CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →
‹Wed · 04 Nov 2026
All daily briefs →
Daily brief · UTC day

Wednesday, 4 November 2026

4 verified findings from 1 run · 6 updates to prior coverage · the settled record for this UTC day, in the classic brief order.

CriticalPatch every Cisco Secure Email Gateway now: unauthenticated root RCE via a single email, already exploitedCVE-2026-76461 +5 · exploited · updated 04 Nov 03:26Z
Criticality
Kind
Topic
Region
TL;DR · the day in one read
  1. 01Bitdefender: a 3AM affiliate joined a school estate's AD domains with new trusts after stealing Veeam credentials. Bitdefender MDR describes a September 2026 intrusion by a 3AM ransomware affiliate into a UK school estate that began as several unconnected Active Directory domains: a modified public Veeam script decrypted credentials stored on three backup servers, the attacker created two backdoor domain-administrator accounts, joined three domains with new two-way trusts within about three hours, tried to remove EDR agents (anti-tampering blocked it) and encrypted machines. Initial access is unknown, every attacker action Bitdefender saw came from an unmanaged internal host, and Bitdefender reads the 40 to 101 second retry cadence as a model-driven loop, flagged as its own interpretation; it says a new trust between domains is a rare change that is cheap to alert on. →
  2. 02Binance's report: fake recruiter, trojaned pyenv, AI-tool pivot and a deployment token reached the signing service. Binance's report of 2026-11-03 says the theft of about USD 6.34 billion on 2026-10-29 was a multi-stage campaign: in September a software engineer contacted through a job platform was led through two fake interviews and told to download an assignment repository to his work computer, whose setup code replaced the pyenv executable in the Homebrew install with a malicious one that endpoint protection did not detect. On 2026-10-20 the attacker used that computer and an internal AI tool to take over two wallet-team engineers and found a container-deployment token, which on 2026-10-29 let it deploy a container and run a script that reached the wallet signing service. The FBI says North Korea was responsible and calls the activity TraderTraitor; Binance says some technical details stay confidential. →
  3. 03cPGuard update channel pushed a fake root update to about 2,950 servers on 2 Nov; update, then rotate root secrets. OPSSHIELD's disclosure of 2026-11-03 says an attacker registered as a customer on its billing portal and ran commands on the billing and licensing server, through crafted requests to the portal's callback pages (the vendor's logs do not record the exact request that gave access), took the keys used to publish updates and shipped a fake cPGuard update for about 70 minutes on 2026-11-02 (02:08 to 03:20 UTC). The update ran as root on about 2,950 customer servers, copied password hashes, root SSH keys, the MySQL root password and root shell history (cloud storage keys on a few) and left a hidden root shell and a scheduled task; about 7,900 billing-portal accounts were exposed as well. The clean update 5.88.26 removes the shell and a follow-up update removes the task, but credentials copied before cleanup may still be usable. →

01Active threats, incidents & disclosures3 items

NOTABLENATOB2

3AM ransomware affiliate in a UK school estate: Bitdefender documents backup-credential theft, rogue domain admins and new two-way trusts between Active Directory domains, with a command-retry pattern it reads as a model-driven loop

Bitdefender MDR attributes the intrusion to a 3AM (ThreeAM) ransomware affiliate on the encryptor build and its command-line pattern; the target was a school estate in the UK whose domains began as separate Active Directory environments, and initial access is unknown (Bitdefender, 2026-11-03). In September 2026 the attacker first took credentials from the backup software: a modified copy of a public script read the credentials stored in Veeam's databases on three backup servers and decrypted them with the Windows Data Protection API, and a browser credential database was copied from a terminal server (Bitdefender, 2026-11-03). It then worked with built-in tools (PowerShell, WMI, reg, netsh, rundll32) and a few public ones (an Impacket-like remote-execution tool that returns output over administrative shares, Mimikatz renamed to look like a monitoring binary), enumerated domain trusts from a domain controller, searched SYSVOL logon scripts for the names and subnets of other schools, created two backdoor domain-administrator accounts, joined three separate domains with two-way trusts within about three hours, tried to remove EDR agents, which anti-tampering controls blocked, deleted system-state backups and encrypted machines with a Rust-based encryptor (Bitdefender, 2026-11-03).

