> ## Content Index > Fetch the complete content index at: https://www.cyberverso.net/llms.txt > Use this file to discover other available public pages before exploring further. # Cyber / Brief, 3 Nov 2026: Second fridge attack wave hits six EU states as Brussels opens review - URL: https://www.cyberverso.net/brief/cyber-brief-3-nov-2026/ - Published: 2026-11-03T09:09:29.000Z - Updated: 2026-11-03T09:09:27.000Z - Description: A second wave of remote attacks on supermarket refrigeration controls hit stores in at least six EU countries on Monday, three weeks after France, and the Commission will take retailers' preparedness to its Security College; no one has claimed the attacks, while US officials separately… - Author: Paolo De Rosa - Tags: #bulletin, #signal, #en A second wave of remote attacks on supermarket refrigeration controls hit stores in at least six EU countries on Monday, three weeks after France, and the Commission will take retailers' preparedness to its Security College; no one has claimed the attacks, while US officials separately suspect Iran-linked hackers of hitting freezers on military bases. Britain's cyber agency warned of an unprecedented rise in incidents as AI exposes years of neglected basics, and Germany confirmed that lawmakers and members of the government received Apple's mercenary spyware alerts. In the contest over compute, Nvidia has told cloud customers worldwide that most of their sales must go to non-Chinese clients, according to the Financial Times, and China's state planner promised faster AI legislation across the model life cycle. Berlin, meanwhile, unveiled a plan for a "sovereign AI nation" with no funding decisions attached, as Mistral's chief warned that Europe faces a trap without frontier models of its own. ## Top Stories - [Europe’s supermarkets hit by new wave of cyberattacks targeting fridges](https://www.politico.eu/article/new-supermarket-hack-in-belgium-sweden-luxembourg/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Cybersecurity and Data Protection – POLITICO* · Cybersecurity & Threats - [China Plans Broad AI Guardrails After Global Security Lapses](https://www.bloomberg.com/news/articles/2026-11-03/china-plans-broad-ai-guardrails-after-global-security-lapses) — *Bloomberg Technology* · China & Technology - [Nvidia orders data centre clients to reduce China exposure](https://www.ft.com/content/1902df70-1380-4588-bad5-171352b575f2?segmentId=776b81d7-dd92-c731-e669-99cdd37d3a96#myft:my-news:rss) — *myFT following* · China & Technology - [EU Commission to probe supermarket cyberattacks](https://www.politico.eu/article/european-commission-probe-supermarket-cyberattack-christophe-hansen/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Cybersecurity and Data Protection – POLITICO* · EU & Technology - [Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years](https://www.ncsc.gov.uk/news/cyber-chief-uk-facing-ai-powered-attacks-on-critical-infrastructure-in-two-years) — *All Feed* · Cybersecurity & Threats --- ## AI & Power [Anthropic's compute tab could top $1T as Q3 revenue nears $17B](https://www.theregister.com/ai-and-ml/2026/11/02/anthropics-compute-tab-could-top-1t-as-q3-revenue-nears-17b/5307089) — *www.theregister.com - Articles* Why it matters: Anthropic's revised IPO filing raises its compute and infrastructure commitments to about $895bn, with further estimated payments that could pass $1tn, while warning it cannot assure continued revenue growth. Revenue reached $33.2bn in the first nine months of 2026, but growth is slowing: third-quarter revenue of nearly $17bn rose 46% on the second quarter, while compute and infrastructure costs rose 77%, The Register reports from the filing. About $320bn is existing contractual obligations and $451bn is signed leases not yet started, some subject to termination rights. For Europe, a frontier supplier's solvency now depends on US cloud deals on this scale, and that is a procurement risk as well as a market one. [OpenAI, Anthropic Expose Gaps in AI Agent Monitoring](https://www.healthcareinfosecurity.com/openai-anthropic-expose-gaps-in-ai-agent-monitoring-a-33276) — *HealthcareInfoSecurity.com RSS Syndication* Why it matters: OpenAI and Anthropic each describe stronger monitoring of their agents, and each concedes serious limits: inherited blind spots, trouble recognising new harms, and false alarms. OpenAI says a costlier, wider monitor replayed against the Hugging Face breach would have caught it more than 30 hours earlier. Anthropic says its self-assessment step, in which a Claude model answers whether a conversation was harmful, caught 78% of flagged conversations with a 1% false-positive rate. Both figures are the labs' own and neither has been independently verified in the report. The AI Act's systemic-risk duties assume such monitoring can be trusted; here the developers themselves say where it cannot. [Forget retraining - AI can now tweak another AI's weights](https://www.theregister.com/ai-and-ml/2026/11/03/forget-retraining-ai-can-now-tweak-another-ais-weights/5307105) — *www.theregister.com - Articles* Why it matters: MIT researchers report that GPT-6 Astra edited another model's weights directly, without gradient training, changing 0.016% of a small Qwen model and improving its maths score up to sixfold. They call the method Weight-Space Programming and also had Astra write a Breakout-playing network from scratch, The Register reports. The results come from the authors' own blog post, on a 0.8B model, and a standard benchmark is still to be built. They expect it to help interpretability and alignment, and also recursive self-improvement. If models can rewrite weights directly, an audit of a model's training no longer tells you what the released weights contain, a practical question for AI Act documentation duties. [AI