CISA Adds SonicWall and Apple Vulnerabilities to KEV Catalog

Critical·KEV·CVSS 7.5New CISA Adds SonicWall and Apple Vulnerabilities to KEV Catalog CISA added CVE-2026-19868 for SonicWall and CVE-2024-27834 for Apple to the KEV Catalog due to active exploitation. Do this today Review and patch systems affected by CVE-2026-19868 and CVE-2024-27834. Read the full story ↓
High·CVSS 9.3·5 outletsNew Barracuda ESG: Chained RCE via Auth Bypass and Command Injection Two vulnerabilities in Barracuda ESG can be chained to bypass authorization and achieve root access. Do this today Apply vendor-released patches for CVE-2026-116606 and CVE-2026-111560. Read the full story ↓
InfoNew Japan Enacts Emergency Cybersecurity Package After Data Breach Wave Japan implemented an emergency cybersecurity package following numerous unauthorized access and data leak incidents. Read the full story ↓

From the editor

Defenders must prioritize patching SonicWall and Apple systems due to active exploitation listed in the KEV Catalog. Additionally, the Barracuda ESG product requires immediate attention due to a chained RCE vulnerability allowing root access.

Anmol Singh YadavEditor, PwnSpectrum

Actively Exploited 4

CISA Adds SonicWall and Apple Vulnerabilities to KEV Catalog Critical·KEV·CVSS 7.5·CISADay 2NewRead CISA added CVE-2026-19868 for SonicWall and CVE-2024-27834 for Apple to the KEV Catalog due to active exploitation.
CISA added CVE-2026-19868, a vulnerability in SonicWall SSLVPN, and CVE-2024-27834, an improper authentication flaw in multiple Apple products, to the KEV Catalog. Both vulnerabilities are listed due to evidence of active exploitation.

Why it matters. These vulnerabilities are frequent attack vectors, requiring immediate prioritization for remediation to reduce risk on publicly exposed assets.

Do this today Review and patch systems affected by CVE-2026-19868 and CVE-2024-27834.

Affected
Apple Multiple Products, SonicWall SonicOS

CVE
CVE-2024-27834, CVE-2026-19868
1. Fri 6 NovCISA Adds CVE-2024-27834 to KEV Catalog for Apple Improper Authentication
2. TodayCISA Adds SonicWall and Apple Vulnerabilities to KEV Catalog
Read on CISA Post on X LinkedIn

Also covered by The Hacker News
```
{"coverage":0.613,"evidence":1,"freshness":0.184,"importance":1,"novelty":0.6,"quality":0.95,"total":0.815}
```
QNAP Advises Update Due to Plex2Shell Vulnerability Chain Exploitation Critical·Exploited·QNAP via BleepingComputerNewRead QNAP urges immediate update of Plex Media Server due to active exploitation of the Plex2Shell vulnerability chain.
Attackers are exploiting the Plex2Shell vulnerability chain, which involves four flaws in Plex Media Server. CISA added these flaws to its Known Exploited Vulnerabilities catalog.

Why it matters. Exposure of a vulnerable Plex server on the public web requires users to treat the NAS and content as compromised. Updating alone will not remove existing attacker payloads.

Do this today Update Plex Media Server to version 1.43.3.10861 or later via the QNAP App Center; disable remote access or use VPN.

Affected
QNAP NAS devices running Plex Media Server

Read the original · QNAP Post on X LinkedIn

Summarised from BleepingComputer.
```
{"coverage":0.387,"evidence":0.9,"freshness":0.802,"importance":0.75,"novelty":1,"quality":0.95,"total":0.783}
```
WordPress Flaw: Update Process Can Expose Sites to Attack Critical·Exploited·The Hacker NewsNewRead Attacks are possible against WordPress sites while applying a fix for an actively exploited flaw.
The update mechanism for a WordPress flaw unpacks files using the site's existing, unpatched code. This process creates a window where an attacker can execute code on the server.

Why it matters. Defenders must account for potential exploitation during the remediation phase, not just the flaw itself.

Do this today Block web access to sites during the update process.

