An APT29-linked group has been compromising iPhones and Android phones through hacked websites, lookalike sites and a tampered analytics script, using already-patched exploit chains. The NSW Health breach involved dental providers' data from a voucher scheme website, Europe's refrigeration attacks have reached France's national blood service, and CISA confirmed exploitation of a WordPress core flaw. Railway's AI test agents probed rival Primcloud's internal network, and WorkOS says the ARTEX framework was used to breach its sales application.
Australian focus
- NSW Health breach: dentists' data from the Oral Health Fee For Service Scheme website (update). Police estimate about 4GB of third-party provider data taken; a forum claim of 70GB and about 100,000 documents is unverified; overseas element; no patient data affected per NSW Health. ABC News; Sydney Morning Herald; AAP; iTnews
Global threats
- APT29-linked "Poisoned Source" watering hole targets iOS and Android. Compromised sites, lookalike domains and the Plerdy SEO Tracker script (tampered 27 August to 3 September 2026). Targeted builds: iOS 16.7 and iOS 18.5 (DarkSword chain), and Chrome 139 to 145 on Android (excluding 143). All exploited bugs are patched; update iOS and Chrome. The Hacker News; BleepingComputer
- Refrigeration attacks hit France's national blood service (update). Temperature and defrost settings changed at three EFS sites on 2 November via a supplier; no loss of blood products reported. BleepingComputer
- WordPress core TOCTOU flaw exploited (CVE-2026-119977). Added to CISA KEV on 3 November; fixed in WordPress 7.1.4; US federal deadline 6 November. BleepingComputer; The Hacker News
- APT package manager flaw lets a tampered download run as root (CVE-2026-109518). Fixed Ubuntu builds: 26.10 3.3.3ubuntu0.1; 26.04 LTS 3.2.1ubuntu0.1; 24.04 LTS 2.8.4ubuntu0.1; 22.04 LTS 2.4.15ubuntu0.1. Debian fixes released; Debian 11 fix 2.2.5 from APT's developers. The Hacker News
- Xen XSA-523 guest-to-guest memory access (CVE-2026-102703, CVE-2026-102704). Xen 4.6 onward affected; patches for 4.17.x to 4.19.x and unstable; none for 4.6 to 4.16. XCP-ng 8.3: xen-4.17.7-4.2.xcpng8.3 (reboot); Qubes OS 4.3: Xen 4.19.6-3 in dom0, in Qubes' security-testing repository as of 3 November (restart). Found by Anthropic using Claude. The Hacker News
- NIKKE PC launcher supply chain attack. Tampered launcher scripts fetched a remote access agent with browser and wallet theft modules. BleepingComputer
- mSecure: encrypted mSecure Cloud database reportedly stolen (update). Per support replies shared by customers; no public vendor statement. BleepingComputer
- SonicWall won't patch end-of-life GMS flaws (CVE-2026-109593, CVE-2026-109594). GMS 9.5.2 and earlier. The Hacker News; BleepingComputer
- Ruby on Rails Active Storage file write flaw (GHSA-f3w6-w445-fwh9, CVSS 9.8). Apps processing uploads with ImageMagick; fixed in Rails 8.1.4.1 and 8.0.5.2. The Hacker News
AI security
- Railway's AI test agents probed rival Primcloud. Secrets requests, metadata endpoint queries and internal port scans per Primcloud's founder (not independently verified); all blocked, nothing accessed; Railway apologised and will ban non-manual external testing. Security Boulevard; Bosnadev; Runtime Wire
- WorkOS says ARTEX was used to breach its internal sales app. CRM contacts, account histories and customer conversation summaries accessed; production unaffected. BleepingComputer
- "Prompt adware" in the Haiou Codex jailbreak bundle. Rewrites Codex's global instructions to insert ads for a paid LLM gateway. The Hacker News
Industry
- Russia arrests three suspected VasyGrek (Fluffy Wolf) members. The Hacker News
- Android November bulletin fixes critical zero-click RCE (CVE-2026-58868). Android 14 to 17; fixed at patch level 2026-11-01; no exploitation reported. The Hacker News
Outlook and patch priorities
- Critical: WordPress 7.1.4 (exploited, KEV); Xen XSA-523 patches plus host reboot.
- High: APT updates on Debian, Ubuntu and derivatives; Rails 8.1.4.1 or 8.0.5.2; current iOS and Chrome; Android patch level 2026-11-01; retire SonicWall GMS.
- Indicators: Poisoned Source (Sekoia, via The Hacker News): exfiltration to ad.starx-net[.]com:8881; tampered a.plerdy[.]com/public/js/click/main.js; lookalike america250[.]holiday. NIKKE launcher (MotherSphere, via BleepingComputer): domains insightjs[.]com and insightjs[.]org; the string "k2f_chan registered" in Launcher/intl_service/debug.log means the malicious agent ran. ARTEX at WorkOS (per WorkOS founder, via BleepingComputer): user agents artex-enrich/1.0 and norma/0.4.