicious cPGuard update accessed root credentials and other secrets; its later disclosure supersedes parts of the initial notice. Cursor identified malicious Claude Code extension versions 2.1.312 and 2.1.313 with SSH persistence. LiteLLM’s October 30 clarification identifies its replacement image signing key: signatures made with the previous key do not establish that an artifact is clean.

What to check: For cPGuard, follow the 5.88.26 cleanup guidance, replace exposed credentials and revoke trust in compromised SSH keys on other hosts. For Cursor, correlate extension installation with endpoint execution and remove persistence. For LiteLLM, compare artifact digests and key provenance, rebuild affected environments and rotate reachable secrets.

Advisory details (updated separately):

[cPGuard: malicious updates expose server credentials](https://www.oktsec.com/radar/cpguard-update-channel-compromise-2026)

[Cursor: malicious Claude Code extensions attempt persistent SSH access](https://www.oktsec.com/radar/cursor-claude-code-malicious-extension-october-2026)

[LiteLLM 1.107.0: check where it ran](https://www.oktsec.com/radar/litellm-1-107-0)

## Northflank and Chainalysis: containment does not complete customer recovery

Northflank’s November 6 update places the earliest known secret decryption at 02:39–03:08 UTC on October 30 and keeps its rotation requirement. Chainalysis began a phased restoration of KYT and Address Screening on November 6; that is not full restoration of every product. Its recovery process requires password resets and API key rotation where applicable.

What to check: Rotate Northflank project and integration secrets at their issuers, revoke old credentials and review usage and billing. Chainalysis customers should coordinate trusted IP access through their established account contact, then reset credentials before resuming transactions. Follow the current provider notice for access to other products.

Advisory details (updated separately):

[Northflank: rotate project and integration secrets after incident](https://www.oktsec.com/radar/northflank-secrets-incident-october-2026)

[Chainalysis confirms credential exposure and suspends KYT](https://www.oktsec.com/radar/chainalysis-user-data-incident-october-2026)

## Wallet recovery requires more than restoring service

Binance’s November 3 preliminary findings connect a fake recruitment assignment and internal AI tooling to access to wallet signing. Its reported 98% replenishment is not recovery of 98% of stolen assets. Separately, BTCPay reports theft affecting servers on 2.4.1 or earlier; its recovery scope also includes servers updated only after the November 1 warning.

What to check: Review access from employee tooling to deployment tokens and signing services, including persistent delegations. For BTCPay servers within the stated scope, preserve evidence, rebuild on a fresh VM with a new wallet and seed, and rotate exposed host secrets. Updating the old host or restoring its full image is insufficient.

Advisory details (updated separately):

[Binance links wallet breach to a fake job interview and internal AI tooling](https://www.oktsec.com/radar/binance-hot-wallet-drain-october-2026)

[BTCPay Server: affected hosts need a fresh VM and wallet](https://www.oktsec.com/radar/btcpay-server-hot-wallet-incident-november-2026)

## Linux: verify the running kernel and the replacement fleet

AWS describes demonstrated unauthenticated code execution through CVE-2026-98432 on hosts with an MPTCP listener, while reporting no evidence of attacks. Amazon Linux fixes and GameLift Servers images are available. RDS/Aurora OS patch availability remains a November 6 target in the reviewed bulletin, not a verified completed rollout.

What to check: Apply the distributor correction and activate the fixed kernel. Replace affected GameLift container fleets created before November 2 at 21:06 UTC and managed EC2 fleets created before November 3 at 01:55 UTC; move session traffic before retiring old fleets. Check the current RDS/Aurora patch state and keep database ports off the public internet.

Advisory details (updated separately):

[Linux IPv4/TCP: check exposed kernels for CVE-2026-98432](https://www.oktsec.com/radar/linux-kernel-cve-2026-98432)

## Brotli and certificate updates need checks by service

AWS now reports corrected CodeBuild curated images and Lambda Node.js runtimes; pinned or custom images still need customer action. Solace reports completed Cloud Console and Micro-Integrations fixes and Schema Registry 1.1.3, while its unused Event Broker appliance RPM remains scheduled for replacement. These product states must not be collapsed into one universal completion claim.

What to check: Rebuild affected containers, update image pins and verify Lambda runtime patch identifiers. Apply Schema Registry 1.1.3 where needed. Separately, finish replacing affected eMudhra certificate chains and application trust stores; an elapsed provider rollout date does not prove that customer certificates or deployed bundles were replaced.

