AI Attacks Expand, Critical Flaws in ESG & Android Patched

Critical Vulnerabilities Under Active Exploitation:

• 'Black October' Attacks Steal API Keys from Nine AI Dev Platforms: The ongoing campaign has expanded to over a dozen AI developer platforms, with threat actors using AI-assisted tools like the Artex framework. Initial access vectors are diverse, including compromised credentials, vulnerable dependencies, and zero-day exploits in the Zammad ticketing system.
• European Supermarkets Suffer Second Wave of Refrigeration Cyberattacks: The cyberattacks have now impacted Finland, Luxembourg, and the Netherlands, with the Coop chain identified as an additional victim. Authorities are considering the incident a potential act of hybrid warfare targeting critical food supply infrastructure, exploiting vulnerabilities in Building Management Systems.
• Barracuda Warns of Critical Flaws Allowing Root Access in ESG: Barracuda Networks is urging immediate patching of two vulnerabilities (CVE-2026-116606 and CVE-2026-111560) in its Email Security Gateway appliances. These flaws can be chained by an unauthenticated attacker to bypass authorization and execute commands with root privileges, a significant increase in threat level.

New Threats and Advisories:

• APT29 Targets iOS & Android Users in 'Poisoned Source' Campaign: The Russian SVR-linked group APT29 is conducting an intelligence-gathering campaign using watering hole attacks and a supply chain compromise of the Ukrainian firm Plerdy. Malicious code was injected to fingerprint devices and deliver exploit chains, including the DarkSword kit for iOS, to victims in Ukraine and the United States.
• Chinese APT 'SlippyNunchucks' Hijacks Sogou App for Malware: The China-aligned group 'SlippyNunchucks' is abusing the Sogou Input Method editor through DNS hijacking. An insecure HTTP communication flaw (CVE-2026-120422) in the application's vocabulary promotion mechanism allows them to deliver their 'DarkVigil' malware to targets across Asia and Europe.

Policy & Industry Notes:

• UK NCSC: AI-Powered Ransomware on Critical Infrastructure Likely by 2028: The NCSC's annual report warns of severe societal disruption from AI-powered ransomware targeting UK Critical National Infrastructure (CNI). The report highlights technical debt and end-of-life systems as vulnerabilities, prompting the UK government to announce funding for a national Cyber Shield and a National Exposure and Real-Time Vulnerability (NERV) Centre.
• Android's November Patch Fixes Critical Zero-Click RCE, 'SMS of Death': The November 2026 Android security update addresses 119 vulnerabilities in core OS components, including the critical CVE-2026-58868. Further patches cover vendor-specific components, and new detection methods for checking security patch levels have been provided.