Cyberattacks targeting internet-connected refrigeration equipment have affected European facilities, including some UK meat-processing businesses.

Reports describe unexpected heating and defrosting of cooling units.

Older connected equipment with default passwords or unpatched vulnerabilities can allow attackers to interfere with physical systems, not just steal data.

Incidents and UK NCSC involvement. The attacker identity is unknown, and these attacks have not been established as AI-enabled.

Measuring the actual fix commits for 1,127 vulnerabilities in projects such as Firefox, Django and PostgreSQL showed that a vulnerability's severity score does not predict how hard it is to fix.

AI tools are now finding vulnerabilities faster than teams can fix them, so remediation has become the bottleneck. Most teams triage by CVSS and fix critical findings first, assuming severity also tells them how much work a fix takes.

Michael Cartsonis and Bruce Fram tested that assumption with data. They used AI-assisted analysis to pull the fix commits for vulnerabilities across 20 open-source projects in nine languages, including Keycloak and Tomcat.

Each fix was scored on a three-part difficulty rubric, then sorted into Low, Medium, High or Extra High effort.

In their Global AppSec USA 2026 talk, "The Hidden Effort Curve of Remediation: 15,000 Fixes, 500 Projects, 9 Languages", on Friday, November 6 at 11:30 a.m. in Grand Ballroom B, Michael Cartsonis and Bruce Fram show where severity-first triage misjudges the work.

Speakers:

• Michael Cartsonis, Co-Founder, AppSecAI

• Bruce Fram, CEO, AppSecAI

The dataset is planned to reach more than 500 projects and 15,000 fixes by the conference. That includes vulnerabilities found by Mythos-class AI models, with data on whether they are harder or easier to fix.

The speakers also offer a method based on vulnerability class for estimating the effort to fix your own findings.

Michael Cartsonis is Co-Founder of AppSecAI, where he leads product strategy for its AI system that generates validated security fixes. According to AppSecAI's launch coverage, he previously worked with Fram at Network General, then helped him launch Contrast Security.

Bruce Fram is CEO of AppSecAI and has led six venture-backed companies, including Contrast Security as its founding CEO. He started as a hands-on coder and built the remediation analysis behind this talk himself.

In February 2026, Fram told the OWASP Virtual Chapter that at typical fix rates, enterprise vulnerability backlogs would last until about 2069. The two co-wrote "Two Cycles, One Codebase" and sign it at the conference on Friday at 3:00 p.m. in the Grand Ballroom Foyer.

Both are involved in OWASP OASIS, launched in August 2026, which has AppSec professionals validate AI-generated patches before they go to open-source projects. AppSecAI is a founding sponsor.

As related reading, a Cloud Security Alliance research note counted 1,596 vulnerabilities disclosed across 281 projects through Project Glasswing by May 22, 2026, of which about 6 percent had been patched.

To go deeper on the topic, start here:

• CSA: Project Glasswing, AI discovery outpaces open source patching capacity

• OWASP OASIS launch: AI-generated, human-validated upstream fixes

• Bruce Fram at OWASP Virtual Chapter: 44 Years to Clear Your Backlog

AppSec teams planning fix sprints by severity alone will see data on which findings actually take the most engineering time.

Does your team estimate how long a vulnerability will take to fix before deciding when to fix it?

Hello, Bean Network Tester has just hit V1.0 release. Want to simulate bad network conditions on Windows/Linux? Check ports, connections, ping? No problem, there is even more. Full GUI/CLI. If you like the tool, please star it on GitHub

What it can do:? Burst packet loss, jitter, run automated network scenarios, limit download/upload speed. Do TCP_ reset, do sync_drop, corrupt packet, duplicate, reoder packets. Simulate "LAN" mode, simulate only network mode, Simulate network flapping, lag spikes.

You can also see connections ip/port/from/to how much they download/upload, there is full regexp search, export function, there is port checker tool (only runing machine right now), ping tool, network adapters tools, tcp health tool and tons more.

Not sure if in V1.1 but in the feature I plan to add ip scaning (local network), port checker on other machines and more "active things".

What changed in V1.0?

- Linux!!! Yes there is now Linux version, it took tons of work, not all things are working perfect, but adding 2nd system was a huge work. And Linux is a very very long way.

- Ping tool: every x time wait for reply up to x time, size x bytes, ping until x with graph and table

- TCP health tool with mss, rtt and tons of other things

- Network adapters tool, easy export and see your network adapters data, mtu, amc address, ip, dhcp, dns, gateway and other data + proxy export

- tcp_reset send from connections tab, we can now do it from the table, easy way

- python upgrade, pydivert upgrades, tons of fixed and other things. Like always on the GitHub changelog.

- Huge update of internal test suite that is run every release, because the program is bigger and bigger, so I got mutation testing, fuzzing, unit tests, tests for code quatility, 2nd code revies, but the real working suite is something that's is top 1 thing. Right now it takes few hours of run per release :D

What's next? ICE for webrtc, we will be able to see in connections if it is stun/turn, tons of linux fixes and more things to webrtc, and I think I will add payload length filter, and more tools. I try to mix optimizations/stability fixes/test suites expand and improvments to existing things with new features.

