November 3, 2026

What happened

Planck Technologies is advertising a remote Cyber Security Architect role in Portugal focused on security architectures for telecommunications networks, platforms, and cloud environments. [1]

The role includes defining security frameworks, assessing risks, conducting threat modeling, and evaluating security technologies. [2]

The architect will work with engineering teams to embed security into deployments, maintain architecture documentation, and support customer workshops and technical reviews. [3]

The position also involves strengthening governance and contributing to transformation projects. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Cyber Security Architect Planck Technologies | Portugal | Remote – View job details As a Cyber Security Architect, you will design security architectures for telecommunications networks, platforms, and cloud environments.

2. [2]

   You will define security frameworks, assess risks, conduct threat modeling, and evaluate security technologies.

3. [3]

   You will partner with engineering teams to embed security into deployments, maintain architecture documentation, and support customer workshops and technical reviews.

4. [4]

   You will strengthen governance and contribute to transformation projects involving … More → The post Cybersecurity jobs available right now: November 3, 2026 appeared first on Help Net Security .

Read the original article →

What happened

The IPFire project released fireperf, an open-source measurement tool that opens connections at a fixed rate and reports how the intervening device handled each connection. [1]

Fireperf is free software for administrators, developers, and testers evaluating firewalls, routers, and other systems that maintain state for each connection. [2]

Why it matters

The article contrasts fireperf with iperf3: iperf3 measures the amount of data two computers can transmit, while fireperf focuses on how an intervening device handles connections. [1] [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The IPFire project has released fireperf, an open-source measurement tool that opens connections at a fixed rate and reports what the device in the middle did with each one.

2. [2]

   It is free software aimed at administrators, developers and testers who evaluate firewalls, routers and other systems that keep a state for every connection.

3. [3]

   What fireperf does iperf3, the widely used bandwidth tester, measures how much data two computers can push between them.

Read the original article →

What happened

Threat actors are attempting to exploit an unpatched maximum-severity vulnerability in the CryptoPayment Gateway WordPress plugin, according to Defused Cyber. [1]

The vulnerability is identified as CVE-2026-81648 and has a CVSS score of 10.0. [2]

Why it matters

Successful exploitation could allow unauthenticated users to delete arbitrary files on the server and extract additional data; the supplied evidence ends before specifying what could be extracted. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Threat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber.

2. [2]

   The vulnerability in question is CVE-2026-81648, which carries a CVSS score of 10.0.

3. [3]

   Successful exploitation of the flaw could permit unauthenticated users to delete arbitrary files on the server and extract

Read the original article →

What happened

The BSI said several Bundestag members and other public figures received Apple threat notifications from October 29, 2026, indicating detected attacks using mercenary spyware. [1] [2] [3]

The BSI and Apple did not establish whether the notifications reflected successful infections or only attempted attacks, and the attackers or sponsoring government were not publicly identified. [4] [5] [6] [7]

Why it matters

The BSI said a compromised phone could expose messages, including in encrypted apps, calls, contacts, calendars and location, and could allow camera and microphone access. [8] [9]

The spyware can use zero-click attacks that require no link click or message opening, and victims may notice nothing unusual. [10] [11]

Known limitations

The government did not disclose which people were targeted or how many received alerts, and Apple had not commented on the reports. [12] [13] [14] [15]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   “The Federal Office for Information Security ( BSI ) has learned that several members of the German Bundestag and other public figures have received a threat notification from Apple on their devices since October 29, 2026.

2. [2]

   In the notification, Apple states that it has detected an attack using so-called mercenary spyware .

3. [3]

   This is commercially developed, advanced spyware that has frequently been used in the past by state actors against specific, targeted individuals.” reads the notice issued by BSI.

4. [4]

   “The BSI (Federal Office for Information Security) is unaware whether these notifications indicate actual compromises or merely signal attempted attacks.

5. [5]

   Apple does not identify the governments behind these attacks, nor does it confirm whether a device was actually infected.

