The daily cybersecurity brief
No. 256
15 stories 4 critical 7 min read Updated 06:30 IST
Top stories
- Zyxel Patches Zero-Day Flaw in GS1900 Switches; CVE-2026-107441 Zyxel patched a zero-day out-of-bounds write flaw in GS1900 switches allowing unauthenticated OS command execution. Do this today Install the latest firmware updates from Zyxel to address CVE-2026-107441. Read the full story ↓
- OpenAI AI Model Exploits 948 Linux Kernel Privilege Escalation Bugs An AI pipeline identified and generated working exploits for 948 Linux kernel local privilege escalation vulnerabilities. Do this today Ensure all systems are patched to the latest available kernel versions. Read the full story ↓
- SlippyNunchucks Hijacks Sogou Input Method for DarkVigil Deployment SlippyNunchucks used DNS hijacking via insecure HTTP in Sogou Input Method to deploy the DarkVigil implant. Do this today Ensure Sogou Input Method is updated to version 16.10 or later. Read the full story ↓
From the editor
Defenders should prioritize patching Zyxel GS1900 switches against the unauthenticated RCE flaw. Furthermore, the discovery of 948 Linux kernel privilege escalation bugs requires immediate review of kernel security posture. Monitor for DNS hijacking vectors targeting input methods.
Anmol Singh YadavEditor, PwnSpectrum
No stories match your search.
Actively Exploited 4
-
Zyxel Patches Zero-Day Flaw in GS1900 Switches; CVE-2026-107441 Zyxel patched a zero-day out-of-bounds write flaw in GS1900 switches allowing unauthenticated OS command execution.
An out-of-bounds write flaw, tracked as CVE-2026-107441, was exploited to execute OS commands on Zyxel GS1900 switches via crafted HTTP requests. This vulnerability allowed unauthenticated attackers to compromise devices and steal credentials. Zyxel released new firmware to mitigate this flaw.
Why it matters. The vulnerability allowed remote command execution without authentication, enabling attackers to steal configuration files and credentials from compromised network infrastructure.
Do this today Install the latest firmware updates from Zyxel to address CVE-2026-107441.
- Affected
- Zyxel GS1900 series switches
- CVE
- CVE-2026-107441, CVE-2026-7273
- Thu 5 NovZyxel Patches Zero-Day in GS1900 Switches via Web Interface
- TodayZyxel Patches Zero-Day Flaw in GS1900 Switches; CVE-2026-107441
Summarised from BleepingComputer; also covered by SecurityWeek, The Hacker News.
{"coverage":1,"evidence":1,"freshness":0.459,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.826} -
CISA Adds CVE-2024-27834 to KEV Catalog for Apple Improper Authentication CISA added CVE-2024-27834, an improper authentication flaw in multiple Apple products, to the KEV Catalog due to active exploitation.
CISA added CVE-2024-27834 to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. This vulnerability involves improper authentication across multiple Apple products. The flaw has a CVSS score of 5.5.
Why it matters. Active exploitation of this vulnerability increases risk across environments. Organizations should prioritize remediation for KEV Catalog vulnerabilities.
- Affected
- Multiple Apple Products
- CVE
- CVE-2024-27834
Also covered by The Hacker News
{"coverage":0.613,"evidence":1,"freshness":0.358,"importance":0.75,"novelty":1,"quality":0.95,"total":0.798} -
Active Exploitation of Siemens IoT2050 Flaw via Node-RED Unauthenticated remote code execution is actively being exploited in Siemens IoT2050 and Node-RED systems.
Active exploitation targets CVE-2026-58115, a critical flaw in Siemens SIMATIC IoT2050 Advanced devices. This vulnerability allows unauthenticated remote attackers to execute arbitrary code. The flaw is associated with an unauthenticated Node-RED admin API issue.
Why it matters. Successful exploitation permits remote attackers to deploy flows that download and run Linux bots on affected systems. This impacts open source IoT/IIoT systems, including those in critical infrastructure.
Do this today Verify authentication status for Node-RED deployments and apply vendor patches for Siemens IoT2050.
- Affected
- Siemens SIMATIC IoT2050 Advanced devices, Node-RED
- CVE
- CVE-2026-58115
- Wed 4 NovSiemens IoT2050 Flaw Allows Unauthenticated Remote Code Execution
- TodayActive Exploitation of Siemens IoT2050 Flaw via Node-RED
Also covered by CSO Online
{"coverage":0.613,"evidence":0.9,"freshness":0.154,"importance":1,"novelty":0.6,"quality":0.8,"total":0.772} -
Gorbag Exploits WinRAR CVE-2025-8088 to Deploy Stealer Malware Gorbag, a Russia-aligned actor, is exploiting WinRAR to deploy information stealer malware against Ukrainian entities.