Advisory details (updated separately):

[Brotli: patch runtimes and proxies that decode untrusted data](https://www.oktsec.com/radar/nodejs-brotli-cve-2026-111497)

[eMudhra: replace affected certificates and review application trust](https://www.oktsec.com/radar/emudhra-chrome-root-removal)

## Application fixes can leave a second task

Rails Active Storage is exposed when untrusted uploads reach ImageMagick under a permissive coder policy; Disk storage can also expose files readable by the application. In n8n, saved workflows with deprecated code nodes can continue to execute after an upgrade. GitLab installations using their own Ruby runtime do not receive the runtime correction by updating GitLab alone.

What to check: Upgrade Active Storage to 8.0.5.2 or 8.1.4.1 and verify the effective ImageMagick policy; investigate and replace exposed application secrets. Upgrade n8n and migrate Function, Function Item and LangChain Code nodes. For GitLab with a separate Ruby runtime, apply Ruby 3.3.13, 3.4.12, 4.0.9 or a later corrected release.

Advisory details (updated separately):

[Rails Active Storage: uploaded images can expose application secrets](https://www.oktsec.com/radar/rails-active-storage-ghsa-f3w6-w445-fwh9)

[n8n: update and migrate workflows using deprecated code nodes](https://www.oktsec.com/radar/n8n-cve-2026-119408)

[GitLab issues an emergency code execution fix](https://www.oktsec.com/radar/gitlab-cve-2026-110264)

## WordPress and Drupal exploitation; CWP2Shell demonstration

BeyondTrust now lists Remote Support 26.3.1 as fixed alongside the BT26-05-RS patch. CISA added the WordPress core upgrade flaw CVE-2026-119977 to KEV on November 3. Drupal confirms active exploitation of Commerce Core CVE-2026-118539. By contrast, CWP2Shell is a demonstrated chain to root, with a valid hosting username required at its unauthenticated entry; the reviewed research does not establish actual attacks for these CVEs.

What to check: For BeyondTrust, verify BT26-05-RS or Remote Support 26.3.1 or later; older releases must upgrade before they can accept the patch. Install WordPress 7.1.4 or the corrected release for the deployed branch and review prior upgrade activity. Update Commerce Core to 3.3.13 or 8.x-2.41 and audit orders. For Control Web Panel, install the vendor’s recommended 1.30.1 security update and restrict access to administration.

Advisory details (updated separately):

[BeyondTrust Remote Support: exploited appliance flaw](https://www.oktsec.com/radar/beyondtrust-bt26-05)

[WordPress: patch the exploited core upgrade flaw](https://www.oktsec.com/radar/wordpress-core-cve-2026-119977)

[Drupal Commerce: patch active exploitation and audit orders](https://www.oktsec.com/radar/drupal-commerce-cve-2026-118539)

[CWP2Shell: update Control Web Panel and restrict panel access](https://www.oktsec.com/radar/control-web-panel-cwp2shell)

## Browser fixes are available; the next Node.js release is still planned

Chrome 157 includes seven Critical fixes in its November 3 desktop release. Mozilla fixed CVE-2026-120572 in Firefox 159.0.1. Neither reviewed announcement reports active exploitation. Node.js separately plans security releases for 22.x, 24.x and 26.x on November 11 or shortly after, with High as the maximum announced severity.

What to check: Update and relaunch managed browsers, then verify their running versions. Inventory Node.js deployments and prepare compatibility tests and a rollout window. The November Node.js fixes and CVE details are not yet published; preparation does not replace the existing Brotli updates.

Advisory details (updated separately):

[Chrome 157: update and relaunch after seven critical fixes](https://www.oktsec.com/radar/google-chrome-157-security-update)

[Firefox: update to 159.0.1 and relaunch the browser](https://www.oktsec.com/radar/firefox-cve-2026-120572)

[Node.js: prepare for security releases planned for November 11](https://www.oktsec.com/radar/nodejs-november-2026-security-releases)

## Mobile exploits and fake verification prompts expose account access

Sekoia recovered three Poisoned Source exploit chains for specific iOS and Android/Chrome versions. The analyzed chains use already patched vulnerabilities and do not work against fully updated devices; attribution to APT29 is Sekoia’s assessment with moderate to high confidence. COLCERT’s Amatera warning describes Windows credential and cookie theft through fake verification prompts and impersonated software pages.

What to check: Check operating system, browser and device security updates. Teach staff to report verification pages that request command execution. Where evidence suggests compromise, preserve relevant records, contain the device and revoke affected sessions and exposed credentials from a trusted system. Installing updates or cleaning the device does not invalidate stolen sessions.