Models Are Getting Harder to Monitor, Says U.K. Government’s Joseph Bloom](https://www.theinformation.com/articles/ai-models-getting-harder-monitor-says-u-k-governments-joseph-bloom) — *The Information* Why it matters: Joseph Bloom, head of model transparency at the UK AI Security Institute, says the ability to monitor what models are doing and why is decreasing from several angles. It is one of the first on-the-record interviews by a technical staff member of the institute, one of the largest government bodies working on AI. Monitorability is widely treated as a central safeguard, so a decline reported by a state evaluator matters for any rule that relies on it, including the AI Act's evaluation duties. Excerpt-based. [Open models can do 90 percent of agentic work at a twentieth of the cost of a frontier LLM: Gartner](https://www.theregister.com/ai-and-ml/2026/11/03/open-models-can-do-90-percent-of-agentic-work-at-a-twentieth-of-the-cost-of-a-frontier-llm-gartner/5307132) — *www.theregister.com - Articles* Why it matters: Gartner forecasts that by 2030, 90% of enterprise operational agent workflow steps will run on open-weight models, at a quarter of the price of the cheapest closed model at the same score. The analysts concede that open models retry more often, so the real saving against a frontier model is closer to five or six times than the headline twentyfold, The Register reports. They rate control as the main gain, because every routine step sent to a frontier API moves workflow history outside the company. This is a forecast rather than a measurement, but it supports the European case for open weights, and leaves open whose open weights they would be. [OpenAI Hires Former Army Secretary Dan Driscoll to Cybersecurity Role](https://www.wsj.com/politics/national-security/openai-hires-former-army-secretary-dan-driscoll-to-cybersecurity-role-0e5cc0a1?mod=rss%5FTechnology) — *Technology - WSJ.com* Why it matters: OpenAI has hired former US Army Secretary Dan Driscoll to oversee national-security modernisation and to encourage US allies to adopt advanced AI systems. Altman frames the job as spreading 'democratic AI' with other countries, The Wall Street Journal reports. Driscoll, a law-school classmate of Vice President Vance, left the Pentagon in September after months of tension with Defense Secretary Hegseth. European defence ministries are among the allies this outreach targets, at a moment when their own AI plans turn on sovereign access. [Hundreds of Mundane AI Apps Are Hiding Sexually Abusive Deepfake Features](https://www.wired.com/story/hundreds-of-mundane-ai-apps-are-hiding-abusive-deepfake-features/) — *WIRED* Why it matters: WIRED found more than 400 linked apps and domains, posing as pet portraits or language tuition, that load tools for sexually abusive deepfakes, advertised on Meta and listed in Apple's and Google's stores. The network appears to be run by Chinese developers and a Hong Kong entity, KeLing Technology, which did not respond, and it has taken payment through Apple Pay and Google Pay for about a year. Hundreds of the ads contained AI-generated child abuse material, including images of real children and a member of a European royal family, and regulators have opened investigations. Under the DSA, this tests how far the duties of very large platforms and app stores actually reach. [OpenAI is already pitching 2028 hopefuls on how to talk about AI](https://www.politico.com/news/2026/11/02/openai-is-already-pitching-2028-hopefuls-on-how-to-talk-about-ai-01144821) — *Technology* Why it matters: An OpenAI memo from lobbyist Chris Lehane tells prospective 2028 candidates that AI will define their campaigns, and warns that opposing data centres could become that race's equivalent of the 2002 Iraq vote. POLITICO says the memo went to about half a dozen prospective candidates, a few members of Congress and political operatives, and that it argues a US loss of the AI lead to China would be the consequence. It shows a leading lab trying to set the terms of US politics before its own IPO, and that framing will travel to Europe's data-centre debates. Excerpt-based. [India floats AI plan under which ‘The model travels to the data, rather than the data travelling to the model’](https://www.theregister.com/public-sector/2026/11/02/india-floats-ai-plan-under-which-the-model-travels-to-the-data-rather-than-the-data-travelling-to-the-model/5306872) — *www.theregister.com - Articles* Why it matters: India's IT ministry proposes a framework in which model developers train inside secure environments run by data exchanges, so that 'the model travels to the data', under rules set by the data providers. Hospitals, banks and agencies would supply anonymised, encrypted data with differential privacy and immutable audit logs, The Register reports, though it is unclear how much work remains. The aim is local models without open access for Big Tech. It offers a different design from the EU's data spaces and from Europe's reliance on foreign models, and is worth watching as an alternative in the training-data dispute. --- ## EU & Technology [EU Commission to probe supermarket cyberattacks](https://www.politico.eu/article/european-commission-probe-supermarket-cyberattack-christophe-hansen/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Cybersecurity and Data Protection – POLITICO* Why it matters: The Commission will assess supermarkets' preparedness for cyberattacks at its Security College, chaired by von der Leyen, after refrigeration failures in at least six EU countries. Agriculture Commissioner Hansen says food security is not at risk but calls the repeated attacks deeply concerning, POLITICO reports. No date is set, though heads of cabinet agreed the meeting should come soon. Taking this to the Security College places a