Bitdefender's reading, which it calls interpretation and not a finding, is that a model drove part of the work: commands call the Veeam web interface on a port and with a login method that do not match the vendor documentation, output is self-labelled, scripts carry numbered revisions, and retries arrive 40 to 101 seconds apart whatever the size of the change, while a new task takes minutes. Every attacker action Bitdefender saw came from an unmanaged internal host with no agent, so the automation itself was never seen, and Bitdefender says it could not document anything about a language model (Bitdefender, 2026-11-03).

a new trust between domains is a rare change and cheap to alert on.

We were not able to access the machine the attacker worked from, so we cannot document anything about the language model itself

Bitdefender
incident04 Nov 03:55Zsingle-sourceOpen finding →
Sources: Bitdefender Business Insights
NOTABLENATOB2

Binance's own report on the 2026-10-29 theft of about USD 6.34 billion: a fake recruiter's coding assignment compromised an engineer's laptop, an internal AI tool carried the attacker to two colleagues and a container-deployment token, and a deployed container reached the wallet signing service; the FBI attributes it to North Korea's TraderTraitor

Binance says the theft of about USD 6.34 billion in digital assets on 2026-10-29 was "a sophisticated, multi-stage campaign" and not a single breach or a simple phishing incident (Binance, 2026-11-03). In September 2026 a software engineer whose job-platform profile named Binance was approached by a person posing as a project director, interviewed by a purported HR representative on live video and then by a purported CEO in a chat application, and told to download an "assignment" repository onto his work computer; its setup code replaced the legitimate pyenv executable in the Homebrew installation with a malicious version, repointed the symlink and spawned a zsh shell, and the 0-day malware was not detected by endpoint protection (Binance, 2026-11-03). On 2026-10-20 the attacker used that computer and an internal AI tool to gain control over a wallet DevOps engineer and a second wallet software engineer, and found a container-deployment permission token on the first engineer's computer; on 2026-10-29 it logged onto the second engineer's computer with the stolen credentials, deployed a container and triggered a script that launched the attack on the wallet signing service (Binance, 2026-11-03). Binance reports an earlier supply-chain event in June 2026, when a wallet DevOps engineer installed a tampered Homebrew installation while searching for an AI coding tool, and says its security team blocked 57 suspected North Korea-linked cases in 2026 (Binance, 2026-11-03). The FBI says North Korea was responsible and calls the activity "TraderTraitor" (FBI, 2026-10-31). BleepingComputer notes that fake job interviews leading to malware installs are a common tactic of the North Korean campaigns known as Contagious Interview and Operation Dream Job, a comparison Binance does not make (BleepingComputer, 2026-11-03).

The transfer to other organisations is the access chain, not the loss: a developer endpoint reached through a recruiting lure, a trojaned version-manager binary that endpoint protection missed, an internal AI tool that let one compromised user act on colleagues' machines, and a deployment token that turned one workstation into code execution in a trusted pipeline.

Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident.

The attacker leveraged the compromised computer of engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C.

The 0-day malware was not detected by the endpoint security protection tools at the time.

Binance

The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."

FBI 2026-10-31

Builds on: SentinelLabs: the same DPRK backdoors from a $292M crypto theft resurface on a victim with no…

incident04 Nov 03:50Zsingle-source · victim disclosureOpen finding →
Sources: Binance (Initial Findings and Response Update) · FBI · BleepingComputer
NOTABLENATOB2

OPSSHIELD cPGuard: an attacker who registered as a customer reached the vendor's billing and licensing server and shipped a fake update on 2026-11-02 that ran as root on about 2,950 Linux servers, copying root secrets and leaving a root shell and a scheduled task

