Blood Fridges Hacked, White House Proxied & 948 Linux Exploits in 30 Hours
Thursday, November 5, 2026 · 5-minute read
Hackers targeted a refrigeration equipment supplier used by France's national blood service and changed temperature and defrost settings at three facilities. The attack put stored blood products at risk — the kind of disruption that can have life-or-death consequences downstream. This is a sharp reminder that critical infrastructure isn't just power grids and pipelines; medical supply chains are targets too.
↗ BleepingComputerSecurity firm Layer3 Intel detected that multiple computers or phones inside the White House's dedicated internet network were running residential proxy software — including one service tied to a Russian founder whose hosting company was used in the 2016 US election system hacks. The proxy activity was spotted on 26 out of 30 days between early October and early November. That means anyone who paid a few dollars to one of 28 proxy services could have routed their internet traffic through the Executive Office of the President's network, making it look like the traffic came from the White House.
↗ Krebs on SecurityGoogle worked with industry partners to take down a botnet called XCPE, made up of more than 1.3 million Android TV set-top boxes — plus up to 10 million other devices including healthcare gadgets and karaoke machines. Chinese manufacturer Videostrong intentionally built malware into its devices that secretly rented users' internet connections out to criminals. Google has taken legal action and shut down the domains used to control the botnet.
↗ Krebs on SecurityHackers tampered with the PC launcher for the popular mobile game Goddess of Victory: NIKKE, slipping malware into the launcher's scripts. Anyone who ran the game's PC client picked up software designed to steal login credentials and drain cryptocurrency wallets. This is a supply-chain attack — you didn't have to do anything wrong; you just trusted a game you already use. The developers have confirmed the breach.
Attackers sent fake Google Calendar invites that led victims through trusted-looking redirects to fake login pages. Once a victim typed in their credentials, the attackers grabbed their active session — meaning MFA was no longer any protection because the crooks had a live, already-authenticated session, not just a password. Nearly 900 malicious domains were used in the campaign before they were taken down.
This flaw — nicknamed *sshole — lets an attacker log into an account that was set up to block password logins entirely (for example, accounts that only allow SSH key authentication). All the attacker needs is a valid username, network access to the server, and a password between 257 and 1,024 characters long. It only affects Alpine Linux systems running OpenSSH without the PAM interface — which is exactly how Alpine ships it by default.
Status: Patch available — OpenSSH 10.6p2 released today. Alpine Linux has published fixed packages for all supported releases back to version 3.16. Update immediately if you run any Alpine Linux servers.
CISA confirmed this week that a remote code execution flaw in the Apache OFBiz open-source business software is being actively exploited in real attacks right now. OFBiz is widely used for ERP and e-commerce management, so businesses running older versions are exposed to full server takeover without needing to log in.
Status: Patch available — update to the latest Apache OFBiz release. CISA has added this to its Known Exploited Vulnerabilities catalog, meaning US federal agencies must patch urgently.
A zero-day flaw in Zyxel's GS1900-series network switches was exploited before Zyxel even knew it existed. Hackers compromised nearly 1,000 switches worldwide and walked away with configuration files and stored credentials — essentially a blueprint of the affected networks. These switches are common in small and medium business environments.
Status: Patch now available from Zyxel. If you use a GS1900 switch, apply the update and rotate any passwords or credentials the device stored.
Researchers at Check Point found a flaw in ChatGPT's desktop app that let attackers silently steal your chat history — without you clicking anything. OpenAI introduced "Lockdown Mode" in June 2026 specifically to prevent this kind of data theft via prompt injection. But a weakness in how the app rendered HTML inside code blocks let attackers bypass Lockdown Mode entirely and exfiltrate conversations.
Status: OpenAI has patched this. Make sure your ChatGPT desktop app is updated to the latest version.
OpenAI detailed a five-stage agentic AI pipeline that found, confirmed, and even wrote working exploit code for 948 local privilege escalation vulnerabilities in the Linux kernel — all in a single 30-hour run. The system reviewed 2,308 candidate bugs, dynamically tested which ones were real, and produced working attack code for 948 of them. It cost OpenAI about $1.2 million in API fees. The double-edged nature of this is hard to miss: the same technology that finds and patches vulnerabilities fast could also be used to find and exploit them fast — which is exactly why OpenAI says it's sharing the research publicly.
Vercel, a major web hosting and deployment platform, is gradually rolling out Device Bound Session Credentials (DBSC) across its platform. DBSC solves a specific and growing problem: information-stealing malware that grabs your active login cookies and lets criminals log in as you even if you have a strong password and MFA enabled. By tying sessions to the physical device, a stolen cookie becomes useless anywhere else. This is a meaningful step forward for anyone who hosts websites or apps on Vercel.
Imagine buying a cheap set-top box to stream movies, only to discover it's been silently moonlighting as a tool for criminals since the moment you first turned it on. That's exactly what happened to more than 1.3 million people worldwide — and Google just confirmed it.
The culprit is a Chinese manufacturer called Videostrong Technology. Google's threat researchers found that Videostrong intentionally built malware directly into its Android TV boxes. The moment a user booted one up for the first time, the device quietly enrolled itself in a botnet called XCPE. From there, it did two things: it made the user's home internet address available for rent to anyone willing to pay a few dollars through one of several residential proxy services, and it downloaded additional malicious software modules from criminal affiliates. The same XCPE malware turned up in other Android-based devices too — telehealth gadgets, karaoke machines, and digital signage systems. The common thread? They all ran Android, and they all came from manufacturers who skipped Google's mandatory security certification process or found ways around it.
For regular people, the implications are unsettling. If your internet address is being rented out to criminals, illegal activity could appear to come from your home. That could mean anything from bypassing fraud detection systems to, in a worst case, drawing the attention of law enforcement for something you didn't do. You'd have no idea it was happening — these devices show no signs of infection during normal use. The proxy activity generates modest network traffic that most people would never notice.
Google has shut down Videostrong's control infrastructure and taken legal action. But the broader problem isn't solved. Cheap Android TV boxes — often sold on Amazon or AliExpress for under $30 — regularly skip security certification. If you own one that wasn't purchased from a recognized brand through a reputable retailer, it's worth doing some research on the manufacturer. When in doubt, a Roku, Apple TV, or certified Fire TV stick is a safer bet. The savings on a no-name box rarely outweigh the risks.