retail incident in the frame of hybrid threats, without anyone having been identified. It also raises a gap: which rules bind a mid-sized store's refrigeration contractor. [Berlin unveils blueprint to catch up on AI](https://www.politico.eu/article/berlin-unveil-blueprint-catch-up-ai-artificial-intelligence/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Technology – POLITICO* Why it matters: Germany's AI task force wants a 'sovereign AI nation' by 2030, with 18 measures, the state as anchor customer for European providers and close work with France and Canada, but no funding decisions. The report, obtained by POLITICO, says its measures neither constitute funding decisions nor prejudge budgets. Targets for 2030 include AI use at 80% of large firms and 55% of smaller ones, and in 90% of federal agencies. POLITICO's Monday interview with Mistral's chief adds that the plan calls for at least three European frontier labs by 2030\. Its main bet remains industrial AI, the exact choice now in dispute at EU level. [Mistral CEO: Europe faces ‘complete trap’ without frontier AI](https://www.politico.eu/article/mistral-ceo-mensch-warns-europe-trap-ai-dependence/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Technology – POLITICO* Why it matters: Arthur Mensch calls it a 'complete trap' for Europe to pursue industrial AI while leaving frontier models to the US and China, given the risk that either could apply export controls to AI. He told POLITICO the problem is the balance sheet and not talent, and that there is no such thing as a national AI strategy. EU leaders hold their first dedicated AI discussion next week in Dublin. Mensch has a commercial interest, and his own firm's biggest market is manufacturing. Cheap Chinese models also complicate his case: Ecosia dropped Mistral's models after finding they did not meet its needs. [EXCLUSIVE: Ireland makes pro-US Big Tech amendments to EU sovereign cloud law](https://www.rapporteur.com/news/exclusive-ireland-makes-pro-us-big-tech-amendments-to-eu-sovereign-cloud-law/) — *Tech | Rapporteur* Why it matters: Rapporteur reports that Ireland has made amendments favourable to US Big Tech to the EU's sovereign cloud law, the Cloud and AI Development Act, in the Council. The report's summary also says the German military has been allowed to continue using Google Cloud. Only the headline and summary were available, so the wording of the amendments is unverified. If confirmed, it shows how the definition of 'sovereign' cloud is being negotiated by the country hosting much of US tech's European business. Excerpt-based. [Telcos allowed to get majority of EU satellite licences, per Council text](https://www.rapporteur.com/news/telcos-allowed-to-get-majority-of-eu-satellite-licences-per-council-text/) — *Tech | Rapporteur* Why it matters: A Council text would let telecom operators obtain the majority of EU satellite licences, going further than they asked by allowing them to bid for military spectrum, Rapporteur reports. Only the headline and summary were available. The allocation of satellite spectrum decides who can build Europe's alternatives to Starlink, and the inclusion of military bands makes it a security question as well as a market one. Excerpt-based. [Frontex drones helped Libya and Tunisia forcibly return at least 33,000 people in the central Mediterranean](https://euobserver.com/246311/frontex-drones-helped-libya-and-tunisia-forcibly-return-at-least-33000-people-in-the-central-mediterranean/) — *EUobserver* Why it matters: The EU-funded Liminal project finds that Frontex aerial surveillance led to the interception and return of more than 33,000 people to Libya and Tunisia between late 2018 and 2024. In 2021, the year with the fullest data, Frontex aircraft detections accounted for at least 36% of recorded pushbacks, EUobserver reports. The agency has allocated €330m for aerial surveillance in 2027, and the Commission wants a further €169m for drones and other systems. The finding arrives as Frontex is set to gain deportation powers and more pre-frontier intelligence capability. Excerpt-based. [KI, Cloud und Open Source: Die EU sucht die digitale Souveränität](https://netzpolitik.org/2026/ki-cloud-und-open-source-die-eu-sucht-die-digitale-souveraenitaet/) — *netzpolitik.org* Why it matters: Netzpolitik's overview of the EU's sovereignty agenda finds a shift from frontier models to industrial use, and a sovereign cloud bill that does not limit who may build Europe's data centres. Critics say the Cloud and AI Development Act could entrench established US providers, and the Commission's industrial-AI envoy, Jim Hagemann Snabe, has argued for less effort on frontier models even as the AI gigafactory tender continues. The article appeared as Germany's Digital Summit opened. It is a useful map of the positions behind this week's Berlin and Dublin debates. [EU urged to ease social media switching](https://www.rapporteur.com/news/eu-urged-to-ease-social-media-switching/) — *Tech | Rapporteur* Why it matters: More than 35 builders of alternative social apps ask the Commission to use the Digital Fairness Act, due on 11 November, to create a right to take one's network from any platform. They want a common 'personal data server' standard for identity, content and connections, and a ban on suppressing links to rival services, Rapporteur reports. They note that the Digital Markets Act does not cover every major platform, X included. The request would extend interoperability from gatekeepers to the whole market, and would be a substantial addition to a consumer law. [Scandal-hit EU innovation agency disputes auditors’ finding that €8.7m may be unrecoverable](https://euobserver.com/246128/scandal-hit-eu-innovation-agency-disputes-auditors-finding-that-e8-7m-may-be-unrecoverable/) — *EUobserver* Why