Botnet of 1.3 million TVs taken down; Mercado Bitcoin confirms attack
Factory backdoor in 1.3 million TVs, Brotli flaw confirmed in attacks, and freezers forced to defrost in six countries.
The 30-second summary
- Google took down a botnet of 1.3 million Android TV boxes with a factory backdoor; devices remain infected and need to be replaced.
- The Brotli flaw is already exploited, confirms CISA (the US cybersecurity agency), with a federal deadline of November 10.
- Mercado Bitcoin confirmed a cyberattack and froze withdrawals; security firms estimate more than US$ 46 million diverted, a figure not confirmed.
- Supermarket freezers were hacked in at least six European countries and forced to defrost; stock was discarded.
- Ransomware encrypts Synology storage devices running an outdated system; the manufacturer asks for immediate updates and the panel off the internet.
Google takes down botnet of 1.3 million TVs; backdoor remains on the device
Google and partners took down the command servers of a network of 1.3 million Android TV boxes. According to Google, manufacturer Videostrong embedded a factory backdoor and sold the access to criminals.
The devices captured screens, recorded what was typed, and extracted account data. The backdoor runs in the firmware, reinstalls after reboot, and the owner cannot remove it: the device must be replaced. Companies should remove TV boxes from corporate networks.
For the technical team
Malware x.cpe embedded in the firmware of Videostrong Android set-top boxes operates as a system app and reinstalls after reboot. It captured screenshots, recorded keystrokes, exfiltrated account data, opened a reverse shell, and disabled Google Play Protect. C2 taken down, but the backdoor remains; 182 affected models identified and TrendAI counted 1,472,554 infected devices between June and October.
- Affected
- Android set-top boxes from manufacturer Videostrong; 182 models identified; malware also seen on other Android devices
- Exploitation
- confirmed active
- Fix
- No fix: the backdoor is in the firmware; guidance is to replace the device or wait for manufacturer intervention
Takeaway: Cheap hardware on the corporate network can come with criminal access built in at the factory.
Sources: The Hacker News, @TheHackersNews 1, @TheHackersNews 2, @DailyDarkWeb
On the radarFollow this incident live →CISA confirms active exploitation of Node2Shell and sets November 10 deadline
CISA confirmed active exploitation of the Node2Shell flaw, in the Brotli compression decoder, and set a federal deadline of November 10. CISA (the US government's cybersecurity agency) only lists flaws already used in real attacks.
The flaw affects Node.js, Bun, Python.NET packages, Visual Studio, PowerShell, Envoy, Istio, PHP for Windows, and Palo Alto firewalls that inspect Brotli. Any application that decompresses untrusted content is exposed. After updating, services must be restarted and container images rebuilt.
For the technical team
Out-of-bounds write in Google's Brotli decoder (CVE-2026-111497, CVSS 9.2) allows unauthenticated remote code execution via malicious compressed data. CISA listed the flaw in the KEV with a federal deadline of November 10. Running processes remain vulnerable after the update until restart; containers require a rebuild.
- CVE
- CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074, CVE-2026-106070, CVE-2026-106071, CVE-2026-106073
- Affected
- Brotli 1.0.3 to 1.2.0; Node.js 22.x, 24.x and 26.x before the fixes (20.x, 23.x and 25.x lines without a fix); Bun before 1.4.4; .NET, Visual Studio, PowerShell, Envoy and Istio with Brotli decompression
- Exploitation
- confirmed active
- Fix
- Node.js 22.23.4, 24.22.1 or 26.12.1; Brotli 1.2.1; Bun 1.4.4; Brotli 1.2.1 and brotlicffi 1.2.1.0 on Python; Microsoft updates from October 25; restart services and rebuild containers
Takeaway: Updating without restarting leaves the old, vulnerable process running for weeks.
Sources: Microsoft, The Hacker News, @ethiack, @IntCyberDigest
On the radarFollow this incident live →Cursor: backdoored version stayed up for 11 hours; manual cleanup is required
The exposure lasted 11 hours: tampered copies of the Claude Code extension stayed on the Cursor marketplace on October 29 installing permanent remote access (an SSH backdoor). Cursor confirms at most 5,000 affected users; the malicious extension was not made by Anthropic.
What changed: the keys were rotated and the attackers' server went offline with the cloud provider. Just updating or uninstalling does not clean the infected machine; the SSH key and the persistence scripts must be removed on each affected host.
For the technical team
Versions 2.1.312 and 2.1.313 of the Claude Code extension on the Cursor marketplace injected a malicious loader with SSH persistence (attacker key) and a reverse tunnel, collecting hostname, user, system, and Git email. Fixed in version 2.1.314; Cursor published IoCs and a detection script.
