Siemens IoT2050 Flaw Allows Unauthenticated Remote Code Execution

Critical·Exploited·CVSS 10.0New Siemens IoT2050 Flaw Allows Unauthenticated Remote Code Execution Active exploitation targets a critical flaw in Siemens IoT2050 allowing unauthenticated remote code execution. Do this today Apply vendor patches for CVE-2026-58115. Read the full story ↓
High·CVSS 9.3New Barracuda Vulnerabilities: Chaining Flaws Allows Root Access Chaining two Barracuda vulnerabilities could allow an attacker to bypass authorization and gain root access. Read the full story ↓
High·10 outletsNew Google Dismantles XCPE Botnet Using 1.3M Android TV Boxes Industry partners dismantled a botnet utilizing over 1.3 million Android TV boxes for advertising fraud. Do this today Review all connected Android IoT devices for unusual outbound network traffic patterns. Read the full story ↓

From the editor

Defenders should prioritize Siemens IoT2050 due to active exploitation enabling unauthenticated remote code execution. Additionally, assess Barracuda deployments for potential root access via chained vulnerabilities. Monitor for botnet activity involving Android TV boxes.

Anmol Singh YadavEditor, PwnSpectrum

Actively Exploited 4

Siemens IoT2050 Flaw Allows Unauthenticated Remote Code Execution Critical·Exploited·CVSS 10.0·The Hacker NewsNewRead Active exploitation targets a critical flaw in Siemens IoT2050 allowing unauthenticated remote code execution.
Active exploitation is targeting a maximum-severity flaw in Siemens SIMATIC IoT2050 Advanced devices. The vulnerability, CVE-2026-58115, permits unauthenticated remote code execution due to missing authentication for a critical function.

Why it matters. Successful exploitation allows an unauthenticated remote attacker to run arbitrary code on the affected device.

Do this today Apply vendor patches for CVE-2026-58115.

Affected
Siemens SIMATIC IoT2050 Advanced devices

CVE
CVE-2026-58115

Read on The Hacker News Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.9,"freshness":0.583,"importance":1,"novelty":1,"quality":0.8,"total":0.821}
```
BTCPay Server: Hot Wallet Thefts Target Outdated Instances Critical·Exploited·BTCPay Server via BleepingComputerNewRead Outdated BTCPay Server instances are being targeted by attackers draining hot wallets of Bitcoin and Litecoin.
Attackers have been draining hot wallets on instances running older versions of BTCPay Server. The attack vector was identified targeting versions 2.4.1 or earlier.

Why it matters. Unpatched instances increase the risk of unauthorized cryptocurrency withdrawals from self-hosted payment processors.

Do this today Update BTCPay Server to version 2.4.7

Affected
BTCPay Server versions 2.4.1 or earlier

Read the original · BTCPay Server Post on X LinkedIn

Summarised from BleepingComputer; also covered by The Hacker News.
```
{"coverage":0.613,"evidence":0.9,"freshness":0.389,"importance":0.75,"novelty":1,"quality":0.95,"total":0.776}
```
Frontline Education Data Breach Affects Over 1.3 Million Records Critical·Exploited·Frontline Education via SecurityWeekNewRead Hackers exploited a third-party software flaw to steal personal data from school staff and students.
Hackers exploited a vulnerability in third-party software to gain unauthorized access to Frontline's environment. The breach compromised personal information from both school district staff and students.

Why it matters. The exposed data includes names, SSNs, dates of birth, and government ID numbers, representing a significant privacy risk.

Affected
Frontline Central and School Health Management products

Read the original · Frontline Education Post on X LinkedIn

Summarised from SecurityWeek.
```
{"coverage":0.387,"evidence":0.9,"freshness":0.748,"importance":0.75,"novelty":1,"quality":0.9,"total":0.773}
```
CISA Adds WordPress Core TOCTOU Vulnerability to KEV Catalog Critical·Exploited·CVSS 8.1·CISANewRead CISA added CVE-2026-119977, a TOCTOU race condition in WordPress Core, to the KEV Catalog.
CISA added CVE-2026-119977, a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in WordPress Core, to its Known Exploited Vulnerabilities Catalog. This vulnerability has been added based on evidence of active exploitation.

Why it matters. Active exploitation of this vulnerability poses a significant risk to exposed assets. Organizations should prioritize remediation for KEV Catalog vulnerabilities.

Affected
WordPress Core

CVE
CVE-2026-119977

Read on CISA Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.9,"freshness":0.697,"importance":0.75,"novelty":1,"quality":0.95,"total":0.773}
```

Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices

Google Threat Intelligence Group (GTIG), via Krebs on Security

Vulnerabilities & Patches 4

Barracuda Vulnerabilities: Chaining Flaws Allows Root Access High·CVSS 9.3·The Hacker NewsNewRead Chaining two Barracuda vulnerabilities could allow an attacker to bypass authorization and gain root access.
Two vulnerabilities were disclosed affecting Barracuda products. Combining a pre-authentication authorization bypass flaw and a command injection vulnerability could lead to root access.

Why it matters. Exploitation allows attackers to bypass authorization controls and achieve root-level access on susceptible devices.

Affected
Barracuda products

CVE
CVE-2026-116606

Read on The Hacker News Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.7,"freshness":0.778,"importance":0.75,"novelty":1,"quality":0.8,"total":0.716}
```
Linux Kernel RCE (CVE-2026-98432) Affects MPTCP and TCP Connections Critical·PoC public·CVSS 9.8·5 outlets·Fortinet PSIRT via BleepingComputerDay 3NewRead A use-after-free flaw in the Linux kernel's IPv4 TCP code allows unauthenticated remote root code execution.
A use-after-free vulnerability exists in the Linux kernel's IPv4 TCP networking code, tracked as CVE-2026-98432. This flaw is triggered by a race condition during TCP connection request handling. Exploitation can lead to unauthenticated remote root command execution.

Why it matters. The vulnerability affects core TCP functionality and can be triggered by both MPTCP listeners and ordinary TCP connections. Successful exploitation grants root access without authentication.

Do this today Install updated kernel packages from distribution vendors or implement nftables rules to block IPv4 TCP packets containing IP options.

Affected
Linux kernels (4.4 and later), Ubuntu, RHEL, Rocky Linux, Debian

CVE
CVE-2026-31695, CVE-2026-98432
1. Fri 30 OctLinux Kernel TCP Flaw (CVE-2026-98432) Allows Root Command Execution
2. Sat 31 OctLinux Kernel Flaw (CVE-2026-98432) Allows Remote Root Execution
3. TodayLinux Kernel RCE (CVE-2026-98432) Affects MPTCP and TCP Connections
Read the original · Fortinet PSIRT Post on X LinkedIn

Summarised from BleepingComputer; also covered by Fortinet PSIRT, The Hacker News.
```
{"coverage":1,"evidence":0.7,"freshness":0.028,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.708}
```
CryptoPayment Gateway Plugin Vulnerability Allows Unauthenticated File Deletion High·CVSS 10.0·The Hacker NewsNewRead Unauthenticated exploitation of the CryptoPayment Gateway plugin allows file deletion and data extraction.
Threat actors are exploiting CVE-2026-81648 in the CryptoPayment Gateway WordPress plugin. This vulnerability allows unauthenticated users to delete arbitrary files on the server and extract data.

Why it matters. Exploitation permits unauthorized data exfiltration and file system modification on compromised WordPress installations.

Do this today Verify and update the CryptoPayment Gateway plugin to a patched version.

Affected
CryptoPayment Gateway WordPress plugin

CVE
CVE-2026-81648

Read on The Hacker News Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.7,"freshness":0.583,"importance":0.75,"novelty":1,"quality":0.8,"total":0.696}
```
Barracuda Warns of Flaws Allowing Root Access to ESG Devices Medium·BleepingComputerNewRead Barracuda issued warnings regarding two vulnerabilities allowing root access to ESG devices.
Two vulnerabilities were identified in Barracuda ESG. CVE-2026-116606 allows modification of global configuration via authentication weakness. CVE-2026-111560 permits OS command injection running as root with admin access.

