Weekly security recap: 29 Oct 2026 to 4 Nov 2026

This week we tracked 185 security stories, 5 newly exploited vulnerabilities and 116 ransomware leak-site claims from 31 groups. Here is what defenders should know.

At a glance

Top security news

• More Asian airlines announce data breaches after attack on Spanish IT provider Amadeus (The Record)
• Zyxel fixes zero-day exploited to hack nearly 1,000 network switches (BleepingComputer)
• DreamHost confirms data breach exposed FTP logins and webmail sessions (BleepingComputer)
• SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records (The Hacker News)
• APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits (The Hacker News)
• AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks (SecurityWeek)
• CISA flags WordPress RCE flaw as actively exploited in attacks (BleepingComputer)
• Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory (The Hacker News)
• Frontline Education Data Breach Impacts Over 1.3 Million (SecurityWeek)
• Android’s November 2026 Updates Patch Over 200 Vulnerabilities (SecurityWeek)

Newly exploited vulnerabilities

• CVE-2026-119977, WordPress WordPress Core: WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability (details)
• CVE-2026-118527, Ivanti Connect Secure: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability (details)
• CVE-2026-111357, Ivanti Connect Secure: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability (details)
• CVE-2026-97229, GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability (details)
• CVE-2026-76418, Cisco Secure Firewall ASA Software and Cisco Secure FTD Software: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability (details)

Ransomware

Ransomware groups posted 116 new claims on their leak sites this week.

Claims come from criminal leak sites (collected by ransomware.live) and are often unverified, so we do not name the organisations listed.

Ransomware in the news

• UK school estate hit by 3AM ransomware in suspected AI-assisted attack (BleepingComputer)
• Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw (The Hacker News)
• Michigan State cyber incident claimed by ransomware gang behind recent hospital attack (The Record)
• Synology warns of C3RB3R ransomware attacks targeting NAS devices (BleepingComputer)
• Bulletproof Host Virtualine Loses Its Domain to FBI Seizure (SecurityWeek)

Web defacement

Our sources did not report any notable website defacement incidents this week.

Defacement is often the visible sign of a deeper compromise. If one of your sites is defaced, take it offline, preserve logs, and look for the way in before restoring from a clean backup.

What to do this week

• Patch the newly exploited vulnerabilities listed above, starting with internet-facing systems.
• Check that backups are recent, offline or immutable, and that you have tested a restore.
• Confirm multi-factor authentication is on for remote access, email and admin accounts.
• Monitor your public websites for unexpected changes to pages and files.

Sources

• CISA Known Exploited Vulnerabilities catalog
• ransomware.live for leak-site statistics
• News links above go to each original report