TLDR INFORMATION SECURITY 2026-11-03

REGISTER NOW FOR THE DATA HARBOR PLATFORM LAUNCH →

FASHION RETAILER RESOLVE SAYS HACKERS STOLE PAYMENT CARD INFORMATION

Revolve told the SEC that attackers accessed multiple systems and used automated methods to obtain names, contact details, and card numbers and expiration dates from customers who stored payment data online. Texas regulators recorded 127,200 affected residents. Vermont reported 1,328. Revolve notified law enforcement, hired a cybersecurity firm, and said operations and finances were unaffected.

CRITICAL LANGFLOW FLAWS COULD LET UNAUTHENTICATED ATTACKERS RUN CODE ON SERVERS

IBM reported four Langflow vulnerabilities affecting versions 1.0.0 through 1.12.8. Two are critical and require no account: CVE-2026-93680 bypasses authentication, while CVE-2026-110186 permits arbitrary code execution through MCP tool enumeration. A public Metasploit module already enumerates Langflow MCP tools without credentials. Version 1.13.0 is the only fix. It disables automatic login by default. IBM has not published a workaround.

SHOP FREEZERS IN SEVEN EUROPEAN COUNTRIES HIT BY CYBER-ATTACK

A suspected cyber-attack switched refrigeration evaporators to defrost mode at supermarkets in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia, and Finland. Freezer temperatures reportedly reached 50°C, forcing stores to discard spoiled food. A Delhaize branch reported €100,000 in losses. Sabcobel said affected units need physical changes. Remote internet-connected maintenance remains part of the operating model.

CLOUDFLARE DDOS THREAT REPORT 2026 Q3: MORE SWARMS, FEWER GIANTS

Cloudflare mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP requests in Q3 2026. Short attacks under 10 minutes and 1 Gbps rose 208% year over year, while attacks above 1 Tbps fell 69% from Q2. CLDAP floods dropped 99.5%. DNS amplification rose 215%, and UDP floods rose 122%. The United States was the most-attacked country, followed by China and Indonesia. Canada rose from 16th to 6th, and Israel to 10th. IoT botnets remain active, with Mirai-classified traffic peaking at 57.23 PB in August.

TURNING THE VALVE - EXPLOITING RCE AND LPE IN THE STEAM PLATFORM

Atredis researchers found four local privilege escalation flaws and two remote code execution bugs in Steam for Windows. The LPE paths abused Steam's SYSTEM service through install-script allowlists, module loading, secure-desktop input forwarding, and driver installation. The remote bugs affected Steam-to-Steam synchronization messages: stack overflows in download-schedule and app-status handlers, plus an uninitialized-memory leak of steamclient64 pointers. The researchers combined the leak with an overflow to build a zero-click RCE using a ROP chain. They reported the issues to Valve through HackerOne. The bugs are patched or past the disclosure timeline, and proof-of-concept code is public.

HOW WE TOOK OVER CHATGPT ACCOUNTS

Researchers at Parameter Labs discovered a complex attack chain that could let attackers create malicious pages using ChatGPT's HTML Previews (formerly Canvas). The exploit begins by using the MathLive JavaScript library to create a new iframe that could load scripts from YouTube despite OpenAI's CSP policy. That iframe could then use YouTube's oEmbed endpoint to access OpenAI API endpoints and steal private data from anyone who accesses the ChatGPT share URL.

READ THE REPORT.

PYPCAPKIT

PyPCAPKit is an open-source Python library for parsing, constructing, and analyzing network packets and PCAP files, with DictDumper as its formatted output dumper.

MCPTRACE

MCPTrace is a Volatility 3 plugin for extracting MCP/JSON-RPC message candidates from Windows and Linux memory dumps.

WAKE AND BREAK

Wake and Break is a PSP (Platform Security Processor) exploit for AMD navi31 cards that will disable PSP's firmware signature check so that the card will load unsigned IP firmware.

OUR LATEST DEFENSES AGAINST EVOLVING WEB SCAMS

The Google Chrome team released several new features to further harden the Enhanced Protection mode of Private Browsing. Chrome will now display warnings when a user browses to a suspicious or risky site (depending on confidence level) and provide LLM-based scam detection. Chrome also implemented LLM-based ClickFix attack detection.

CYBERATTACK HITS ROSSTAT AS HACKERS CLAIM HUGE DATA THEFT

The Belarusian Cyber Partisans and Silent Crow hacking groups claimed they stole 23TB of data from Russia's state statistics agency, Rosstat. The attackers claim to have stolen data on Russian wartime losses, demographic and economic statistics, and documents marked “for official use only.” Rosstat denied that any databases or legally protected information was leaked.

SECURING INTERNET CRITICAL SOFTWARE: HOW WE COULD HAVE BACKDOORED BASH

Researchers at Hacktron discovered a command injection vulnerability in GNU Savannah that let them gain root and take over user accounts, including a Bash maintainer. The vulnerability stemmed from the GPG key validator inserting a user's email address directly into commands it executed without sanitizing the input. The attackers utilized this vulnerability to install a webshell, read the database password, set their account to a superuser, impersonate other users, and also escalate privileges by exploiting GemOver(lay).

FLORIDA STUDENT AID WEBSITE HACK PUTS DATA OF 4.9 MILLION PEOPLE AT RISK

The Florida Department of Education disclosed a breach of its student financial aid website on October 19.

GERMANY SAYS LAWMAKERS' IPHONES MAY HAVE BEEN HACKED WITH SPYWARE

Germany's BSI has warned that Bundestag members and other prominent figures received Apple's mercenary spyware threat notifications, part of a batch Apple sent to users in 99 countries, and says anyone who gets one should assume their device may have been compromised, although no one has yet been named as behind the attacks.

GOOGLE INTRODUCES $250,000 ROOT-IN-CLOUD BUG BOUNTY REWARD

Google's Cloud VRP now pays up to $250,000 for exploits that achieve roles/owner or full IAM control over arbitrary Google Cloud tenants, or code execution in its Borg production infrastructure, without existing access, stolen credentials, or user interaction.