Top 5 Cybersecurity News

This week’s Top 5 Cybersecurity News for November 6, 2026 follows five routine acts that turned into the way in. A fake job interview got an engineer to run a code test on a Binance work laptop, and about $6.3 billion followed. Stored backup credentials gave a ransomware affiliate a school estate, in an attack Bitdefender describes as part human, part AI loop. A booking-display environment at Amadeus gave unauthorized access to airline reservations for about three years. A WordPress core update opened a window that attackers are already probing. And Synology NAS devices left on old software are now being encrypted. Five exposure layers, one question for every executive: which everyday process in your company has never been examined as an attack path?

1) A Fake Job Interview Put Malware on a Binance Laptop, and About $6.3 Billion Followed

Binance said on November 3 that the October 29 attack, which affected about $6.34 billion in digital assets, was a multi-stage campaign, not a single breach. About $2.85 billion has been frozen or intercepted. In September a software engineer was approached through a job-hunting platform. In the second interview, a person posing as the CEO of the fake company asked him to download an assignment. That code ran on his work computer during setup and swapped a legitimate development tool for a malicious copy, which Binance’s endpoint tools did not catch at once. On October 20 the attackers used that machine and an internal AI tool to reach two colleagues’ computers; one held a container deployment token. The FBI attributes the theft to North Korea, under the name TraderTraitor.

No software flaw was needed; a person’s trust was enough. The interviewer built credibility by sharing a social media account with personal photos and videos, and the test ran on a company-issued computer. Two details matter for any firm that employs developers. A deployment token sat on a laptop, so one compromised laptop became a route to production. And an internal AI tool with access to colleagues’ machines served as a bridge between them. Practical consequences: run candidates’ coding tests in a disposable virtual machine, keep deployment tokens short-lived and off workstations, and treat internal AI tools like any other privileged account.

The campaign began in June, when an engineer downloaded a malicious Homebrew installation. Binance’s team detected it, replaced the device and rotated the credentials, yet the report says that engineer’s role and his colleagues on the wallet team had been exposed to the attacker. Cleaning up a device does not erase what an attacker has learned about who holds which access. A patient adversary can turn a contained incident into the first stage of the next one, and recruiting channels belong in the threat model next to email.

Read more on: Binance Incident Report · The Register

2) A 3AM Affiliate Took a School Estate Through Its Backup Servers, and Bitdefender Sees an AI Loop at Work

Bitdefender’s research, published on November 3, describes how a 3AM ransomware affiliate took over a school estate in the UK. On September 10 and 11 the attacker read stored credentials from the databases of three Veeam backup servers. Two backdoor domain administrator accounts followed, created by separate routes. On September 18 the attacker joined three separate domains with two-way trusts within about three hours, and on September 19 machines were encrypted while system-state backups were deleted. Bitdefender found no novel tools. What stood out was the pattern: commands retried every 40 to 101 seconds with small changes, and a backup-software call that did not match the vendor’s documentation.

The backup layer made this possible: it stores privileged credentials and usually has wide reach. The schools sat in separate domains, which should have contained the damage; the attacker built the trusts that removed the separation. Bitdefender points out that a new trust between domains is a rare change and cheap to alert on, and recommends alerting on credential-reading access to backup databases and on exports of the SAM, SYSTEM and SECURITY registry hives outside known jobs. Assumption: both rules can be built in most existing log platforms.

Bitdefender is careful about the AI claim. It could not access the attacker’s machine, cannot name a model and cannot exclude a person pasting text between a shell and a chat window, so it presents the hybrid reading as a working model to plan around, not as established fact. The practical lesson holds either way: tempo stops being a signal. An operator that retries every 40 seconds without fatigue makes patient intrusions cheaper, and Bitdefender expects hybrid attacks to become more common in 2027. The weak points it used were old ones: stored backup credentials and domain trust.

Read more on: Bitdefender Research · Dark Reading

3) Amadeus Booking Data Was Reachable Without Authorization for About Three Years

Amadeus, a travel technology provider, says it found a vulnerability in a travel booking display environment where certain booking-display data was accessible. Airlines report that unauthorized access ran from August 2023 to September 2026, and Amadeus notified them between October 20 and 28. Cathay Pacific says the unauthorized party used credentials of an Amadeus system account. Singapore Airlines reports about 46,000 booking records, Cathay Pacific about 53,000 bookings and Japan Airlines about 92,000 customers; ANA, Korean Air, Asiana and Malaysia Airlines are also affected, and Qantas is still investigating. The data was mostly names, booking references and flight details, and for some passengers passport details. Amadeus says it found no evidence that payment data was accessed.

No airline reports a breach of its own systems, which is the point: the exposure sat inside a supplier’s environment that none of its customers could watch. The figures count different things (records, bookings, passengers) and cannot be added up; Amadeus has not published a total. Condor, a German carrier, has confirmed to aeroTELEGRAPH that its records are affected, without giving numbers. For other companies, the practical questions are which suppliers hold copies of customer or employee data, how access to those systems is credentialed, and what the contract says about notifying you. Travellers with exposed itineraries face more convincing phishing. Questions on GDPR notification duties belong with your data protection officer or counsel.