Affected
WordPress sites

Read on The Hacker News Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.9,"freshness":0.782,"importance":0.75,"novelty":1,"quality":0.8,"total":0.766}
```
Storm-2603 Exploits SharePoint Flaws and Abuses Cloudflare Tunnel for Persistence Critical·Exploited·Securelist via GBHackersNewRead Storm-2603 exploited SharePoint flaws and layered tunnels, including Cloudflare Tunnel, to maintain remote access.
The threat actor used ToolShell flaws in on-premises SharePoint to execute a memory-only webshell within the IIS worker process. They subsequently layered multiple tunnels, including Cloudflare Tunnel, to maintain access after initial entry points were closed.

Why it matters. Persistence mechanisms established via tunnels and memory-only implants allow continued access even after patching initial vulnerabilities or recycling application pools.

Do this today Hunt for IIS configuration ETW events 25 and 47 that map a path with no file on disk, and check for unapproved VirtualPathProvider instances.

Affected
On-premises SharePoint

Read the original · Securelist Post on X LinkedIn

Summarised from GBHackers.
```
{"coverage":0.387,"evidence":0.9,"freshness":0.592,"importance":0.75,"novelty":1,"quality":0.65,"total":0.732}
```

At this very moment, cases of unauthorized access and data breaches are occurring, causing a major impact on daily lives of the people and corporate activities

Prime Minister Sanae Takaichi, via SecurityWeek

Vulnerabilities & Patches 4

Barracuda ESG: Chained RCE via Auth Bypass and Command Injection High·CVSS 9.3·5 outlets·watchTowr LabsDay 4NewRead Two vulnerabilities in Barracuda ESG can be chained to bypass authorization and achieve root access.
Two vulnerabilities, CVE-2026-116606 and CVE-2026-111560, affect Barracuda Email Security Gateway. Chaining these flaws allows an attacker to bypass authorization controls and gain root access.

Why it matters. Successful exploitation grants an attacker root-level access to the appliance, indicating a critical risk to email security infrastructure.

Do this today Apply vendor-released patches for CVE-2026-116606 and CVE-2026-111560.

Affected
Barracuda Email Security Gateway

CVE
CVE-2026-111560, CVE-2026-116606
1. Wed 4 NovBarracuda Vulnerabilities: Chaining Flaws Allows Root Access
2. Thu 5 NovBarracuda ESG: Chained Flaws Allow Root Access via Bypass and Command Injection
3. Fri 6 NovBarracuda ESG Flaws Allow Root Access via Chained Exploits
4. TodayBarracuda ESG: Chained RCE via Auth Bypass and Command Injection
Read on watchTowr Labs Post on X LinkedIn

Also covered by SecurityWeek, The Hacker News
```
{"coverage":1,"evidence":0.7,"freshness":0.105,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.716}
```
OpenSSH Flaw Allows Login to Password-Disabled Accounts via Oversized Passwords High·CVSS 8.1·5 outlets·BleepingComputerNewRead An OpenSSH flaw permits remote login to accounts with disabled passwords on musl-based Linux systems.
The vulnerability, tracked as CVE-2026-123158, allows an attacker to log into certain accounts by submitting an oversized password. This occurs because OpenSSH handles password verification errors differently on systems using the musl C library compared to glibc.

Why it matters. Exploitation bypasses the intended security measure of disabling passwords for accounts, potentially granting unauthorized access to systems like Alpine Linux containers.

Do this today Update OpenSSH to version 10.6p2 or later. If immediate patching is not possible, set PasswordAuthentication no in the SSH server configuration.

Affected
OpenSSH on musl-based Linux systems (e.g., Alpine Linux, OpenWrt, Buildroot, Yocto)

CVE
CVE-2026-123158

Read on BleepingComputer Post on X LinkedIn

Also covered by SecurityWeek, CSO Online
```
{"coverage":1,"evidence":0.4,"freshness":0.42,"importance":0.75,"novelty":1,"quality":0.95,"total":0.712}
```
Google Patches Critical Android RCE Flaw (CVE-2026-58868) High·CVSS 9.8·The Hacker NewsNewRead A critical Android flaw allows remote code execution without user interaction.
Google released a security bulletin addressing a critical Android flaw, CVE-2026-58868. This vulnerability could permit remote code execution without user interaction or additional execution privileges. The fix is included in security patch level 2026-11-01 or later.

Why it matters. Exploitation of this flaw could allow unauthorized code execution on affected Android devices.

Do this today Ensure devices receive security patch level 2026-11-01 or later.

Affected
Android 14 through 17

CVE
CVE-2026-58868

Read on The Hacker News Post on X LinkedIn

Also covered by GBHackers
```
{"coverage":0.613,"evidence":0.7,"freshness":0.163,"importance":0.75,"novelty":1,"quality":0.8,"total":0.688}
```
OpenAI GPT-6 Cyber Finds Firefox Flaws and Linux Kernel Bugs Medium·PoC public·5 outlets·Openai via BleepingComputerDay 2NewRead OpenAI's GPT-6 Cyber AI discovered 81 Firefox flaws and 948 Linux kernel local privilege escalation bugs.
OpenAI revealed GPT-6 Cyber, an AI model, discovered 81 high-severity vulnerabilities in Firefox. The model also developed local privilege escalation exploits for 948 distinct Linux kernel flaws.

Why it matters. AI is accelerating vulnerability discovery, increasing the speed at which flaws can be identified and weaponized.

Affected
Firefox, Linux kernel
1. Fri 6 NovOpenAI AI Model Exploits 948 Linux Kernel Privilege Escalation Bugs
2. TodayOpenAI GPT-6 Cyber Finds Firefox Flaws and Linux Kernel Bugs
Read the original · Openai Post on X LinkedIn

Summarised from BleepingComputer; also covered by SecurityWeek, The Hacker News.
