Global Cybersecurity Risk Briefing

01 / Daily Analysis

Back to the four-story overview ↑

UK NCSC warns AI could intensify ransomware risks to essential services

Published in this issue:2026.11.04 00:22 HKT

Facts

In an assessment published on 3 November, the UK National Cyber Security Centre said an AI-powered malware ransomware attack on UK critical national infrastructure by 2028 is highly likely. It also assesses that criminal adoption of AI will likely increase the scale and efficiency of ransomware, social engineering and vulnerability exploitation. This is a risk assessment, not confirmation that the specific forecast attack has occurred.

Analysis

Our analysis: although the report focuses on the UK, organisations responsible for essential services can review existing weaknesses and recovery capacity. Potential changes in attack speed and scale do not replace the basics of patching, access control and tested backups.

Suggested Actions

• Inventory essential services and internet-facing systems, prioritise known vulnerabilities and restrict access to management interfaces.
• Keep offline or immutable backups of important data, and regularly test recovery and continuity arrangements.
• Review the data and account permissions accessible to AI tools, and monitor unusual sign-ins and access.

Scope：UK; related protective measures also apply elsewhere · Research reports

Event date：2026-11-03

Source

• UK National Cyber Security Centre · Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years· Source published 2026-11-03 · Verified at 2026.11.04 00:22 HKT
• UK National Cyber Security Centre · Artificial intelligence and cyber intrusion· Source published 2026-11-03 · Verified at 2026.11.04 00:22 HKT

02 / Daily Analysis

Back to the four-story overview ↑

AWS patches template injection in Virtual Engineering Workbench; redeploy affected installations

Published in this issue:2026.11.04 00:28 HKT

Facts

On 2 November, AWS disclosed CVE-2026-119085. Under the stated conditions, an authenticated remote user could execute code through the publishing component with its Lambda IAM role permissions, potentially accessing data and resources across tenant projects. Commits before the fix, c146486, are affected.

Analysis

Our analysis: teams using or deriving this open-source platform should check the deployed code revision and product-version permissions. A fix in the main branch does not mean every fork or derivative has been updated.

Suggested Actions

• Redeploy from the latest main branch and ensure forks and derivative code include the fix.
• Until redeployment, restrict who can create or update product versions; AWS says this does not fully remove the issue.

Scope：Organisations using the affected software · Vulnerability advisories

Event date：2026-11-02

Source

• Amazon Web Services · CVE-2026-119085: Template injection in the publishing component of Virtual Engineering Workbench· Source published 2026.11.03 01:30 HKT · Verified at 2026.11.04 00:27 HKT

03 / Daily Analysis

Back to the four-story overview ↑

AWS SDK for pandas fixes an Iceberg write issue: check versions and data permissions

Published in this issue:2026.11.04 00:28 HKT

Facts

On 2 November, AWS disclosed CVE-2026-119301, affecting awswrangler versions from 3.5.2 up to, but not including, 3.17.1. An authenticated user permitted to modify AWS Glue Data Catalog metadata could exploit a crafted column name to read tables accessible to a more privileged principal or write to the table that principal is updating. Version 3.17.1 was released on 3 August.

Analysis

Our analysis: teams using shared catalogues and data jobs with different privileges should check both the library version and who can modify metadata, so lower-privileged input cannot affect higher-privileged jobs.

Suggested Actions

• Upgrade to the latest applicable AWS SDK for pandas release and ensure derivative code includes the fix.
• Restrict glue:UpdateTable and related permissions on shared databases. Before upgrading, follow AWS guidance on avoiding a to_iceberg() principal with greater privileges than those who can modify the metadata.

Scope：Organisations using the affected software · Vulnerability advisories

Event date：2026-11-02

Source

• Amazon Web Services · CVE-2026-119301: Apache Iceberg SQL identifier generation in AWS SDK for pandas· Source published 2026.11.03 00:30 HKT · Verified at 2026.11.04 00:27 HKT

This article was prepared with assistance from SI agents. Factual summaries, vendor claims and Anti-Ransomware analysis are presented separately. It provides general information and education, not professional advice for a particular environment. Completeness, timeliness, accuracy and product security are not guaranteed, nor are prevention, decryption or recovery. Check the original sources and consult qualified professionals about your environment. Inclusion does not imply certification, endorsement or partnership. Trademarks and rights to original text belong to their respective owners.