Daily Update: Nov 3 - Top 10 Cybersecurity Headlines

Grab your coffee. Here are the ten security stories worth your attention on Tuesday, November 3, from the last day or so.

Each one comes with what happened, why it matters, and what to do about it before lunch.

1. Ivanti Connect Secure: two more zero-days, chained

Ivanti patched two more Connect Secure flaws, CVE-2026-111357 and CVE-2026-118527, that attackers chained since at least October 1. They were used alongside an authentication bypass, CVE-2026-104935, that Ivanti fixed last month. Volexity reported the attacker deployed no malware or web shell and re-exploited the device for every command, tampering with logs along the way. Rapid7 noted the activity evades Ivanti's Integrity Checker Tool, so a clean scan does not mean you are clean. CISA added the two new flaws to its Known Exploited Vulnerabilities catalog, with deadlines of November 2 and November 13 for federal agencies. Shadowserver tracks over 5,000 internet-exposed Connect Secure instances.

Key CISO Takeaway: Patch, then hunt. Preserve memory and logs before rebooting, rotate credentials the box could touch, and treat your VPN as an untrusted edge, which is the whole idea behind Zero Trust.

2. Supermarket freezers hacked across seven European countries

Dozens of supermarkets in seven European countries had their refrigerators and freezers hit by a cyber-attack on Monday. About 40 Delhaize stores in Belgium and Luxembourg were affected, plus shops in Sweden, Ireland, the Netherlands, Estonia and Finland. Some freezers reportedly climbed as high as 50C, and stores threw away food. Sabcobel, which manufactures some of the affected units, said the evaporators were switched to defrost mode, and that it believes this matches last month's attack on French supermarkets. The company says the units need physical modifications, not just software updates. Nobody has said who is behind it.

Key CISO Takeaway: Operational technology is part of your attack surface. Inventory anything with a remote management connection, and put it behind a secure connection instead of the open internet.

3. Synology NAS devices hit by C3RB3R ransomware

Synology warned customers to update immediately because of a surge in C3RB3R ransomware attacks on NAS devices. The company says attackers are exploiting a vulnerability patched in December 2024 on devices running outdated DiskStation Manager versions. Synology has not named the exact flaw, but pointed to a November 2024 advisory covering CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445. Victims report encrypted files with a .L0CK3D extension and a ransom note pushing a paid decryptor. Shadowserver tracks over 380,000 internet-exposed Synology NAS devices.

Key CISO Takeaway: Pull the NAS management interface off the internet today, update DSM, turn on automatic updates, and keep one backup copy that the NAS itself cannot overwrite.

4. GitLab maximum-severity RCE now exploited

CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on Friday. It is a maximum-severity integer overflow in GitLab's CI/CD regular expression compiler that can let an unauthenticated attacker run code on the server. GitLab shipped fixes on October 12 in versions 19.4.2, 19.3.5 and 19.2.8. Shadowserver still sees over 1,000 unpatched servers for this one. It also counts over 11,300 instances exposed to CVE-2026-110264, a similar bug fixed last month.

Key CISO Takeaway: If you self-host GitLab, you are the patch team. Upgrade to a fixed version now, and ask why a three-week-old patch is still not applied.

5. Northflank breach leads to stolen AI API keys

Cloud hosting platform Northflank told customers to assume their environment variables were decrypted and to rotate every secret stored there. Customers reported unauthorized use of AI API keys supplied to the platform. Wiz alerted Northflank on October 30, and the company patched network policies within hours. Northflank has not said how attackers got in or how many customers are affected. Wiz separately counted at least nine incidents at AI developer platforms in October, many aimed at AI credentials.

Key CISO Takeaway: Rotate any key that ever lived in that platform, check your AI provider billing for odd usage, and review how you store secrets across your cloud setup.

6. BeyondTrust Remote Support: scanning begins

Honeypot telemetry from Previdian shows someone probing BeyondTrust Remote Support appliances for CVE-2026-102764 on November 1. The requests hit the POST /api/start_session endpoint on decoys in the US and Germany. There was no successful exploitation, so this is early probing and not proof of mass attacks. BeyondTrust disclosed the flaw on October 15, and CISA added it to the Known Exploited Vulnerabilities catalog on October 16. The flaw affects Remote Support 26.2.3 and earlier, and Mandiant tied earlier exploitation to a suspected China-linked group.

Key CISO Takeaway: Self-hosted Remote Support needs the BT26-05-RS patch and restricted external access. Check for unexpected privileged sessions and unfamiliar scripts.

7. Revolve discloses stolen saved payment cards

Online fashion retailer Revolve disclosed in an SEC 8-K filing that attackers used automated means to take names, contact details, card numbers and expiry dates. The data came from customers who had saved payment details in their accounts. Revolve has not said when the attack happened. State filings point to the scale, with 127,200 Texas residents notified. The company reports no operational disruption and no expected material financial impact.

Key CISO Takeaway: Saved card data is a liability you choose to hold. If you do not need to store it, let your payment processor tokenize it and keep it off your systems.

8. Abrigo takes Sageworks offline after irregular activity

Abrigo, which serves more than 2,400 community banks and credit unions, took its Sageworks application offline on October 30 after spotting irregular activity. Affected services included Online Portal Now, Sageworks Analyst and the Sageworks API. Most functionality is back, except borrower-facing features. Abrigo has not said whether this was a breach or a technical issue. Earlier this year a self-described ShinyHunters-linked actor claimed a theft of Salesforce records, which was never confirmed, and some researchers suggested rotating Sageworks API keys.

Key CISO Takeaway: If a vendor of yours goes dark, rotate the API keys you gave them and ask for facts. Run the drill from your incident response plan before you need it.

9. Android "SMS of Death" proof of concept goes public

A researcher released a proof-of-concept for CVE-2026-58882, a zero-click flaw where a malformed WAP Push text crashes the phone process. It can drop cellular service and disconnect calls, including emergency calls. Google reportedly fixed it in the October 2026 updates for Android 14 through 17, but Android 12 and 13 devices remain exposed. The researcher says about 20 malicious messages can leave a phone stuck in a reboot loop. Updates depend on your manufacturer and carrier, and a restart may be needed.

Key CISO Takeaway: Check your fleet for Android 12 and 13 devices that no longer get patches, and retire them from anything that matters.

10. HYBE discloses employee data exposure via a vendor tool

K-pop agency HYBE disclosed that attackers accessed personal data of current and former employees and business partners. Access came through an outside vendor's document preview software tied to its electronic approval system, and also reached its expense management system. The breaches happened September 12 to 13 and October 3 to 5. Exposed data included resident registration numbers, card numbers, medical records, passport numbers and bank details. HYBE did not say how many people were affected and reports no known misuse.

Key CISO Takeaway: Your third-party plugins are part of your perimeter. Ask which vendor components touch your sensitive systems, and what data they can reach.

That is today's list. Bookmark the daily feed and swing by tomorrow for the next ten.