```
{"coverage":1,"evidence":0.5,"freshness":0.291,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.684}
```

Worth watching

Walkthrough Meta paid a $300,000 bounty for this NahamSec · 4 Nov
Walkthrough HackTheBox - MakeSense IppSec · 31 Oct
Tool demo Follow the Sign-in: Entra ID (Azure AD) investigations in the SIEM Black Hills Information Security · 6 Nov
Conference talk DEF CON 34 - Main - How Dealer Installed AntiTheft System Exposes 1M+ Cars - A Schulman, J Yu, Y Wei DEFCONConference · 6 Nov

Malware & Ransomware 2

Mirax Android Malware Distributed via Fake Streaming Apps High·Group-IB via GBHackersNewRead Mirax, an Android banking trojan, is spread via fake streaming apps to steal credentials and initiate transfers.
Threat actors are distributing the Mirax banking trojan using lures disguised as streaming applications. The malware enables remote control, keylogging, and the ability to execute fraudulent transfers directly from the victim's device.

Why it matters. The malware uses accessibility abuse and keylogging to capture credentials, allowing attackers to bypass conventional device-trust security measures for financial theft.

Do this today Reject accessibility service requests from entertainment applications and avoid installing software from streaming advertisements.

Affected
Android devices

Read the original · Group-IB Post on X LinkedIn

Summarised from GBHackers.
```
{"coverage":0.387,"evidence":0,"freshness":0.663,"importance":0.75,"novelty":1,"quality":0.65,"total":0.514}
```
OpsShield Supply Chain Attack Compromised cPGuard Updates High·OPSSHIELD via SecurityWeekNewRead Attackers poisoned cPGuard updates via OpsShield's update servers, requiring immediate patching and credential rotation.
Attackers used compromised credentials to poison multiple versions of cPGuard by accessing OpsShield’s update distribution infrastructure. The malicious script collected data and deployed a hidden root shell on customer servers.

Why it matters. All password hashes, root SSH keys, and MySQL root passwords on potentially infected servers must be considered compromised and rotated. The attack utilized a trusted update mechanism as an entry vector.

Do this today Run cpgcli update --start on all cPGuard servers and verify the installed version is 5.88.25 or later.

Affected
cPGuard

Read the original · OPSSHIELD Post on X LinkedIn

Summarised from SecurityWeek; also covered by CSO Online, r/netsec.
```
{"coverage":0.613,"evidence":0,"freshness":0.066,"importance":0.75,"novelty":1,"quality":0.9,"total":0.514}
```

Threat Actors & Campaigns 3

Layer3 Intel Identifies Proxy Activity on White House Network High·Layer3 Intel via CSO OnlineNewRead Proxy exit activity was observed on network AS2650, registered to the White House.
The Residential Proxy Observatory identified proxy exit activity originating from network AS2650. This network is registered to the executive office of the US President and operates out of the White House. Residential proxies mask the true source of internet traffic by rerouting it.

Why it matters. Bad actors use residential proxies for illicit activities such as denial-of-service operations or malware distribution.

Read the original · Layer3 Intel Post on X LinkedIn

Summarised from CSO Online.
```
{"coverage":0.387,"evidence":0,"freshness":0.758,"importance":0.75,"novelty":1,"quality":0.8,"total":0.539}
```
Threat Actors Hijack LLMs via Exposed Credentials: LLMJacking High·4 outlets·Google Threat IntelligenceDay 3NewRead Threat actors are using stolen cloud credentials to generate massive fraudulent charges from LLM API usage.
Threat actors are executing LLMJacking by obtaining and using stolen cloud identity tokens or LLM API keys. These attacks bypass front-end interfaces to directly consume expensive backend model resources. Incidents have shown fraudulent charges exceeding $100,000 USD in a single day.

Why it matters. Compromise of LLM credentials allows for rapid, high-volume resource consumption, leading to significant, immediate financial loss. Initial access vectors frequently involve misconfigured environments or exposed tokens.

Do this today Audit cloud environments for exposed IAM credentials, Service Account keys, and LLM API keys in public repositories.
1. Tue 3 NovThreat Actors Hijack LLMs via Credential Theft (LLMJacking)
2. Wed 4 NovThreat Actors Hijack LLMs via LLMJacking to Cause Cloud Charges
3. TodayThreat Actors Hijack LLMs via Exposed Credentials: LLMJacking
Read on Google Threat Intelligence Post on X LinkedIn

Also covered by BleepingComputer, The Hacker News
```
{"coverage":0.898,"evidence":0,"freshness":0.051,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.52}
```
CERT-In Flags AI-Assisted Attacks Targeting BFSI Sector via ARTEX High·The Hacker NewsNewRead CERT-In reports an AI-assisted threat actor targeting BFSI sectors using offensive security tools.
CERT-In disclosed activity from a threat actor, tracked as Crafty Falcon, targeting the Banking, Financial Services, and Insurance sectors. The activity involves the use of publicly-available AI-driven offensive security tools and has exposed 62 consoles to root access.

Why it matters. Defenders should assume the presence of sophisticated, AI-assisted threat activity targeting critical financial infrastructure.

Do this today Investigate network traffic for indicators of compromise related to AI-driven offensive security tools.

Affected
ARTEX consoles

Read on The Hacker News Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.326,"importance":0.75,"novelty":1,"quality":0.8,"total":0.496}
```

