~/radar / 2026-44
Patch radar, week 44/2026
The week from 26 October 2026 to 1 November 2026: what needs patching and what else mattered.
Check this week
- Northflank security breach leads to abuse of customers' AI API keys
- Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
- Chinese hackers use AI‑powered ARTEX to target over 200 organizations worldwide
- A shared ChatGPT link could run attacker code and read private chats
- Critical Linux kernel flaw allows remote root attacks on MPTCP servers
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen
- Hugging Face malware campaign returns to hijack GPUs for crypto mining
- ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories
Security & patches
Northflank security breach leads to abuse of customers' AI API keys
Following the breach, Northflank urges customers to rotate all credentials and secrets. Audit stored API keys, regenerate tokens, and review access logs.
Source ↗Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
CISA added two critical Ivanti Connect Secure flaws to its KEV catalog, noting active exploitation. Verify patches, enforce extra authentication, and audit VPN logs.
Source ↗Chinese hackers use AI‑powered ARTEX to target over 200 organizations worldwide
The Go‑based ARTEX framework is used by state‑sponsored actors. Security teams should look for unusual pen‑test tools and audit network logs for related artifacts.
Source ↗A shared ChatGPT link could run attacker code and read private chats
A malicious share link can execute code in a logged‑in ChatGPT session and read chats. Users must avoid unknown links and ensure OpenAI patches are applied.
Source ↗Critical Linux kernel flaw allows remote root attacks on MPTCP servers
The critical kernel bug affects Multipath TCP listeners. Ops should verify if MPTCP is enabled and apply patches or mitigations immediately.
Source ↗Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen
A security incident at Binance impacted about $6.3 billion in assets, with nearly $3 billion frozen. Customers using cloud storage for crypto backups should audit access controls and monitor for abnormal transactions.
Source ↗Hugging Face malware campaign returns to hijack GPUs for crypto mining
Malware abusing Hugging Face models hijacks GPU servers for crypto mining. AI workload operators should verify model sources, monitor GPU usage spikes, and scan for unknown backdoors.
Source ↗ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories
ThreatsDay highlights several critical firewall vulnerabilities and active banking trojans. Network and security teams should apply firmware updates, rotate passwords, and intensify log analysis.
Source ↗Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions
A critical Linux kernel TCP flaw (CVE‑2026‑98432) allows unauthenticated remote code execution. Admins of Ubuntu, RHEL and other distros must apply patches immediately and monitor network logs for suspicious activity.
Source ↗Sony ISP Subsidiary Data Breach Exposes 2.5 Million Customer Records
After the leak, mail and DNS admins should audit passwords, enforce MFA and alert users to phishing. Increase log monitoring for abnormal logins.
Source ↗Police Seize Virtualine Bulletproof Service Tied to Ransomware, Cybercrime
Hosting providers should check if customers still reference Virtualine domains and block them. Run log analysis for traffic to the seized domains.
Source ↗Google to Allow One‑Tap Android App Installs From Approved Third‑Party Stores Outside U.S.
Third‑party store operators must pass identity checks and submit full catalogs for Google’s malware scanning. Support should verify scanning is active and background updates are enabled.
Source ↗Volt Typhoon Used Covert Silent Train Network in Four Zero‑Day Exploitation Campaigns
Ops should verify whether internal SOHO, IoT or enterprise devices are part of rotating compromised chains. Monitor network traffic for Silent‑Train links and patch affected devices.
Source ↗CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets
CyberStrikeAI employs 44 AI agents to automate attacks on Japanese targets, showing AI can be weaponized in cyber campaigns. Security ops should update detection rules for automated behavior and scrutinize logs for anomalies.
Source ↗GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption
The GoAhead embedded web server loads a CRL but never enables revocation checking, allowing revoked client certificates and possible session decryption. Users of GoAhead with mutual TLS must turn on revocation checks or apply patches.
Source ↗Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
A campaign has injected malicious JavaScript into 953 online stores, mainly Magento. Magento admins should audit CMS blocks, remove unknown scripts, and ensure the platform is up‑to‑date.
Source ↗PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
PHP released rebuilt Windows packages for 8.2‑8.5 fixing a Brotli compression flaw. Ops should deploy the updated builds and verify cURL settings to avoid accidental exploitation.
Source ↗CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
CISA added two PHP2Shell flaws to its KEV list after confirming active exploitation. Anyone running vulnerable PHP versions should verify they are patched and review logs for suspicious activity.
Source ↗PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
Exploitation attempts still target vulnerable PHP apps using PHP2Shell‑like flaws. Operators of PHP services should patch applications, harden inputs and monitor for scanning activity.
Source ↗Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers
Unpatched Tailscale SSH flaws let a compromised device use port‑forwarding to gain root on reachable servers. Admins using Tailscale SSH should verify patches, review access rules and disable port‑forwarding if not required.
Source ↗Other news
France plans Internet tax: 5.5 cents per gigabyte
France’s proposed 5.5 cent per GB internet tax could raise cloud storage and transfer costs. Review traffic to/from France and adjust budgeting or routing accordingly.
Source ↗Cloudflare reports 18.2 million network‑layer DDoS attacks in Q3, up 38 %
Network‑layer DDoS attacks are rising sharply. Operators need to review DDoS protection, including rate limiting and cloud‑scrubbing services.
Source ↗Storage shortage due to AI hype: Fujifilm multiplies magnetic‑tape production
Fujifilm is dramatically increasing magnetic tape production to meet the AI‑driven storage shortage. Backup teams should watch tape availability and pricing and reassess long‑term archiving strategies.
Source ↗HPE unifies network and security management with AI
HPE consolidates LAN, WLAN and SASE network‑and security data into Mist and Aruba Central, adding the AI agent Marvis for faster fault analysis. Operations should verify the integration, monitor data pipelines and adjust alerts accordingly.
Source ↗OpenAI launches GPT-6.1 Terra with 3x faster AI agents, 50% lower pricing
OpenAI released GPT‑6.1 Terra, a faster, cheaper model aimed at coding, visual reasoning and automation. Teams using AI automation should evaluate the model for performance gains, pricing impact and integration requirements.
Source ↗AI coding agents hijacked using AGENTS.md file in Downloads folder
A malicious AGENTS.md in the Downloads folder fooled AI coding agents into installing a rogue npm package. Teams using AI code assistants should restrict file access and verify npm installations.
Source ↗New articles by e-mail
One e-mail per new article. No tracking, unsubscribe any time. As a thank-you after confirming: my “Server operations & patching” checklist (PDF).
Selected automatically and commented with AI. Please report mistakes — I withdraw entries when needed.
Weekly roundups: 43/2026