Independent cybersecurity briefing

Latest November 11, 2026

Breaches, bounties, zero-days, and AI.

Desk 03

Zero-Days & CVEs

Newly disclosed vulnerabilities, exposure, and what is actually worth patching first.

Zero-Days & CVEs

Windows 10 KB5131096: 1,235 Patch Tuesday flaws, ESU only

KB5131096 is Microsoft's November 10, 2026 extended update for Windows 10 ESU and Enterprise LTSC, taking those installs to builds 19045.7846 and 19044.7846. Confirm the build on enrolled machines, re-sign PowerShell scripts the new UTF-8 check rejects, and patch Outlook separately for exploited CVE-2026-124194.

ZeroDay Times DeskNovember 11, 20263 min read

Zero-Days & CVEs

OpenSSH, GPUStack, FreeSWITCH, IBM: patch by November 12

CISA added OpenSSH CVE-2026-123158, GPUStack CVE-2026-102895, SignalWire FreeSWITCH CVE-2026-116779, and IBM Aspera Faspex CVE-2026-123218 to the Known Exploited Vulnerabilities catalog, with a federal due date of November 12, 2026. Install OpenSSH 10.6p2, GPUStack 2.2.0, FreeSWITCH 1.11.3, and Faspex 5.0.19 PL1, and review any host still on the vulnerable build.

ZeroDay Times DeskNovember 10, 20264 min read

Zero-Days & CVEs

Shahid Kaveh: 700 French stores and 15 fires

France attributes the October 11–12 refrigeration attacks to the IRGC unit Shahid Kaveh: about 700 retail sites, at least 15 fires, and tens of millions of euros in spoiled food. Segment Danfoss and Dixell controllers, and alarm when a cold room leaves range without a local change.

ZeroDay Times DeskNovember 10, 20263 min read

Zero-Days & CVEs

Xen Orchestra: VSA-2026-062 takes XCP-ng as root

Vates says attackers are using critical flaw VSA-2026-062 to log into Xen Orchestra as an admin and take over XCP-ng hosts as root. Install 6.9.1 or 6.10.0, keep the console off the internet, and rotate every secret the orchestrator stored if it was reachable.

ZeroDay Times DeskNovember 10, 20262 min read

Zero-Days & CVEs

Microsoft Paint CVE-2026-83844: the fix skips Windows Update

Windows Paint below 11.2609.401.0 still has CVE-2026-83844, an unauthenticated remote code-execution flaw Microsoft scores 8.1. Update Paint from the Microsoft Store and read the version on every account, because Windows Update does not deliver the fix.

ZeroDay Times DeskNovember 9, 20263 min read

Zero-Days & CVEs

OpenSSH CVE-2026-123158: root on a honeypot in nine hours

Previdian confirmed root on an Alpine OpenSSH honeypot less than nine hours after CVE-2026-123158 was published. Install OpenSSH 10.6p2, restart sshd, and treat a password login on a locked account as a compromise.

ZeroDay Times DeskNovember 9, 20262 min read

Zero-Days & CVEs

QNAP NAS: Plex2Shell, four CVEs, assume compromise

QNAP says customers' NAS devices are being compromised through Plex2Shell, a four-bug chain in Plex Media Server now on CISA's catalog. Update Plex to 1.43.3.10861, and rebuild any box that was exposed on an older build.

ZeroDay Times DeskNovember 8, 20262 min read

Zero-Days & CVEs

Veeam Appliance: kernel panic on AMD EPYC

Veeam Software Appliance 13.1 and later can kernel-panic on reboot when the host uses certain AMD EPYC processors, including the 7262, 7302, and 7F72, after a FIPS jitterentropy check fails. Move the VM to another CPU, or hold automatic updates and power the virtual machine off and on if the panic hits.

ZeroDay Times DeskNovember 8, 20263 min read

Zero-Days & CVEs

WordPress CVE-2026-119977: the 7.1.4 install is one last window

Sites on WordPress 5.9 through 7.1.3 can still be hit while they install the 7.1.4 fix for CVE-2026-119977, because the old updater unpacks the patch. Deny web access to the upgrade directory before you update, then confirm the version.

ZeroDay Times DeskNovember 8, 20264 min read

Zero-Days & CVEs

Crédit Mutuel Arkéa: $133 million via a provider

Crédit Mutuel Arkéa says an attacker reached its network through a service provider and moved funds from the bank's own account, on the order of $133 million, while member balances stayed put. Reconcile Arkéa payments from November 1, and tell customers to confirm any message with their adviser.

ZeroDay Times DeskNovember 7, 20263 min read

Zero-Days & CVEs

GitHub: fake Fscan helper, 2,000 Windows hosts

Dr. Web says poisoned GitHub security projects, including a fake helper for the Fscan scanner, have compromised more than 2,000 Windows systems with a backdoor and a stealer. Quarantine any host that built one, and rotate the secrets that machine could see.