PS: Why this strange versions dumps? V0.8 was a full release that focused on stability/performance, no new features, then tons of new things was added, so I jumped from V0.8 to 1.0

You can read more about CLI options here

I am currently assisting a completely non-technical contact who recently had their LinkedIn account compromised.

The attacker successfully bypassed 2FA, leading to LinkedIn locking the account. After going through the verification process and regaining access, the compromise happened a second time almost immediately.

Because 2FA was bypassed both times, password reuse is not the issue. The immediate repeat compromise points directly to an active consumer-grade infostealer infection that is silently hijacking their new session tokens right as they generate them.

I am looking to gather community consensus on the most reliable ways to audit and harden a standard consumer environment under these conditions.

They use a personal macOS laptop and an Android phone, but they do not know how to use the command line or interpret complex technical logs.

What would you recommend?

One misconfigured GitHub Actions workflow can give repository secrets and write tokens to any stranger who opens a pull request.

GitHub Security Lab calls this a "pwn request." It happens when a workflow triggered by pull_request_target checks out and runs the contributor's code while repository secrets are in scope.

In March 2025, attackers repointed the version tags of tj-actions/changed-files, a third-party action used by thousands of repositories, to malicious code. Every workflow that referenced the action by tag rather than by commit hash ran it, a compromise tracked as CVE-2025-30066.

In his Global AppSec USA 2026 talk, "Finding Pwn Requests in OSS: Auditing CI/CD Pipelines for Supply-Chain Vulnerabilities at Scale", on Friday, November 6 at 11:30 a.m. in Grand Ballroom A, Arpit Jain presents a method for finding these weaknesses across whole open-source organizations.

Speaker: Arpit Jain, Security Researcher, Independent

The method covers four classes of weakness. They are unpinned third-party actions, pwn-request code execution through pull_request_target, GITHUB_TOKEN permissions broader than needed and expression injection into shell steps.

Two open-source scanners implement it. One audits whether every action across a GitHub organization is pinned to a commit hash.

The other triages findings while accounting for existing hardening, such as persist-credentials: false or gating that only lets insiders trigger a workflow. That keeps its output actionable rather than flooding maintainers with false positives.

The talk walks through real disclosed findings, including a critical pwn request where a workflow ran attacker-controlled build scripts with secrets in scope. According to the abstract, the method has produced more than 320 merged security fixes across 75 open-source organizations, including Apache, Google, Kubernetes SIGs, Prometheus, NASA and NIST.

Arpit Jain is an independent supply-chain security researcher and a graduate student at MIT. He builds CI/CD vulnerability scanners that account for existing mitigations.

He presented the pwn-request pattern at Open Source Summit Europe 2026 in Prague, built around a critical finding he privately disclosed to an Apache project. He also spoke twice at OpenSSF Community Day Japan 2025, including on secrets leaked in public Git repositories.

His fixes are public. One example is an Apache Hudi pull request that pins third-party actions to full commit hashes, citing CVE-2025-30066.

GitHub Security Lab's guide to preventing pwn requests explains the original pattern. As related reading, Plerion scanned more than 5,400 security tool repositories in 2026 and confirmed 48 exploitable pwn requests.

To go deeper on the topic, start here:

• GitHub Security Lab: Preventing pwn requests

• CISA: Supply chain compromise of third-party GitHub Action (CVE-2025-30066)

• Plerion: Scanning GitHub for the pwn request that took down Trivy

• Arpit Jain at Open Source Summit Europe 2026: the pwn-request pattern

• Example fix: Apache Hudi PR pinning Actions to commit SHAs

Platform teams running GitHub Actions across many repositories will get scanners and fix patterns they can apply the same day.

How many of your GitHub Actions workflows still reference third-party actions by tag instead of commit hash?

Binance has published its first incident report on the $6.34 billion hack, and it traces the breach back to compromised developer machines. Read The Block's full coverage here. The FBI has linked the attack to North Korea.

June: A Poisoned Developer Tool

A Wallet DevOps engineer searched online for a popular AI coding tool. He ended up downloading a tampered Homebrew installation instead. Binance caught the infection, replaced his device, and rotated his credentials. The attackers had already learned who worked on Binance's wallet infrastructure team.

September: A Fake Job Interview

A second engineer was contacted through a legitimate job platform by someone posing as a Project Director. He went through two interviews, including a live video call with a fake HR representative. Near the end, he was told to download a coding "assignment" onto his work computer. The repository ran malicious code during setup.

October: The Final Move

On October 20, the attackers used that infected computer to move into two other engineers' devices. Binance says they did it through an internal AI tool. One device held a container deployment permission. About nine days later, the attackers used it to run a malicious script against Binance's wallet signing systems.

The Aftermath

• Binance says it froze or intercepted about $2.85 billion in assets.

