https://www.pk-sharma.com/briefing/ncsc-ai-cyber-intrusion-assessment-highly-likely-ransomware-on-uk-cni-what-the-assessment-says P.K. Sharma en 2026-11-03T16:04:59Z NCSC says AI-powered malware in a ransomware attack on UK CNI is 'highly likely' by 2028, a range of 80 to 90% https://www.pk-sharma.com/briefing/bitdefender-3am-ransomware-uk-school-estate-hybrid-ai-agentic-loop-what-the-report-says P.K. Sharma en 2026-11-03T16:04:13Z Bitdefender calls a 3AM attack on a UK school estate hybrid: model like commands, a human not ruled out https://www.pk-sharma.com/briefing/kaspersky-cyberstrikeai-llm-on-the-c2-server-education-africa-latin-america-what-the-report-says P.K. Sharma en 2026-11-03T16:01:10Z Kaspersky says an LLM on the attacker's server chose the commands; agent to domain admin took 3 to 4 days https://www.pk-sharma.com/briefing/eset-gorbag-russia-aligned-group-harvests-ukrainian-councils-and-courts-what-eset-says P.K. Sharma en 2026-11-03T12:34:35Z ESET says Gorbag harvests Ukrainian justice bodies and city councils in one pass, then deletes itself https://www.pk-sharma.com/briefing/node-red-cve-2026-58115-siemens-iot2050-fix-80-days-before-exploitation-vulncheck P.K. Sharma en 2026-11-03T12:33:37Z VulnCheck says its canary caught CVE-2026-58115, a CVSS 10 Siemens flaw, exploited 80 days after the advisory https://www.pk-sharma.com/briefing/absolute-secure-access-13-0-to-14-60-critical-authentication-bypass-fixed-in-14-61-what-absolute-says P.K. Sharma en 2026-11-03T11:37:11Z Absolute says Secure Access servers 13.0 to 14.60 have a critical authentication bypass, fixed in 14.61 https://www.pk-sharma.com/briefing/google-llmjacking-stolen-cloud-access-ai-bills-100000-a-day-up-to-1-million-what-google-says-and-does-not P.K. Sharma en 2026-11-03T11:35:26Z Google says stolen cloud access ran AI bills up to $1 million; the post gives no count of victims or days https://www.pk-sharma.com/briefing/mcphantom-ai-coding-agents-install-archived-mcp-servers-glow-labs-says-no-patch-is-coming P.K. Sharma en 2026-11-03T11:35:20Z Glow Labs says AI coding agents install archived MCP servers from model memory, and no patch is coming https://www.pk-sharma.com/briefing/michigan-state-university-byod-ransomware-claims-1-3-million-students-what-the-university-says P.K. Sharma en 2026-11-02T21:12:41Z Michigan State says no evidence other data was stolen; a gang lists it and claims 1.3 million students https://www.pk-sharma.com/briefing/abrigo-sageworks-offline-about-69-hours-status-page-says-only-irregular-activity P.K. Sharma en 2026-11-02T21:11:56Z Abrigo kept Sageworks offline about 69 hours; its status page says only "irregular activity" https://www.pk-sharma.com/briefing/google-xcpe-botnet-1-3-million-android-tv-boxes-videostrong-sold-access-what-google-says-and-does-not P.K. Sharma en 2026-11-02T18:44:30Z Google says TV box maker Videostrong built a backdoor into 1.3 million boxes and sold access: its assessment https://www.pk-sharma.com/briefing/control-web-panel-cve-2026-73695-73696-73697-fixed-1-12-and-1-16-changelog-lists-no-1-16 P.K. Sharma en 2026-11-02T18:43:39Z Control Web Panel's three CVEs say fixed in 1.12 and 1.16; the vendor changelog lists no 1.16 and names no CVE https://www.pk-sharma.com/briefing/trigger-dev-attacker-accessed-environment-variables-of-some-organizations-no-count-or-times-stated P.K. Sharma en 2026-11-02T18:42:26Z Trigger.dev says an attacker accessed environment variables of some organisations; no count or times given https://www.pk-sharma.com/briefing/barracuda-esg-cve-2026-116606-cve-record-says-unauthenticated-barracuda-says-admin-access-fixed-9-4-0-030 P.K. Sharma en 2026-11-02T18:41:43Z Barracuda ESG CVE-2026-116606: CVE record says unauthenticated, Barracuda says admin access is required https://www.pk-sharma.com/briefing/langflow-33-cve-records-three-ibm-bulletins-1-13-0-bulletin-pairs-none-of-its-four-themes-with-a-cve P.K. Sharma en 2026-11-02T16:04:43Z Langflow's 33 CVE records are three IBM bulletins, and the 1.13.0 one pairs none of its 4 themes with an ID https://www.pk-sharma.com/briefing/european-supermarket-freezers-second-wave-2-november-what-is-stated-and-what-is-not P.K. Sharma en 2026-11-02T16:02:51Z Reports say supermarket freezers were hit again; 'same method as France' is attributed to one installer https://www.pk-sharma.com/briefing/btcpay-server-hot-wallet-thefts-2-4-1-and-older-via-2-4-2-flaw-method-and-losses-not-stated P.K. Sharma en 2026-11-02T15:56:47Z BTCPay Server says hot wallet thefts hit 2.4.1 and older via the 2.4.2 flaw; method and losses not stated https://www.pk-sharma.com/briefing/synology-warns-of-ransomware-on-outdated-dsm-nas-c3rb3r-patched-in-2024-no-cve-named P.K. Sharma en 2026-11-02T11:59:30Z Synology warns of ransomware attacks on outdated DSM through a flaw patched in 2024, and names no CVE https://www.pk-sharma.com/briefing/deepseek-dsh-superagent-coding-agent-takes-work-from-team-chat-who-can-ask-and-who-merges P.K. Sharma en 2026-11-02T10:28:43Z DeepSeek's repository says lists decide who can ask its coding agent, and its workers run with full access https://www.pk-sharma.com/briefing/aur0ra-ransomware-gold-ogre-ai-agents-mapped-networks-and-hunted-credentials-what-sophos-found P.K. Sharma en 2026-11-02T10:28:39Z Sophos says Aur0ra ransomware operators let AI agents do the network work after a red team cover story https://www.pk-sharma.com/briefing/wso2-cve-2025-11969-system-rest-apis-let-lower-privilege-users-run-administrative-actions P.K. Sharma en 2026-11-02T10:21:11Z WSO2 says low privilege users could run admin actions on its System REST APIs; its advisory is 280 days old https://www.pk-sharma.com/briefing/beta9-three-cvss-9-9-flaws-let-one-tenant-reach-the-worker-as-root-and-its-service-account-token P.K. Sharma en 2026-11-01T21:53:05Z Beta9's three CVSS 9.9 flaws let a workspace token reach the shared worker as root, the CVE records say https://www.pk-sharma.com/briefing/prefab-ui-cve-2026-120338-generative-ui-sandbox-let-llm-written-code-write-files-on-the-host P.K. Sharma en 2026-11-01T21:49:30Z Prefab UI's sandbox for model written code let FastMCP tool callers write host files, CVE-2026-120338 says