The threat actor Gorbag is exploiting CVE-2025-8088 in WinRAR. This activity involves deploying information stealer malware, such as BeautyStealer, against targeted organizations. The group has focused on Ukrainian law enforcement, justice, and defense sectors since at least February 2025.
Why it matters. The exploitation allows for rapid collection of intelligence from targeted organizations. The vulnerability is listed in CISA KEV with a high CVSS score.
Do this today Apply vendor patches for CVE-2025-8088.
- Affected
- WinRAR
- CVE
- CVE-2025-8088
Also covered by GBHackers
{"coverage":0.613,"evidence":1,"freshness":0.179,"importance":0.75,"novelty":1,"quality":0.8,"total":0.765}
To the best of our knowledge, the agents in this pipeline discovered and used at least 10 novel Linux exploitation techniques
Vulnerabilities & Patches 4
-
OpenAI AI Model Exploits 948 Linux Kernel Privilege Escalation Bugs An AI pipeline identified and generated working exploits for 948 Linux kernel local privilege escalation vulnerabilities.
An unreleased OpenAI cyber model generated working root exploits for 948 unique Linux kernel vulnerabilities. The process involved analyzing 2,308 candidate bugs and confirming 1,724 vulnerabilities. The exploits were tested on virtual machines with common protections enabled.
Why it matters. Local access on an unpatched operating system is functionally equivalent to root access for a well-resourced threat actor. The discovery demonstrates advanced automated vulnerability research capabilities.
Do this today Ensure all systems are patched to the latest available kernel versions.
- Affected
- Linux kernel
Summarised from SecurityWeek; also covered by The Hacker News, CSO Online.
{"coverage":0.898,"evidence":0.5,"freshness":0.566,"importance":0.75,"novelty":1,"quality":0.9,"total":0.731} -
Barracuda ESG Flaws Allow Root Access via Chained Exploits Chaining an authentication bypass and command injection flaw can grant root access on Barracuda ESG appliances.
Two vulnerabilities, CVE-2026-116606 (authentication bypass) and CVE-2026-111560 (command injection), can be chained to achieve root access on Barracuda ESG appliances. Successful exploitation requires access to the appliance's admin interface.
Why it matters. Root access on an email gateway exposes credentials and connections used for all inbound and outbound messages. The combination allows bypassing authorization controls.
Do this today Apply security patches released by Barracuda for CVE-2026-116606 and CVE-2026-111560.
- Affected
- Barracuda Email Security Gateway (ESG) versions prior to 9.4.0.030
- CVE
- CVE-2026-111560, CVE-2026-116606
- Wed 4 NovBarracuda Vulnerabilities: Chaining Flaws Allows Root Access
- Thu 5 NovBarracuda ESG: Chained Flaws Allow Root Access via Bypass and Command Injection
- TodayBarracuda ESG Flaws Allow Root Access via Chained Exploits
Also covered by The Hacker News, CSO Online
{"coverage":0.898,"evidence":0.7,"freshness":0.205,"importance":0.75,"novelty":0.6,"quality":0.9,"total":0.705} -
Cisco Snort: Out-Of-Bounds Write RCE via sf_unfold_header Unauthenticated remote code execution exists in Cisco Snort due to improper data validation during ZIP archive processing.
A flaw in Cisco Snort's handling of HTTP response bodies containing ZIP archives allows an out-of-bounds write. This vulnerability permits remote attackers to execute arbitrary code without authentication.
Why it matters. Exploitation allows code execution within the context of the Snort service account. This represents a critical risk to network security infrastructure.
Do this today Apply the Cisco security advisory update for Snort.
- Affected
- Cisco Snort
- CVE
- CVE-2026-20043
{"coverage":0.387,"evidence":0.7,"freshness":0.155,"importance":0.75,"novelty":1,"quality":0.9,"total":0.664} -
APT Flaw in Debian/Ubuntu Allows Root Code Execution via MitM An APT flaw enables attackers to swap verified packages and execute code as root via manipulated downloads.
A vulnerability in the APT package manager allows an attacker who can modify package downloads to swap a verified package for a malicious one. This occurs due to improper file handling when APT processes HTTP redirects or retries failed downloads. Successful exploitation can lead to arbitrary code execution with root privileges.
Why it matters. Defenders must treat package manager integrity as a high risk, as this flaw allows remote code execution with the highest privileges via network interception.
Do this today Ensure APT is updated to the patched versions released by Debian and Ubuntu.
- Affected
- Debian, Ubuntu, and derivatives
- CVE
- CVE-2026-109518
Also covered by CSO Online, GBHackers
{"coverage":0.774,"evidence":0.4,"freshness":0.411,"importance":0.75,"novelty":1,"quality":0.8,"total":0.662}
Worth watching
-
Malware analysis Malware Analysis - Decompiling V8 JavaScript Galaxy Stealer -
Tool demo Introducing Theme Studio Pro
Malware & Ransomware 1
-
SlippyNunchucks Hijacks Sogou Input Method for DarkVigil Deployment SlippyNunchucks used DNS hijacking via insecure HTTP in Sogou Input Method to deploy the DarkVigil implant.