Why it matters. Successful exploitation of both flaws could allow an attacker to bypass authorization controls and achieve root access to the device.

Do this today Apply security patches for CVE-2026-116606 and CVE-2026-111560.

Affected
Barracuda Email Security Gateway (ESG)

Read on BleepingComputer Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.759,"importance":0.75,"novelty":1,"quality":0.95,"total":0.554}
```

Worth watching

Tool demo 🍍📟 [PAYLOAD] 🔴 Hak5 Live: WiFi Pineapple Pager with Darren Kitchen Hak5 · 3 Nov

Malware & Ransomware 1

Google Dismantles XCPE Botnet Using 1.3M Android TV Boxes High·10 outlets·Krebs on SecurityNewRead Industry partners dismantled a botnet utilizing over 1.3 million Android TV boxes for advertising fraud.
Google and industry partners dismantled the XCPE botnet, which used over 1.3 million Android TV set-top boxes. The malware secretly rented users' internet connections for advertising fraud.

Why it matters. The botnet posed a risk of compromising other IoT devices, including telehealth and karaoke machines, by selling compromised IP addresses as residential proxies.

Do this today Review all connected Android IoT devices for unusual outbound network traffic patterns.

Affected
Android TV set-top boxes, Android-based IoT devices

Read on Krebs on Security Post on X LinkedIn

Also covered by BleepingComputer, The Record
```
{"coverage":1,"evidence":0,"freshness":0.398,"importance":0.75,"novelty":1,"quality":1,"total":0.615}
```

Threat Actors & Campaigns 4

Gorbag Group Targets Ukrainian Government and Aid Infrastructure High·Welivesecurity via The RecordNewRead Russia-linked group Gorbag steals documents and credentials from Ukrainian agencies using phishing and malware.
A Russia-aligned group named Gorbag targets Ukrainian government, defense, and military aid infrastructure. The group uses phishing emails with malicious attachments to steal credentials and documents. Their tools include BeautyStealer and Prime ReverseShell.

Why it matters. The group's targeting aligns with Russian intelligence priorities, focusing on war crimes investigations and military supply assessment.

Do this today Patch WinRAR to address CVE-2025-8088.

Read the original · Welivesecurity Post on X LinkedIn

Summarised from The Record.
```
{"coverage":0.387,"evidence":0,"freshness":0.729,"importance":0.75,"novelty":1,"quality":0.95,"total":0.551}
```
Threat Actors Hijack LLMs via LLMJacking to Cause Cloud Charges High·3 outlets·Google Threat IntelligenceDay 2NewRead Threat actors are hijacking enterprise LLM access via stolen credentials to generate massive fraudulent cloud charges.
Threat actors are executing LLMJacking by obtaining or exposing cloud identity tokens, API keys, or endpoints for Large Language Models (LLMs). This activity allows them to generate large spikes in fraudulent cloud charges, sometimes exceeding $100,000 per day.

Why it matters. Compromise of LLM credentials bypasses traditional security controls and can result in significant, rapid financial loss through cloud resource consumption.

Do this today Review and restrict access to LLM API keys and cloud identity tokens, ensuring MFA is enforced for all access methods.
1. Tue 3 NovThreat Actors Hijack LLMs via Credential Theft (LLMJacking)
2. TodayThreat Actors Hijack LLMs via LLMJacking to Cause Cloud Charges
Read on Google Threat Intelligence Post on X LinkedIn

Also covered by BleepingComputer, The Hacker News
```
{"coverage":0.774,"evidence":0,"freshness":0.378,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.534}
```
Cybercriminals Hijack LLM Access for Financial Gain High·CSO OnlineNewRead Threat actors are hijacking enterprise cloud and LLM access credentials to resell model usage.
Cybercriminals are executing financially motivated LLMjacking campaigns by compromising enterprise cloud and model access. These stolen credentials are used to generate large, fake cloud charges through underground subscription services. Attackers use LLM Mixers to aggregate and resell access across various providers.

Why it matters. Compromised credentials can lead to massive, unexpected cloud billing charges. Attackers can establish persistence and escalate privileges using seemingly low-volume initial requests.

Do this today Implement granular API key scopes and restrict credentials to intended models, workloads, and endpoints.

Read on CSO Online Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.694,"importance":0.75,"novelty":1,"quality":0.8,"total":0.532}
```
China-linked Group Uses AI Agents to Target Endpoint Security Blind Spots High·CrowdStrike via CSO OnlineNewRead A China-linked group used an AI framework to test security weaknesses across numerous global organizations.
A China-linked group, tracked as VAPOR PANDA, utilized an AI-powered penetration testing framework called ARTEX. This group targeted over 200 organizations globally over an 11-day period. The attackers instructed AI agents to examine systems for security control presence.