6. [6]

   Germany’s cybersecurity agency, the BSI, also says it is unclear whether the alerts indicate successful infections or only attempted attacks.

7. [7]

   Nobody has publicly identified the attackers or the government that may have ordered the attacks.

8. [8]

   Once a phone is compromised, the BSI says, attackers can read messages, including in encrypted apps, and access calls, contacts, calendars and location.

9. [9]

   They can also turn on the camera and microphone.

10. [10]

    It can infect devices through so-called zero-click attacks, which do not require victims to open a message or click a link.

11. [11]

    In most cases, victims do not notice anything unusual.

12. [12]

    Wildberger didn’t say how many politicians got the alerts or who they are.

13. [13]

    The German government has not revealed who was targeted.

14. [14]

    However, he did not say which government members received the alerts or whether Chancellor Friedrich Merz was among them.

15. [15]

    Apple has not commented on the reports, according to Euronews.

Read the original article →

What happened

NIS2 Article 20 requires management bodies of essential and important entities to approve cybersecurity risk-management measures, oversee implementation, and potentially be held liable for infringements under national law. [1]

Access control is among the required measures, alongside asset management and, where appropriate, multi-factor or continuous authentication. [2] [3] [4]

Directors are not expected to manage individual administrator rights or user accounts, but must know that access is controlled, responsibility is assigned, and identified problems are addressed. [5] [6]

Why it matters

Board reporting should demonstrate whether approved controls work in practice, including unresolved active accounts, excessive privileges, unreviewed MFA exemptions, and supplier access that outlasts contracts. [7] [8] [9] [10]

Organizations should be able to show who can access critical systems, why access was granted, who approved it, how long it remains valid, and when it was changed or revoked. [11]

For essential entities, member states must set a maximum fine of at least €10 million or 2% of global annual turnover, whichever is higher; important entities face at least €7 million or 1.4%, respectively. [12] [13] [14]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Under Article 20, the management bodies of essential and important entities must approve the cybersecurity risk-management measures required by the directive, oversee their implementation, and can be held liable for infringements, subject to national law.

2. [2]

   Access control is one of the required measures.

3. [3]

   The measures themselves are set out in Article 21.

4. [4]

   They include access control policies and asset management, along with the use of multi-factor authentication or continuous authentication solutions where appropriate.

5. [5]

   Directors are not expected to decide who gets administrator rights or review individual user accounts.

6. [6]

   They do, however, need to know that access is being controlled, that someone has responsibility for managing the risk, and that problems are being addressed.

7. [7]

   The board needs evidence Board reports often show what the access control policy requires, rather than whether it is being followed.

8. [8]

   For example, a company policy will likely require MFA and the removal of accounts when employees leave.

9. [9]

   However, the board also needs to know about the exceptions, including old accounts that remain active, excessive privileges, MFA exemptions that have never been reviewed, and suppliers whose access has outlasted their contracts.

10. [10]

    The board needs information about how the controls are working in practice.

11. [11]

    Organizations should be able to show who can access critical systems, why that access was granted, who approved it, how long it is valid, and when it was changed or revoked.

12. [12]

    For organizations in countries where NIS2 has been transposed, regulators have significant enforcement powers.

13. [13]

    For essential entities, member states must set a maximum fine of at least €10,000,000 or 2% of the global annual turnover , whichever is higher.

14. [14]

    Important entities are subject to a lower maximum threshold, of at least €7,000,000 or 1.4% of their global annual turnover, in a similar capacity.

Read the original article →

What happened

Synology said threat actors targeted NAS devices running outdated DiskStation Manager (DSM) versions by exploiting a vulnerability it had patched in December 2024. [1] [2]

The reported attacks aimed to encrypt data and extort ransom. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks.

2. [2]

   The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM.

