This briefing covers 20 cybersecurity and geopolitics stories published around Wednesday, November 4, 2026, including activity involving APT29, Russia, and 6 disclosed vulnerabilities (CVE-2026-111036, CVE-2026-119977, CVE-2026-120422, CVE-2026-121144 and others). Each entry links to the original reporting.
Russia's APT29 compromised Plerdy SEO Tracker and multiple websites to deliver device-fingerprinting exploits against iOS and Android users in a large-scale watering hole campaign. Weaponizing a legitimate analytics supply chain raises the attack surface for any site running third-party tracking scripts.
China-aligned SlippyNunchucks exploited insecure HTTP in Sogou Input Method's Windows client to hijack DNS and install the DarkVigil (FDMTP) backdoor in a surveillance campaign active since July 1, 2026.
Binance confirmed that a North Korean-linked intrusion beginning with a fraudulent job interview social-engineering lure ultimately resulted in the $6.3 billion theft, describing it as a sustained, multi-vector campaign rather than a simple phishing incident.
Pyongyang launched missiles toward the sea and formally denied US attribution of the Binance cryptocurrency heist, escalating pressure ahead of potential diplomatic talks.
An unattributed cyberattack wiped data across the cloud infrastructure of Beget, one of Russia's major web hosting providers, taking down hundreds of customer websites.
Beijing is carefully avoiding entanglement in US-Iran tensions, declining to bail out Washington's strategic position on Iran. China's studied neutrality preserves its equities with Tehran while extracting diplomatic cost from Washington without direct confrontation.
Aerospace and defense firm ILC settled for $13 million after allegedly failing to meet contractual cybersecurity requirements on US government contracts, with parent company claiming issues were resolved pre-settlement.
Last-minute developments—Iranian strikes and US cuts to Israel aid—injected foreign policy directly into US midterm voting calculus. The timing compresses the window between geopolitical escalation and domestic political consequence, testing how quickly voters price in international events.
North Korean hackers tricked a Binance employee via a fake job interview into installing malware, ultimately compromising wallet infrastructure and stealing $6.34 billion in digital assets.
Russia's MVD arrested three suspected members of VasyGrek (aka Fluffy Wolf), a financially motivated threat actor targeting Russian and international companies since 2016, and dismantled its infrastructure.
An unauthorized attacker accessed portions of Chainstack's production infrastructure, exposing customer data and password hashes in an incident linked to a broader AI-assisted attack campaign identified the prior week.
Attackers used compromised credentials to access OpsShield's update servers and distribute malicious cPGuard versions to downstream hosting security customers.
CISA added CVE-2026-119977 (CVSS 8.1), a TOCTOU race condition in WordPress Core that allows unauthenticated code execution during upgrade windows, to its Known Exploited Vulnerabilities catalog.
CISA's KEV catalog formally lists CVE-2026-119977, a WordPress Core TOCTOU flaw enabling unauthenticated remote code execution via predictable staging paths during full-package upgrades.
Tata Motors iRA 2.0 and iRA.ev apps fail to enforce SSL certificate pinning, exposing vehicle-backend communications to interception or modification by network-positioned attackers. Exploitation requires no credentials, threatening vehicle telemetry and control channels at scale.
Tata Motors iRA 2.0 and iRA.ev apps ship with hardcoded service-account credentials, API keys, and auth tokens extractable by any attacker who downloads the package. Static secrets in connected-vehicle apps create persistent, patchless exposure until credentials are rotated server-side.
Sogou Input Method for Windows retrieves configuration via unencrypted HTTP in SGTool.exe, allowing a network-positioned attacker to inject malicious configs and execute arbitrary code. Sogou's 500-million-plus user base makes this a high-leverage delivery vector for mass compromise.
An authenticated attacker on Coupa's SaaS Supplier Portal can trigger server-side request forgery through the Contracts template DOCX-to-PDF conversion feature, exploiting insufficient validation in Aspose.Words for Java.
About Time Technologies' Herowatch Mini ships with a publicly available signing key, letting authenticated local attackers sign and execute malicious code with elevated privileges. Hardcoded test keys in consumer IoT wearables signal systemic secure-development failures with direct physical-access exploitation paths.
CISA added a high-severity WordPress remote-code-execution flaw to its Known Exploited Vulnerabilities catalog after confirming active in-the-wild attacks against federal agency systems.