CyberNews: 03/11/2026 Edition

Today’s roundup

Inside XCPE, the botnet that turned 1.3M set-top boxes into proxy servers

Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets

Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials

Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing

Chinese hackers use ARTEX AI in automated attacks against 200 orgs

DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment

Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware

Apple’s spyware notifications reach the Bundestag: what the BSI says to do now

Harvard University data breach exposed info of 851,000 accounts

Summary

Google and its partners dismantled XCPE, a backdoor that had enrolled more than 1.3 million Android TV set-top boxes in a botnet. Google says it is highly confident that the device maker Videostrong Technology deliberately created, spread and operated the backdoor for money, reportedly selling access to criminal groups. The botnet was used for ad fraud and to secretly add devices to residential proxy networks.

VulnCheck revealed active exploitation of CVE-2026-58115 (CVSS 10.0), a missing authentication flaw in Siemens SIMATIC IoT2050 Advanced devices that lets an unauthenticated remote attacker run arbitrary code. Attackers are using it to plant remote command backdoors.

BTCPay Server urged users to update after reports of Bitcoin and Litecoin being stolen from hot wallets. The attacks targeted servers running BTCPay Server 2.4.1, released on 23 July 2026, or earlier.

Defused Cyber observed attackers trying to exploit CVE-2026-81648 (CVSS 10.0), an unpatched flaw in the CryptoPayment Gateway WordPress plugin that lets unauthenticated users delete arbitrary files on the server and can expose wallet credentials.

Red Hat released fixed kernels for Red Hat Enterprise Linux 8, 9 and 10 for CVE-2026-98432, a use-after-free in the Linux kernel's IPv4 TCP code rated 9.8 that a remote, unauthenticated attacker can reach. Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel, with no date for a regular update.

Chinese hackers used ARTEX, an open-source multi-agent AI penetration-testing framework, in automated attacks against more than 200 organizations across 14 countries.

Dream Research Labs detailed DarkBlinders, an Iran state-aligned espionage campaign between August and October 2026 that compromised a high-profile individual in Israel and a government cloud environment in the Kurdistan Region of Iraq.

ESET reported that Gorbag, a Russia-aligned group active since at least February 2025, exploits a WinRAR flaw to deploy simple data-stealing malware against Ukrainian organizations, mainly law enforcement and justice entities, local administrations near the front line and the defense sector.

Germany's BSI said several members of the Bundestag and other public figures have received Apple threat notifications since October 29, 2026 warning of mercenary spyware attacks, and urged recipients to assume their devices are compromised.

Have I Been Pwned reported that hackers who breached Harvard University's Alumni Affairs and Development systems in November 2025 stole data linked to more than 850,000 unique email addresses.

Want to dig deeper?

Vulnerabilities

CVE-2026-58115	Critical
CVE-2026-81648	Critical
CVE-2026-98432	Critical