ZeroDay Times DeskNovember 7, 20262 min read

Zero-Days & CVEs

SonicWall: CVE-2026-19868 skips SAML MFA

SonicWall says CVE-2026-19868, now on CISA's exploited list, lets a holder of an alternate login skip SAML multi-factor checks on SonicOS SSL VPN. Federal agencies have until November 20. Move Gen7 to 7.3.4-7013 and Gen8 to 8.2.3-8015.

ZeroDay Times DeskNovember 7, 20262 min read

Zero-Days & CVEs

D-Link DGS-3130: unpatched, disable DDP

D-Link has no firmware and no CVE identifiers yet for several zero-days in DGS-3130 switches, found in the discovery protocol. Disable DDP, drop default SNMP communities, and keep SSH, the web interface, and SNMP on an isolated management network.

ZeroDay Times DeskNovember 6, 20263 min read

Zero-Days & CVEs

Truffle Security: 1.4 million exposed secrets still work

Truffle Security says 1.4 million secrets left in public code, images, and datasets are still valid, and 81% of keys it flagged last year still worked six months later. Revoke at the issuer, and rotate any key that left a private store.

ZeroDay Times DeskNovember 6, 20263 min read

Zero-Days & CVEs

Apple CVE-2024-27834: CISA's deadline is November 18

CISA put Apple's CVE-2024-27834 on the known-exploited list on November 4, with a federal patch date of November 18, 2026. Move iPhone, iPad, Mac, Safari, Apple TV, and Watch builds to the May 2024 fixes or newer.

ZeroDay Times DeskNovember 5, 20262 min read

Zero-Days & CVEs

EFS: three blood stores pushed hot, none lost

France's national blood service says a November 2 attack on refrigeration supplier Coolworld raised cold-room settings at three sites. Alarms caught it, and no blood products were lost. Treat remote refrigeration controls as production systems and alarm on setpoint changes.

ZeroDay Times DeskNovember 5, 20264 min read

Zero-Days & CVEs

OpenSSH '*sshole': locked accounts still log in

Unpatched OpenSSH on musl Linux, including Alpine, OpenWrt, and Alpine's images on AWS and Azure, can accept a password on accounts configured to refuse one. Install OpenSSH 10.6p2, or turn password logins off until that package is on the host.

ZeroDay Times DeskNovember 5, 20262 min read

Zero-Days & CVEs

cPGuard: a hijacked update reached 2,946 servers

OPSSHIELD says a hijacked cPGuard update on November 2 reached 2,946 Linux servers, copying password hashes, database settings, and SSH trust files, and that its own billing database was copied too. Install 5.88.25 or later, then rotate every secret the update cannot revoke.

ZeroDay Times DeskNovember 4, 20263 min read

Zero-Days & CVEs

CISA sets a Friday deadline for WordPress CVE-2026-119977

CISA added WordPress CVE-2026-119977 to the Known Exploited Vulnerabilities catalog after confirming attacks in the wild, and federal civilian agencies have until Friday to patch. Move every public site to WordPress 7.1.4.

ZeroDay Times DeskNovember 4, 20262 min read

Zero-Days & CVEs

Abrigo's Sageworks: borrower portal still down

Abrigo shut Sageworks down on October 30 after unexplained activity and, as of November 2, had restored the lending platform except borrower-facing features for more than 2,400 community banks and credit unions. Confirm which modules are back and rotate Sageworks API keys while the investigation stays open.

ZeroDay Times DeskNovember 3, 20263 min read

Zero-Days & CVEs

Barracuda CVE-2026-116606 chains to root on the email gateway

Barracuda Email Security Gateway is open to CVE-2026-116606, a 9.3 pre-authentication bypass that chains with CVE-2026-111560 to root. Pull the admin interface off the public internet and move ESG firmware to 9.4.0.029 or later.

ZeroDay Times DeskNovember 3, 20263 min read

Zero-Days & CVEs

Siemens IoT2050 CVE-2026-58115 plants remote command backdoors

Attackers are using CVE-2026-58115, a CVSS 10 missing-authentication flaw on Siemens SIMATIC IoT2050 Advanced, to run code and leave a command backdoor. Install Industrial OS 4.3.4.1 or later, or remove Node-RED.

ZeroDay Times DeskNovember 3, 20262 min read

Zero-Days & CVEs

CVE-2026-97229: Alpine rebuilt GitLab and reset every password

Alpine Linux rebuilt its development GitLab and reset passwords after October 20–21 attempts on CVE-2026-97229. A custom image had missed the Ruby fix. Pull the October 27 image and rotate CI secrets.

