Claude, you've got company.

Claude Dispatch opens the door to hijacking. Residential proxies turn up on White House networks. Asian airlines suffer a wave of data breaches. Cisco and WatchGuard roll out critical patches. GhostMap traps Android phones in endless reboot loops. Hackers exploit a Zyxel zero-day to compromise nearly a thousand devices. Ukraine's scam call center crackdown ensnares senior security officials. AI-powered scammers prey on owners of missing pets. A former U.S. government IT worker admits to spying for Ethiopia. Our guest is Rebecca Krauthamer, CEO and co-founder of QuSecure, with insights on the NIST PQC roadmap. Voters pull the plug on data centers.

Today is Thursday November 5th 2026. I’m Dave Bittner. And this is your CyberWire Intel Briefing.

Claude Dispatch proves vulnerable to being hijacked. 

A security researcher has uncovered a vulnerability in Anthropic’s Claude that could allow a malicious browser extension to execute commands on a user’s computer, or even another machine connected to the same account. Forever Security’s Gal Weizman discovered that Claude Dispatch, which lets users remotely control Claude Desktop, could be hijacked through an authenticated browser session. His proof-of-concept attack tricked Claude into installing a malicious npm package while automatically approving permission requests. Weizman says the underlying design weakness also affects Claude Cowork and Code Remote Control, potentially allowing attackers to move from personal devices into corporate environments. Anthropic acknowledged the vulnerability in May but reportedly has not fixed it. The researcher warns that Claude’s convenient cross-device connectivity comes at the expense of traditional browser security boundaries.

Not even the White House is immune to residential proxies. 

Security researchers say computers connected to the White House network are running residential proxy services that allow outsiders to rent their internet addresses. Layer3 Intel detected proxy activity on 26 of 30 days, recording 236 connections through six White House IP addresses. Researchers identified 28 proxy services using the network, including Infatica, a Russian company whose founder previously operated hosting infrastructure linked to Russian attacks on U.S. election systems in 2016. Residential proxies are often bundled into free applications, sometimes without users realizing their devices are being used. The services can enable cybercrime and potentially expose internal networks to attack. Researchers warn that anyone willing to pay a few dollars could route internet traffic through White House IP addresses. The White House has not commented.

Asian airlines report customer data breaches. 

At least six Asian airlines have reported customer data breaches stemming from a cyberattack on Spanish technology provider Amadeus, which operates reservation, ticketing, and check-in systems. Affected carriers include Japan Airlines, Cathay Pacific, Korean Air, Asiana, Singapore Airlines, and Malaysia Airlines. Japan Airlines reported 92,000 affected customers, Cathay Pacific 53,000, and Singapore Airlines 46,000. Exposed information includes passenger names, booking details, travel itineraries, and, in some cases, passport information and frequent flyer numbers. Cathay Pacific says attackers used credentials assigned to an Amadeus system account. Amadeus says it has addressed the vulnerability and found no evidence that financial information was accessed or ransomware was involved. The airlines say their own systems and operations remain unaffected. Singapore Airlines is changing exposed booking numbers and warning customers about phishing attempts.

Cisco and WatchGuard patch serious vulnerabilities. 

Cisco and WatchGuard have released patches for several serious vulnerabilities, including remote code execution and authentication flaws. WatchGuard addressed four critical bugs, although patches remain unavailable for a Linux kernel vulnerability affecting its Dimension platform. Cisco fixed a high-severity flaw in UCS Central Software and confirmed that 19 products are affected by the actively exploited Brotli vulnerability known as Node2Shell. Meanwhile, SonicWall warned that two vulnerabilities in its discontinued Global Management System platform will remain unpatched. Neither Cisco nor WatchGuard reports exploitation of their newly patched flaws.

GhostMap disables Android phones through a specially crafted app. 

Bitdefender researchers have discovered an Android vulnerability called GhostMap that could render phones unusable simply by installing a specially crafted app. The app requires no permissions or executable code. Instead, malformed file information causes a core Android system process to repeatedly crash, trapping the device in a reboot loop. Neither restarting nor safe mode resolves the problem, potentially leaving a factory reset, and the resulting loss of locally stored data, as the only recovery option. Researchers reproduced the flaw on Android 17 and say it affects versions dating back to Android 10. The vulnerability could theoretically enable extortion or interfere with malware detection, although no exploitation has been observed. Google acknowledged the report but declined to issue a security update, referring it for possible future consideration.

