AlembicSec Brief

§ 01

Act now

Nothing new meets the Act now criteria since 12:00 CST.

1.ACISA KEV

0 this edition

No new KEV additions since 12:00 CST.

Earlier additions still inside their remediation window are in previous editions.

1.BCritical package advisories

0 this edition

No new critical package advisories since 12:00 CST.

Lower severities are listed under Packages.

§ 02

CISA KEV

4 entries still inside CISA's remediation window · 0 new since 12:00 CST

Google Brotli CVE-2026-111497 EPSS 83% contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed streamLatestNov 3 · Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up Due Nov 107d left DetailsHide13
1. Oct 22CVE publishedNVD · CVSS 9.2 · Critical
2. Oct 22Fix releasedbrotli (PyPI) 1.2.1 · GHSA-9v8h-qqgm-4m35
3. Oct 22Fix releasedbrotlicffi (PyPI) 1.2.1.0 · GHSA-9v8h-qqgm-4m35
4. Oct 26Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches · BleepingComputer
  Oct 26PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw · The Hacker News
5. Oct 27Added to KEVDue in 14 days · ransomware use unknown
6. Oct 27Node2Shell puts Microsoft and Node.js on Brotli patch duty · CSO Online
  Oct 27Brotli bug reaches far beyond Node.js (CVE-2026-111497) · Help Net Security
7. Oct 28First in AlembicSecOct 28 Morning
8. Show 1 earlierHide 1 earlier
  Oct 28Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges · The Hacker News
  Oct 28CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts · SecurityWeek
  Oct 28CISA warns of hackers now exploiting critical Node2Shell flaw · BleepingComputer
  Nov 3Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up · Help Net Security
  
  Oct 28CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts · SecurityWeek
  Oct 28CISA warns of hackers now exploiting critical Node2Shell flaw · BleepingComputer
  Nov 3Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up · Help Net Security
9. Today · Nov 3
10. Nov 10Due7 days left
SourcesKEV entry NVD
Adobe Commerce and Magento CVE-2026-48356 EPSS 45% contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session Due Nov 107d left DetailsHide3
1. Jul 14CVE publishedNVD · CVSS 9.3 · Critical
2. Oct 27Added to KEVDue in 14 days · ransomware use unknown
3. Oct 28First in AlembicSecOct 28 Morning
4. Today · Nov 3
5. Nov 10Due7 days left
SourcesVendor advisory KEV entry NVD
Broadcom VMware ESX CVE-2026-41709 contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being loggedLatestOct 29 · Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls Due Nov 118d left DetailsHide5
1. Jul 30CVE publishedNVD · CVSS 2.7 · Low
2. Oct 28Added to KEVDue in 14 days · ransomware use unknown
3. Oct 29China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility · The Hacker News
  Oct 29Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day · SecurityWeek
  Oct 29Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls · Help Net Security
4. Today · Nov 3 · not reported in AlembicSec yet
5. Nov 11Due8 days left
SourcesVendor advisory KEV entry NVD
Ivanti Connect Secure CVE-2026-118527 contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on diskLatestNov 2 · CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) Due Nov 1310d left DetailsHide7
1. Oct 14Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles · Dark Reading
2. Oct 30Added to KEVDue in 14 days · ransomware use unknown
3. Oct 30First in AlembicSecOct 30 Evening
4. Show 1 earlierHide 1 earlier
  Oct 31Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access · The Hacker News
  Nov 2Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain · SecurityWeek
  Nov 2Ivanti patches two more Connect Secure zero-days chained in attacks · BleepingComputer
  Nov 2CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) · Help Net Security
  
  Nov 2Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain · SecurityWeek
  Nov 2Ivanti patches two more Connect Secure zero-days chained in attacks · BleepingComputer
  Nov 2CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) · Help Net Security
5. Today · Nov 3
6. Nov 13Due10 days left
SourcesKEV entry NVD

§ 03

Top stories

27 events from 63 articles

01ResearchAI securityUpdated

Anthropic Addresses Video Game Cloning With Minor Claude Update

There’s a fine line between AI creations inspired by video games and those that are infringing copyright.

