Your TV Box Is Spying on You — Plus 8 Chrome Zero-Days and a White House Wi-Fi Scandal
Tuesday, November 10, 2026 · 5-minute read
French authorities have officially blamed Iranian state-backed hackers for October cyberattacks that knocked out refrigeration systems at over 700 supermarkets and retail stores. The attacks caused widespread food spoilage and sparked at least 15 fires. It's a stark reminder that cyberattacks can cause very real, physical consequences — not just stolen data.
↗ BleepingComputerSecurity researchers at Check Point have connected three separate hacking campaigns — codenamed SilentDelivery, OceanGate, and DarkWire — to a single Chinese malware ecosystem called Sparrow. The campaigns hit telecoms, military organizations, government agencies, and research institutions in Latin America, Asia, and Europe. A shadowy group called CopperDragon appears to be building and supplying the tools used across all three operations.
↗ The Hacker NewsSecurity researchers discovered that computers and phones inside the White House network were quietly sharing their internet connections through residential proxy services — including one linked to a Russian company connected to 2016 US election hacking. The activity was detected on 26 out of 30 days between October and November, with 28 different proxy services able to route traffic through the official White House network. It's unclear whether staff knowingly installed these services or picked them up through free apps.
↗ Krebs on SecurityAttackers are actively exploiting a critical bug in Xen Orchestra, a popular tool for managing virtual machines. The flaw is surprisingly simple: sending a specially crafted cookie tricks the system into handing over full admin access — no password required. Once inside, attackers can run any code they want across entire pools of managed servers. French software maker Vates VMS confirmed the bug is being exploited right now, and no CVE tracking number has even been assigned yet.
A persistent hacking group called Blind Eagle is sending phishing emails disguised as official court summons, government notices, and legal documents to targets across Latin America. The emails are written convincingly in Portuguese and Spanish. Opening the attachment installs a remote access trojan, giving attackers full, hidden control of the victim's machine. The group has been running similar campaigns since 2018.
A flaw in how Xen Orchestra reads login cookies lets anyone send a malformed request and get handed full administrator access — no username or password needed. From there, an attacker can run any code they want on every virtual server being managed. It is being actively exploited in the wild right now.
Status: Patch in progress — apply vendor mitigations immediately. No official CVE number assigned yet.
Attackers chained two flaws in AhsayCBS — a popular enterprise backup tool — to bypass login screens and run commands directly on affected servers. Because backup servers hold copies of everything, this is especially dangerous. Researchers at Huntress found attackers had installed web shells, crypto miners, and a custom backdoor — and the intruders had been patient, suggesting a bigger operation than a quick smash-and-grab.
Status: Patches released by Ahsay Backup in mid-October 2026 — update immediately if you haven't already.
Binance is warning that a vulnerability in several recent versions of Apple's iOS could allow a rogue app to read private files stored by other apps on the same device — including seed phrases, secret keys, and login credentials for crypto wallets. If you have a cryptocurrency wallet app on your iPhone, this is worth taking seriously right now.
Status: Apple patch status unconfirmed — monitor for an iOS update and install it immediately when available.
Google pushed an emergency update to Chrome after discovering attackers were already using a newly found zero-day vulnerability. This is the eighth time this year Google has had to rush out an emergency Chrome patch. The details of the flaw are being kept quiet so more attackers don't copy the technique before users update.
Status: Patch available now — open Chrome, go to Help → About Google Chrome, and let it update.
The SANS Institute — one of the most respected names in security training — has launched six new GIAC certifications focused specifically on AI security. The courses cover practical skills for security operations, digital forensics, penetration testing, and application security — all through the lens of AI tools and risks. Each certification is backed by hands-on labs, not just multiple-choice tests. As AI tools flood every workplace, knowing how to secure them (or attack-test them) is quickly becoming a core skill. This is worth bookmarking if you or your team are thinking about upskilling.
Imagine buying a cheap Android TV box, plugging it in, and unknowingly handing strangers a key to your internet connection — forever. That's exactly what happened to more than 1.3 million people around the world, thanks to a Chinese manufacturer that deliberately pre-loaded its devices with malware. Google just announced it dismantled the entire operation.
The company behind the scheme was Videostrong Technology Co., a Chinese TV box maker. When customers powered on their new devices for the first time, hidden software quietly enrolled them in a botnet called XCPE. That malware then made each device's internet connection available for rent through residential proxy services. Criminal customers paid to route their traffic through ordinary people's home connections — making their activity look like it came from innocent households. The same malware was also found in Android healthcare devices, karaoke machines, and digital signage systems.
For regular people, this matters for two reasons. First, your internet connection has real value to criminals — it makes their activity hard to trace. If your connection is secretly being rented out, you could be unknowingly linked to fraud, hacking attempts, or worse. Second, this shows that the danger isn't always a phishing email or a dodgy website. Sometimes the threat is baked right into the hardware you bought. Cheap, unbranded Android devices — especially TV boxes — are a known weak spot because they often skip the security checks Google requires of certified manufacturers.
Google says it has taken legal action to shut down Videostrong's control servers and has addressed the weakness that let the malware load at first boot. But the bigger lesson stands: be careful about which devices you connect to your home network. Stick to reputable brands, check reviews from security-focused sources, and if you own a no-name Android TV box, consider whether it's worth keeping plugged in.