This roundup collects the stories readers followed most during the week of Nov. 2–8. Topics included ransomware, AI, vulnerabilities, data breaches, and critical infrastructure.
Ransomware
Burnaby School District Confirms ransomware attack as Qilin claims data leak. Burnaby School District confirmed a Sept. 21 ransomware attack after unauthorized access to its systems. Qilin claimed a data leak; the district said personal information about students, parents, guardians, staff and former employees may have been affected.
AI
Glow Labs finds AI coding agents install unpatchable deprecated MCP servers. Glow Labs said AI coding agents placed MCP servers from archived, deprecated repositories onto developer machines in a pattern called MCPhantom. Agents chose deprecated package names in 98% of reviewed sessions, according to research published Nov. 3.
OpenAI discloses AI pipeline that generated 948 Linux kernel exploits. OpenAI disclosed a prototype cyber-focused AI pipeline after a mid-October run produced 948 working Linux kernel privilege-escalation exploits. The 30-hour run used an upcoming cyber model OpenAI has not publicly identified by name.
Vulnerabilities & Patches
Attackers exploit critical Node-RED flaw CVE-2026-58115 from single IP. VulnCheck reported active in-the-wild exploitation of CVE-2026-58115 starting Oct. 30 from a single IP in Microsoft’s AS8075 network geolocating to Brazil. Siemens disclosed and patched the missing-authentication flaw in SIMATIC IoT2050 Advanced version V4.3.4.1.
Attackers exploit unpatched CryptoPayment Gateway plugin flaw to Steal wallet credentials. Attackers are actively attempting to exploit CVE-2026-81648, an unpatched CVSS 10.0 flaw in the CryptoPayment Gateway WordPress plugin. An unauthenticated user can read stored wallet credentials in cleartext, erase arbitrary files, and change payment gateway configuration; no fix exists.
Data Breaches
Chainstack confirms production breach exposing customer data and password hashes. Chainstack said an intruder accessed its development and production environments through a software component from another company, exposing customer data and password hashes. The company detected the intrusion Oct. 31 and blocked the attacker’s access the same day, disclosing the breach Nov. 3.
Critical Infrastructure
Cyber attacks hit supermarket refrigeration across Europe. Ahold Delhaize, Colruyt, ICA, Coop and Kitman Coldtech reported that attackers manipulated refrigeration and freezer systems across Belgium, Sweden, Luxembourg and Estonia on Nov. 2. Temperatures rose to 50°C or higher overnight, spoiling food.
Grocery chains report supermarket refrigeration cyberattacks across seven European countries. Grocery chains in at least seven European countries reported supermarket refrigeration cyberattacks on Nov. 2. Industrial Cyber published a story on the incidents the same day.
Join the discussion