Why it matters. Automated, parallelized attacks increase the speed of reconnaissance and exploitation. Defenders must focus on continuous monitoring across all environments rather than relying on individual controls.

Do this today Enforce SAML signature validation and restrict cloud access privileges.

Read the original · CrowdStrike Post on X LinkedIn

Summarised from CSO Online.
```
{"coverage":0.387,"evidence":0,"freshness":0.675,"importance":0.75,"novelty":1,"quality":0.8,"total":0.531}
```

Breaches & Incidents 2

FBI Links $6.3B Binance Crypto Heist to North Korean Hackers High·7 outlets·TRM Labs via The RecordDay 4NewRead North Korean hackers, identified as TraderTraitor, are linked to a $6.3 billion theft from Binance.
Binance confirmed a $6.3 billion cyber heist, which the FBI and blockchain security firms attribute to North Korean state-sponsored hackers. The breach was traced by Binance to a compromised laptop belonging to a company engineer. Binance suspended deposits and withdrawals while investigating the theft.

Why it matters. The incident highlights the ongoing threat of state-sponsored actors targeting the cryptocurrency sector. The theft was executed using methods matching previous North Korea-linked heists.

Affected
Binance
1. Sat 31 OctBinance Hacked: $6.3 Billion Theft Linked to North Korea
2. Mon 2 NovBinance Hack Linked to North Korean Group TraderTraitor
3. Tue 3 NovFBI Links $6.3B Binance Crypto Heist to North Korean Hackers
4. TodayFBI Links $6.3B Binance Crypto Heist to North Korean Hackers
Read the original · TRM Labs Post on X LinkedIn

Summarised from The Record; also covered by BleepingComputer.
```
{"coverage":1,"evidence":0,"freshness":0.035,"importance":1,"novelty":0.6,"quality":0.95,"total":0.608}
```
Revolve Data Breach: Personal and Payment Card Information Stolen High·Malwarebytes via SecurityWeekNewRead Hackers accessed Revolve's online platform, exfiltrating customer names, addresses, and payment card details.
Unauthorized access occurred on Revolve's online shopping platform, leading to the theft of customer data. The exfiltrated data included names, addresses, payment card numbers, and expiration dates.

Why it matters. The breach confirms unauthorized access to sensitive customer payment and personal information stored on the e-commerce platform.

Affected
Revolve e-commerce platform

Read the original · Malwarebytes Post on X LinkedIn

Summarised from SecurityWeek; also covered by Malwarebytes.
```
{"coverage":0.613,"evidence":0,"freshness":0.374,"importance":0.75,"novelty":1,"quality":0.9,"total":0.544}
```

CVE spotlight

CVE	Affects	CVSS	EPSS	Status
CVE-2026-58115	—A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Nod…	10.0	1%	Not in KEV
CVE-2026-116606	—An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to in…	9.3	1%	Not in KEV
CVE-2026-119977	—WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging path…	8.1	1%	Not in KEV
CVE-2026-81648	—The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing …	10.0	0%	Not in KEV
CVE-2026-98432	—In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_…	9.8	0%	Not in KEV
CVE-2026-31695	linux_kernelIn the Linux kernel, the following vulnerability has been resolved: wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free Current…	7.8	0%	Not in KEV

Quiz

Yesterday's answer

According to the text, which products are affected by the newly added vulnerabilities in the KEV Catalog?