Advisory details (updated separately):

[Poisoned Source: mobile exploits target cookies and private data](https://www.oktsec.com/radar/poisoned-source-mobile-campaign)

[Amatera in LATAM: fake verification prompts put business access at risk](https://www.oktsec.com/radar/amatera-stealer-latam-clickfix)

## CyberStrikeAI used familiar paths to domain compromise

Kaspersky reports activity against educational organizations in Latin America and Africa. In the detailed incident, attackers already controlled a SQL Server before deploying CyberStrikeAI. An LLM on the control server selected actions; the implant executed conventional commands, including credential theft and movement through SMB and WMI. This does not establish a new vulnerability in every SQL Server.

What to check: Review unexpected child processes of sqlservr.exe, scheduled tasks, credential access and privileged account use. Limit server to server administration paths and investigate suspicious SMB/WMI activity. Correlate the published indicators with local evidence rather than treating use of an AI tool as proof of attribution.

Advisory details (updated separately):

[CyberStrikeAI: attackers compromised domain admins in 3–4 days](https://www.oktsec.com/radar/cyberstrikeai-education-latam-africa)

## Amadeus: reservation data exposed through airline bookings

Amadeus and airline notices confirm unauthorized access to reservation data. Names, booking references and itineraries appear in the notices; additional fields vary by airline and customer subset. Counts mix passengers and bookings, so they cannot be added into a unique victim total. Amadeus says it found no evidence of access to payment or financial data.

What to check: Travel teams should check the relevant carrier notice, verify unexpected itinerary or payment messages through established channels and follow instructions for affected booking references. Keep the provider’s statements separate from an independent forensic conclusion.

Advisory details (updated separately):

[Amadeus booking data breach: airlines notify affected passengers](https://www.oktsec.com/radar/amadeus-airline-booking-data-breach-2026)

## Recommended checks

1. Identify exposed administration and validate operational safety with the people running refrigeration and other connected equipment.
2. Confirm the corrected kernel, runtime, firmware or image is actually running; retain proof for each deployment.
3. Complete the second task after patching: rotate exposed credentials, revoke sessions and SSH trust, migrate saved workflows or rebuild affected hosts.
4. Keep exploit demonstrations, observed attacks, provider statements and scheduled releases separate in the response record.