ZeroDay Times DeskNovember 2, 20263 min read

Zero-Days & CVEs

Polymarket refunds $2.7 million after a hijacked DebugBear script

A swapped DebugBear page-speed script on Polymarket sold or moved positions for signed-in traders on October 29, and the company is returning about $2.7 million to 726 wallets. Sites that load third-party code on pages where people sign should pin the file or remove it.

ZeroDay Times DeskNovember 2, 20263 min read

Zero-Days & CVEs

Android 'SMS of Death' can crash unpatched phones without a tap

CVE-2026-58882 is a zero-click cellular denial of service via malformed WAP Push SMS. Google's October 2026 fix covers Android 14–17. Older builds and late OEM updates stay exposed.

ZeroDay Times DeskNovember 1, 20263 min read

Zero-Days & CVEs

CVE-2026-112816: LXD and MicroCloud score CVSS 10.0

Canonical's LXD and MicroCloud can accept a caller as a trusted client when that caller holds only the client's public certificate and can reach the HTTPS API. Refresh the snap and confirm the fixed build is the one installed.

ZeroDay Times DeskNovember 1, 20262 min read

Zero-Days & CVEs

Brotli's decoder bug is on KEV: patch every stack that ships the library

CVE-2026-111497 lets a crafted compressed stream corrupt decoder memory. Node, Envoy, Python, and distro packages all carry copies. Federal due date is November 10.

ZeroDay Times DeskOctober 31, 20262 min read

Zero-Days & CVEs

CISA puts Cisco SSL VPN DoS on the exploited list with a November 1 clock

CVE-2026-76418 lets an unauthenticated caller reload ASA and FTD boxes that expose SSL remote access VPN with secondary authentication. Federal shops have until November 1.

ZeroDay Times DeskOctober 31, 20263 min read

Zero-Days & CVEs

Network DDoS rose 38% as short floods replaced the terabit attacks

Cloudflare mitigated 18.2 million layer-3 DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. The growth is bursts under ten minutes, sold by booter services.

ZeroDay Times DeskOctober 31, 20263 min read

Zero-Days & CVEs

Drupal says Commerce Core access bypass is already hitting live shops

CVE-2026-118539 skips authorization on routes and entity fields that touch money. Unauthenticated callers are in play. Patch Commerce Core and audit orders.

ZeroDay Times DeskOctober 31, 20262 min read

Zero-Days & CVEs

CISA puts GitLab's max-severity CI regex flaw on the exploited list

CVE-2026-97229 is a CVSS 10 issue in the CI/CD regex path. Federal shops have a short BOD clock. Everyone else should treat exposed instances the same way.

ZeroDay Times DeskOctober 31, 20262 min read

Zero-Days & CVEs

CISA sets a November 2 deadline on exploited Ivanti Connect Secure bug

CVE-2026-111357 lets a local caller on Connect Secure 22.8R2.4 become root. Volexity says it completed a zero-day chain to unauthenticated root. Patch, rotate directory secrets, and plan forensics.

ZeroDay Times DeskOctober 31, 20263 min read

Zero-Days & CVEs

Magento's PolyShell upload bug is on KEV and still landing files on disk

CVE-2026-48356 lets anyone push a file through Adobe Commerce and Magento guest-cart REST. Sansec tracked mass abuse. Apply APSB26-73, then look for what is already there.

ZeroDay Times DeskOctober 31, 20263 min read

Zero-Days & CVEs

WordPress upgrade race is already drawing tens of thousands of probes

Wordfence blocked nearly 63,000 attempts in a day against a core remote-code bug fixed in 7.1.4. The window is short. The polling is not.

ZeroDay Times DeskOctober 31, 20262 min read

Zero-Days & CVEs

TeamViewer fixed a flaw that lets the host hit the operator who connected

The machine being controlled could crash the viewer's client, and on some platforms go further. Patch the operator side. Do not assume the remote end is the only risk.

ZeroDay Times DeskOctober 30, 20263 min read

Zero-Days & CVEs

Unlisted Chrome extensions hijacked search on a reported 13.4 million installs

Socket counted 319 Chrome add-ons that sent queries through an operator's server on the way to Bing or Yahoo. The listing can vanish and the installed copy still owns the search box.

ZeroDay Times DeskOctober 29, 20263 min read

Zero-Days & CVEs

CVE-2026-98432 is patched upstream and still missing from Ubuntu and Red Hat

The kernel project scores a use-after-free in IPv4 TCP setup at 9.8. Debian and several other vendors have shipped fixes. Ubuntu and Red Hat had not, as of October 29.

ZeroDay Times DeskOctober 29, 20265 min read

Zero-Days & CVEs

Exposed SSH is still a patching problem with a name: CVE-2024-6387

Qualys called it regreSSHion. The durable lesson is that an admin service on the open internet needs an owner, a version, and a weekend plan.

ZeroDay Times DeskOctober 24, 20264 min read