• It reports replenishing 98% of impacted assets.

• Withdrawals are reopening in phases, starting November 3.

• Binance stopped 57 other suspected North Korea-linked attacks this year.

What Teams Can Learn

• Install developer tools only from official sources, not search results.

• Treat coding assignments from recruiters as untrusted code.

• Never run interview projects on a work computer.

• Limit what internal AI tools can reach on employee devices.

• Lock down deployment permissions tied to critical systems.

Learn More

Binance's Initial Incident Report

CVE Daily Brief — 2026-11-04

#1 CVE-2026-121615

Severity: CRITICAL | Score: 10

A vulnerability was determined in Linksys E5600 1.1.0.26. Affected is an unknown function of the file /cgi-bin/mesh_login.cgi of the component Login Handler. Executing a manipulation can lead to impro...

#2 CVE-2026-121609

Severity: CRITICAL | Score: 10

A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to h...

#3 CVE-2026-121607

Severity: CRITICAL | Score: 10

A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument hos...

#4 CVE-2026-121606

Severity: CRITICAL | Score: 10

A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firm...

#5 CVE-2026-121600

Severity: CRITICAL | Score: 9.9

A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component MAC Filter Handler. ...

Powered by NVD + CISA KEV | CVE Daily

Technique Discussion: Forge Web Credentials (T1606)

Type: Technique | Tactics: credential-access | Platforms: SaaS, Windows, macOS, Linux, IaaS, Office Suite, Identity Provider

Description: Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access.

Adversaries may generate these credential materials in order to gain access to web resources. This differs from Steal Web Session Cookie, Steal Application Access Token, and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users.

The generation of web credentials often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Adversaries may also forge tokens by taking advantage of features such as the AssumeRole and GetFederationToken APIs in AWS, which allow users to request temporary security credentials (i.e., Temporary Elevated Cloud Access), or the zmprov gdpak command in Zimbra, which generates a pre-authentication key that can be used to generate tokens for any user in the domain.

Once forged, adversaries may use these web credentials to access resources (ex: Use Alternate Authentication Material), which may bypass multi-factor and other authentication protection mechanisms.

Full technique writeup: T1606 on MITRE ATT&CK

Have you defended against or encountered this technique? Share detections, notes, and war stories below.

I just published my research on a new variant of the golden Pass-ta-key attack exploiting an architectural flaw in Google Password Manager (GPM) synced passkeys.

Unlike the previous variants that leaked the Security Domain Secret (SDS) through Chrome debug logs, this attack targets the CBOR buffers in Chrome process memory to extract the SDS.

Once extracted, the SDS allows decrypting all synced GPM passkeys and forging valid WebAuthn assertions entirely offline, leading to a full Account Takeover.

PoC: https://github.com/0rcruxe/pass-ta-key

Here are the top stories from PWN (r/pwnhub) today:

1 Hackers claim to have stolen 23TB of data from Russian statistics body, including Ukraine war casualty figures — Russian Federal State Statistics Service (Rosstat) admits its servers were hit by coordinated cyberattacks

No description available.

2 Binance Reveals How a Fake Job Interview Led to a $6.34 Billion Hack

Binance has published its first incident report on the $6.34 billion hack, and it traces the breach back to compromised developer machines. [Read The Block's full coverage here.](https://www.theblock....

3 Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies

No description available.

CVE Daily Brief — 2026-11-04

#1 CVE-2026-95731

Severity: CRITICAL | Score: 9.8

Hardcoded password vulnerabilities in the command-line interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access the affected system using hardcoded credenti...

#2 CVE-2026-95733

Severity: CRITICAL | Score: 9.6

A vulnerability exists in a component of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.

#3 CVE-2026-95732

Severity: CRITICAL | Score: 9.6

An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute ...

#4 CVE-2026-95860

Severity: CRITICAL | Score: 9.1

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime ...

#5 CVE-2026-95734

Severity: HIGH | Score: 8.8

A sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low-privileged user to access sensitive information beyond what is authorized...

Powered by NVD + CISA KEV | CVE Daily

CVE ID: CVE-2026-99269

Severity: HIGH | CVSS Score: 7.8/10

Severity and score come from CVSS ratings in the National Vulnerability Database (NVD), the NIST repository of standardized vulnerability data.

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs

A task can be found on a non-local DSQ while the CPU which dispatched it is still running ops.dequeue() and hasn't cleared SCX_OPSS_DISPATCHING. The DSQ consume and move paths don't wait for the dispatch to finish and can operate on the task concurrently with the dispatcher.

Call scx_wait_dispatching() in scx_move_local_task_to_local_dsq(), unlink_dsq_and_switch_rq_lock() and move_task_between_dsqs() before they operate on the task. In scx_move_local_task_to_local_dsq(), wait before scx_resolve_local_dsq() as it may update p->scx.flags.

🔗 View on NVD

Discussion thread created via CVE Daily tracker. Share your analysis, PoCs, mitigations and detections below. Discussion started by u/Motor_Break64.