Here are today’s top cybersecurity stories for Tuesday, November 3, 2026.
Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Backdoors
VulnCheck observed active exploitation of CVE-2026-58115, a CVSS 10.0 missing authentication flaw in the Node-RED HTTP interface on SIMATIC IoT2050 Advanced devices running Industrial OS. Unauthenticated attackers create malicious flows and run code with maximum privileges. Observed payloads include a Linux botnet binary and an HTTP backdoor with reboot persistence. Siemens issued advisory SSA-834709 in August. The Hacker News
New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe
Attackers remotely changed settings on refrigeration controls in nine countries overnight into Monday, forcing stores to pull chilled and frozen food. Danfoss said its controllers were involved and said Dutch systems used default passwords. No group claimed the attacks, and Belgium’s federal prosecutor opened a criminal investigation. The Hacker News
Google Warns LLMjacking Attacks Cost Some Enterprises Up to $1 Million in Cloud Charges
Google Threat Intelligence Group and Mandiant report single-day fraudulent charges above $100,000 and cumulative bills of $1 million at some organizations. Threat actor UNC6993 used a fake portal to capture an access token. Attackers also exploited CVE-2026-40217 in LiteLLM to escalate privileges. The Hacker News
Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware
ESET details Gorbag, a group active since at least February 2025 and tracked by CERT-UA as UAC-0226. The group uses CVE-2025-8088 in WinRAR to start a DLL sideloading chain for the GIFTEDCROOK stealer. Targets include Ukrainian law enforcement, local administrations, and defense organizations. The Hacker News
Barracuda Flaws Allow Authorization Bypass and Root Access
Barracuda disclosed CVE-2026-116606, a CVSS 9.3 pre-authentication bypass in Email Security Gateway, and CVE-2026-111560, a CVSS 8.6 command injection across six products. Attackers need access to the administrative interface. Barracuda has not reported exploitation and advises restricting admin access to trusted internal networks. The Hacker News
Hackers Exploit BTCPay Server Flaw to Drain Bitcoin and Litecoin Hot Wallets
BTCPay Server versions 2.4.1 and earlier face wallet thefts reported since November 1. Release 2.4.7 fixes one critical and several medium-severity issues. BTCPay advises operators to move to a fresh server with a new wallet and keep only operating funds on the server. The Hacker News
mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys
Developer mSeven Software emailed current and former customers on November 3 about suspicious activity linked to the app. The email does not say what happened or whether stored data was exposed. mSeven states vault data is encrypted on the device before syncing. The Hacker News
Attackers Target Unpatched CryptoPayment Gateway Flaw Exposing Wallet Credentials
Defused Cyber reports exploitation of CVE-2026-81648, a CVSS 10.0 missing authorization flaw in the CryptoPayment Gateway WordPress plugin, versions 1.2.1 and 1.2.2. Attackers delete files, overwrite gateway settings, and recover wallet credentials in cleartext. No fix exists, and the plugin was closed on the WordPress directory on August 28. The Hacker News
Stay tuned for today’s in-depth analysis posts.
