Weekly Cybersecurity Recap: Critical CVEs, Linux Botnet, Device-Code Phishing, and Android Spyware

The week of November 2, 2026, saw several significant cybersecurity incidents reported across different platforms and vectors. Among the notable events were the exploitation of critical Common Vulnerabilities and Exposures (CVEs) affecting various software, the active operation of a Linux-based DDoS botnet, campaigns abusing the Microsoft device-code phishing flow, the distribution of Android spyware disguised as legitimate applications, and attacks targeting devices protected with no or default passwords.

Critical CVEs were exploited in the wild, though specific CVE identifiers and affected products were not detailed in the recap. Exploitation of these vulnerabilities likely allowed unauthorized access, privilege escalation, or remote code execution depending on the affected software.

A Linux DDoS botnet was observed operating, compromising poorly secured devices to generate volumetric traffic. The botnet targeted Linux systems, potentially leveraging weak credentials or unpatched services to gain footholds.

Device-code phishing campaigns were reported, exploiting the Microsoft authentication flow. These attacks typically involve tricking a victim into entering a code on a legitimate-looking page, granting the attacker access to the account without needing the password. Targets were primarily enterprise accounts.

Android spyware was distributed, though specific malware families or distribution channels were not identified in the recap. The spyware likely aimed to exfiltrate data, monitor activity, or gain unauthorized access to device functions.

Additionally, attacks leveraging devices with no password protection were reported, emphasizing the risk of unsecured hardware access, particularly in organizational settings where devices may be lost or shared.