The most important cybersecurity stories of the last 30 days, worldwide, chosen and summarised each working day. Every story links to the reporting it is based on.
Espionage13 Nov 2026
North Korean hackers steal record billions in Binance cryptocurrency heist
State-sponsored actors executed the largest cryptocurrency heist in history against Binance by exploiting missing controls and using a fake job interview to deploy malicious sweepers. The attack resulted in billions of stolen assets.
Why it mattersDemonstrates the severe financial risk posed by advanced state-sponsored groups targeting cryptocurrency infrastructure used globally.
Italy fines Meta heavily for unauthorized Android gallery access
Italy's data protection authority penalized Meta for a Facebook feature that automatically accessed smartphone photos, videos, and metadata without explicit user consent. The regulatory action highlights strict privacy enforcements regarding mobile device media.
Why it mattersReminds European compliance teams of stringent regional penalties for failing to secure clear user consent for data harvesting.
AI extension marketplace compromised following third-party access key theft
Code editor Cursor suffered a security breach after attackers stole an API access key exposed during a separate incident at Fireworks AI. The stolen credentials allowed threat actors to distribute a malicious Claude Code extension.
Why it mattersIllustrates how compromised AI infrastructure providers can cascade security failures down to downstream development tools.
US disrupts North Korean social engineering campaign targeting cryptocurrency
Law enforcement disrupted a North Korean social engineering operation that used deepfake video calls to steal massive sums of cryptocurrency over eighteen months. The coordinated intervention targeted cloud infrastructure used by the threat actors.
Why it mattersDemonstrates how sophisticated social engineering and deepfake technologies are deployed by state actors for large-scale financial theft.
International police operation dismantles major loader infrastructure and seizes logins
Law enforcement agencies disrupted servers behind Gootloader, CastleRAT, and StealC malware families, while seizing millions of stolen logins. The coordinated action led to numerous arrests across multiple dark web marketplaces.
Why it mattersDisrupting primary access brokers and botnets significantly reduces initial compromise vectors threatening European networks.
Zero-day exploits target N-able and Check Point enterprise gateways
Threat actors rapidly exploited newly disclosed zero-day vulnerabilities in N-able N-central and Check Point gateways to deploy cryptocurrency miners and data wipers. Vendors rushed out emergency mitigations as active server compromises mounted.
Why it mattersCritical infrastructure gateways remain primary targets for threat actors seeking immediate root access and persistence.
SilentAir group hijacks Asian telecom networks to intercept messages
A state-sponsored espionage group compromised mobile network nodes across multiple Asian countries to intercept calls and SMS authentication codes, primarily targeting users in Taiwan. Telecommunications software providers identified the malicious infrastructure.
Why it mattersExposes telecommunications core network vulnerabilities that allow sophisticated actors to bypass multi-factor authentication mechanisms.
German parliament expands domestic intelligence hacking and sabotage authorities
Lawmakers approved a sweeping overhaul of federal spy laws, granting intelligence agencies expanded legal authority to conduct offensive hacking and digital sabotage operations. The legislation passed following months of cabinet-level reviews.
Why it mattersExpands the legal framework for state-backed cyber operations within a major European Union member state.
Hardware crypto wallets found with hidden cellular data-exfiltration implants
Hardware wallet manufacturer Trezor confirmed that specific devices sold by a regional reseller contained unauthorized microchips. These hidden circuits secretly captured user recovery phrases and transmitted them over cellular networks.
Why it mattersReminds security teams that hardware supply chain compromises can bypass software security measures entirely.
Ransomware and worm-like malware target managed service providers via ScreenConnect
Attackers exploited a critical vulnerability in ConnectWise ScreenConnect to deploy a worm-like toolkit named SCKit across multiple managed service providers. The malware successfully spread from customer devices to technician networks.
Why it mattersManaged service providers represent high-value targets, where a single compromise can cascade across numerous client networks.
Cyber-attacks disrupt refrigeration systems across European supermarkets
Malicious actors manipulated temperatures in supermarket and medical supply refrigerators across Europe, building on earlier incidents affecting French infrastructure. Authorities have attributed the coordinated supply chain disruptions to state-sponsored actors.
Why it mattersUnderscores the vulnerability of operational technology and Internet-connected cold-chain infrastructure to physical sabotage.
Turla hackers deploy new malware to siphon European government emails
The Russia-linked Turla espionage group adopted a modular toolset named Cereal to compromise Microsoft Exchange servers. The campaign specifically targets government systems to quietly harvest diplomatic and institutional emails.
Why it mattersHighlights ongoing espionage threats against European institutional mail servers by persistent state-backed threat actors.
Massive Android set-top box botnet dismantled by tech giants
Security partners and authorities dismantled a massive botnet comprising over one million compromised Android TV boxes and IoT devices. The hardware manufacturer allegedly shipped the devices with malicious software acting as proxy infrastructure.
Why it mattersHighlights supply chain risks where insecure consumer IoT devices are weaponized to build criminal proxy networks.
3AM ransomware affiliate uses hybrid AI tactics in school estate breach
A ransomware affiliate deployed automated loops resembling artificial intelligence commands during an attack on a UK educational institution. The breach resulted in the successful exfiltration of sensitive financial data.
Why it mattersSignals the increasing adoption of automated or AI-assisted loops by ransomware operators to accelerate enterprise compromises.
Members get every notice in full: the buyer, the value, an English summary, the official link, filters, saved searches and email alerts. See the plans or log in.
Updated 15 Nov 2026. Stories are chosen and summarised automatically from the sources named under each one, and can contain mistakes. Read the original reporting before you act.