A hijacked analytics script, and the phones it quietly emptied
Notas do episódio
Evening edition, Friday 6 November 2026
Sekoia says a Russian-linked group used a hijacked analytics script to push patched-bug exploits at iPhones and Android phones. The lesson for UK organisations is what they let their own web pages load. Plus an exploited WordPress updater flaw and the NCSC's annual review.
Sources
- Sekoia: Poisoned Source, APT29 watering holes target mobile devices with n-day exploits
- BleepingComputer: Hackers use n-day exploits in zero-click attacks on iOS, Android devices
- SecurityWeek: Russia-linked hackers hit iOS, Android devices with exploit chains via watering holes
- WordPress 7.1.4 security release
- CISA: Adds One Known Exploited Vulnerability to Catalog (3 November 2026)
- NCSC: Cyber chief says UK facing AI-powered attacks on critical infrastructure in two years