3. [3]

   "These attacks aim to encrypt data and extort ransom," it said in a statement

Read the original article →

What happened

BTCPay Server urged users to install its latest software after reports that Bitcoin and Litecoin were stolen from hot wallets on instances running older versions. [1]

BTCPay Server said its investigation found the attacks targeted servers running BTCPay Server 2.4.1, released 23 July 2026, or earlier. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   BTCPay Server, a self-hosted, open-source cryptocurrency payment processor, has urged users to install the latest version of its software in response to reports of Bitcoin and Litecoin being stolen from hot wallets on instances running older versions.

2. [2]

   "Our investigation found that these attacks targeted servers running BTCPay Server 2.4.1 (released on 23 July 2026) or earlier," BTCPay Server

Read the original article →

What happened

CISA’s “CISA 2030: Defend, Harden, Prevail” prioritizes operational technology security, software supply-chain integrity, and continuity of essential services while acknowledging that strong defenses cannot guarantee intrusions will stop. [1] [2]

An inventory alone does not establish whether controller software is authentic, who can change its configuration, or which systems depend on its credentials; these trust questions can cross organizational boundaries. [5] [6] [7] [8]

Why it matters

A compromised contractor credential or unverified update can turn an infrastructure problem into mission disruption, particularly where federal operational systems depend on devices, suppliers, and machine identities. [3] [4]

The article characterizes an authenticated AI agent with excessive permissions as an operational threat and says model instruction-following cannot serve as the security boundary. [9] [10] [11]

Source-supported guidance

It recommends testing isolation, credential replacement, and restoration of verified software while essential functions continue, with compensating controls for legacy equipment until replacement. [12] [13]

Known limitations

CISA committed to an implementation and outcome-measurement approach within 180 days; the article proposes measuring whether operators can identify compromised trust, revoke access, and restore verified systems while maintaining essential services. [14] [15]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   That is the uncomfortable reality behind the Cybersecurity and Infrastructure Security Agency’s (CISA) new strategy , “CISA 2030: Defend, Harden, Prevail.” The strategy prioritizes operational technology security, software supply chain integrity and continuity of essential services.

2. [2]

   It also acknowledges that strong defenses cannot guarantee that intrusions will stop.

3. [3]

   Federal agencies face these dependencies in building controls, research facilities and other operational systems.

4. [4]

   A compromised contractor credential or unverified update can turn an infrastructure problem into a mission disruption.

5. [5]

   An inventory is a starting point.

6. [6]

   Knowing a controller exists says little about whether its software is authentic, who can change its configuration or which systems depend on its credentials.

7. [7]

   Those questions cross organizational boundaries.

8. [8]

   Device security, software assurance and identity management may each have an owner.

9. [9]

   Reading diagnostic data and changing an equipment setting carry very different consequences.

10. [10]

    An authenticated agent with excessive permissions is still a threat to operations.

11. [11]

    A model’s willingness to follow instructions cannot be the security boundary.

12. [12]

    Exercises should expose those dependencies by testing isolation, credential replacement and restoration of verified software while essential functions continue.

13. [13]

    Legacy equipment may need compensating controls until it is replaced.

14. [14]

    CISA has committed to an implementation and outcome-measurement approach within 180 days.

15. [15]

    One measure should be whether operators can identify compromised trust, revoke access and restore verified systems while keeping essential services running.

Read the original article →

What happened

Gorbag, described as Russia-aligned, has been observed using simple information-stealer malware against Ukrainian organizations. [1]

The group has reportedly been active since at least February 2025 and focused exclusively on Ukrainian targets. [2]

Why it matters

Reportedly preferred targets include law-enforcement and justice entities, local administrations near the front line, and the defense sector. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations.

2. [2]

   "Active since at least February 2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice entities, local administrations near the front line, and the defense sector," ESET researcher

Read the original article →

What happened

The authors report identifying a substantial number of previously unrecorded vulnerabilities in the German legal system using LLMs and present potential exploits for a selection they believe would not cause serious harm. [1] [2] [3] [4]

The source characterizes written law as potentially containing vulnerabilities that can invite exploitation, with courts absorbing most exploits through interpretation. [5] [6]

Why it matters

The authors believe highly capable AI could enable vulnerability discovery at unprecedented scale and that proliferating cheap legal reasoning could jeopardize the functioning of current legal systems. [7] [8]

Interpretation: The reported findings motivate reassessing how legal systems identify and handle exploitable ambiguities as AI-assisted legal reasoning becomes more available. [1] [7] [8]

Known limitations

The source presents the issue as being in its early stages while asserting that it is coming; it does not establish how broadly the reported German findings generalize. [1] [9]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   In testing this hypothesis, we have identified a substantial number of vulnerabilities in the German legal system using LLMs.

