Someone asked me this week to look at their telly because “it’s gone a bit slow”. I looked at the £30 box tucked behind it and decided some questions are best left unasked. The Premier League was on, so I said it seemed fine.

The free football was never free

Google has disrupted the XCPE Android botnet, which had around a million devices on its books, and banned the TV box maker responsible. The box was cheap because you were never the customer. You were the premises.

Banning the manufacturer is satisfying, but the boxes are still humming away behind a million sofas, patient as houseguests who haven’t been told the party is over. Somebody will ask them for something eventually. They always do.

https://www.bleepingcomputer.com/news/security/google-disrupts-million-device-xcpe-android-malware-botnet-bans-tv-box-maker/

Nobody hacked the air raid system

Fake nuclear threat alerts were sent to citizens in both Ukraine and Russia. The attackers didn’t break the alert system. They found what the app was willing to believe and fed it exactly that. The alert even named the missile, which is the sort of detail you only get from someone who takes pride in their work.

I’m part disgusted and part admiring of the thoroughness. Most phishing emails can’t spell the name of the company they’re pretending to be.

Hackers Send Fake Nuclear Threat Alerts to Ukrainian and Russian Citizens

The White House has a spare room

Some White House devices have been subletting their IP addresses to strangers for a few dollars a time. The guests checked in and out 236 times, and nobody noticed until now.

Every landlord knows the first rule is to check who’s actually living there. Apparently the most secure address in the world hadn’t read the tenancy agreement. At least the Airbnb reviews would have been interesting.

https://krebsonsecurity.com/2026/11/want-to-rent-an-internet-address-at-the-white-house/

Security by sternly worded folder name

A tobacco company’s secret recipes sat on a file share open to every employee. The attackers’ Metasploit made a racket, and the antivirus heard nothing. But the folder was marked confidential, so that’s all right then.

It’s the “Wet Paint” sign of access control. It works on everyone who was never going to touch the wall anyway.

https://www.theregister.com/security/2026/11/05/tobacco-company-got-smoked-by-leaving-secret-recipes-on-a-file-share/5307704

The bloke in hi-vis got there first

Updating WordPress is when the builders take your front door off. CVE-2026-119977 is the bloke in hi-vis who turned up before they did, swapped the locks and invoiced you for it. Nobody questions a hi-vis jacket, which is rather the point.

I admire the timing. Patching is the one bit of advice we’ve shouted for twenty years, and someone has found a way to make it the way in.

https://cybersec.picussecurity.com/s/cve-2026-119977-when-updating-wordpress-becomes-the-vulnerability-30308

That’s your lot. If you’ve got a drawer full of old devices that still check in with someone, hit reply and tell me. I’ll pretend to be shocked. You can also find me on the socials sometimes, where I’m equally unreliable but shorter.

Javvad