Your TV Box May Be a Spy — Plus WordPress Patches That Can Still Get You Hacked
Friday, November 6, 2026 · 5-minute read
Security researchers at Layer3 Intel detected residential proxy software quietly running on computers inside the White House network — including one service founded by a Russian man whose hosting company was linked to election-system hacks in 2016. The software, called Infatica, makes the user's internet address available for anyone willing to pay a few dollars. Researchers found 28 separate proxy services could exit through the White House network at any time — meaning outsiders could browse the web appearing to come from inside the Executive Office of the President.
↗ Krebs on SecurityGoogle worked with industry partners to take down a botnet made up of more than 1.3 million Android TV set-top boxes — all secretly infected by their own manufacturer, Videostrong Technology Co. in China. The infected boxes rented out users' internet connections to criminals without anyone's knowledge and committed advertising fraud. The same malware also turned up in telehealth devices, karaoke machines, and digital signage systems, hinting at how wide the contamination spread.
↗ Krebs on SecurityThe FBI and CISA issued a joint warning that attackers are actively targeting industrial refrigeration systems and cold-chain monitoring equipment around the world. A successful attack could cause food spoilage, equipment damage, or even fire hazards. CISA also published a guide urging operators to harden these systems, which are increasingly connected to the internet but rarely built with security in mind.
↗ BleepingComputerA newly disclosed flaw in OpenSSH — nicknamed SSHole — lets attackers log into accounts on certain Linux servers without a password. The bug affects Linux systems running OpenSSH on the musl C library with a specific authentication setting disabled, which is the default setup for Alpine Linux. All an attacker has to do is send an oversized password, and they're in. Security researchers found real exploit attempts hitting honeypot servers within hours of the flaw going public, with attackers gaining root-level control — meaning full access to the machine.
Attackers are sending fake invitations to events supposedly hosted by OpenAI, SpaceX, and Anthropic to trick employees into handing over their account credentials and session tokens. Two separate phishing-as-a-service platforms are powering the campaign. Because the attacks steal session tokens too — not just passwords — turning on two-factor authentication alone won't fully protect you if you click the link and enter your details.
When WordPress installs a security update, it briefly unpacks the new files into a temporary folder that the web server can reach. An attacker who hits that window at exactly the right moment — before WordPress cleans up the folder — can run their own code on the server, even without an account. The twist: installing the fix can still leave you exposed for a few seconds while the update runs using the old, vulnerable code. CISA has flagged this as an actively exploited vulnerability.
Status: Patch available, but block web access to your site's wp-content/upgrade folder before updating to protect the brief window during the update itself.
An attacker with no account and no password can log into certain Linux servers just by sending an oversized password string. The bug traces back to a patch from 2016 that introduced a subtle error in how OpenSSH handles failed password checks on accounts deliberately set up to block password logins. It affects Alpine Linux's default OpenSSH configuration and is already being actively exploited in the wild.
Status: Patch available — update to OpenSSH 10.6p2 now.
Yes, Microsoft Paint. A flaw in the app could let an attacker run code on your computer over a network — no file download needed. The bug is an out-of-bounds read that Microsoft rates as Important. The catch: the fix doesn't come through Windows Update. It only arrives through the Microsoft Store, which may not update automatically on all machines.
Status: Fix available (build 11.2609.401.0) — open the Microsoft Store app and manually check for updates to Paint if you want to be sure.
OpenAI unveiled GPT-6 Cyber on Thursday, a specialized AI model focused on cybersecurity research. It scored 48.5% on ExploitGym — a benchmark that tests whether an AI can turn a known software flaw into a working real-world attack — compared to 32.1% for its predecessor. OpenAI says this new model is also significantly better at staying within the boundaries researchers set, following instructions without going rogue and probing systems it wasn't told to test in 99.93% of cases. The company has flagged it as "Critical" under its own safety framework, acknowledging it's powerful enough to need careful handling. OpenAI says the model's bug-finding skills are what make it valuable — it previously helped discover 81 Firefox flaws and 948 Linux exploits — but that same power is why the company is moving carefully about who gets access.
Cheap Android TV boxes are everywhere. You'll find them on Amazon, at electronics markets, and bundled with streaming subscriptions. They promise the same apps as a Roku or Apple TV for a fraction of the price. But this week, Google confirmed what security researchers have suspected for years: some of those boxes ship with malware already baked in — installed deliberately by the manufacturer before the box ever reaches your hands.
The company at the center of this week's takedown is Videostrong Technology Co., based in China. Google's threat researchers say Videostrong quietly infected more than 1.3 million of its set-top boxes with a backdoor called XCPE. The moment a user turned one of these boxes on for the first time, the malware phoned home to Videostrong's servers and enrolled the device in a botnet. From that point on, the box was quietly renting out the user's home internet connection to paying customers — criminals who wanted to mask their real location online.
Think of it like this: someone secretly put a sublet clause in your lease, and strangers are using your address without your knowledge. Every time a criminal paid to route traffic through the XCPE botnet, there's a chance it looked like it came from your home IP address. That matters because companies and law enforcement use IP addresses to track fraud, block suspicious activity, and investigate crimes. If your address shows up in their logs, you're the one who looks suspicious — not the criminal who rented your connection.
The same XCPE malware also turned up in telehealth devices and digital signage systems, which shows the problem goes well beyond bargain TV boxes. Google says it has since closed the loophole Videostrong used to load malware on first boot, and it took legal action against the domains controlling the botnet. But millions of already-infected devices are still out there. If you own a cheap Android TV box from an unfamiliar brand — especially one bought off a third-party marketplace — it's worth checking whether it's been flagged, or simply swapping it for a device from a name-brand maker that goes through Google's security certification process.