by sig9
Hacker Wars - November 03, 2026
Your daily dose of infosec chaos
Schools are having a rough week: a UK school estate got ransomed by a crew that may have let an AI model drive parts of the intrusion, and a US education vendor leaked data on over a million people. Meanwhile the patch queue is stacked - a 9.8-rated Linux TCP bug, a Node-RED flaw under live attack, and 200-plus Android fixes. Grab coffee and open your ticketing system.
3AM Ransomware Hits UK Schools With A Little Help From AI
A 3AM affiliate slipped in through an unmanaged host and encrypted around 37 of the nearly 50 machines it reached across a UK school estate. Researchers spotted commands being written and rewritten mid-attack, a hallmark of a model improvising on the job - not fully autonomous hacking, but close enough to be uncomfortable.
What to do: Hunt down unmanaged hosts on your network and segment aggressively - one forgotten machine was the entire foothold here.
Red Hat Ships Fix For 9.8-Rated Linux TCP RCE
A use-after-free in the kernel’s IPv4 TCP stack gives remote attackers a shot at code execution, and patched kernels are now out for Red Hat Enterprise Linux 8, 9, and 10. Ubuntu users are less lucky: fixes for the three newest LTS releases are still stuck in the opt-in testing channel with no date for a regular update.
What to do: Patch your RHEL fleet now; on Ubuntu, pull from the testing pocket or mitigate - do not sit around waiting for the regular update.
Node-RED Flaw Under Active Attack Right Now
Attackers are hammering a critical Node-RED vulnerability from a single IP, dropping Linux bots and webshells on exposed instances. Node-RED runs the automation flows in a lot of labs, homes, and industrial setups, which makes it a nice quiet pivot point - and “quiet” is exactly what a webshell wants.
What to do: Update Node-RED immediately and make sure its editor UI is not reachable from the public internet.
Android November Update Squashes Over 200 Flaws
Google’s November 2026 patch batch fixes more than 200 vulnerabilities, including a critical Framework bug that gives remote code execution with zero user interaction. No tap, no link, no unlucky click - just a device that answers the phone at the wrong time. Everyone’s favorite kind of vulnerability.
What to do: Apply the November security update as soon as your OEM ships it, and check that your MDM actually covers every managed device.
Frontline Education Breach Impacts Over 1.3 Million
Attackers exploited a flaw in third-party software to steal personal information on school district staff and students from education vendor Frontline. Education suppliers keep getting popped, and the loot is exactly the kind of PII - kids, teachers, staff - that powers spear-phishing and identity fraud for years.
What to do: If your district uses Frontline, assume the PII is exposed - warn staff about targeted phishing and consider credit freezes for affected families.
Until next time, may your logs be clean and your alerts be false positives.
Brought to you by sig9 - sig9.ch | Protecting the unseen, securing the unknown
This bulletin is provided for informational purposes. Contact us for tailored security analysis.