## Sources

- [US joint fact sheet: hardening refrigeration and cold chain monitoring, November 5](https://www.cisa.gov/resources-tools/resources/us-government-partners-urge-hardening-industrial-refrigeration-and-cold-chain-monitoring-systems) — CISA / FBI / HHS / USDA / DoT; Government advisory; checked 2026-11-05T19:51:39Z
- [EU joint statement: recurring refrigeration incidents, November 4](https://digital-strategy.ec.europa.eu/en/news/joint-statement-cyber-incidents-refrigeration-systems-across-eu) — European Commission / ENISA / Europol / CSIRTs Network / EU-CyCLONe; Government advisory; checked 2026-11-05T20:32:23Z
- [CSIRTs Network: collection of national refrigeration advisories](https://github.com/enisaeu/CNW/blob/main/advisories/2026/CNW-2026-05_retail-incidents.md) — ENISA / CSIRTs Network; Government advisory; checked 2026-11-05T20:32:23Z
- [CERT-FR refrigeration-controller alert; guidance revised October 16](https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/) — CERT-FR / ANSSI; Government advisory; checked 2026-11-05T19:51:39Z
- [Copeland/Dixell XWEB security and recovery bulletin, October 14](https://dixell.fr/wp-content/uploads/2026/10/Recommandations-pour-une-utilisation-securisee-des-superviseurs-XWEB-v1.0.pdf) — Copeland Controls / Dixell France; Vendor notice; checked 2026-11-05T19:51:39Z
- [EL PAÍS: further European supermarket refrigeration incidents, November 2](https://elpais.com/tecnologia/2026-11-02/un-ciberataque-causa-perdidas-millonarias-en-decenas-de-supermercados-en-belgica-y-suecia.html) — EL PAÍS; Media report; checked 2026-11-02T12:48:28Z
- [ONYPHE: Danfoss StoreView exposure, October 13; updated October 15](https://blog.onyphe.io/en/refrigeration-as-critical-infrastructure-analyzing-the-cyberattack-on-french-supermarkets/) — ONYPHE; Research report; checked 2026-11-02T13:04:52Z
- [ONYPHE: Copeland/Dixell exposure study, October 22](https://blog.onyphe.io/en/refrigeration-as-critical-infrastructure-beyond-danfoss-the-exposure-of-copeland-dixell-supervisory-systems/) — ONYPHE; Research report; checked 2026-11-02T13:04:52Z
- [Siemens SSA-834709: affected product and correction](https://cert-portal.siemens.com/productcert/html/ssa-834709.html) — Siemens; Vendor notice; checked 2026-11-05T20:16:34Z
- [Node-RED exploitation attempts in canary telemetry](https://www.vulncheck.com/blog/exploitation-targeting-node-red) — VulnCheck; Research report; checked 2026-11-03T17:00:17Z
- [Secure the Node-RED editor and admin API](https://nodered.org/docs/user-guide/runtime/securing-node-red) — Node-RED; Vendor notice; checked 2026-11-03T17:00:17Z
- [Latest incident disclosure and recovery guidance](https://opsshield.com/notice/security-incident-disclosure-servermanage.html) — OPSSHIELD; Vendor notice; checked 2026-11-05T12:14:16Z
- [Earlier advisory: affected updates and log limitations](https://opsshield.com/notice/cpguard-update-channel-compromise.html) — OPSSHIELD; Vendor notice; checked 2026-11-05T12:14:16Z
- [Cursor security notice: malicious Anthropic.claude-code versions](https://cursor.com/blog/claude-code-extension-security-notice) — Cursor; Vendor notice; checked 2026-10-31T18:51:00Z
- [Microsoft analysis: persistent SSH backdoor in the Cursor extension](https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/) — Microsoft Security Research; Research report; checked 2026-10-31T18:51:00Z
- [October 21 supply chain incident](https://docs.litellm.ai/blog/security-incident-oct-21-2026) — LiteLLM; Vendor notice; checked 2026-10-31T12:46:55Z
- [Definitive investigation: the attack chain behind release 1.107.0](https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain) — LiteLLM; Vendor notice; checked 2026-10-24T13:11:44Z
- [Northflank incident updates and rotation guidance](https://status.northflank.com/) — Northflank; Vendor notice; checked 2026-11-03T17:00:17Z
- [Chainalysis incident updates through November 4](https://www.chainalysis.com/blog/security-incident-october-30/) — Chainalysis; Vendor notice; checked 2026-11-05T20:16:34Z
- [Binance November 3 preliminary findings: fake interview, internal AI tooling and signing access](https://www.binance.com/en/square/post/11-03-2026-binance-says-98-of-6-34-billion-stolen-assets-replenished-details-multi-stage-attack-384312984895952) — Binance News · official account; Vendor notice; checked 2026-11-03T16:03:45Z
- [Binance November 3 report: containment, replenishment and investigation status](https://www.binance.com/en/square/post/11-03-2026-binance-reports-initial-findings-on-october-29-2026-security-incident-384312475100740) — Binance News · official account; Vendor notice; checked 2026-11-03T16:03:45Z
- [Binance October 30 statement: estimated impact, initial investigation and response](https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7) — Binance; Vendor notice; checked 2026-10-30T10:26:59Z