Ivanti Connect Secure, GitLab, and Cisco products.

The story explicitly lists the affected products as Ivanti Connect Secure, GitLab, and Cisco.

Today's question

According to the news story, what is the primary impact of the CVE-2026-58115 vulnerability?

On the radar tomorrow

Patch Tuesday in 6 daysTuesday 10 November
WatchingMalicious Claude Code extension on Cursor planted SSH backdoors
WatchingOne Compromised Laptop, Billions Lost: The Binance Attack-Path Warning

Also worth your time

Exploits

PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCERemote · CVE-2026-109618
pizzafy-1.0 - SQLiWebApps
South River Technologies Titan MFT Server 26.0.0 - code executionRemote
Synametrics Syncrify 6.2 - command executionRemote
Keycloak 26.7.2 - Unauthenticated Account TakeoverWebApps

Tools

synthient/public-researchIn today's news · via Krebs on Security · OSINT · GoProvides open source research and talks covering threat intelligence, fingerprinting, and fraud detection techniques.
su-kaka/agy2apiIn today's news · via Google Threat Intelligence · AI security · PythonProvides a unified API layer to interface with multiple large language models using standardized endpoints.
Balanov/skeinNew · 261 stars in 1 day · Cloud & containers · GoProvides a framework for executing explicit task graphs with bounded concurrency and epoch-fenced work control.
1337isnot1337/DOPPLERGEISTNew · 136 stars in 1 day · Forensics & malware analysis · PythonAnalyzes audio recordings to geolocate the recording source by comparing Doppler patterns to historical flight tracks.
Chipwithinflash/watson-AI-osint-all-in-oneNew · 68 stars in 1 day · OSINT · TypeScriptPerforms digital footprint checks by querying over 3,100 public sources using a single input field.
PatchBuilderAmplify/stolen-crypto-tracerNew · 34 stars in 1 day · Forensics & malware analysis · JavaScriptTraces cryptocurrency movements across multiple blockchains to identify potential exchange deposit addresses.

Community

Podcasts

182: BlackshadesDarknet Diaries · 39:17
Snake Oilers: Minimal.dev, Request Rocket and TRM LabsRisky Business · 44:26
SN 1102: A Strategic Plug Pull - Lessons From a Global Patch-and-Panic Fire DrillSecurity Now · 2:54:06
SANS Stormcast Tuesday, November 3rd, 2026: Multipath TCP (MPTCP) Detection; BTCPay Server 2.4.1 Hot Wallet Thefts; Barracuda ESG Flaws (CVE-2026-116606, CVE-2026-111560); Synology DSM RansomwareSANS Internet Storm Center · 6:14

And finally

CISA's new strategy runs into America’s blind trust problem

CISA's new roadmap highlights that existing dependencies and forgotten approvals remain significant operational risks. Accountability for trust across systems requires continuous verification.

CyberScoop

End of No. 254

That's today's brief.

On the radarPatch Tuesday in 6 days: Tuesday 10 November

The next brief lands at 06:30 IST.

Wednesday, 4 November 2026

From the editor

Actively Exploited 4

Vulnerabilities & Patches 4

Worth watching

Malware & Ransomware 1

Threat Actors & Campaigns 4

Breaches & Incidents 2

CVE spotlight

Quiz

On the radar tomorrow

Also worth your time

Exploits

Tools

Community

Podcasts

And finally

Keyboard shortcuts

Top stories

From the editor

Actively Exploited 4

Vulnerabilities & Patches 4

Worth watching

Malware & Ransomware 1

Threat Actors & Campaigns 4

Breaches & Incidents 2

CVE spotlight

Quiz

On the radar tomorrow

Also worth your time

Exploits

Tools

Community

Podcasts

And finally