A China-aligned actor, SlippyNunchucks, executed a DNS hijacking operation targeting Sogou Input Method. This abuse leveraged the application's brand promotion mechanism over insecure HTTP communications. The operation was used to deploy the DarkVigil implant.
Why it matters. Defenders must assume potential compromise via this vector, as the malware targets Chinese-speaking users across multiple regions. The threat actor uses the DarkVigil toolset for surveillance activities.
Do this today Ensure Sogou Input Method is updated to version 16.10 or later.
- Affected
- Sogou Input Method
- CVE
- CVE-2026-120422
Also covered by The Hacker News, GBHackers
{"coverage":0.774,"evidence":0.4,"freshness":0.338,"importance":0.75,"novelty":1,"quality":0.9,"total":0.665}
Threat Actors & Campaigns 2
-
APT29 Targets iPhone and Android via Watering Hole Campaigns Russian state-linked group APT29 used fake websites to target mobile devices with known exploits.
APT29, linked to Russia's SVR, executed a watering hole campaign targeting users in the US, Europe, and Ukraine. The operation used compromised legitimate and cloned websites to deliver malicious code to vulnerable mobile devices. The attacks targeted data such as passwords, messages, and emails.
Why it matters. The campaign leveraged previously patched vulnerabilities on iOS and Android, indicating a broad effort to collect data from vulnerable devices. Full patching is necessary to mitigate risk from these known exploits.
Do this today Ensure all mobile operating systems and browsers are updated to the latest stable versions.
- Affected
- iPhone (iOS 16, iOS 18.5), Android (older Chrome versions)
Summarised from The Record; also covered by SecurityWeek, GBHackers.
{"coverage":0.774,"evidence":0,"freshness":0.365,"importance":0.75,"novelty":1,"quality":0.95,"total":0.573} -
Phishing Attacks Impersonate OpenAI, SpaceX Events for Credential Theft Attackers use fake AI event invitations to trick users into providing Microsoft and Google credentials.
Threat actors are distributing phishing lures impersonating events from OpenAI, SpaceX, and Anthropic. These pages trick users into signing in with corporate accounts to claim rewards. The attack utilizes Kali365 for Microsoft device code phishing and VoidProxy for Google AiTM session hijacking.
Why it matters. These techniques allow attackers to bypass standard MFA by capturing authentication tokens or session cookies, leading to potential account takeover of Microsoft 365 and Google Workspace resources.
Do this today Restrict device code authentication where not needed and enforce phishing-resistant MFA like FIDO2 security keys.
Summarised from BleepingComputer.
{"coverage":0.387,"evidence":0,"freshness":0.907,"importance":0.75,"novelty":1,"quality":0.95,"total":0.569}
Breaches & Incidents 4
-
DigiCert Data Breach Exposed Customer Information and Identity Documents DigiCert suffered a data breach due to a misconfigured server migration exposing archived customer data.
A server migration mistakenly exposed an internal business system to the internet. This allowed unauthorized access to archived customer data, including names, business emails, and potentially identity documents.
Why it matters. Defenders should monitor for credential stuffing or identity theft attempts targeting services associated with DigiCert customers.
- Affected
- DigiCert customers
Summarised from BleepingComputer; also covered by GBHackers.
{"coverage":0.613,"evidence":0,"freshness":0.641,"importance":0.75,"novelty":1,"quality":0.95,"total":0.576} -
Crédit Mutuel Arkéa hit by third-party service provider supply chain attack Attackers accessed a French bank's internal account via an unnamed third-party provider, transferring funds.
Attackers accessed an internal account at Crédit Mutuel Arkéa through an unnamed third-party service provider's platform. Funds were transferred to other financial institutions, potentially for cryptocurrency conversion. The bank temporarily suspended some transactions following the detection of the breach.
Why it matters. The incident highlights the risk of third-party service providers in financial sector cyberattacks. Interconnected systems increase exposure to external threats.
- Affected
- Crédit Mutuel Arkéa
Summarised from CSO Online.
{"coverage":0.387,"evidence":0,"freshness":0.929,"importance":0.75,"novelty":1,"quality":0.8,"total":0.556} -
Norad Compromise: User Data Stolen from Grant Portal Norway's aid agency confirmed a cyber breach exposing names and emails of registered users.
Cybercriminals breached Norad's grant portal, compromising 27 accounts. This resulted in the theft of names and email addresses for 20,614 registered users. Data from at least three organizations' applications was also affected.
Why it matters. The breach potentially exposed sensitive information regarding individuals in conflict areas and authoritarian states. Users should assume their personal data has been compromised.
