Weekly security recap: 30 Oct 2026 to 5 Nov 2026

This week we tracked 199 security stories, 4 newly exploited vulnerabilities and 88 ransomware leak-site claims from 28 groups. Here is what defenders should know.

At a glance

Top security news

• Social media giants sue California to overturn law shielding kids 15 and under from compulsive use (The Record)
• OpenSSH flaw lets attackers log into password-disabled Linux accounts (BleepingComputer)
• AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research (SecurityWeek)
• Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction (The Hacker News)
• DigiCert data breach exposes customer information, identity documents (BleepingComputer)
• ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories (The Hacker News)
• Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out (The Hacker News)
• Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day (SecurityWeek)
• Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes (SecurityWeek)
• Chainalysis warns all users hit in cyber breach involving ‘agentic’ techniques (The Record)

Newly exploited vulnerabilities

• CVE-2024-27834, Apple Multiple Products: Apple Multiple Products Improper Authentication Vulnerability (details)
• CVE-2026-119977, WordPress WordPress Core: WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability (details)
• CVE-2026-118527, Ivanti Connect Secure: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability (details)
• CVE-2026-111357, Ivanti Connect Secure: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability (details)

Ransomware

Ransomware groups posted 88 new claims on their leak sites this week.

Claims come from criminal leak sites (collected by ransomware.live) and are often unverified, so we do not name the organisations listed.

Ransomware in the news

• Queens Public Library says ransomware attack disrupted Wi-Fi, on-site computers (The Record)
• UK school estate hit by 3AM ransomware in suspected AI-assisted attack (BleepingComputer)
• Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw (The Hacker News)
• Michigan State cyber incident claimed by ransomware gang behind recent hospital attack (The Record)
• Synology warns of C3RB3R ransomware attacks targeting NAS devices (BleepingComputer)
• Bulletproof Host Virtualine Loses Its Domain to FBI Seizure (SecurityWeek)

Web defacement

Our sources did not report any notable website defacement incidents this week.

Defacement is often the visible sign of a deeper compromise. If one of your sites is defaced, take it offline, preserve logs, and look for the way in before restoring from a clean backup.

What to do this week

• Patch the newly exploited vulnerabilities listed above, starting with internet-facing systems.
• Check that backups are recent, offline or immutable, and that you have tested a restore.
• Confirm multi-factor authentication is on for remote access, email and admin accounts.
• Monitor your public websites for unexpected changes to pages and files.

Sources

• CISA Known Exploited Vulnerabilities catalog
• ransomware.live for leak-site statistics
• News links above go to each original report