- [Binance: investigation into a potential security issue](https://x.com/binance/status/2115915483832832425) — Binance; Vendor notice; checked 2026-10-30T00:00:29Z
- [Binance: $2.54 billion frozen, not a final loss estimate](https://x.com/binance/status/2115947325617299903) — Binance; Vendor notice; checked 2026-10-30T00:00:29Z
- [Binance 14: EIP-7702 delegation at 20:20:59 UTC](https://etherscan.io/tx/0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b) — Etherscan; Research report; checked 2026-10-30T00:00:29Z
- [Binance 14: ETH and token transfers at 20:24:23 UTC](https://etherscan.io/tx/0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3) — Etherscan; Research report; checked 2026-10-30T00:00:29Z
- [Binance Hot Wallet 34: 780 million USDC transfer](https://etherscan.io/tx/0xdc102dd89dded5a83f1008906883ffb7c81ff3b7d7965d8c7277d170b5e17481) — Etherscan; Research report; checked 2026-10-30T00:00:29Z
- [EIP-7702 delegation and transfer analysis](https://x.com/odysseas_eth/status/2115910280140276155) — Odysseas / Phylax; Research report; checked 2026-10-30T00:00:29Z
- [Circle: more than 800 million USDC frozen](https://x.com/jerallaire/status/2115916207463481846) — Jeremy Allaire / Circle; Vendor notice; checked 2026-10-30T00:00:29Z
- [Tether: more than 1.567 billion USDT frozen](https://x.com/paoloardoino/status/2115918000373346709) — Paolo Ardoino / Tether; Vendor notice; checked 2026-10-30T00:00:29Z
- [EIP-7702: account code delegation and security considerations](https://eips.ethereum.org/EIPS/eip-7702) — Ethereum Improvement Proposals; Research report; checked 2026-10-30T00:00:29Z
- [BWEnews tally reported by BBX: $5.643 billion in outflows at 21:22 UTC](https://bbx.com/news-detail/3158067) — BBX / BWEnews; Media report; checked 2026-10-30T00:46:36Z
- [Binance 14: second transfer at 21:44:11 UTC](https://etherscan.io/tx/0x55ba4dabc41b468e580751373ad31acdee6f5ba398682df2c93e5a8340870556) — Etherscan; Research report; checked 2026-10-30T00:46:36Z
- [Binance security incident update #2: additional breach points and replacement assets](https://www.binance.com/en/support/announcement/detail/d3306d9dca5243548c813b605e1d1751) — Binance; Vendor notice; checked 2026-10-31T12:46:55Z
- [Binance recovery update #3: 90% replenishment and reserve-proof timeline](https://www.binance.com/en/support/announcement/detail/1fdf1f61559c401da0435895ffcccb62) — Binance; Vendor notice; checked 2026-10-31T18:51:00Z
- [Binance recovery update #4: 95% replenishment and phased withdrawals](https://www.binance.com/en-PH/support/announcement/detail/73911fb819b240f88b88256bdd318eda) — Binance; Vendor notice; checked 2026-11-01T11:26:03Z
- [Binance Chinese official account: first-phase BTC withdrawals have begun](https://www.binance.com/en/square/post/383484274355718) — Binance Chinese; Vendor notice; checked 2026-11-01T11:26:03Z
- [FBI October 31 attribution: North Korean TraderTraitor activity](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack) — FBI; Government advisory; checked 2026-11-01T11:26:03Z
- [BTCPay incident scope and recovery guidance](https://blog.btcpayserver.org/btcpay-server-security-incident-2-4-1-and-earlier/) — BTCPay Server; Vendor notice; checked 2026-11-03T17:00:17Z
- [AWS 2026-160: kernel, node and managed-service response](https://aws.amazon.com/security/security-bulletins/2026-160-aws/) — AWS; Vendor notice; checked 2026-11-05T20:16:34Z
- [Linux CNA: IPv4/TCP mechanism and upstream branch fixes](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/98xxx/CVE-2026-98432.json) — Linux; Vendor notice; checked 2026-11-01T19:45:56Z
- [Amazon Linux: affected packages and CVSS assessment](https://explore.alas.aws.amazon.com/CVE-2026-98432.html) — Amazon Linux; Vendor notice; checked 2026-11-01T19:45:56Z
- [Red Hat: affected products and mitigation limits](https://access.redhat.com/security/vulnerabilities/RHSB-2026-016) — Red Hat; Vendor notice; checked 2026-11-04T11:43:00Z
- [Red Hat: affected branches and issued security errata](https://access.redhat.com/security/cve/CVE-2026-98432) — Red Hat; Vendor notice; checked 2026-11-04T11:43:00Z
- [October Node.js security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) — Node.js; Vendor notice; checked 2026-10-24T02:44:01Z
- [Node2Shell research demonstration](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/) — Imperva; Research report; checked 2026-10-23T21:03:38Z
- [Brotli exposure, fixed releases and mitigations](https://patchtheplanet.org/brotli) — OpenAI · Patch the Planet; Research report; checked 2026-10-24T02:44:01Z
- [Brotli 1.2.1 security release](https://github.com/google/brotli/releases/tag/v1.2.1) — Google Brotli; Vendor notice; checked 2026-10-24T02:44:01Z