- Affected
- Norad grant portal users
{"coverage":0.387,"evidence":0,"freshness":0.684,"importance":0.75,"novelty":1,"quality":0.85,"total":0.536} -
Binance Reports $6.3B Crypto Loss via Compromised DevOps Laptop Binance attributed a $6.3 billion crypto loss to a compromised DevOps laptop, indicating systemic control weaknesses.
Binance reported a $6.3 billion cryptocurrency loss. The preliminary investigation pointed to a compromised employee device that provided access to a service container involved in withdrawals. The attack reportedly involved techniques such as laptop infections and compromised internal tooling.
Why it matters. The incident demonstrates how weak system separation and inadequate controls can lead to systemic financial loss from a single endpoint breach.
Do this today Review access controls and system separation between development, operations, and production environments.
- Affected
- Binance
- Tue 3 NovBinance Breach Linked to Compromised DevOps Laptop
- Thu 5 NovBinance Reports $6.3B Crypto Theft Linked to Compromised DevOps Laptop
- TodayBinance Reports $6.3B Crypto Loss via Compromised DevOps Laptop
Also covered by Dark Reading, CSO Online
{"coverage":1,"evidence":0,"freshness":0.096,"importance":0.75,"novelty":0.6,"quality":0.9,"total":0.535}
CVE spotlight
| CVE | Affects | CVSS | EPSS | Status |
|---|---|---|---|---|
| CVE-2024-27834 | Apple Multiple ProductsThe issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, ma… | 5.5 | 1% | Exploited (KEV)CISA due 18 Nov |
| CVE-2026-119977 | WordPress CoreWordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging path… | 8.1 | 1% | Exploited (KEV)CISA due 6 Nov |
| CVE-2026-7273 | Zyxel GS1900 Series SwitchesA stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a… | 8.8 | 3% | Exploited (KEV)CISA due 24 Sep (passed) |
| CVE-2025-8088 | RARLAB WinRARA path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious … | 8.8 | 94% | Exploited (KEV)CISA due 2 Sep (passed)ransomware |
| CVE-2026-58115 | —A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Nod… | 10.0 | 1% | Not in KEV |
| CVE-2026-116606 | —An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to in… | 9.3 | 1% | Not in KEV |
Quiz
Yesterday's answer
According to the provided text, which specific flaw was found within the Brotli decoder?
out-of-bounds write in the Brotli decoder
The story explicitly states that the vulnerabilities include an out-of-bounds write in the Brotli decoder.
Today's question
According to the report, what key characteristic defined the severity of CVE-2026-107441?
Locked in. The answer is in tomorrow's brief.
The week in review
- MondayWordPress RCE Flaw Under Active Exploitation; Update to 7.1.4
- TuesdayCISA Adds Multiple Exploited Vulnerabilities to KEV Catalog
- WednesdaySiemens IoT2050 Flaw Allows Unauthenticated Remote Code Execution
- ThursdayNode.js/Brotli Vulnerabilities Affecting Cisco Products: CVE-2026-105482 to CVE-2026-111497
On the radar tomorrow
- Patch Tuesday in 4 daysTuesday 10 November
- CTF starts Fri 10:00 UTCHKCERT CTF 2026 (Qualifying Round)
- WatchingThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources
- WatchingSonicWall warns of unpatched flaws in end-of-life GMS software
Also worth your time
Tools
- RRQM/TouchSocketProvides a comprehensive .NET framework for implementing various network protocols including TCP, UDP, and WebSockets.
- chromiumembedded/cefProvides a framework for embedding Chromium-based web browser controls into native applications.
- Dicklesworthstone/franken_doppler_finderAnalyzes audio recordings and archived flight data to estimate the location of unrecorded propeller aircraft passes.
- superboyyy/HOneClickThis tool executes a temporary root exploit chain on Honor devices using local vulnerabilities and kernel module loading…
- MWDLH/ShellSentry-AIAudits malicious code across multiple languages using deterministic forensics, LLM inference, and agent-based falsificat…
Community
- Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560) - watchTowr Labs
- Sogou Input Method update hijack installs DarkVigil backdoor; update to 16.10 (CVE-2026-120422)
- ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS · Forever Security
- The Confessions of an AI Fraud Kingpin
- Who’s Trying to Get Into Our Fridge Freezer? There's nowt in it!
- Escaping AWS Firecracker from guest userspace: VMM memory corruption (CVE-2026-122192)
And finally
ARTEX Platforms Automate Vulnerability Discovery
ARTEX platforms automate vulnerability discovery using LLMs. Threat actors use these tools for broad, financially motivated activities.
Check Point Research
End of No. 256
That's today's brief.
On the radarPatch Tuesday in 4 days: Tuesday 10 November
The next brief lands at 06:30 IST.