Cyber Security News

Hacking Editorial Brief — November 5, 2026

Active Exploitation Confirmed Against Siemens Industrial Devices and BTCPay Server Cryptocurrency Infrastructure

Researchers report active exploitation of CVE-2026-58115, a maximum-severity vulnerability in Siemens SIMATIC IoT2050 devices, enabling remote attackers to execute arbitrary code and deploy Linux bot payloads, according to The Hacker News. The flaw affects industrial IoT gateway devices used in manufacturing and critical infrastructure environments, though operational details of successful compromises have not been independently verified. Separately, attackers exploited a vulnerability in BTCPay Server versions 2.4.1 and earlier to steal Bitcoin and Litecoin from hot wallets in ongoing cryptocurrency theft campaigns, The Hacker News reports. BTCPay Server is an open-source cryptocurrency payment processor used by merchants and exchanges, though the number of affected installations and total cryptocurrency losses remain undisclosed. Neither campaign attribution nor overlap with known threat actor clusters has been established.

European Refrigeration Infrastructure Attack and North Korean Cryptocurrency Laundering Activity

Multiple sources report cyberattacks on November 2 altered refrigeration control systems at European supermarkets and French blood banks, forcing stores to discard food and raising concerns about operational technology vulnerabilities. Reuters, RTE, and ABC News documented the incidents, though attribution, technical exploitation methods, and the full scope of affected facilities remain under investigation. Separately, blockchain analysts observed North Korea-linked TraderTraitor group resuming laundering operations for proceeds from the Binance breach, routing ether through THORChain to convert to bitcoin, CoinDesk reports. The activity appears linked to the $6.3 billion Binance compromise reported yesterday, though exact transaction volumes and destination wallets have not been fully mapped.

Additional Exploitation and Compromise Disclosures

CISA added a patched Apple vulnerability (CVE-2024-27834) to its Known Exploited Vulnerabilities catalog after confirming exploitation to deliver information-stealing malware, The Hacker News reports. Security Week documented China-linked actors exploiting PHP2Shell flaws chained with the Fragnesia kernel privilege escalation vulnerability to gain root access on Palo Alto Networks firewalls and deploy webshells. Researchers reported exploitation of Chrome and Qualcomm Adreno GPU driver flaws to infect Android devices through malicious websites, Android Authority reports, though campaign scale and victim counts remain unconfirmed. A French banking firm confirmed experiencing a "sophisticated attack" with reports estimating $133 million stolen, The Record reports, though the bank has not disclosed technical details or attribution. A U.S. federal grand jury indicted two Canadian nationals for allegedly hacking multiple U.S. universities to conduct cryptocurrency mining operations, SC Media reports.

Sources: The Hacker News · The Hacker News · Reuters · RTE · CoinDesk · The Record · Security Week · Android Authority · SC Media