Security researchers have for years warned about North Korean hacking tactics, in some cases taking months to lure in their targets. The fact that Binance was breached to the tune of $6+ billion — in part because of security weaknesses in its own network — will likely be of focus for investigators. https://techcrunch.com/2026/11/03/researchers-warned-of-north-korean-hacking-tactics-years-before-record-6-3b-binance-heist/
Wow... so DreamHost last week resolved a cyber incident involving its customers' email systems and FTP access. Now we know why. In a filing with California's AG, DreamHost says hackers had access to its systems, including customer session info (which lets attackers log in!!), for at least three months.
More: https://oag.ca.gov/ecrime/databreach/reports/sb24-632268
All of this always-listening and always-recording tech (like Meta's pervert glasses) is surveillance & unwanted data collection. You can't proactively opt out of it. What you can do is call it out for what it is — gross! Friends don't let friends wear pervert glasses or use listening devices. https://this.weekinsecurity.com/reframing-smart-glasses-as-pervert-glasses/
Apple has begun rolling out its "always-listening" tech to Watch users, which summarizes conversations & allows live replaying of the last 15 seconds of audio. It's very gross, and no way for others to opt out.
I wrote back in Sept. why this Apple feature is a very bad idea: https://this.weekinsecurity.com/watch-what-you-say-apple-opens-the-door-to-a-nightmare-world-of-always-listening-tech/
For fuck's sake, vote.
Heads up: A password management app/platform called Msecure from mSeven Software says it recently learned of suspicious activity associated with its app. Here is the important part of their advisory:
"Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys."
There isn't much else to the notice. I've pasted the entire thing below anyway.
"Important Security Notice
mSeven Software (“mSeven”) recently learned of suspicious activity associated with the mSecure password management application. In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist. You are receiving this email because you are a current or former mSecure customer.
Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.
We regret any inconvenience that this may cause.
Sincerely,
The mSeven Software Team"
This guy claims he can geolocate videos using the audio by using the doppler effect of planes passing. Scary stuff
https://www.youtube.com/watch?v=UytYrhYLOKI
Refrigerator hacks also hit Romania, but only six supermarkets
(besides Belgium, the Netherlands, Luxembourg, Sweden, Ireland, Estonia, and Finland)
New, by me: Germany's government warns that some lawmakers, including members of the parliament (Bundestag) and other high-profile people, may have been hacked with spyware.
Read more: https://techcrunch.com/2026/11/02/germany-says-lawmakers-iphones-may-have-been-hacked-with-spyware/
Bypass for ad-blockers: https://web.archive.org/web/20261102171034/https://techcrunch.com/2026/11/02/germany-says-lawmakers-iphones-may-have-been-hacked-with-spyware/
More reporting from The Record's Kyiv correspondent on the earlier hacks. https://therecord.media/ukraine-hackers-russia-alert-system
Zelenskyy confirms that Ukraine hacked-back after Russia's targeted its emergency alert system by targeting Russia's. In both hacks, each country's alerts warned of nuclear attacks. https://www.pbs.org/newshour/world/watch-zelenskyy-confirms-ukraine-hacked-back-after-russias-cyberattack-of-its-emergency-alert-system
I've confirmed with folks the impacted freezers in the countries impacted today are all mgmt interface facing internet, same issue and vuln as last time.
Many of the freezers are end of life and have no patch available, they've just been left online to quite literally rot.
CISA won't hold periodic calls tomorrow to brief the media on various election threats and rumors. It had been a longstanding practice through the first Trump and Biden administrations, mostly as rumor control, stressing that someone having a broken voting machine didn't throw the election.
Highly recommend this week’s installment of This Week in Security by @zackwhittaker.
Zach’s writing is always excellent and clear, but this week’s onslaught of developments has led to a particularly entertaining and punchy read. 😁
⭐️⭐️⭐️⭐️⭐️
https://this.weekinsecurity.com/this-week-in-security-november-1-2026-edition/
In this week's cyber newsletter: Homeland Security hacked and personnel data published online. Binance lost billions in record heist blamed on North Korea. Solar system bugs risk grid glitches. Web hosts report security incidents. Apple spyware threats. A new Wyden siren. Plus: A brand new cyber-cat. 🐈
Read online: https://this.weekinsecurity.com/this-week-in-security-november-1-2026-edition/
Sign up/RSS, and become a paid subscriber ❤️ https://this.weekinsecurity.com
this week in security — november 1 2026 edition
Homeland Security hacked and data leaked, PHP2Shell actively exploited, Binance breached and billions stolen in record heist, Asia hit by hacking wave, military malfunctioning freezers, web hosts hit by incidents, data breaches galore, and more.https://this.weekinsecurity.com/this-week-in-security-november-1-2026-edition/
Found the Binance hacker.
Writing the latest edition of my cybersecurity newsletter https://this.weekinsecurity.com with all the news that happened this week and realizing that we're all absolutely cooked.
Per @kevincollier, Chainalysis disclosed it was recently hacked. "Some non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on our platform were accessed, including such information relating to your organization and users." Company doesn't say when the breach happened. https://www.chainalysis.com/blog/security-incident-october-30/
"Florida Education Department reports data breach after unauthorized access to financial aid systems"
May have impacted about 4.9 million individuals. Information that may have been exposed includes Social Security numbers, first and last names, dates of birth, home addresses, phone numbers including mobile numbers, email addresses and gender identification codes, listed as M or F, according to the department.
You'd think that maybe folks (maybe) might begin to see a pattern worth paying attention to here and do something about it. Who am I to say?