Synology NAS ransomware, stolen keys running up $100K AI bills | Cyber Security News Nov 3
Show notes
Ransomware is encrypting outdated Synology NAS boxes, attackers are running up six-figure AI bills with stolen cloud keys, and Trigger.dev customers need to rotate their secrets. Plus a Langflow login bypass, coding agents installing abandoned MCP servers, and a second wave of supermarket freezer attacks across Europe. Every version number and every fix in this episode was checked against the vendor's advisory or the CVE record before it aired. Today's question: Who in your shop finds out first when a cloud bill jumps overnight? Reply in the comments or at [email protected].
1. Ransomware hits outdated Synology NAS boxes - CVE-2024-10441, CVE-2026-13639, CVE-2026-13684 - Fixed: 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, 7.2.1-69057-12 - Do: Update Synology DSM and close its admin page - https://www.synology.com/en-global/security/advisory/Synology_SA_24_20
2. Stolen cloud keys run up $100K-a-day AI bills - Do: Alert when someone switches on cloud AI services - https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models/
3. Trigger.dev customers' secrets exposed - Do: Rotate every secret you keep in Trigger.dev - https://trigger.dev/blog/security-incident-nov-2026
4. Langflow fixes critical login bypass and RCE - CVE-2026-93680, CVE-2026-110186 - Fixed: 1.13.0 - Do: Upgrade Langflow and turn off auto-login - https://www.ibm.com/support/pages/node/7294467
5. Coding agents install unmaintained MCP servers - Do: Keep an approved list of MCP servers - https://www.glow.io/blogs/mcphantom-ai-coding-agents-are-installing-vulnerable-deprecated-mcp-servers-from-training-data
6. Update: freezer attacks hit six more countries - Do: Take vendor-managed controllers off the internet - https://censys.com/blog/european-refrigerator-controller-redux-a-new-wave-of-refrigeration-attacks/