A million TV boxes shipped already compromised, and Google blames the maker

Evening edition, Wednesday 4 November 2026

Google has dismantled the XCPE botnet of more than 1.3 million Android TV boxes and blames the manufacturer, which it says built the backdoor into the firmware. Also: the NCSC annual review, how Binance's record theft began, and an exploited WordPress flaw.

Sources

• Google Threat Intelligence Group: Shutting the Door on the XCPE Botnet
• The Record: Google dismantles botnet hidden in Android TV boxes
• NCSC: Cyber chief says UK facing AI-powered attacks on critical infrastructure within two years
• CNBC: Binance co-CEO Richard Teng says hackers used fake job interviews to steal $6.3 billion
• BleepingComputer: CISA flags WordPress RCE flaw as actively exploited in attacks

Read the written version