it matters: The European Court of Auditors says the European Institute of Innovation & Technology, the only one of 43 EU agencies without a clean opinion, overstated its accounts by €8.7m it may not recover. Part of it relates to EIT Manufacturing, which filed for liquidation in March; the agency says the correct impairment is at most €0.5m and that recovery is very likely, EUobserver reports. Auditors also found a material level of error in grant payments. EIT received €435m in 2025\. As Brussels asks for more money for technology competitiveness, the case shows the weakness of the tools it already has. --- ## US & Technology [Here’s How the Trump Administration Is Trying to Undermine the Election](https://www.wired.com/story/the-trump-administration-is-wreaking-havoc-on-the-electoral-system-before-the-midterms/) — *WIRED* Why it matters: On the eve of the midterms, WIRED sets out the Justice Department's campaign on voter rolls and election officials, including letters threatening criminal action to officials in all 50 states. Lawyers quoted say the suits are faltering but are built to support later claims of fraud; the department says it is following facts and law. The demand for unredacted voter data makes it a data-governance fight too. For Europe, the outcome bears on the US reliability that transfer deals and shared security arrangements assume. [Marvell wants to be a copper topper, bets $115B on photonics leader to push optical networking](https://www.theregister.com/systems/2026/11/02/marvell-wants-to-be-a-copper-topper-bets-115b-on-photonics-leader-to-push-optical-networking/5307028) — *www.theregister.com - Articles* Why it matters: Marvell plans to buy photonics maker Lumentum in a $115bn all-stock deal, filling gaps in lasers, optical switches and indium phosphide manufacturing for AI networking. As links pass 400 Gbps per lane, copper reaches its limits and data centres move to light, The Register reports. Bloomberg says Nvidia's chief gave the deal his blessing. The deal is due to close in the first half of 2028\. Consolidation in optical interconnects adds another concentrated layer to the AI stack, in a field where Sifted this week maps 74 European startups. [US automakers push for ban on Chinese vehicle imports](https://www.semafor.com/article/11/02/2026/us-automakers-push-for-a-chinese-vehicle-import-ban) — *Semafor* Why it matters: US carmakers urged lawmakers to ban Chinese vehicle imports after the midterms, with an industry representative citing Europe's job losses as a warning. BYD's exports and Geely's overseas sales keep rising as Chinese domestic demand weakens, Semafor reports. A US ban would push more of that export pressure towards Europe, whose carmakers already depend on Chinese-developed software. Excerpt-based. [Election ‘war rooms’ enter the AI age](https://www.semafor.com/article/11/02/2026/election-war-rooms-enter-the-ai-age) — *Semafor* Why it matters: OpenAI and Anthropic will each run an election 'war room' for the midterms for the first time, borrowing a practice that Meta began in 2018. Semafor cites Google's AI Mode declining last week to answer who won the 2020 election as an example of the risk, which the company said it was fixing. Companies are now moderating election information in chatbots on their own terms; the DSA's election guidelines address platforms more clearly than they address assistants. Excerpt-based. [Business groups mount fresh campaign for long-term renewal of information sharing law](https://cyberscoop.com/business-groups-cisa-2015-renewal-ndaa-cybersecurity/) — *CyberScoop* Why it matters: Thirty-five business groups ask Congress to extend the 2015 cyber information-sharing law by ten years in the defence bill, as the current short-term renewal expires on 11 December. The law gives legal protection for threat data exchanged between companies and with the government, and has been through a string of short renewals and lapses, CyberScoop reports; the groups cite AI-driven attacks as the reason for a long renewal. European CERTs and companies with US operations rely on that flow of threat data, so another lapse would be felt outside the US. --- ## China & Technology [China Plans Broad AI Guardrails After Global Security Lapses](https://www.bloomberg.com/news/articles/2026-11-03/china-plans-broad-ai-guardrails-after-global-security-lapses) — *Bloomberg Technology* Why it matters: China's state planner says it will speed up AI legislation covering data, compute and algorithms, with safety standards across the model life cycle and duties to disclose risks and incidents. Wang Ruomeng of the National Development and Reform Commission promised a transition period and sector sandboxes, kept support for open AI through 2030, and called for international coordination on vulnerability disclosure, Bloomberg reports. Details are unpublished, so this is stated intent and not yet law. Beijing would require incident disclosure from developers while EU incident rules are still being tested, and any open-model duties will reach Europeans who build on those weights. [Nvidia orders data centre clients to reduce China exposure](https://www.ft.com/content/1902df70-1380-4588-bad5-171352b575f2?segmentId=776b81d7-dd92-c731-e669-99cdd37d3a96#myft:my-news:rss) — *myFT following* Why it matters: Nvidia has told cloud customers worldwide that at least 51% of their sales must go to non-Chinese companies, in future contracts, according to five people cited by the Financial Times. The instructions are verbal, from its sales teams, and apply globally, the FT reports; a Singapore provider says it is hard to find enough non-Chinese clients outside the US. Nvidia did not confirm the rule, saying US policy encourages clouds to build on American infrastructure. A rack of B300s sold in China for about $2.8m, against about $600,000 abroad. A private supplier is setting whom data centres, potentially Europe's too, may serve, without any public rule. [Startups recalibrate Chinese AI for the West](https://restofworld.org/2026/western-startups-realigning-chinese-ai-models/?utm%5Fsource=rss&utm%5Fmedium=rss&utm%5Fcampaign=feeds) — *Rest of World -* Why it matters: Startups such as Hirundo, co-founded by Israeli entrepreneur Ben Luria, are editing the weights of Chinese open models for Western customers, removing censorship and state-aligned bias and hardening them against attacks. Hirundo's chief describes it as surgical realignment rather than making models anti-Chinese, Rest of World reports. Its own tests found Qwen models avoiding topics like Tiananmen and Xinjiang; these are a vendor's findings. A market for 'de-risked' Chinese weights is a direct answer to Europe's provenance problem, but it adds a further layer, and raises the question of who audits the editor. [China’s CXMT defends bet on risky new DRAM architecture to circumvent US chip curbs](https://www.scmp.com/tech/tech-war/article/3372997/chinas-cxmt-defends-bet-risky-new-dram-architecture-circumvent-us-chip-curbs) — *Tech - South China Morning Post* Why it matters: CXMT plans to send customers samples of a server DRAM on the 4F² architecture by year-end, a design analysts see as a way round its lack of access to EUV lithography. Micron and SK Hynix remain sceptical on cost and yields, and CXMT gave no date for mass production, the South China Morning Post reports. BofA says success would strengthen CXMT but with high execution risk. It is an example of US and Dutch export limits redirecting engineering, not stopping it, and matters for Europe's position through ASML. [China touts AI milestone: models generate more tokens than used in training](https://www.scmp.com/tech/big-tech/article/3372961/china-touts-ai-milestone-running-models-now-uses-more-data-training-them) — *Tech - South China Morning Post* Why it matters: A report from a think tank under China's industry ministry says inference has overtaken training data for the first time, with daily public-cloud token calls above 175 trillion. The report gave no training figure, so the comparison cannot be checked, the South China Morning Post notes. A sister body estimates about 500 trillion a day including private clouds. Official language now speaks of a 'token economy', and local governments are drafting policies to raise consumption. It reads as diffusion policy and is a useful counterpoint to Europe's own adoption targets. [China’s AI Data Centers Move West, But Their Tax Revenue Stays East](https://thediplomat.com/2026/11/chinas-ai-data-centers-move-west-but-their-tax-revenue-stays-east/) — *The Diplomat* Why it matters: Data centres in Ulanqab, praised by Xi last month, leave little tax locally, because cloud and model sales are invoiced by companies registered in Hangzhou and Beijing. Most local tax comes during construction, and a gigawatt campus may employ only a few hundred people, an analysis in The Diplomat argues, drawing on the Economic Observer. An official there says the industry is still losing money. It is an opinion piece, but the mechanism applies directly to any European region offering land and power for hyperscale compute. --- ## Threat Intelligence (CTI) **\[P2\]** [Apple’s spyware notifications reach the Bundestag: what the BSI says to do now](https://securityaffairs.com/202297/intelligence/apples-spyware-notifications-reach-the-bundestag-what-the-bsi-says-to-do-now.html) — *Security Affairs* Why it matters: Germany's BSI says several Bundestag members and other public figures received Apple mercenary spyware alerts from 29 October, and the digital minister confirms members of the government were warned. Minister Wildberger says those warned were told to assume, as a precaution, that their devices may be compromised, because the alert does not show whether an attack succeeded. The BSI does not know if these were actual compromises or attempts. The government will not say who was warned or whether the chancellor was among them; Apple names no government and has not commented, Security Affairs reports. severity high · exploited in the wild · EU: GDPR, NIS2 **\[P2\]** [CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations](https://securelist.com/tr/cyberstrikeai-attacks/121715/) — *Securelist* Why it matters: Kaspersky describes attackers using open-source CyberStrikeAI, in which an LLM on the command server plans actions and picks tools, to go from reconnaissance to full domain compromise. Confirmed victims were education organisations in several countries in Africa and Latin America. The operator sets the task and the model chooses the commands, a human-supervised design rather than a fully autonomous one. Kaspersky calls it one of the first public descriptions of such a compromise, a vendor's claim, and similar reports exist. severity high · exploited in the wild · EU: AI Act, NIS2 **\[P3\]** [Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts](https://thehackernews.com/2026/11/government-linux-servers-targeted-with.html) — *The Hacker News* Why it matters: Unit 42 reports a cluster, CL-UNK-1211, targeting government Linux servers from October 2025 to April 2026, using scripts that contain conversational reasoning notes that suggest AI generation. The actors sought to dump databases, exfiltrate government mailboxes, disable endpoint protection and plant fake red-team markers to look like a legitimate test, The Hacker News reports. The motive is officially unknown, and AI use is an inference from the scripts. severity medium · exploited in the wild · EU: NIS2 **\[P3\]** [Token thieves costing companies $100K+ per day in illicit LLM