- Affected
- Users who installed Claude Code for VS Code 2.1.312 or 2.1.313 through the Cursor marketplace, in a window of about 11 hours on October 29
- Exploitation
- confirmed active
- Fix
- Update to Claude Code 2.1.314; on affected hosts, isolate, remove the unauthorized SSH key, the persistence scripts, and the tunnel processes; consider rebuilding the machine
Sources: @cursor_ai, The Hacker News, @TheHackersNews
On the radarFollow this incident live →Mercado Bitcoin confirms attack and freezes withdrawals; estimate tops US$ 46 million
Mercado Bitcoin confirmed a cyberattack and suspended deposits and withdrawals. Blockchain security firms estimate more than US$ 46 million in suspicious outflows from the platform. The company says customer data and assets are safe and promises to restore operations in the coming days.
Experts present blockchain evidence that contradicts the company's account, with customer wallets apparently drained. Tether, the issuer of USDT, froze about US$ 4.5 million; other platforms, US$ 2 million. The exchange reports about 4.5 million customers.
For the technical team
The Brazilian exchange confirmed a breach and suspended deposits and withdrawals. Hypernative flagged more than US$ 40 million in suspicious transfers across about 10 blockchains; the aggregate estimate for the case points to more than US$ 46 million. Tether froze about US$ 4.5 million and other platforms, US$ 2 million.
- Affected
- Mercado Bitcoin platform; root cause not reported in the sources
- Exploitation
- not reported in the sources
- Fix
- Deposits and withdrawals suspended; the company promises to restore the platform in the coming days
Sources: @coinbureau, @WatcherGuru, @PabloSabbatella
On the radarFollow this incident live →Binance: 7,541 wallets from the US$ 6.3 billion theft remain monitored
The US$ 6.3 billion theft at Binance, attributed by TRM Labs, a blockchain analysis firm, to the North Korean group TraderTraitor, remains active. The monitoring cites 7,541 wallets under observation: 3,849 still hold part of the funds, mostly in ETH and BTC, moved via bridges.
Nearly US$ 3 billion was frozen with issuers and partners, but about US$ 2.4 billion remains out of reach, according to TRM. Anyone receiving crypto should screen addresses from this case before accepting deposits from bridges and market makers.
For the technical team
Monitoring of the case lists 7,541 wallets: 3,692 in the flow of funds and 3,849 holding part of the value, mostly in ETH and BTC, moved using bridges. The FBI published more than 600 addresses linked to the theft. TRM Labs attributes the attack to the TraderTraitor group, from North Korea.
- Affected
- Binance hot wallets across ten blockchains, in the October 29 theft
- Exploitation
- not reported in the sources
- Fix
- Nearly US$ 3 billion frozen with issuers and partners; Binance covers losses with its own funds and SAFU; withdrawals have resumed
Sources: @WatcherGuru, @pashov, @vxunderground
On the radarFollow this incident live →WordPress crypto plugin suffers exploitation attempts with no fix
Cryptocurrency plugin on WordPress suffers exploitation attempts, according to Defused Cyber. The flaw, in CryptoPayment Gateway, is maximum severity with no fix: without login, an attacker deletes files, extracts wallet credentials, and changes where payments go.
If exploited, the flaw hands over wallet credentials and allows redirecting incoming payments to the attacker's accounts. WordPress stores and billing sites are the target. With no patch, users of the plugin must choose between disabling it and monitoring it closely.
For the technical team
CVE-2026-81648 (CVSS 10.0) in the CryptoPayment Gateway plugin for WordPress allows unauthenticated attackers to delete arbitrary files on the server, extract wallet credentials, and overwrite payment settings. Defused Cyber reports exploitation attempts in the wild; there is no known fix.
- CVE
- CVE-2026-81648
- Affected
- CryptoPayment Gateway plugin for WordPress; versions not specified in the sources
- Exploitation
- confirmed active
- Fix
- No known fix; mitigation is to disable the plugin and monitor server files, payment settings, and wallet movements
Sources: The Hacker News, @TheHackersNews
On the radarFollow this incident live →More than 1,000 GitLab servers remain exposed to flaw under active exploitation
More than 1,000 GitLab servers remain exposed on the internet to a maximum-severity flaw that lets intruders run commands on the server without a password, with active exploitation confirmed by CISA. The federal fix deadline expired on November 1.
The flaw exposes instances with source code, CI/CD secrets, and delivery automation: a taken-over server hands over code and passwords and allows tampering with software. The Alpine Linux case showed that updating GitLab is not enough if the bundled Ruby remains old.
For the technical team
CVE-2026-97229 (CVSS 10.0): integer overflow in the CI/CD regular expression compiler (Ruby's Onigmo engine) allows unauthenticated RCE via a malicious regex in CI configuration. Added to CISA's KEV on October 29, with active exploitation confirmed; there was an attempt against the Alpine Linux project's GitLab. More than 1,000 servers remain exposed.
- CVE
- CVE-2026-97229
- Affected
- GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2, self-managed
- Exploitation
- confirmed active
- Fix
- GitLab 19.2.8, 19.3.5 or 19.4.2; with bundled Ruby, also update to Ruby 3.3.13, 3.4.12, 4.0.9 or later; signs of attack require rebuild and credential reset
Takeaway: Fixing the application may not fix the dependency it bundles.