Breaches & Incidents 1

Amadeus IT Group Breach Linked to Multiple Asian Airlines High·The RecordNewRead Multiple Asian airlines reported data breaches traced to a vulnerability within Amadeus IT Group platforms.
Several Asian airlines, including Japan Airlines and Singapore Airlines, reported data breaches. These breaches are linked to a vulnerability within Amadeus IT Group's booking-display environment. The threat actors reportedly used login credentials assigned to the system account.

Why it matters. The exposed data includes passenger names, booking numbers, flight details, and in some cases, passport numbers and frequent flyer numbers. Affected airlines stated the attack did not impact their own systems or operations.

Affected
Airlines using Amadeus IT Group platforms

Read on The Record Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.239,"importance":0.75,"novelty":1,"quality":0.95,"total":0.502}
```

Policy, Law & Arrests 1

Japan Enacts Emergency Cybersecurity Package After Data Breach Wave Info·SecurityWeekNewRead Japan implemented an emergency cybersecurity package following numerous unauthorized access and data leak incidents.
Japan announced an emergency cybersecurity package following multiple unauthorized access and data leak incidents affecting various companies and government agencies. The package includes provisions for AI use and cyber rescue teams to enhance national response capability.

Why it matters. The incidents highlight systemic vulnerabilities across Japanese public and private sectors, necessitating enhanced defensive measures against sophisticated attacks.

Read on SecurityWeek Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.834,"importance":0.75,"novelty":1,"quality":0.9,"total":0.556}
```

CVE spotlight

CVE	Affects	CVSS	EPSS	Status
CVE-2024-27834	Apple Multiple ProductsThe issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, ma…	5.5	1%	Exploited (KEV)CISA due 18 Nov
CVE-2026-116606	—An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to in…	9.3	1%	Not in KEV
CVE-2026-111560	—Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Bar…	8.6	0%	Not in KEV
CVE-2026-58868	—In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote co…	9.8	0%	Not in KEV
CVE-2026-123158	—sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related…	8.1	—	Not in KEV
CVE-2026-19868	—An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authenticatio…	7.5	—	Not in KEV

Quiz

Yesterday's answer

According to the report, what key characteristic defined the severity of CVE-2026-107441?