A recently patched Zyxel vulnerability compromises nearly 1,000 devices. 

Researchers at Binarly say a recently patched vulnerability in Zyxel GS1900 switches was exploited as a zero-day to compromise nearly 1,000 devices. The flaw allows unauthenticated attackers to execute operating system commands through specially crafted HTTP requests. The attacks, attributed to Chinese threat actor Red Heron, were initially believed to exploit a different Zyxel vulnerability. Binarly determined the hackers were actually exploiting the previously unknown flaw, rendering earlier patches ineffective. Zyxel released fixes on October 23, covering ten affected switch models.

Senior Ukrainian security officials are fired after a scam call center probe. 

Ukraine's security service has dismissed two senior officials amid an expanding corruption investigation into a criminal network allegedly paying law enforcement officers to protect fraudulent call centers. Investigators say the organization included at least 12 people, among them senior security officials, prosecutors, police officers, and organized crime figures. The group's alleged activities extended beyond online scams to drug trafficking, counterfeiting, kidnappings, and violence. During one search, investigators say a senior security official threatened them with a firearm. The investigation, dubbed Operation Carthage, follows earlier allegations that prosecutors accepted bribes to shield scam operations targeting victims in Ukraine and abroad. The scandal has prompted Ukraine's parliament to approve tougher penalties for operating fraudulent call centers, with potential prison sentences of seven to twelve years.

UK scammers target missing pets. 

Scammers in Britain are using AI-generated images of missing pets to extort desperate owners, sometimes threatening to kill the animals unless they receive payment. When Stephanie Young's cat Buddy disappeared, a supposed rescuer sent convincing pictures and demanded Apple gift cards. After Young questioned the images, the scammer threatened to murder or sell her cat. Other victims report similar experiences, including one woman whose supposed rescuer demanded £40,000 for her missing cat. Fraudsters create elaborate backstories and convincing images to exploit owners' emotional vulnerability, often demanding payment before agreeing to return the animals. British authorities advise owners to verify claims by requesting live video or arranging an in-person meeting before paying. Experts warn that AI has made these scams remarkably easy to produce, while the urgency and emotional distress surrounding a missing pet make victims particularly susceptible.

A former U.S. government IT worker pleads guilty to spying for Ethiopia. 

A former U.S. government contractor with Top Secret clearance has pleaded guilty to spying for Ethiopia. Abraham Teklu Lemma, a 53-year-old naturalized American citizen from Maryland, worked across several federal agencies, including the State and Justice Departments. Prosecutors say he accessed classified intelligence reports without authorization, copied information from at least 133 reports, and smuggled documents out of secure facilities on discs disguised as containing unclassified material. He transmitted sensitive intelligence to senior Ethiopian military, political, and intelligence officials through encrypted messaging and personal storage devices. According to the FBI, Ethiopian officials used the information in military operations during an ongoing conflict. Investigators also identified more than $66,000 in bank deposits during the period. Lemma has agreed to a prison sentence ranging from 10 years to nearly 22 years.

 

Voters pull the plug on data centers. 

America's data center industry had a rough election night. Across the country, candidates campaigning against massive computing facilities scored victories, as voters expressed frustration over electricity costs, noise, pollution, and the expanding influence of artificial intelligence. Democrats Sherrod Brown in Ohio and Chris Pappas in New Hampshire were among the winners, while candidates dubbed “Data Center Derek” and “DC Derrick” weren't so fortunate. In Texas and Georgia, newly elected governors have advocated pausing data center construction, potentially complicating hundreds of planned projects. Local ballot measures also reflected growing resistance to development. Industry-backed candidates lost several races despite substantial financial support. The backlash crossed party lines, suggesting that enthusiasm for AI infrastructure isn't necessarily shared by the communities expected to host it. And as the returns came in, Elon Musk suggested that data centers in space were looking increasingly appealing. Apparently, the zoning regulations are more accommodating up there.

And that’s the CyberWire.

For links to all of today’s stories, check out our Daily Briefing at the cyberwire dot com.

 

We’d love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com

 

N2K’s lead producer is Liz Stokes. We’re mixed by  Tré Hester, with original music by and sound design Elliott Peltzman. Our contributing host is Maria Varmazis. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. And I’m Dave Bittner. Thanks for listening.