TLDR INFORMATION SECURITY 2026-11-04

READ THE GUIDE

TECH FIRMS DISMANTLE BOTNET THAT TURNED 1.3M TV BOXES INTO PROXIES

Google says it disrupted the XCPE botnet, built from more than 1.3 million Android TV boxes made by Videostrong. The devices secretly rented users' internet connections to residential-proxy services and ran ad fraud. Google took down the operator's domains and servers. The action may cut off more than 10 million additional infected devices. The malware also appeared in telehealth devices, karaoke machines, and digital signage.

FINANCIAL SERVICES FIRM MONEYSMART HIT BY IT SECURITY BREACH, SOME CUSTOMERS' DATA COPIED

Financial services company MoneySmart disclosed that a “security incident” led to the disclosure of some of its customers' personal data in Hong Kong and Singapore. MoneySmart said the data may include names and email addresses, shipping addresses, and application or policy reference numbers for customers who submitted rewards claims.

MERCADO BITCOIN HIT BY $46M SECURITY BREACH

Mercado Bitcoin, Brazil's largest crypto exchange, disclosed that it suffered a security incident involving approximately $46.3M in assets. Mercado stated that the breach did not affect customers or result in a data breach. It has temporarily paused transactions while it investigates the breach further, and has published the destination wallet address.

JAILBREAKING MY CAR'S NAVIGATION SYSTEM JUST SO I CAN CHANGE THE TIME

A Renault Latitude's TomTom Carminat LIVE head unit hid its clock settings behind a legitimate navigation SD card. The card used CID-based DRM and signed files, so a blank card could not supply the missing menu definition. The author reverse-engineered the Linux 2.6.28 firmware, built a QEMU and CAN emulator, and found that master.script allowed a root path-traversal write through its LOG command and wrote |/bin/sh /media/sdcard/payload.sh into /proc/sys/kernel/core_pattern, then crashed /bin/dbus-monitor to trigger a coredump and execute the payload as root. The exploit enabled an eMMC backup and a timezone patch from UTC+3 to UTC+2.

PRIORITIZE WHAT ATTACKERS WILL EXPLOIT: 4 ELEMENTS OF STRONG EXPOSURE PRIORITIZATION

Fewer than 10% of vulnerabilities are exploited, but remediation programs often treat most findings as urgent. Rank exposures using active-exploitation intelligence, asset criticality, EPSS-style exploitability modeling, and control validation. A vulnerability on an internet-facing system that handles regulated data, has known exploitation, and lacks segmentation should outrank a high-CVSS finding on an isolated internal asset. The model measures success by fewer exploitable exposures and reduced remediation effort, rather than ticket volume.

THE QUIET PHASE: WHY ACTIVE DIRECTORY GROUP ENUMERATION DESERVES YOUR ATTENTION

Attackers map who sits in Domain Admins with SharpHound or PowerView long before they change any group membership, and an audit entry (SACL) on the group's member attribute turns those reads into Event 4662, or 4799 for built-in groups, on the domain controller that answered. On real privileged groups, the signal drowns in reads from directory sync, Exchange, and admin tooling, and SAMR-based tools like net group /domain bypass it entirely. Pair the audit with decoy groups that nothing legitimate ever reads, correlate a decoy read and a real admin-group read from the same logon session, and check coverage with its QuietPhase PowerShell script.

explore AWS Partner solutions in AWS Marketplace.

CRASHTEST

Crashtest runs adversarial security tests against a JavaScript app's real route handlers entirely in-process, so it never opens a socket or needs a live server. Its built-in campaigns cover identity-spoofing headers, prototype pollution, cross-tenant ID enumeration, leaked secrets, and cost-amplification abuse, and every attack ends in a verdict of REFUSED, EXPLOITED, or BOUNDED (an accepted risk with a named owner). It plugs into Hono, Express, and Fastify, and its GitHub Action fails CI only on a new exploit or a regression, never on risks the team already accepted.

SAFEAGENTS

safeagents is a local proxy that sits between a coding agent and its model API and checks each tool call before the harness runs it. It blocks calls to undeclared tools and calls that reach hosts nobody mentioned in the conversation, and it runs atif-scan detectors that catch reads of /proc/1/environ or curl --noproxy. Ambiguous calls can go to an optional judge model that sees only the user's prompt, the call, and the findings, never the agent's reasoning, and it works with any harness that accepts a custom base URL, including Claude Code, OpenCode, and Hermes.

DRAGON-TALES

dragon-tales is a binary analysis library for disassembling, assembling, and analyzing machine code across multiple architectures.

TOKEN THIEVES COSTING COMPANIES $100K+ PER DAY IN ILLICIT LLM CHARGES

Google Mandiant reports that criminals are stealing LLM API keys and cloud service account credentials, then running high-volume model inference at victims' expense. Charges reached $100,000 per day in one case and $1 million in total before access was revoked. One service, Jet Night, allegedly used stolen keys to offer access to frontier models for about $60 per month.

RED HAT PATCHES 9.8-RATED LINUX TCP RCE FLAW WHILE UBUNTU RELEASES FIXES FOR TESTING

Red Hat has patched CVE-2026-98432, a 9.8-rated use-after-free in the Linux kernel's IPv4 TCP handling. A remote attacker can send IPv4 Record Route or Timestamp options to a listening TCP port and trigger a race that reads freed memory, potentially allowing code execution. RHEL 8, 9, and 10 fixes require a reboot. No exploitation has been reported. An nftables rule can drop IPv4 TCP packets with IP options, but it does not fully prevent exploitation.

HOW CISCO DEFENDS AT MACHINE SPEED WITH OPENAI

Cisco is pairing its network telemetry with OpenAI's Daybreak program and GPT-6 Astra to link signals that look harmless on their own and to speed up vulnerability patching, and Cisco's Jeetu Patel calls the gains "step function improvements." Patel also argued that agent security will depend on telling a hijacked agent apart from one pursuing a legitimate goal in an unintended way. That will take security telemetry and observability data read side by side. The post is an OpenAI customer story with no metrics or technical detail behind its claims, so it reads more as a sign of where vendor AI partnerships are heading than as evidence of results.

RUSSIA DISMANTLES INFRASTRUCTURE OF VASYGREK CYBERCRIME GROUP, DETAINS THREE SUSPECTS

In a rare domestic crackdown, Russian police, working with Kaspersky, dismantled the infrastructure of VasyGrek (also tracked as Fluffy Wolf), a financially motivated phishing group.

RAILWAY'S SIGNUP-TESTING AGENTS PROBED PRIMCLOUD'S NETWORK

A Railway engineer's agent harness, meant only to test Primcloud's signup flow, used its container's credentials to request every tenant's secrets, queried the cloud metadata endpoint, and port-scanned Primcloud's internal network twice in 15 minutes.