Daily brief: Wednesday 4 November 2026
A hijacked cPGuard update backdoored Linux servers, the NCSC's annual review says UK resilience is falling behind, and ransomware is hitting old Synology NAS boxes.
cPGuard's update system was hijacked to backdoor Linux servers
OPSSHIELD says an attacker used stolen credentials to get into the update system for its cPGuard security tool at 02:06 UTC on 2 November. A malicious script went out in versions 5.88.12 to 5.88.19, installed a backdoor and collected files including /etc/shadow, root's MySQL or MariaDB config, root's shell history and SSH key files. OPSSHIELD caught it within 12 hours and says version 5.88.25 or later removes the backdoor, but credentials that were copied may still work.
Source: The Hacker News
NCSC Annual Review: 80 nationally significant incidents in a year
The NCSC's Annual Review 2026 covers September 2025 to August 2026. It received 1,831 reports of attacks, 337 needed help from its incident team and 80 were nationally significant. It warns that UK cyber resilience is not keeping pace with the threat, and that many successful attacks still use the basics: unpatched internet-facing systems, stolen credentials and social engineering. It also says AI-powered malware is highly likely to be used in a ransomware attack on UK critical national infrastructure by 2028.
Source: Intelligent CISO
Ransomware hits Synology NAS boxes running out-of-date DSM
Synology has warned that attackers are exploiting a flaw it patched in 2024 to encrypt data on NAS devices running old DSM versions, using C3RB3R ransomware that adds a .L0CK3D extension. Synology hasn't said exactly which flaw is being used, but linked the attacks to advisory Synology_SA_24_20, which includes a 9.8-rated remote code execution bug (CVE-2024-10441). Fixed builds include DSM 7.2.2-72806-1, 7.2.1-69057-6 and 7.1.1-42962-7 or later.
Source: The Hacker News
CISA adds the WordPress upgrade flaw to its exploited list
CISA added a WordPress Core time-of-check time-of-use race condition (CVE-2026-119977) to its Known Exploited Vulnerabilities catalogue on 3 November, based on evidence of active exploitation. WordPress says the weakness in the upgrade process can lead to remote code execution during the upgrade window. It is fixed in 7.1.4, released on 28 October, with backported fixes such as 7.0.8, 6.9.11 and 6.8.12.
Source: Windows Forum · DefConLevel (CISA alert copy)
Bitdefender: 3AM ransomware attack on a UK school used AI-style automation
Bitdefender describes a 3AM ransomware attack on a UK school estate of 47 systems, where about 37 machines were encrypted. The attackers stole credentials from three backup servers, created two domain admin accounts named to blend in ('library' and 'svc_bkpmon'), and deleted system-state backups as the encryptor ran. Bitdefender says the timing and mistakes in the commands suggest AI-driven automation, but it could not prove which model was used and calls it a single case, not yet a trend.
Source: Cyber Security News
Barracuda fixes two flaws that can be chained to get root
Barracuda has fixed a pre-authentication authorisation bypass in Email Security Gateway (CVE-2026-116606, CVSS 9.3) and a command injection flaw (CVE-2026-111560, CVSS 8.6) that affects several products, including Web Application Firewall, Load Balancer ADC and Message Archiver. Together they could give an attacker root on the device. Barracuda says the attacker needs access to the admin interface. The report does not say the flaws are being exploited.
Source: The Hacker News
Google warns stolen AI keys are running up cloud bills of up to $1 million
Google Threat Intelligence Group and Mandiant say 'LLMjacking', where attackers use stolen API keys or cloud tokens to run AI models at the owner's cost, is growing. Some incidents ran up more than $100,000 in a single day, and some organisations reached $1 million before access was cut off. Keys were taken from public GitHub repositories, leaked code and misconfigured service accounts, and in one case users were tricked into pasting an access token into a fake portal.
Source: The Hacker News
Anthropic shares FlashProve, research to prove which AI model produced an output
Anthropic has published research on FlashProve, an open-source system for 'provable inference': a cryptographic proof that an output came from a specific model. Labs would publish a fingerprint for each model that doesn't reveal its weights, and outputs could be checked against it, even on a local device. Anthropic released a specification and code on GitHub, but says this is intermediate research and there are no plans to deploy it at any lab yet.
Source: TechCrunch
Weather
Live forecastLoading the forecast…