CyberNews: 02/11/2026 Edition

Today’s roundup

Ivanti patches two more Connect Secure zero-days chained in attacks

New wave of fridge cyberattacks hits European supermarkets, this time in Belgium, Luxembourg, Sweden and Estonia

Synology warns of C3RB3R ransomware attacks targeting NAS devices

Over 1,000 GitLab servers vulnerable to ongoing RCE attacks

Chainalysis Investigates Security Incident Involving AI-Driven Attack Techniques

Hackers Send Fake Nuclear Threat Alerts to Ukrainian and Russian Citizens

New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value

Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts

Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data

Hundreds of Mundane AI Apps Are Hiding Sexually Abusive Deepfake Features

Summary

Ivanti patched two more Connect Secure remote access gateway flaws that have been chained in zero-day attacks since at least October 1.

A new wave of cyberattacks on supermarket refrigeration systems raised fridge and freezer temperatures overnight across five European countries. Ahold Delhaize and Colruyt reported an IT incident affecting dozens of stores in Belgium and Luxembourg on November 2, and Swedish chains ICA and Coop reported similar problems.

Synology urged customers to update their NAS devices immediately due to a surge in C3RB3R ransomware attacks.

More than 1,000 internet-exposed GitLab servers remain unpatched against a maximum-severity flaw being actively exploited in remote code execution attacks.

Chainalysis disclosed that an external actor using offensive agentic AI techniques accessed its systems and internal tools this month and stole customer names, emails and user IDs; the company says investigation data and passwords are safe.

Ukraine and Russia both said hackers compromised their emergency alert apps on Sunday night and sent fake air raid and nuclear attack warnings; Ukraine's Air Alarm app issued the highest-level alerts nationwide. Neither claim has been independently confirmed.

Researchers discovered VOLTA-AUTODOXER, a new Windows infostealer that harvests browser passwords and cookies, Outlook profiles and Slack workspace data, then uses large language models such as Claude, Gemini and Kimi to rank victims by financial value.

Palo Alto Networks Unit 42 tracked CL-UNK-1211, an espionage campaign against Linux infrastructure of government and state-affiliated entities between October 2025 and April 2026 that deployed SysGoRAT and suspected AI-generated scripts.

Microsoft investigated two intrusions in which attackers posing as IT support on Microsoft Teams persuaded employees to grant remote control of their PCs, then abused insecure Active Directory Certificate Services settings to obtain certificates for privileged accounts, including a domain controller, and steal company data.

WIRED uncovered some 400 apps and websites linked to Chinese-language developers that look like ordinary AI tools but hide features for creating sexually abusive and violent AI-generated images and video.