- [Brotli 1.1.1 security release](https://github.com/google/brotli/releases/tag/v1.1.1) — Google Brotli; Vendor notice; checked 2026-10-24T02:44:01Z
- [Brotli 1.0.10 security release](https://github.com/google/brotli/releases/tag/v1.0.10) — Google Brotli; Vendor notice; checked 2026-10-24T02:44:01Z
- [Bun 1.4.4 Brotli dependency](https://github.com/oven-sh/bun/blob/bun-v1.4.4/scripts/build/deps/brotli.ts) — Bun; Vendor notice; checked 2026-10-24T02:44:01Z
- [Envoy Brotli decompressor advisory](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3wvj-j6qm-62mr) — Envoy; Vendor notice; checked 2026-10-24T02:44:01Z
- [Istio security advisory and fixed releases](https://istio.io/latest/news/security/istio-security-2026-007/) — Istio; Vendor notice; checked 2026-10-24T02:44:01Z
- [IO::Compress::Brotli 0.023 security release](https://github.com/timlegge/perl-IO-Compress-Brotli/releases/tag/0.023) — IO::Compress::Brotli maintainers; Vendor notice; checked 2026-10-25T13:12:31Z
- [PAN-OS October 29 matrix and Transporter correction](https://security.paloaltonetworks.com/CVE-2026-111497) — Palo Alto Networks; Vendor notice; checked 2026-10-31T12:46:55Z
- [Updated PHP Windows builds for Brotli security fix](https://www.php.net/archive/2026.php#2026-10-26-1) — PHP; Vendor notice; checked 2026-10-26T23:22:16Z
- [PAN-OS 12.2.4-h1 addressed issues](https://docs.paloaltonetworks.com/ngfw/release-notes/12-2/pan-os-12-2-4-known-and-addressed-issues/pan-os-12-2-4-h1-addressed-issues) — Palo Alto Networks; Vendor notice; checked 2026-10-27T15:32:05Z
- [PAN-OS 12.1.7-h11 addressed issues](https://docs.paloaltonetworks.com/ngfw/release-notes/12-1/pan-os-12-1-7-known-and-addressed-issues/pan-os-12-1-7-h11-addressed-issues) — Palo Alto Networks; Vendor notice; checked 2026-10-27T15:32:05Z
- [CISA KEV: CVE-2024-27834 added November 4; other chain CVEs have earlier entries](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — CISA; Government advisory; checked 2026-11-05T12:14:16Z
- [AWS: Brotli runtime verification and CodeBuild corrections](https://aws.amazon.com/security/security-bulletins/2026-155-aws/) — AWS; Vendor notice; checked 2026-11-04T10:42:26Z
- [Solace: corrected components and Schema Registry 1.1.3](https://solace.com/support/brotli-decoder-security-vulnerabilities/) — Solace; Vendor notice; checked 2026-11-04T10:42:26Z
- [CloudLinux OS: separate system, EasyApache and alt-php Brotli fixes](https://cloudlinux.zendesk.com/hc/en-us/articles/31345594031132-Brotli-CVE-2026-111497-on-CloudLinux-OS-affected-packages-and-fixed-versions) — CloudLinux; Vendor notice; checked 2026-10-30T18:04:00Z
- [Microsoft guidance: PHP2Shell, Brotli and eMudhra](https://www.microsoft.com/en-us/msrc/blog/2026/10/patch-now-php2shell-brotli-emudhra-guidance-for-customers) — Microsoft; Vendor notice; checked 2026-10-31T12:46:55Z
- [Chrome and Android response to compromised eMudhra intermediates](https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/) — Google; Vendor notice; checked 2026-10-26T11:05:34Z
- [Java security alert CVE-2026-91403](https://www.oracle.com/security-alerts/alert-cve-2026-91403.html) — Oracle; Vendor notice; checked 2026-10-25T13:12:31Z
- [Java follow-up alert: root certificate removal](https://www.oracle.com/security-alerts/alert-cve-2026-114820.html) — Oracle; Vendor notice; checked 2026-10-27T15:32:05Z
- [Runtime checks and mitigations for eMudhra certificates](https://ops.java/emudhra) — Oracle; Vendor notice; checked 2026-10-27T15:32:05Z
- [Python ssl certificate denylist announcement](https://mail.python.org/archives/list/security-announce@python.org/message/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/) — Python; Vendor notice; checked 2026-10-25T13:12:31Z
- [CPython certificate denylist merged change](https://github.com/python/cpython/pull/160042) — Python; Vendor notice; checked 2026-10-25T13:12:31Z
- [MongoDB Compass 1.53.1 release](https://github.com/mongodb-js/compass/releases/tag/v1.53.1) — MongoDB; Vendor notice; checked 2026-10-25T13:12:31Z
- [Electron 44.9.1 certificate mitigation](https://releases.electronjs.org/release/v44.9.1) — Electron; Vendor notice; checked 2026-10-25T13:12:31Z
- [Python 3.15.2 security release](https://www.python.org/downloads/release/python-3152/) — Python; Vendor notice; checked 2026-10-26T11:05:34Z
- [Python 3.14.10 security release](https://www.python.org/downloads/release/python-31410/) — Python; Vendor notice; checked 2026-10-26T11:05:34Z
- [Python 3.13.18 security release](https://www.python.org/downloads/release/python-31318/) — Python; Vendor notice; checked 2026-10-26T11:05:34Z
- [Python 3.12.16 security release](https://www.python.org/downloads/release/python-31216/) — Python; Vendor notice; checked 2026-10-26T11:05:34Z