Now reported by 10 sources

AffectsAndroidGoogleLinux+2

10 sources · 17 articles ▾

CNET Cybersecurity Anthropic Addresses Video Game Cloning With Minor Claude Update lead 2 Nov 18:06 CST
CNBC Cybersecurity Anthropic warns AI models could soon copy themselves across home devices 13 Oct 03:27 CDT
The New York Times Anthropic Joins the A.I. Agent Race With Claude Duet 21 Oct 17:45 CDT
BBC Cyber Anthropic warns of 'catastrophic risk' to humankind ahead of blockbuster share listing 26 Oct 11:27 CDT
The New York Times Anthropic’s IPO S-1 Spells Out a Future of Promise and Peril 26 Oct 14:36 CDT
The New York Times The Key Numbers From Anthropic’s IPO Filing 26 Oct 15:21 CDT
CNBC Cybersecurity Anthropic IPO filing warns some risks may be uninsurable. AI coverage will be issue for every company 28 Oct 13:32 CDT
The New York Times Inside Anthropic’s Hunt for A.I. Computing Power 2 Nov 12:01 CST
Dark Reading Anthropic Finds Ingredients for Future AI Worms 13 Oct 15:35 CDT
Help Net Security Anthropic details what stops Claude Duet from going rogue 26 Oct 05:41 CDT
CSO Online OpenAI, Anthropic disclosures spotlight growing AI containment challenge 26 Oct 06:57 CDT
Security Magazine Anthropic’s Claude AI Model Accessed US Voter Data 26 Oct 12:05 CDT
SecurityWeek Anthropic Files for Potentially the Biggest IPO Ever as CEO Warns of Risk to Humanity From AI 26 Oct 15:20 CDT
SecurityWeek Risks Spelled Out for Anthropic Investors Include Possible Harms From Runaway AI 27 Oct 05:44 CDT
The Hacker News Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits 28 Oct 03:15 CDT
CSO Online Anthropic and OpenAI diverge on who should pull the plug on risky AI 29 Oct 07:18 CDT
CSO Online Fake Anthropic AI previews lure in overeager employees 29 Oct 08:05 CDT

02IncidentOT/ICSUpdated

UK food supply chain affected by European freezer hacks, cyber chief says

Supermarkets in countries including Ireland, Sweden and Belgium reported fridges being hiked in temperature on Monday.

Now reported by 10 sources

HitRetail · Europe

10 sources · 13 articles ▾

BBC Cyber UK food supply chain affected by European freezer hacks, cyber chief says lead 05:32 CST
CNBC Cybersecurity French supermarket fridges get hacked, heating to 122°F and sparking fires 13 Oct 07:22 CDT
BBC Cyber 'All this food is now useless': Piles of rubbish after shop freezers hit by cyber-attack 2 Nov 11:34 CST
BBC Cyber If hackers can take control of a supermarket freezer, how vulnerable is other tech? 2 Nov 12:25 CST
The New York Times Are Freezers Being Hacked? Europe and the U.S. Military Investigate. 02:45 CST
Infosecurity Magazine French Supermarket Cyber-Attack Impacts More Refrigeration Controllers 14 Oct 04:30 CDT
Help Net Security Second wave of refrigeration cyberattacks hits European supermarkets 2 Nov 08:28 CST
BleepingComputer Hackers disrupt refrigeration systems at European supermarkets 2 Nov 08:28 CST
CSO Online European supermarkets that failed to act after French freezer attack are now feeling the heat 2 Nov 18:23 CST
The Hacker News New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food 01:27 CST
SecurityWeek Over 100 European Stores Hit as Supermarket Fridge Attacks Return 01:43 CST
Cybernews Explainer: Could hackers get inside my fridge? 04:15 CST
Cybernews Who’s behind the wave of refrigerator hacks that hit Europe over the weekend? 04:46 CST

03IncidentAPT/Nation-stateFraud/PhishingUpdated

Binance, crypto and hacks: What to know about keeping coin safe as cyber criminals advance

The Binance hack of $6.3 billion, the largest crypto theft ever, is a wake-up call for investors to understand how coin is guarded and the risk of losing it.