Sources: The Hacker News, CISA KEV, @DailyDarkWeb
On the radarFollow this incident live →Linux kernel: scanning for the 9.8 flaw; Ubuntu and Red Hat still without a patch
A researcher detected internet scanning for servers exposed to the critical Linux kernel flaw (9.8 out of 10), which gives total control of the server without a password. Ubuntu and Red Hat still had no fix as of October 29; Debian and other distributions have already released patches.
An AI model wrote a functional exploit for the flaw, according to Anthropic; it was not disclosed and there are no known attacks. Programs on Go 1.24 or newer use Multipath TCP by default on Linux, widening exposure. Without a patch, disable MPTCP.
For the technical team
CVE-2026-98432 (CVSS 9.8): use-after-free due to a race condition in the IPv4 TCP stack, triggerable before authentication on hosts with a Multipath TCP listener; allows memory corruption and running commands as root. Anthropic generated a functional exploit with an unreleased model, not disclosed, in about 53 minutes of testing. Internet-wide scanning already detected, with no known exploitation in the wild.
- CVE
- CVE-2026-98432
- Affected
- Linux kernel 4.4 and later with an active Multipath TCP listener
- Exploitation
- not observed
- Fix
- Patched stable kernels (5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3); Debian, Oracle, Amazon and SUSE have released part of the branches; Ubuntu and RHEL without a package as of October 29. Mitigation: sysctl net.mptcp.enabled=0
Sources: The Hacker News, @TheHackersNews, @DarkWebInformer, @IntCyberDigest
On the radarFollow this incident live →Second wave forces freezers to defrost in more than 100 stores in Europe
Attackers forced supermarket freezers to defrost in the early hours of November 2, in the second wave in three weeks. More than 100 stores were hit in at least six countries, with reports also in Finland, Italy, and Portugal. Food was discarded.
Equipment reached 50 °C and at least one store closed. According to Kitman Coldtech, from Estonia, access came through old controllers exposed to the internet. Danfoss acknowledged at least 17 affected companies and advises cutting the controllers' internet access.
For the technical team
Remote temperature manipulation in old Danfoss AK-SM/AK-SC and Copeland refrigeration controllers, exposed to the internet and without security updates. Second wave in three weeks; no group claimed responsibility. No patch: mitigation is to remove the controllers from the internet, change default credentials, and plan replacement.
- Affected
- Old Danfoss AK-SM/AK-SC and Copeland controllers exposed to the internet, on networks such as Ahold Delhaize, Colruyt, Delhaize, ICA and Coop
- Exploitation
- confirmed active
- Fix
- No patch for the old models; Danfoss advises cutting internet access, reconnecting only through a secure network, and planning physical modification or replacement
Takeaway: Old equipment exposed to the internet becomes a target as soon as someone looks for it.
Sources: The Record, @TGLetter, @InsiderGeo, @coinbureau
On the radarFollow this incident live →Synology warns: C3RB3R ransomware encrypts NAS with outdated DSM
Synology confirmed ransomware attacks that encrypt data on its storage devices (NAS) and demand ransom. The attackers use a flaw fixed in December 2024, on devices running an outdated DSM system. Victims report files locked with the .L0CK3D extension.
Synology did not identify the flaw in use. 360 and Solar, Chinese security firms, disagree: one links the cases to flaws fixed in September, the other suspects a zero-day in an updated victim. A researcher cites thousands affected, unverified.
For the technical team
C3RB3R ransomware encrypts data on Synology NAS with outdated DSM; files get the .L0CK3D extension and the read-me3.txt note directs to buying a decryptor. Synology points to advisory Synology-SA-24:20 (CVE-2024-10441, CVE-2024-50629, CVE-2024-10445), fixed in December 2024, without confirming the exact vector. 360 cites flaws fixed in September and Solar suspects a zero-day in a victim on the latest DSM 7.4.1.
- CVE
- CVE-2024-10441, CVE-2024-50629, CVE-2024-10445
- Affected
- Synology NAS with outdated DSM versions, vulnerable per advisory Synology-SA-24:20
- Exploitation
- confirmed active
- Fix
- Update DSM and enable automatic updates; the fix for the cited flaw has existed since December 2024; remove the management interface from direct internet exposure and check offline backups
Takeaway: A fix released months ago keeps delivering victims to those who did not update.
Sources: The Hacker News, @DailyDarkWeb, @DarkWebInformer, @IntCyberDigest
On the radarFollow this incident live →Wrapping up
The pattern of the day repeats: flaws with an available fix keep producing victims, from Synology to GitLab, and attackers sweep the internet for unpatched systems, from the Linux kernel to refrigeration controllers. In almost every case, the target was already exposed before anyone at the company looked. Fixing fast and checking that the fix worked is what avoids the loss.
What has your company still not looked for in its own infrastructure?
Several of these flaws already had a fix available before they became attacks.
Talk to us