CISA sets November 6 deadline to patch attacked WordPress

WordPress: CISA confirms attack and sets November 6 deadline

CISA (the US cybersecurity agency) confirmed an active attack on the WordPress flaw and added it to the KEV (list of flaws already used in attacks). Federal agencies have until November 6 to patch. Wordfence recorded almost 63 thousand attempts in 24 hours.

The flaw affects the WordPress core from versions 4.7 to 7.1.3, the base of a large share of the world's websites. Exploitation gives server control, with risk of defacement, data theft and use of the site for new attacks. Wordfence reported no successful breaches.

Takeaway: The update window also exposes: updating fast and checking afterward is what protects.

Sources: CISA KEV, The Hacker News, @DarkWebInformer 1, @DarkWebInformer 2, SecurityWeek

Binance theft began on a laptop infected through a fake interview

Binance revealed that the theft of $6.3 billion began on a DevOps engineer's laptop, infected in a fake job interview scam. The access led to a service container that sent unauthorized withdrawals, with no leak of private keys.

TRM Labs, Elliptic and Chainalysis attribute the theft, with high confidence, to the North Korean group TraderTraitor. About $3 billion was frozen; the attackers hold $2.4 billion in ETH and BTC. One employee's machine reached systems that move billions.

Takeaway: Engineering machine access to systems that move money needs isolation and limits.

Sources: @vxunderground, @pashov, @WatcherGuru

TV botnet: Brazil is among the most infected countries

A new count by TrendAI identified 1,472,554 devices infected with the XCPE backdoor across 206 models, between June and October. Brazil appears among the five countries with the most compromised devices, alongside Malaysia, Iraq, Mexico and Taiwan.

The backdoor came from the factory, says Google: Videostrong embedded it and sold the access to criminals, who used the devices as residential proxies and for ad fraud. The servers went down, but the code remains, reinstalls itself and does not leave the device.

Sources: The Hacker News, @DailyDarkWeb, @TheHackersNews

Android patches critical flaw that runs code without touch

Google patched a critical flaw in Android that allows running code on the phone without any click or user action. The fix entered the November bulletin, which closed 216 vulnerabilities. There are no confirmed attacks, according to Google.

The flaw affects Android 14 to 17, versions used by employees with access to corporate email and data. According to Google data, more than 40% of Android devices run versions too old to receive the fix, which widens the risk window.

Sources: SecurityWeek, @DarkWebInformer, @TheHackersNews

Mercado Bitcoin promises to cover losses; experts point to drained wallets

Mercado Bitcoin announced it will cover all customer losses from the cyberattack that suspended deposits and withdrawals at Brazil's largest exchange. Blockchain firms estimate more than $46 million left the platform; the company denies a data leak.

Experts presented blockchain evidence that some customers' wallets were drained, contradicting the company's version. Tether froze $4.5 million of the stolen funds and other platforms, another $2 million. The return of withdrawals is promised for the coming days.

Sources: @coinbureau, @WatcherGuru, @PabloSabbatella

Node-RED without password is breached with bots and webshells

VulnCheck, a threat intelligence firm, recorded successful breaches through a maximum-score flaw in Node-RED, an automation tool also used in industrial systems. The first case occurred on October 30; by November 1, another 15 attacks came from the same IP.

A remote attacker, without login, creates malicious flows and runs commands with maximum privileges, taking full control of the instance. According to VulnCheck, criminals' tools automatically look for instances without authentication and exploit them with a single HTTP request.

Takeaway: An internal tool exposed without a password becomes an automatic target; exposure testing must be continuous.

Sources: SecurityWeek

Freezer attacks hit a contractor of the French blood bank

Freezer attacks reached Coolworld, a contractor of the French blood service EFS: donor sample chambers jumped from -30 °C to 110 °C, revealed Le Canard Enchaîné. A technician detected the change in time; the French Ministry of Health denies impact.

It is the campaign's first escalation to medical infrastructure, after supermarkets in several countries lost stock with remotely heated freezers. Companies with cold chambers connected to the internet and old controllers face the same risk of total loss.

Sources: The Record, @TGLetter, @InsiderGeo

SonicWall GMS: critical flaw exposes files without a password and without a fix

SonicWall disclosed two flaws in the Global Management System (GMS), a firewall management tool. The critical one, scored 9.1, allows reading internal files without a password and without user action. The second, scored 6.8, allows SQL injection by authenticated attackers.

There will be no fix: the affected versions, GMS 9.5.2 and earlier, on Windows and Linux, are end of life. The risk remains until the product is replaced. There is no public PoC or confirmed exploitation, according to the source.

Takeaway: End-of-life software becomes a permanent risk: without a patch, only isolation and replacement.

Sources: @DarkWebInformer

Linux kernel: Red Hat patches 9.8 flaw; Ubuntu still in testing

Red Hat released fixes for the 9.8 flaw in the Linux kernel TCP stack in RHEL 8, 9 and 10. On Ubuntu, the fix remains only in the testing channel, with no date for the stable channel. Debian patched on October 16.

The flaw allows remote code execution as root, without a password, on servers with exposed network services. Anthropic demonstrated a working exploit created by its AI. There are no known attacks, but one researcher detected a scan of the entire internet for exposed systems.

Sources: The Hacker News, @DarkWebInformer, @TheHackersNews