Now reported by 12 sources

ActorPRK attributedHitFinance

12 sources · 23 articles ▾

CNBC Cybersecurity Binance, crypto and hacks: What to know about keeping coin safe as cyber criminals advance lead 1 Nov 08:29 CST
BBC Cyber Who could be behind the Binance hack and what we know so far 30 Oct 06:57 CDT
BBC Cyber What we know about Binance's $6.3bn hack 30 Oct 07:27 CDT
BBC Cyber Crypto giant Binance attempting to recover $6.3bn stolen in hack linked to North Korea 30 Oct 16:13 CDT
BBC Cyber What we know about the $6.3bn Binance hack 31 Oct 02:56 CDT
CNBC Cybersecurity Binance resumes withdrawals following $6.3 billion hack, says 90% of stolen user assets are covered 1 Nov 06:19 CST
BleepingComputer Binance probes potential $5.8 billion crypto-theft hack 29 Oct 17:45 CDT
The Hacker News Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen 29 Oct 23:14 CDT
Cybernews Binance hack: North Korean hackers blamed for $6.3B theft 30 Oct 01:22 CDT
SecurityWeek $6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor 30 Oct 03:16 CDT
Help Net Security Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record 30 Oct 03:26 CDT
BleepingComputer Binance links $6.3 billion crypto theft to compromised DevOps laptop 30 Oct 04:18 CDT
Infosecurity Magazine Binance Hit by Record-Breaking $6.3bn Hack in Largest Cryptocurrency Heist in History 30 Oct 06:25 CDT
Wired Security The $6.3 Billion Binance Hack Was Pulled Off in Just 20 Minutes 30 Oct 06:36 CDT
Security Magazine North Korea May Be Behind the $6.3B Binance Hack 30 Oct 13:32 CDT
The Hacker News FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist 1 Nov 01:03 CST
BleepingComputer FBI links $6.3 billion Binance crypto heist to North Korean hackers 1 Nov 13:57 CST
SecurityWeek FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist 2 Nov 02:40 CST
Help Net Security FBI pins $6.3 billion Binance crypto heist on North Korea while scammers circle anxious users 2 Nov 04:12 CST
Infosecurity Magazine FBI Attributes Binance Heist to North Korea’s TraderTraitor 2 Nov 04:15 CST
CSO Online A compromised DevOps laptop caused the $6.3B Binance breach 2 Nov 06:32 CST
Dark Reading One Compromised Laptop, Billions Lost: The Binance Attack-Path Warning 2 Nov 16:27 CST
Cybernews FBI points finger at North Korea for $6B Binance attack 00:57 CST

04Law enforcementMalwareSupply chainFraud/PhishingUpdated

Certified Android TV maker Videostrong backdoored its own devices, criminals monetized 1.3M devices

Infected TV boxes, without owners’ knowledge, were involved in residential proxy networks, ad fraud, and were loaded with additional malware.

Now reported by 7 sources

AffectsAndroidGoogleActorVideostrong Technology

7 sources · 7 articles ▾

Cybernews Certified Android TV maker Videostrong backdoored its own devices, criminals monetized 1.3M devices lead 04:46 CST
The Hacker News Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access 2 Nov 09:50 CST
Help Net Security Google disrupts XCPE botnet, bans the company behind it 2 Nov 09:50 CST
BleepingComputer Google disrupts million-device XCPE Android malware botnet, bans TV box maker 2 Nov 12:16 CST
Krebs on Security Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies 2 Nov 20:24 CST
SecurityWeek Google Dismantles XCPE Botnet of 1.3 Million Android Devices 03:22 CST
Infosecurity Magazine Police and Tech Firms Team Up to Dismantle XCPE Botnet 03:35 CST

05VulnerabilityVulnerability/ExploitUpdated

Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials

Threat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber. The vulnerability in question is CVE-2026-81648, which carries a CVSS score of 10.0. Successful exploitation of the flaw could permit unauthenticated users to delete arbitrary files on the server and extract

New CVEs: CVE-2026-81648

AffectsCryptoPayment GatewayWordPressCoreCVE-2026-81648

2 sources · 3 articles ▾

The Hacker News Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials lead 2 Nov 23:34 CST
SecurityWeek Fresh WordPress Vulnerability in Attackers’ Crosshairs 30 Oct 07:04 CDT
The Hacker News WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours 30 Oct 09:08 CDT