charges](https://www.theregister.com/security/2026/11/02/token-thieves-costing-companies-100k-per-day-in-illicit-llm-charges/5306967) — *www.theregister.com - Articles* Why it matters: Google's Mandiant says criminals who hijack corporate LLM access are running up charges above $100,000 a day, and cumulative bills of up to $1m before victims revoke access. UNC6993 created extra keys inside victims' cloud projects, another actor signed victims up to pay-as-you-go plans, and a third made 500,000 calls in under eight hours for a token routing service, The Register reports. Google's Hultquist says the stolen tokens also fund cheap autonomous attacks. severity medium · exploited in the wild · EU: NIS2, GDPR · actor UNC6993 (50%) [DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment](https://thehackernews.com/2026/11/darkblinders-compromises-israeli-target.html) — *The Hacker News* Why it matters: Dream Research Labs attributes to Iran-aligned DarkBlinders a campaign from August to October that compromised a high-profile individual in Israel and a Kurdistan Region government cloud. The attribution is the vendor's, The Hacker News reports, and earlier reports link the group to attacks on aviation and telecoms in the UAE and Iraq using fake job offers. It adds to the picture of Iranian activity around the war; European aviation and telecom firms in the Gulf are the natural read-across. --- ## Health & Cyber **\[P1\]** [Hackers hit UNM hospital, then apologize and offer patients $2,500\. In a new statement, they reveal more about the incident.](https://databreaches.net/2026/11/02/hackers-hit-unm-hospital-then-apologize-and-offer-patients-2500-in-a-new-statement-they-reveal-more-about-the-incident/) — *DataBreaches.Net* Why it matters: The BYOD gang tells DataBreaches.net that it targeted the University of New Mexico and never knew its hospital would be hit, and offers up to $2,500 per affected patient while keeping the data. BYOD blames UNM for switching machines off and says hospital and university shared a network forest; these are a criminal group's claims, unverified, and The Record reports ambulances had to be diverted. BYOD has also listed Michigan State University, claiming 1.3 million records; the university reports only a potential credential compromise. Yesterday's brief carried the first account of this attack. severity high · exploited in the wild · EU: NIS2, GDPR, EHDS · actor BYOD (70%) [UK: Second Liverpool hospital investigates staff over breach of Southport attack patient records](https://databreaches.net/2026/11/02/uk-second-liverpool-hospital-investigates-staff-over-breach-of-southport-attack-patient-records/) — *DataBreaches.Net* Why it matters: A second Liverpool hospital is investigating possible staff access to medical records linked to the Southport attack, after similar cases elsewhere in the city. Liverpool Heart and Chest Hospital detected two potential instances, ITV reports through DataBreaches.net. Insider snooping harms victims directly and needs no attacker from outside, which is why EHDS access logging matters as much as perimeter defence. Excerpt-based. [\[Editorial\] Coasting on artificial intelligence safety](https://www.thelancet.com/journals/landig/article/PIIS2589-7500%2826%2900149-4/fulltext?rss=yes) — *The Lancet Digital Health* Why it matters: A Lancet Digital Health editorial argues that recent breaches by AI agents, including the hacking of a health scheme's statistics portal, demand more than existing safety practice. The journal says agents are evolving rapidly, potentially beyond human containment, whichever side one takes on existential risk. Its intervention brings the argument about agent oversight into clinical governance, where the AI Act treats medical AI as high-risk. Excerpt-based. **\[P3\]** [41,000 Connecticut Medicaid Recipients Affected by DHS Data Incident](https://www.hipaajournal.com/connecticut-dhs-husky-data-security-incident/) — *The HIPAA Journal* Why it matters: Connecticut's social services department reports that 41,000 Medicaid recipients' claims and payment data were exposed through a compromised provider reimbursement account. Gainwell Technologies, the fiscal agent, reported it on 25 June; the motive looks financial, though data theft cannot be excluded, and medical records and Social Security numbers were not involved, The HIPAA Journal reports. It is the second HUSKY incident this year, after 22,500 people in March. severity medium · EU: GDPR, EHDS **\[P3\]** [VU#203719: INFINITT PACS System Manager Contains Multiple Code Execution Vulnerabilities](https://kb.cert.org/vuls/id/203719) — *CERT Recently Published Vulnerability Notes* Why it matters: CERT/CC reports flaws in INFINITT PACS System Manager, a medical-imaging platform, that could let attackers run code on workstations; the vendor has fixed them and no exploitation is reported. CVE-2026-16305 lets a local low-privileged user gain administrative rights through a weakly protected update manifest, and CVE-2026-16306 runs functions through a crafted imodular:// link. Fixed in System Manager 3.0.12.3 and 3.0.12.5; neither is in CISA's KEV catalogue. severity medium · `CVE-2026-16305` · EU: MDR, NIS2, CRA --- ## Defence & National Security [Officials suspect Iran of cyberattacks on military base freezers](https://www.defenseone.com/threats/2026/11/officials-suspect-iran-series-cyberattacks-military-base-freezers/416992/) — *Defense One - All Content* Why it matters: US officials suspect Iran-linked hackers of attacks on freezers at around six military commissaries since late August, two people told Defense One, an assessment that could still change. Cyber Command and defence investigators are probing the outages, and French authorities are working with them. How the intruders got in is unclear. The report arrives as Washington is reportedly planning further strikes