- [Python 3.11.18 security release](https://www.python.org/downloads/release/python-31118/) — Python; Vendor notice; checked 2026-10-26T11:05:34Z
- [Application updates for compromised eMudhra certificates](https://firebase.google.com/support/guides/compromised-emudhra-intermediate-ca) — Google; Vendor notice; checked 2026-10-26T11:05:34Z
- [AWS trust bundle updates: ALB certificates and Lambda deployment actions](https://aws.amazon.com/security/security-bulletins/2026-150-aws/) — AWS; Vendor notice; checked 2026-11-05T20:16:34Z
- [MongoDB CNA record: Compass CVE-2026-115929](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115929.json) — MongoDB; Vendor notice; checked 2026-10-28T15:05:20Z
- [GHSA-f3w6-w445-fwh9: scope and credential recovery](https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9) — Ruby on Rails; Vendor notice; checked 2026-11-05T12:14:16Z
- [Rails 8.1.4.1: ImageMagick policy and compatibility changes](https://github.com/rails/rails/releases/tag/v8.1.4.1) — Ruby on Rails; Vendor notice; checked 2026-11-05T12:14:16Z
- [Rails 8.0.5.2: corrected branch release](https://github.com/rails/rails/releases/tag/v8.0.5.2) — Ruby on Rails; Vendor notice; checked 2026-11-05T12:14:16Z
- [n8n: deprecated code nodes and migration requirements](https://github.com/n8n-io/n8n/security/advisories/GHSA-9p7v-45m2-wxgj) — n8n; Vendor notice; checked 2026-11-03T17:00:17Z
- [CNA record: CVE mapping and affected branches](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119408.json) — VulnCheck; Research report; checked 2026-11-03T17:00:17Z
- [GitLab critical patch release](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/) — GitLab; Vendor notice; checked 2026-11-05T20:16:34Z
- [BT26-05 security advisory](https://www.beyondtrust.com/trust-center/security-advisories/bt26-05) — BeyondTrust; Vendor notice; checked 2026-11-05T20:16:34Z
- [ARMORY CASTLE investigation and response](https://www.beyondtrust.com/blog/entry/bt26-05) — BeyondTrust; Vendor notice; checked 2026-11-05T20:16:34Z
- [WordPress 7.1.4 security release](https://wordpress.org/news/2026/10/wordpress-7-1-4/) — WordPress; Vendor notice; checked 2026-11-03T22:13:58Z
- [Wordfence: affected branches and corrected releases](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution) — Wordfence; Research report; checked 2026-11-03T22:13:58Z
- [Wordfence CNA: CVE-2026-119977 branch ranges](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119977.json) — Wordfence / CVE Program; Research report; checked 2026-11-03T22:13:58Z
- [SA-CONTRIB-2026-254: Commerce Core access bypass](https://www.drupal.org/sa-contrib-2026-254) — Drupal; Vendor notice; checked 2026-11-01T00:22:00Z
- [Commerce Core 3.3.13 security release](https://www.drupal.org/project/commerce/releases/3.3.13) — Drupal; Vendor notice; checked 2026-11-01T00:22:00Z
- [Commerce Core 8.x-2.41 security release](https://www.drupal.org/project/commerce/releases/8.x-2.41) — Drupal; Vendor notice; checked 2026-10-31T23:54:40Z
- [CWP2Shell: research demonstration and staged fixes](https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce) — VulnCheck; Research report; checked 2026-11-04T09:49:59Z
- [Control Web Panel: security release 1.30.1](https://control-webpanel.com/changelog) — Control Web Panel; Vendor notice; checked 2026-11-04T09:49:59Z
- [CVE-2026-73695: CNA affected range](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/73xxx/CVE-2026-73695.json) — VulnCheck CNA; Research report; checked 2026-11-04T09:49:59Z
- [CVE-2026-73696: CNA affected range](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/73xxx/CVE-2026-73696.json) — VulnCheck CNA; Research report; checked 2026-11-04T09:49:59Z
- [CVE-2026-73697: CNA affected range](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/73xxx/CVE-2026-73697.json) — VulnCheck CNA; Research report; checked 2026-11-04T09:49:59Z
- [CVE-2026-77876: CNA affected range](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77876.json) — VulnCheck CNA; Research report; checked 2026-11-04T09:49:59Z
- [CVE-2026-77877: CNA affected range](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77877.json) — VulnCheck CNA; Research report; checked 2026-11-04T09:49:59Z
- [CVE-2026-77878: CNA affected range](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77878.json) — VulnCheck CNA; Research report; checked 2026-11-04T09:49:59Z
- [CVE-2026-77879: CNA affected range](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77879.json) — VulnCheck CNA; Research report; checked 2026-11-04T09:49:59Z
- [CVE-2026-77880: CNA affected range](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77880.json) — VulnCheck CNA; Research report; checked 2026-11-04T09:49:59Z