06ResearchAI securityCloudIdentity

Stolen AI access leaves companies with cloud bills of up to $1 million

Criminals who break into corporate cloud accounts are using the stolen access to run AI models at the victim’s expense, in some cases racking up more than $100,000 in charges in a single day, Google Threat Intelligence Group (GTIG) and Mandiant researchers have found. Usage chart showing LLMJacking generating a spike in API requests (Source: Google) In 2026, Mandiant responded to several of these…

AffectsGoogle

3 sources · 3 articles ▾

Help Net Security Stolen AI access leaves companies with cloud bills of up to $1 million lead 03:39 CST
Infosecurity Magazine LLMJacking is Costing Some Businesses Up to $1m, Warns Google 04:45 CST
CSO Online Enterprises pay $100,000 a day for AI they never ordered 05:52 CST

07IncidentAPT/Nation-stateMalwareData breach

Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware

ESET has been tracking a Russia-aligned group it calls Gorbag, which has been breaking into Ukrainian organizations since at least February 2025 using spearphishing attachments and a stealer that erases itself once the data is gone. Spearphishing email message from a compromised email sender (Source: ESET) Every target ESET identified sits in Ukraine. About a quarter are law enforcement and…

ActorGorbagRUSHitGovernment · Europe

1 source · 1 article ▾

Help Net Security Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware lead 04:00 CST

08VulnerabilityVulnerability/ExploitOT/ICSMalware

Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code. "SIMATIC IoT2050 Advanced devices running

AffectsSiemensSIMATIC IoT2050 AdvancedCVE-2026-58115

1 source · 1 article ▾

The Hacker News Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors lead 2 Nov 23:34 CST

09ResearchAI securityIdentity

AI Agents Generated More Than 600 Million Requests to Login Pages

Recently, DataDome recently released a report on bot and AI agent security.

1 source · 1 article ▾

Security Magazine AI Agents Generated More Than 600 Million Requests to Login Pages lead 04:00 CST

Government advisories

0 new since 12:00 CST

No new government advisories since 12:00 CST.

Collected hourly.

§ 05

Packages

0 GitHub-reviewed advisories across 0 ecosystems

No new package advisories since 12:00 CST.

GitHub-reviewed advisories only.

§ 06

Ransomware

New leak-site posts since 12:00 CST.

posts across 10 groups

Posts per edition slot, last 9 · dashed line = 7-day average

Most active groups

N0n4

Orova4

akira3

everstake2

qilin2

5 others5

By sector

Unknown7

Manufacturing3

Financial Services2

Healthcare2

Hospitality1

Other5

By country

Unknown7

US5

MY2

SG2

AE1

Other3

Victims

20 postsAs claimed by the groups, unverified

PostedVictimSectorCountryGroup

01:25 CST

Here at Pope and Johnson County Title CompanyHere at Pope and Johnson County Title Company Pope County Title Company - title insurance & escrow agency2,536,208 files, ~784 GBPope County…

Financial Services—rhysida

01:06 CST

MARDEC BerhadMARDEC Berhad (formerly known as the Malaysian Rubber Development Corporation or MRDC) was established on 20th September 1969 as a fully–own…

ManufacturingMYOrova

01:05 CST

Hydrogel Vision CorporationHydrogel Vision Corp. based in Sarasota, Florida was founded in May 2002 as an independent subsidiary of Benz Research and Development. The…

HealthcareUSOrova

01:04 CST

Raffles United Holdings Pte LtdKian Ho Singapore(“KHS”), is a wholly-owned subsidiary of Raffles United Holdings Pte Ltd (“RUH”) formerly known as Kian Ho Bearings Ltd whi…

HospitalitySGOrova

2 Nov 22:06 CST

Stahlbau Mann GmbHStahlbau Mann GmbH is a German structural engineering and manufacturing company specializing in the design, fabrication, and assembly of ste…

ManufacturingDEpayload

2 Nov 21:27 CST

Company #121greeting cards and gifts retail · United States | [PENDING EXPOSURE]

—USN0n

Show 14 more postsShow fewer

2 Nov 21:27 CST

Company #120data analytics and AI services · United States | [PENDING EXPOSURE]

—USN0n

2 Nov 21:26 CST

Company #119value fashion retail · Middle East | [PENDING EXPOSURE]

——N0n

2 Nov 21:26 CST

Company #118retail conglomerate · United Arab Emirates | [PENDING EXPOSURE]

—AEN0n

2 Nov 16:26 CST

REFSA S.A.Data is not available now.