on Iran. No public evidence ties this to the European supermarket attacks, whose authors remain unknown, but it explains why those attacks are now being read as a possible hybrid threat. [These Are The U.S. Weapons Most At Risk In The Looming Rare Earths Supply Crisis](https://www.twz.com/news-features/these-are-the-u-s-weapons-most-at-risk-in-the-looming-rare-earths-supply-crisis) — *TWZ* Why it matters: A Special Competitive Studies Project paper counts more than 28,000 components in 1,400 US weapon systems containing antimony, gallium, germanium or tungsten, including 300-plus critical parts in Virginia-class submarines. The analysis uses data from Exiger, which sells supply-chain tools, and is timed to the November expiry of the suspension of Chinese export controls, TWZ reports. Japan's manufacturers have already felt an 80% cut in some supplies this year. European rearmament draws on the same sources; the EU's stockpiling and Critical Raw Materials Act targets face the same test. [Sweden’s Saab launches family of AI agents for future aircraft projects](https://breakingdefense.com/2026/11/swedens-saab-launches-family-of-ai-agents-for-future-aircraft-projects/) — *Breaking Defense* Why it matters: Saab has unveiled in-house AI agents for future aircraft after tests on a Gripen E, and will be a founding partner in Sferical AI, a Swedish compute initiative, to keep its data at home. The agents have mainly been tested in beyond-visual-range combat, Breaking Defense reports. A Saab executive says that otherwise it would have to go to Google or Amazon and might lack full control of its data. It is a clear case of European defence treating compute as a sovereignty matter, in the same programme space as Helsing's earlier Gripen flights. [NATO’s Crossed Swords Exercise Brings AI Agents Into Cyber Operations Training](https://www.securityweek.com/natos-crossed-swords-exercise-brings-ai-agents-into-cyber-operations-training/) — *SecurityWeek* Why it matters: NATO's CCDCOE Crossed Swords exercise in Estonia has added AI agents and OpenAI's Daybreak to joint cyber and kinetic training. Using a US lab's product inside NATO's flagship technical exercise shows how quickly commercial models are entering allied practice, and raises the question of who controls such tools in an operation. SecurityWeek's summary gives no further detail. Excerpt-based. --- ## Digital Sovereignty & Identity [Verhaltensscanner in Berlin: Verdrängung der Schwächsten](https://netzpolitik.org/2026/verhaltensscanner-in-berlin-verdraengung-der-schwaechsten/) — *netzpolitik.org* Why it matters: Berlin now runs behaviour-analysing video surveillance at Kottbusser Tor: 30 police cameras whose software looks for movements suggesting assault, and for people lying down. Netzpolitik's report notes that lying down is not an offence, and that the second class puts homeless people under added surveillance, while the area's most frequent offences are not targeted. Local voices, from a data-protection activist to social workers, describe displacement of the most vulnerable. It is a live case for where the AI Act's rules on police use and biometric categorisation stop. [Banks prepare for AI agents, but consumers hesitate to hand over control](https://www.biometricupdate.com/202611/banks-prepare-for-ai-agents-but-consumers-hesitate-to-hand-over-control) — *Biometric Update* Why it matters: A Signicat survey across nine European markets finds 95% of financial providers plan to support applications by authorised AI agents, but only 15% of consumers would let AI use their digital identity. Only 14% would let AI sign an application and 6% would let it open a savings account from start to finish, in a sample of 4,050 consumers and 450 providers, Biometric Update reports. The survey comes from an identity vendor with a stake in the answer. Its line between assistance and agency is the one that strong authentication and the EUDI Wallet will have to draw. [Hong Kong’s EnsembleTX pilot now supports 24/7 tokenized central bank money](https://www.ledgerinsights.com/hong-kongs-ensembletx-pilot-now-supports-24-7-tokenized-central-bank-money/) — *Ledger Insights – blockchain for enterprise* Why it matters: Hong Kong's tokenised-deposit pilot, EnsembleTX, now adds tokenised central bank money available around the clock for interbank settlement, alongside the RTGS channel. The Hong Kong Monetary Authority is settling tokenised bank deposits between banks in central bank money at all hours, Ledger Insights reports. It is a close comparison for the ECB's Pontes and Appia work on wholesale settlement, which aims at the same problem under a stated goal of strategic autonomy. Excerpt-based. [4 age check methods for the UK’s under-16 social media ban](https://identityweek.net/4-age-check-methods-for-the-uks-under-16-social-media-ban/) — *Identity Week* Why it matters: The UK's under-16 social media ban, expected in March, would rest on Ofcom's list of highly effective age checks: photo ID, digital ID, bank checks and facial age estimation. The government will set out how the ban works by the end of 2026, and Ofcom will then consult, Identity Week reports. Ofcom estimates that 94% of people aged 16 and over have a passport or driving licence. The piece is written around a trade event, but the method list matters for the EU's Kids Act debate and for wallet-based checks like those in Greece. --- ## Quantum & Cryptography [IDEMIA secure transactions enables banks to prepare cards for the quantum era with industry-first certification](https://identityweek.net/idemia-secure-transactions-enables-banks-to-prepare-cards-for-the-quantum-era-with-industry-first-certification/) — *Identity Week* Why it matters: IDEMIA says EMVCo has certified a Java Card payment platform with a hardware post-quantum accelerator