- [CVE-2026-77881: CNA affected range](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77881.json) — VulnCheck CNA; Research report; checked 2026-11-04T09:49:59Z
- [CVE-2026-104080: CNA affected range](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104080.json) — VulnCheck CNA; Research report; checked 2026-11-04T09:49:59Z
- [Chrome 157: desktop stable security release](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html) — Google; Vendor notice; checked 2026-11-04T09:49:59Z
- [Mozilla MFSA 2026-123: Firefox 159.0.1](https://www.mozilla.org/en-US/security/advisories/mfsa2026-123/) — Mozilla; Vendor notice; checked 2026-11-04T20:41:46Z
- [November 2026 security release announcement](https://nodejs.org/en/blog/vulnerability/november-2026-security-releases) — Node.js; Vendor notice; checked 2026-11-05T12:01:09Z
- [Poisoned Source: mobile delivery, recovered chains and attribution assessment](https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits) — Sekoia; Research report; checked 2026-11-05T12:25:00Z
- [Apple security releases and device eligibility](https://support.apple.com/en-us/100100) — Apple; Vendor notice; checked 2026-11-04T18:36:14Z
- [DarkSword: earlier research and patch context, separate from Poisoned Source](https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain) — Google Threat Intelligence Group; Research report; checked 2026-11-04T18:36:14Z
- [Chrome for Android: March 12 security update](https://chromereleases.googleblog.com/2026/03/chrome-for-android-update_12.html) — Google; Vendor notice; checked 2026-11-04T18:36:14Z
- [CVE-2026-3910: corresponding Chrome security fix](https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html) — Google; Vendor notice; checked 2026-11-04T18:36:14Z
- [CVE-2025-27038: Qualcomm CNA record for Adreno GPU drivers](https://www.cve.org/CVERecord?id=CVE-2025-27038) — Qualcomm, via CVE Program; Vendor notice; checked 2026-11-04T18:36:14Z
- [COLCERT AL 20261103 125: regional warning and response guidance](https://www.colcert.gov.co/800/articles-442397_COLCERT_AL__20261103__125_Alerta_Aumento_de_campanas_del_infostealer_Amatera_ACR_Stealer_en_America_Latina.pdf) — COLCERT; Government advisory; checked 2026-11-04T20:41:46Z
- [Amatera detections in Latin America during the first half of 2026](https://www.welivesecurity.com/es/malware/amatera-infostealer-en-aumento-america-latina/) — ESET; Research report; checked 2026-11-04T20:41:46Z
- [ACR Stealer: two intrusion chains observed from April to June](https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/) — Microsoft Security Research; Research report; checked 2026-11-04T20:41:46Z
- [May research into impersonated AI and development tool pages](https://www.straiker.ai/blog/acr-stealer-claude-code-impersonation-campaign) — Straiker; Research report; checked 2026-11-04T20:41:46Z
- [CyberStrikeAI: investigation of attacks on education](https://securelist.com/tr/cyberstrikeai-attacks/121715/) — Kaspersky Securelist; Research report; checked 2026-11-04T10:16:02Z
- [Education campaign: observed dates and incident timeline](https://www.kaspersky.com/about/press-releases/kaspersky-uncovers-ai-driven-attacks-on-educational-organizations-in-latin-america-and-africa) — Kaspersky; Research report; checked 2026-11-04T10:16:02Z
- [Earlier CyberStrikeAI infrastructure and FortiGate targeting — separate activity](https://www.team-cymru.com/post/tracking-cyberstrikeai-usage) — Team Cymru; Research report; checked 2026-11-04T10:16:02Z
- [Amadeus statement on the booking display vulnerability](https://amadeus.com/en/industry-messaging/amadeus-statement-oct) — Amadeus; Vendor notice; checked 2026-11-04T19:33:00Z
- [JAL and Japan Transocean Air: customer scope and response](https://www.jal.co.jp/en-jp/news/general/2026/other/261028.html) — Japan Airlines; Vendor notice; checked 2026-11-04T19:33:00Z
- [ANA: unauthorized access to passenger reservation data](https://www.ana.co.jp/en/us/special-notice/001615.html?p1=top&p2=en&p3=global) — ANA; Vendor notice; checked 2026-11-04T19:33:00Z
- [Cathay Pacific: reservation data incident at Amadeus](https://www.cathaypacific.com/cx/it_IT/latest-news/security-and-operational-changes/personal-data-security.html) — Cathay Pacific; Vendor notice; checked 2026-11-04T19:33:00Z
- [CNA reports Singapore Airlines’ November 3 statement](https://www.channelnewsasia.com/singapore/sia-singapore-airlines-amadeus-data-breach-booking-records-6517151) — CNA; Media report; checked 2026-11-04T19:33:00Z
- [EFE: Asian airlines affected by the Amadeus data breach](https://efe.com/economia/2026-11-04/reservas-aerolineas-asia-afectadas-brecha-seguridad-amadeus/) — EFE; Media report; checked 2026-11-04T19:33:00Z

## Scope and corrections

Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure.

[Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.