OtherARnightspire

2 Nov 15:00 CST

S... G...Redacted entry - full company name pending disclosure (FULL DATA TIMER active).

——SilentRansomGroup

2 Nov 14:21 CST

Isapre Consalud

HealthcareCLqilin

2 Nov 10:54 CST

Harry's InternationalHarry’s is Singapore’s largest collection of everyday bars and kitchens - a homegrown destination where people from all walks of life come t…

Retail & E-CommerceSGOrova

2 Nov 10:17 CST

da*****t.comLogistics

Technology—everstake

2 Nov 10:16 CST

ra*****g.comManufacturing

——everstake

2 Nov 10:00 CST

Holland & KnightSector: Law Firm | Revenue: $2B USD

Professional ServicesUSRedact

2 Nov 09:21 CST

Astino Berhad

ManufacturingMYqilin

2 Nov 09:01 CST

Princeton ManagementPrinceton Management offers a range of residential and commercial properties, emphasizing quali ty and competitive pricing. The company is d…

Financial Services—akira

2 Nov 09:01 CST

UsnextU.S.NEXT specializes in custom web development and IT services tailored for businesses, governm ent entities, non-profits, and professionals…

——akira

2 Nov 09:00 CST

Howells Motor FreightHowell's Motor Freight, established in 1957, specializes in refrigerated, frozen, and dry trans port and distribution services. The company…

TransportationUSakira

§ 07

AI & models

9 releases and 2 announcements in the last 7 business days · 4 new

Frontier top 5

Source: Artificial Analysis (https://artificialanalysis.ai/)

RankModelLabReleasedIntelligence Index

Gemini 4 CarbonHigh

Google DeepMind2026-10-2859.4

Claude Opus 5.5Max

Anthropic2026-09-2258.4

GPT-6 AstraMax

OpenAI2026-09-0356.9

GPT-6.1 SolMax

OpenAI2026-09-2954.5

Claude Sonnet 5.5Max

Anthropic2026-09-2854.2

Latest releases

9 releases · 2 announcedModel data: llm-stats.com

Model · orgReleasedWeightsContextNotable benchmark

GLM 5.3 FlashX LegalZhipu AI

2026-11-02

—

LongCat-2.5NewMeituan

2026-11-01

—

GPT-6 RosalindNewOpenAI

2026-10-30

ClosedProprietary

—

Mistral Large 4 (Le Chonk)AnnouncedMistral · Lab post · Le Chonk: Built for Coders, Trusted by Defenders.

2026-10-29

—

Particle-1Particle AI

2026-10-28

ClosedProprietary

—

Gemini 4 CarbonGoogle DeepMind · llm-stats · Lab post · Gemini 4 Carbon: Our next frontier model

2026-10-28

ClosedProprietary

—

Intelligence Index 59.4Artificial Analysis

Show 5 more modelsShow fewer

LFM3-VL-2BNewLiquid AI

2026-10-27

—lfm1_0

—

LFM3-1.7BNewLiquid AI

2026-10-27

—lfm1_0

—

Genie 4AnnouncedGoogle DeepMind · Lab post · Genie 4: A new generation of world simulation

2026-10-27

—

GPT-6.1 Terra ProOpenAI

2026-10-26

—

GPT-6.1 TerraOpenAI · OpenRouter · llm-stats

2026-10-26

ClosedProprietary

Intelligence Index 51.0Artificial Analysis

At a glance

Act now

1.ACISA KEV

1.BCritical package advisories

CISA KEV

Top stories

Anthropic Addresses Video Game Cloning With Minor Claude Update

UK food supply chain affected by European freezer hacks, cyber chief says

Binance, crypto and hacks: What to know about keeping coin safe as cyber criminals advance

Certified Android TV maker Videostrong backdoored its own devices, criminals monetized 1.3M devices

Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials

Stolen AI access leaves companies with cloud bills of up to $1 million

Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware

Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

AI Agents Generated More Than 600 Million Requests to Login Pages

More stories

Government advisories

Packages

Ransomware

Most active groups

By sector

By country

Victims

AI & models

Frontier top 5

Latest releases