Cyber news on November 2, 2026

1. 0107:57 UTC

   Ivanti patches two more Connect Secure zero-days used in attack chain

   2 outlets · first: securityweek.com Vulnerability

   Machine summary Ivanti released fixes for CVE-2026-111357 and CVE-2026-118527, two Connect Secure zero-days that were chained with the authentication bypass CVE-2026-104935 in attacks Volexity tied to the group UTA0576 since at least October 3. The new builds, 25.1.1.3 and 22.8R2.6, supersede the October 13 releases, which fixed only the bypass. Shadowserver tracks more than 5,000 internet-exposed Connect Secure instances, BleepingComputer reported.

   1. CVE-2026-111357, rated 8.8 by Ivanti, is a missing-authentication privilege-escalation flaw and is the bug that had no fix when the attacks were revealed in mid-October
   2. CVE-2026-118527, rated 4.3, involves predictable identifiers and lets a remote authenticated attacker write chosen file content to a known disk location
   3. Volexity reported that the group it tracks as UTA0576 chained CVE-2026-104935 with two other flaws since at least October 3 to gain unauthenticated root-level code execution, deploying no malware and altering logs to avoid Ivanti's Integrity Checker Tool
   4. Defused reported first signs of CVE-2026-104935 exploitation on October 1, and Shadowserver tracks more than 5,000 internet-exposed Connect Secure instances, BleepingComputer wrote

   Reported by securityweek.com and bleepingcomputer.com.

   • Ivanti
   • Volexity
   • Defused
   • UTA0576
   • CVE-2026-104935
   • CVE-2026-111357

2. 0218:54 UTC

   Germany says lawmakers' iPhones may have been hacked with spyware

   2 outlets · first: Rt-english Threat intelligence

   Machine summary Germany's BSI said members of the Bundestag and other public figures received Apple threat notifications indicating they may have been targeted by mercenary spyware.

   1. The BSI said members of the Bundestag and other unnamed public figures received Apple threat notifications warning they may have been targeted by cyberattacks (TechCrunch, November 2, 2026)
   2. Digital Transformation Minister Karsten Wildberger told ARD and ZDF on Monday that Berlin suspects state involvement and that the matter is still under investigation (RT)
   3. Apple does not attribute attacks to specific governments and does not confirm whether a phone was actually compromised (TechCrunch)
   4. Berlin's spokesperson for the government, Stefan Kornelius, described the incident and the alert as matters of the highest seriousness, without revealing if Chancellor Friedrich Merz had been a target (Financial Times, via TechCrunch).

   Reported by Rt-english and techcrunch.com.

   • Apple
   • Friedrich Merz
   • BSI (Federal Office for Information Security)
   • Bundestag

3. 0318:16 UTC

   Google says it dismantled the XCPE botnet of 1.3 million TV boxes

   2 outlets · first: bleepingcomputer.com Threat intelligence

   Machine summary Google's Threat Intelligence Group says it disrupted the XCPE botnet, which it assesses was built from more than 1.3 million Android TV set-top boxes carrying a factory-installed backdoor. Google attributes the backdoor with high confidence to Chinese manufacturer Videostrong Technology Co. and says removing the shared command-and-control servers also cut off at least 10 million additional compromised devices. Google says it revoked Videostrong's Android TV licence and banned the company and its future affiliates from certified Android devices.

   1. Google's Threat Intelligence Group says the XCPE botnet comprised more than 1.3 million Android TV streaming boxes, and assesses with high confidence that the backdoor was intentionally developed and operated for financial gain by Videostrong Technology Co.
   2. According to Google, XCPE command-and-control servers used by over a dozen connected malware families were taken down, a move the company says blocks access to at least 10 million more infected devices, among them retail set-top boxes, karaoke machines and telehealth hardware.
   3. According to Google, ties with Videostrong have been ended, the licence to build Android TV hardware shipping with Google apps and services preinstalled has been withdrawn, and the firm plus any future affiliates are barred from producing certified Android devices or providing software to certified vendors.

   Reported by bleepingcomputer.com and krebsonsecurity.com.

   • Google
   • Android TV
   • Videostrong Technology Co.
   • XCPE

4. 0413:25 UTC

   Google sets $250,000 Cloud VRP reward for root-in-cloud findings

   2 outlets · first: securityweek.com Vulnerability

   Machine summary Research that grants 'roles/owner' or total IAM authority across any Google Cloud project or organization can now earn a $250,000 top-tier payout from Google's Cloud Vulnerability Reward Program. The company said qualifying exploit paths may not rely on prior project access, compromised credentials, user interaction or social engineering, and that remote code execution reports in Borg are automatically evaluated for eligibility.

   1. SecurityWeek and BleepingComputer report that Google's Cloud Vulnerability Reward Program has introduced a top-tier reward of $250,000 for vulnerabilities that grant 'roles/owner', or total IAM control over arbitrary Google Cloud organizations and projects.
   2. Qualifying exploit paths may not depend on pre-existing access to the victim project, previously compromised credentials, user interaction or social engineering, Google said.
   3. Cloud VRP lead Michael Cote said Google built a deterministic proof-of-root mechanism using a designated service account so researchers can cryptographically prove unauthorized access.
   4. Google suspended submissions to its Open Source Software Vulnerability Rewards Program in October, which BleepingComputer's report links to a flood of AI-generated submissions.

   Reported by securityweek.com and bleepingcomputer.com.

   • Google
   • Google Cloud
   • Identity and Access Management (IAM)
   • Open Source Software Vulnerability Rewards Program (OSS VRP)
   • Borg
   • Cloud Vulnerability Reward Program (Cloud VRP)

Each summary and its key facts are a machine summary of the reports linked under it; the outlets, times and counts come from those reports' own records. How a rundown is built.