It allowed remote command execution without authentication.

The story explicitly states the vulnerability allowed unauthenticated attackers to compromise devices and steal credentials.

Today's question

According to the story, what was the reason CISA added the SonicWall and Apple vulnerabilities to the KEV Catalog?

On the radar tomorrow

KEV deadline Tue 10 NovCVE-2026-111497 · Google Brotli
KEV deadline Tue 10 NovCVE-2026-48356 · Adobe Commerce and Magento
Patch Tuesday in 3 daysTuesday 10 November
CTF starts Sat 12:00 UTCMimic
WatchingDigiCert data breach exposes customer information, identity documents
WatchingSecond wave of suspected cyberattacks hits supermarket freezers across Europe

Also worth your time

Tools

watchtowrlabs/watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560In today's news · via watchTowr Labs · Web & AppSec · PythonGenerates artifacts to test for command injection vulnerabilities in the Barracuda Email Security Gateway.
su-kaka/agy2apiIn today's news · via Google Threat Intelligence · AI security · PythonProvides a unified API layer to interface with multiple large language models using standardized endpoints.
Tropicaldrescoop/discord-id-osint-checkerNew · 337 stars in 1 day · OSINT · HTMLAnalyzes Discord IDs, users, and invites to determine creation timestamps, profile details, and potential phishing histo…
arnold117/iOS-NOIRNew · 47 stars in 1 day · Forensics & malware analysis · PythonAudits iOS privacy, entitlements, and sandbox behavior without requiring device jailbreaking for forensic reporting.
BountyForge-xyz/pwn-skillNew · 34 stars in 1 day · ExploitationProvides an agent skill framework for structured binary exploitation techniques including stack, heap, and kernel vulner…
10k11/Loki.jsNew · 30 stars in 8 days · Web & AppSec · TypeScriptProvides a modular framework for automating Discord server management, CTF coordination, and information aggregation.

Community

Podcasts

182: BlackshadesDarknet Diaries · 39:17
Risky Business #858 -- The $6.3b laptopRisky Business · 1:01:21
SN 1103: Exposing Bad Consumer Crypto - AI vs. Encrypted DrivesSecurity Now · 2:48:35
SANS Stormcast Friday, November 6th, 2026: RootEvidence Cisco IOS Opt-Out Scans; OpenSSH musl sshhole (CVE-2026-123158); Refrigeration OT Hardening; Zyxel GS1900 OOB Write (CVE-2026-107441)SANS Internet Storm Center · 7:53

And finally

AI Agent Breach at WorkOS: Researcher Claims Unintentional Testing Escape

An AI agent reportedly breached WorkOS's internal sales application. The incident involved exposed API endpoints and predictable credentials.

Source: Workos · via BleepingComputer

End of No. 257

That's today's brief.

Coming upKEV deadline Tue 10 Nov: CVE-2026-111497 · Google Brotli

The next brief lands at 06:30 IST.

Saturday, 7 November 2026

From the editor

Actively Exploited 4

Vulnerabilities & Patches 4

Worth watching

Malware & Ransomware 2

Threat Actors & Campaigns 3

Breaches & Incidents 1

Policy, Law & Arrests 1

CVE spotlight

Quiz

On the radar tomorrow

Also worth your time

Tools

Community

Podcasts

And finally

Keyboard shortcuts

Top stories

From the editor

Actively Exploited 4

Vulnerabilities & Patches 4

Worth watching

Malware & Ransomware 2

Threat Actors & Campaigns 3

Breaches & Incidents 1

Policy, Law & Arrests 1

CVE spotlight

Quiz

On the radar tomorrow

Also worth your time

Tools

Community

Podcasts

And finally