2. [2]

   To our knowledge, none of these have been previously recorded.

3. [3]

   We share a selection of vulnerabilities below, and present potential exploits for each.

4. [4]

   We share only those vulnerabilities whose exploitation we believe would not cause serious harm.

5. [5]

   Here’s some demonstrations of this from Germany: Legal systems encode the foundations of social order in natural language.

6. [6]

   Similar to computer systems, the written law can contain vulnerabilities that invite exploitation.1 Courts absorb most exploits through interpretation, and such vulnerabilities rarely surface in the first place.

7. [7]

   With highly capable AI systems enabling the discovery of vulnerabilities at unprecedented scale, we believe the latter could change.

8. [8]

   We believe that with cheap legal reasoning proliferating, AI systems could jeopardize the functioning of today’s legal systems.

9. [9]

   Still in its early stages, but definitely something that’s coming.

Read the original article →

What happened

The UK's NCSC says AI-powered malware is highly likely to feature in a ransomware attack on Britain's critical national infrastructure between now and 2028. [1]

The NCSC gave limited detail on the form of future AI malware but pointed to open-source AI security tools being repurposed for malicious activity. [2] [3]

The NCSC considers it a realistic possibility that an autonomous attacker could self-replicate and conduct cyberattacks beyond its human operator's control. [7] [8]

Project DROMOS began with a four-week pilot analyzing government code repositories and later expanded into selected operational environments; the NCSC says it found hundreds of potential security issues, including critical vulnerabilities. [9] [10]

Cyber Shield is expected to be delivered in stages over the next five years, with defensive agents receiving data intended to strengthen participating organizations' national resilience. [11] [12] [13]

Why it matters

Researchers are increasingly seeing widespread abuse of ARTEX, an open-source Chinese-made AI red-teaming platform, in attacks involving UK registrar 123 Reg, Microsoft 365 and others since its July launch. [4] [5]

In its pessimistic 2028 scenario, the NCSC envisages more frequent and sophisticated cyberattacks worldwide, with wider AI adoption making attribution harder. [6]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The UK's National Cyber Security Centre (NCSC) says AI-powered malware is "highly likely" to be a part of a future ransomware attack on Britain's critical national infrastructure between now and 2028.

2. [2]

   The cyber arm of signals intelligence agency GCHQ did not provide much detail about what form this AI malware may take.

3. [3]

   However, it alluded to open source AI security tools that were initially intended to assist security researchers being repurposed for nefarious activity.

4. [4]

   Attackers are already repurposing such tools.

5. [5]

   For example, researchers are increasingly seeing widespread abuse of ARTEX, an open source, Chinese-made AI red-teaming platform, in attacks on UK registrar 123 Reg, Microsoft 365, and others since its launch in July.

6. [6]

   In its pessimistic scenario for 2028, the NCSC envisages "a significant increase in the frequency and sophistication of cyberattacks worldwide," with wider adoption of AI tools making attribution harder.

7. [7]

   It also considers a further threat: an autonomous attacker operating beyond its human operator's control.

8. [8]

   The NCSC says it "is a realistic possibility such an entity could self-replicate and conduct cyberattacks at will, with no apparent motivation or restraint." Such attacks would likely complicate geopolitical relationships, owing again to attribution difficulties, making it easier for countries that order attacks on others to deny their involvement.

9. [9]

   Project DROMOS began earlier this year with a four-week pilot analyzing government code repositories, before expanding into selected operational environments.