A three-year window in a shared system shows how supplier concentration works: one account’s credential hygiene sets the exposure of many companies at once, and each company’s own security programme is blind to it. Certificates and questionnaires describe intent. What lowers the risk is evidence of detection: how long unusual use of a service account would go unnoticed at the supplier, and whether you would be told. Hypothesis: that the access lasted so long suggests it resembled normal use; sources differ on when Amadeus noticed it, and none says how.

Read more on: Amadeus Statement · aeroTELEGRAPH

4) The WordPress Update Itself Became the Vulnerability

CISA added CVE-2026-119977 (CVSS 8.1) to its Known Exploited Vulnerabilities catalog on November 3, with a federal deadline of November 6. The flaw is a race condition in WordPress Core: during a full-package core upgrade, the new files are staged in predictable, web-accessible paths, and an unauthenticated attacker who times a request correctly can execute code on the server. Versions 4.7 through 7.1.3 are affected; WordPress 7.1.4, released on October 28, fixes it. Wordfence counted more than 18,500 requests to staged setup-config.php installer paths in the first 21 hours after disclosure, and Previdian recorded attempts against a honeypot on October 30. No actor is named in the sources we reviewed.

The exposure is short, but it returns with every full core update, and the attacker needs no plugin flaw and no login, only timing. Assumption: agencies and hosts that update many sites at once open that window most often. Do not rely on auto-updates alone; confirm the version of each site, including those run by an agency or host. As of November 4, WordPress.org listed only 7.1.4 for this fix, so confirm that a release exists for your branch. Check web server logs since October 28 for requests to staged installer paths, and look for unknown PHP files and new administrator accounts.

The advisories disagree on severity: WordPress’s own advisory rates the issue Low, while Wordfence scores it 8.1 because the attacker has to hit the window. Last week’s ESXi logging flaw, rated 2.7, showed the same gap between a rating and what an attacker can do with a flaw. Evidence of exploitation, not the label, should set the patch order. An update is also a change to a production system, and most sites do not record who ran it, when, and what appeared in the web root afterwards. That record is what an investigation would need.

Read more on: CISA KEV Alert · The Hacker News

5) Ransomware Is Encrypting Synology NAS Devices on Old Software, and Nobody Agrees Which Flaw Gets In

On October 29 Synology said attackers are exploiting a flaw it patched in December 2024 to encrypt data on NAS devices running outdated DiskStation Manager (DSM) and demand a ransom. Its notice points to advisory Synology-SA-24:20, which covers CVE-2024-10441, and names no CVE of its own. Qihoo 360 calls the ransomware C3RB3R, a Cerber variant, and says the cases it examined entered through two newer flaws, CVE-2026-13639 and CVE-2026-13684 (both CVSS 9.8), fixed in September. Synology has not confirmed that. Encrypted files get the extension .L0CK3D and a note named read-me3.txt. In the sources we checked on November 2, none of the three CVEs was in CISA’s KEV catalog.

Many mid-sized firms keep their backups on a NAS inside the same network, often with remote access left on for convenience and updates left to whoever installed it. If the NAS is encrypted, the data and its copies fall together. Update DSM, switch on automatic updates, remove direct internet access (including port forwards and QuickConnect) and keep at least one backup copy that the NAS’s own credentials cannot reach. Then test a restore.

Which CVE is the entry point matters less than what both candidates share: a fix had been available for months or almost two years and had not been applied. Hypothesis: storage appliances sit outside normal server patch cycles because no one is named as their owner. Story 2 showed the same layer from the other side. The backup layer, whether a backup server or a NAS, is where attackers go to remove the option of restoring, which makes its patching and ownership a resilience question for the board, not housekeeping.

Read more on: Synology Notice · BleepingComputer

If this week tells us anything, it’s this:

Each of the five incidents ran through something routine. A job interview, a backup job, a supplier’s booking display, a core update and a storage box all counted as normal business, so nobody treated them as attack surface. No new attack technique was required. The attackers relied on trust that was already there: a candidate’s trust in an employer, one domain’s trust in another, an airline’s trust in its supplier, a site’s trust in its own upgrade folder, an office’s trust that an old box would not matter. The structural exposure is the set of everyday processes that nobody has examined from the attacker’s side.

For boards and CISOs the useful exercise is a short list. Which recurring processes touch privileged credentials or customer data, such as hiring tests, backup jobs, supplier connections, update windows and storage appliances? For each, who owns it, when was it last examined as an attack path, and what would you see if it were misused? If the honest answer to the last question is “nothing”, start there.

The three questions above map to work DIESEC does every day. Penetration testing and red teaming examine a routine, such as an update window, a storage appliance or a hiring process, the way an attacker would. Managed Detection & Response with NovaMDR™ and our SOC as a Service answer the third question: what you would see if the routine were misused. Governance, Risk and Compliance support helps define the owners that Stories 3 and 5 were missing, including for supplier connections under NIS2.

If one of these routines sounds familiar from your own environment, you are welcome to get in touch, and we can look at it together.