November 2026

Blockchain security companies said more than $46 million left the Mercado Bitcoin platform.

A recent post by the BYOD gang appears to line up with a security incident that prompted campus-wide action at Michigan State University. BYOD drew attention in October for an attack on the University of New Mexico.

In a post-mortem about an October 29 incident, prediction market Polymarket said it will pay people back what they lost, as well as compensate them for the site’s downtime.

An alliance of Belarusian and pro-Ukrainian hackers claimed to have taken out Russia’s federal statistics agency, Rosstat, and stolen vast amounts of sensitive government data in a cyberattack.

Some attacks this week didn’t need much of a trick. A fake support call, a trusted extension, a shared link, or a device with no password. Small things that people barely think about. Yet each was enough to cause serious trouble.

Then there were the bigger messes. Billions stolen, hidden networks of hacked devices, poisoned software, and attackers finding new ways to turn normal tools against

A botnet of more than 1.3 million Android devices, mostly TV set-top boxes, lost control of its servers in late October in a takedown led by Google.

Google says it is highly confident that device maker Videostrong intentionally put a backdoor in the boxes and sold access to criminals.

They used the boxes for ad fraud and to pass other people’s internet traffic through owners’ home

Cybersecurity researchers have disclosed details of a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026.

According to a report published by Dream Research Labs, the campaign has led to the compromise of a high-profile individual in Israel, along with additional compromises affecting a government cloud

Two critical flaws in Langflow could let a remote attacker with no account bypass authentication or run arbitrary code, IBM said last week.

Langflow is an open-source tool for building AI agents and workflows, and its vulnerability reports go to IBM. Every release from 1.0.0 through 1.12.8 has the flaws, and the only fix is version 1.13.0.

Neither flaw is in CISA’s Known

The extension performed host reconnaissance and attempted to create a reverse SSH tunnel.

The post Malicious Claude Code Extension Served in Cursor Supply Chain Attack appeared first on SecurityWeek.

The attackers used offensive agentic techniques to access the company’s systems and internal tools.

The post Chainalysis Discloses Data Breach Following AI-Driven Cyberattack appeared first on SecurityWeek.