Binance's $6.3B North Korea Heist and Ivanti Zero-Day Deadline

CISA sets patch deadlines for exploited Ivanti Connect Secure flaws

CISA added two actively exploited Ivanti Connect Secure vulnerabilities, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities catalog after Volexity found them chained with a third flaw, CVE-2026-104935, to gain root access on fully patched VPN appliances. Attackers used the foothold to query Active Directory for LAPS passwords and BitLocker recovery keys. Federal civilian agencies must address CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13. Ivanti has released patches for all three flaws, and researchers warn a clean scan from Ivanti's Integrity Checker Tool does not rule out compromise. (Help Net Security)

Chainalysis discloses breach via 'offensive agentic techniques'

Blockchain analytics firm Chainalysis disclosed a breach unrelated to the Binance hack, saying attackers used what it called offensive agentic techniques in October to access internal systems and tools. The company found no evidence that investigation content, transaction results, cleartext passwords, MFA secrets, or session tokens were taken, but confirmed exposure of customer IDs, full names, email addresses, and organization role labels. Chainalysis has been tracking the Binance theft's laundering trail and warned affected customers to watch for password-reset phishing and to enable two-factor authentication. (Help Net Security)

Revolve files 8-K on payment card data breach

Online fashion retailer Revolve disclosed in an 8-K filed with the SEC that attackers used automated means to access customer names, contact details, payment card numbers, and card expiration dates stored on its ecommerce platform. The company has not said when the breach occurred but has notified federal law enforcement and hired an outside cybersecurity firm. State filings show the scale: Texas regulators were told 127,200 residents were affected, and Vermont reported 1,328. Revolve says the incident caused no operational disruption and does not expect a material financial impact. (The Paypers)

Second wave of refrigeration cyberattacks spreads across Europe

A second wave of cyberattacks hit supermarket refrigeration systems across Belgium, Luxembourg, Sweden, Finland, Ireland, Estonia and the Netherlands, three weeks after a similar attack spoiled food in French stores. Attackers remotely switched evaporators into defrost mode, the same technique used in the earlier French incident on units made by Danfoss, Copeland and Dixell. The root cause remains internet-exposed, unpatched management interfaces, with many affected freezers past end of life and lacking available patches. Technicians in Belgium worked overnight to disconnect units from the network, and no attacker has been identified. (Help Net Security)

Google dismantles 1.3 million-device Android TV botnet

Google shut down the command infrastructure behind XCPE, a backdoor built into the firmware of more than 1.3 million Android TV set-top boxes, and attributed the operation with high confidence to manufacturer Videostrong Technology. Criminal affiliates used the access to run hidden ad views, enroll devices into residential proxy networks, steal account data, and install further malware. Google banned the company and its future subsidiaries from building certified Android devices, tightened firmware integrity checks, and worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI on the takedown. (Help Net Security)

Sierra names Kyle Randolph as Chief Information Security Officer

AI agent company Sierra named Kyle Randolph as Chief Information Security Officer, bringing 24 years of experience as a security leader and software engineer. He most recently served as CISO at Verkada and has previously built and led security teams at Adobe, Citrix, Twitter, and Optimizely. Sierra said the hire reflects the need to keep raising its security bar as AI advances introduce new threats, noting its customer base includes nearly half of the Fortune 50. (Sierra)