10. [10]

    The NCSC says it uncovered hundreds of potential security issues, including critical vulnerabilities.

11. [11]

    The review also reaffirms plans for Cyber Shield, an agentic cyber defense system first teased in July.

12. [12]

    Cyber Shield is expected to be delivered in stages over the next five years.

13. [13]

    It will involve the NCSC providing defensive agents deployed by participating organizations with data that will strengthen national resilience to ongoing cyber threats.

Read the original article →

What happened

On November 2, an attacker compromised cPGuard’s update system and used it to send a malicious script to customers’ Linux servers. [1]

The script installed a backdoor and collected password hashes and other sensitive files from servers on which it ran, according to cPGuard maker OPSSHIELD’s advisory. [2]

Why it matters

The attacker subsequently took some of the collected data. [3]

Known limitations

The supplied evidence does not state whether cPGuard 5.88.25 and later versions were affected, fixed, or otherwise relevant. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers.

2. [2]

   The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory.

3. [3]

   The attacker has since taken some of that data.

4. [4]

   cPGuard 5.88.25 and later versions

Read the original article →

What happened

mSecure developer mSeven Software reported suspicious activity associated with the password-management application and said it launched an investigation, took mitigation steps, and engaged external cybersecurity experts. [1] [2] [3]

mSeven has not explained what the suspicious activity involved, when it occurred, whether attackers accessed customer information, or whether customer secrets were exposed. [3] [4] [5]

Why it matters

Because mSeven has not identified the affected data or required scope of remediation, customers cannot determine which credentials, two-factor methods, or passkeys need replacement. [5] [6] [7] [8]

Known limitations

Customers have sought clarification about whether the warning applies to all stored passwords and authentication methods or only those used to access mSecure. [8] [9] [10] [11] [12]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   In an email sent to customers on November 3, seen by The Register, US-based developer mSeven Software said it launched an investigation after discovering something amiss with its password management application.

2. [2]

   "mSeven Software ('mSeven') recently learned of suspicious activity associated with the mSecure password management application," the company wrote.

3. [3]

   "In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist." The company has yet to answer what the suspicious activity involved, when it occurred, or whether attackers accessed customer information.

4. [4]

   Password manager mSecure has warned customers to change their passwords, reset two-factor authentication, and potentially remove their passkeys after detecting suspicious activity, but it has not explained what happened or whether anyone's secrets were exposed.

5. [5]

   mSeven has yet to respond to The Register's questions, leaving customers to guess whether their data has actually been compromised or the company is simply being cautious.

6. [6]

   And without knowing what happened, customers have no way of telling which credentials they actually need to replace.

7. [7]

   Please state what remedial action is required, and what data was compromised." Others are wondering whether they're expected to spend the next several days changing every password they've ever saved.

8. [8]

   A separate user, who said they had more than 500 passwords stored in the application, questioned whether the warning applied to every two-factor authentication method and passkey associated with their accounts, or just those used to access mSecure itself.

9. [9]

   The warning has understandably gone down poorly with customers, who have taken to mSecure's support forum demanding answers.

10. [10]

    "Please provide more context to your email below advising there has been a security breach," one customer wrote.

11. [11]

    "It is not acceptable to offer the vague advice 'take steps'.

12. [12]

    "I have over 800 passwords in mSecure, is the email saying I need to change all of them!" another customer asked.

Read the original article →

What happened

Binance said the $6.43 billion theft from the cryptocurrency exchange resulted from a sophisticated, multi-stage campaign involving a tampered Homebrew installation and recruitment-themed social engineering targeting two engineers. [1]

Why it matters

Binance characterized the incident as neither a single isolated breach nor a simple phishing incident. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Binance on Tuesday said the record-setting theft of $6.43 billion in assets from the world's largest cryptocurrency exchange was the culmination of a "sophisticated, multi-stage campaign" that involved the use of a tampered Homebrew installation and recruitment-themed social engineering attack targeting two of its engineers.

2. [2]

   "It was not a single isolated breach or a simple phishing incident,"

Read the original article →