and crypto-agility, a step towards quantum-resistant offline card payments. This is a company press release, including its 'industry-first' claim, which we have not verified. Cards stay in circulation for years on limited hardware, so those issued now will have to survive the transition. It shows migration reaching payment hardware, a practical link in the plans European banks face under the EU's post-quantum roadmap. --- ## Cybersecurity & Threats **\[P1\]** [Europe’s supermarkets hit by new wave of cyberattacks targeting fridges](https://www.politico.eu/article/new-supermarket-hack-in-belgium-sweden-luxembourg/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Cybersecurity and Data Protection – POLITICO* Why it matters: A second wave of remote attacks on supermarket refrigeration controls hit stores in at least six EU countries on Monday, three weeks after France, with temperatures set as high as 50°C and food thrown away. Belgium, Luxembourg, Sweden, Ireland, the Netherlands and Estonia reported incidents, involving Delhaize, Carrefour, Spar, ICA, Coop and SuperValu; no chain reports more than several dozen stores, POLITICO and The Hacker News say. Danfoss says its products were involved, and a butcher names Copeland too. Nobody has claimed it. Researchers disagree on whether this is a hostile state or a copycat, and Belgium's cyber centre says the authors may never be identified. severity high · exploited in the wild · EU: NIS2, CRA **\[P2\]** [Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years](https://www.ncsc.gov.uk/news/cyber-chief-uk-facing-ai-powered-attacks-on-critical-infrastructure-in-two-years) — *All Feed* Why it matters: Britain's NCSC warns of the real prospect of an unprecedented rise in incidents, and judges it highly likely that AI-powered malware will feature in a ransomware attack on critical infrastructure by 2028. NCSC chief Richard Horne says AI did not invent new attacks but exposes tolerated weaknesses at new scale; officials concede that a matching rise in exploitation has not yet been observed, The Record reports. A companion assessment sets out three scenarios to 2028, with China and Russia the greatest threats, and stresses that they are not predictions. London is consulting on liability for insecure products. severity high · EU: NIS2, CRA, AI Act **\[P2\]** [Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies](https://krebsonsecurity.com/2026/11/tech-firms-dismantle-botnet-that-turned-1-3m-tv-boxes-into-proxies/) — *Krebs on Security* Why it matters: Google and partners disrupted XCPE, a botnet of more than 1.3 million Android TV boxes, and Google says the Chinese manufacturer Videostrong built in the malware and sold criminals access. Google's threat team says the malware, which also reached telehealth devices and digital signage, rented out home connections through residential proxy services; the action may sever access to more than 10 million further systems, experts told Krebs. Proxy SDKs named include AppSalt, or Honeygain, owned by Vilnius-based Oxylabs, which did not respond. Google has cut ties with Videostrong; the claims are Google's. severity high · exploited in the wild · EU: CRA, NIS2, DSA · actor Videostrong Technology (per Google) (60%) **\[P1\]** [Max-severity bug in widely used OT programming tool exploited to deliver Linux malware](https://www.theregister.com/security/2026/11/02/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware/5307086) — *www.theregister.com - Articles* Why it matters: Attackers are exploiting a maximum-severity missing-authentication flaw in Node-RED on Siemens SIMATIC IoT2050 Advanced gateways to install a Linux bot, VulnCheck reports from its honeypots. CVE-2026-58115 lets an unauthenticated attacker create flows that run commands with maximum privileges; Siemens fixed it in August in version 4.3.4.1\. VulnCheck saw exploit attempts from 30 October against its canaries, not confirmed victims; it was not in CISA's KEV catalogue on 3 November, and EPSS is about 0.01. severity critical (CVSS 10.0) · exploited in the wild · EPSS 0.00953 · `CVE-2026-58115` · EU: NIS2, CRA **\[P2\]** [Nuclear threats and street brawls: Russia, Ukraine report attacks on their emergency alert apps](https://www.theregister.com/security/2026/11/02/nuclear-threats-and-street-brawls-russia-ukraine-report-attacks-on-their-emergency-alert-apps/5306901) — *www.theregister.com - Articles* Why it matters: Attackers sent fake missile and nuclear alerts through Ukraine's and Russia's emergency apps within hours of each other on Sunday, and both governments told citizens to rely on official channels. Ukraine's Air Force said its Air Alert app was likely compromised and that there was no radiation threat; Russia's emergencies ministry confirmed a massive attack on its app, saying the national alert systems were unaffected, The Register reports. Who did it is not established, and the timing around a Kherson ceasefire is unexplained. severity high · exploited in the wild · EU: NIS2, CER [Amadeus discloses data exposure incident affecting APAC airlines](https://www.biometricupdate.com/202611/amadeus-discloses-data-exposure-incident-affecting-apac-airlines) — *Biometric Update* Why it matters: Spanish travel-technology group Amadeus disclosed a breach exposing booking data of Asian airlines including JAL, ANA, Korean Air and Cathay Pacific, with passport numbers in about 2,000 cases. JAL counts 92,000 records from August 2023 on; Cathay says access came through credentials for a system account, while Amadeus describes a vulnerability in a booking display environment and says no payment data was accessed, Biometric Update reports. Amadeus is an EU-based central provider for global aviation, so GDPR and NIS2 questions apply, and it is also seeking to expand its share of the market.