OPSSHIELD says the attacker registered a customer account under a false identity on the vendor's billing portal, studied how the cPGuard agent talks to the licensing system with a trial install, sent crafted requests to the portal's callback pages, gained the ability to run commands on the billing and licensing server, took the keys used to publish updates and shipped a fake update for about 70 minutes on 2026-11-02; the vendor's logs do not record the exact request that gave access (OPSSHIELD, 2026-11-03). cPGuard agents installed the fake update between 02:08 and 03:20 UTC, and it ran as root (OPSSHIELD, 2026-11-03). The script copied the local password hashes, root's SSH private keys and authorization files, the MySQL root password and root's shell history back to the attacker, and root's cloud storage keys on a small number of servers; it also left a hidden root shell and a scheduled task (OPSSHIELD, 2026-11-03). The vendor puts the affected servers at about 2,950 and the exposed billing-portal accounts, with name, company, postal address, e-mail and hashed password, at about 7,900 (OPSSHIELD, 2026-11-03). A clean update, 5.88.26, removes the hidden root shell and a follow-up update removes the scheduled task (OPSSHIELD, 2026-11-03), but credentials copied before cleanup may still be usable (OPSSHIELD, 2026-11-03). The shared exposure is every operator of a cPGuard server: BleepingComputer says hosting firms and server administrators commonly run it alongside panels such as cPanel, DirectAdmin and Plesk (BleepingComputer, 2026-11-03).

The attacker signed up as a customer, used that account to break into our billing and licensing server, took the keys we use to publish updates, and shipped a fake cPGuard update for about 70 minutes on 2 November.

If your server had cPGuard installed and online between 02:08 and 03:20 UTC on 2 November, assume its root-level secrets are known to the attacker.

OPSSHIELD (security incident disclosure) 2026-11-03

A successful update removes the known files, but credentials copied before cleanup may still be usable.

OPSSHIELD (cPGuard security advisory) 2026-11-03
incident04 Nov 03:45Zsingle-source · victim disclosureOpen finding →
Sources: OPSSHIELD (security incident disclosure) · OPSSHIELD (cPGuard security advisory) · BleepingComputer
NOTABLECVE-2026-116606 +1NATOA2

CVE-2026-116606 / CVE-2026-111560, Barracuda Email Security Gateway: an unauthenticated configuration-import bypass chained with a root command injection through the administrative interface; patches are out and no exploitation is reported (CVSS 9.3 and 8.6)

Barracuda's advisory of 2026-11-02 covers two flaws that, chained, give root on the appliance: CVE-2026-116606, a pre-authentication authorization bypass in the Email Security Gateway, and CVE-2026-111560, a command injection that also affects the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway (Barracuda, 2026-11-02). Barracuda says successful exploitation requires access to the administrative interface and that, in combination, the flaws let an attacker bypass authorization controls and obtain root (Barracuda, 2026-11-02). Mandiant's disclosure describes the first as letting an unauthenticated remote attacker invoke the gateway's configuration-import function and restore a crafted backup archive, which changes the appliance's global configuration (Mandiant, 2026-11-02), and the second as shell metacharacters in the timezone configuration field that let an authenticated administrator run commands as root when the crafted value is processed, in Email Security Gateway versions up to 9.4.0.27, Load Balancer ADC versions up to 6.4.0, Web Application Firewall versions up to 11.0.1, Web Security Gateway versions up to 16.1.100.100, Message Archiver versions up to 5.5.4.0 and WAF Control Center versions up to 2.2.1 (Mandiant, 2026-11-02). NCSC Switzerland rates the exploitation status unknown and notes that the vendor's table lists administrative access as the authentication requirement although it calls CVE-2026-116606 a pre-authentication bypass (NCSC Switzerland, 2026-11-03). No source reports attacks or a public exploit.

Barracuda released patches (BNSF-40425 from firmware 9.4.017 and BNSF-40430 below it for the gateway, BNADC-16586 for the Load Balancer ADC and the Web Application Firewall, BNMA-32468 for the Message Archiver, BNWF-60060 for the WAF Control Center, BNYF-24789 for the Web Security Gateway) and asks customers to apply any patch that was not applied automatically and to turn automatic patching on (Barracuda, 2026-11-02). Its Campus article names firmware 9.4.0.029 or later for the Email Security Gateway (Barracuda Campus, 2026-11-02), while the CVE record lists versions earlier than 9.4.0.030 as affected (Mandiant, 2026-11-02); 9.4.0.030 or later satisfies both.

If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device

Successful exploitation requires an attacker to have access to the administrative interface of an affected product.

Barracuda Trust Center 2026-11-02

allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive

Mandiant (CVE-2026-116606 disclosure) 2026-11-02

allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed

Mandiant (CVE-2026-111560 disclosure) 2026-11-02

Appliances should upgrade to 9.4.0.029 and above.

Barracuda Campus 2026-11-02
vulnerability04 Nov 03:40Zmulti-sourceOpen finding →
Sources: Barracuda Trust Center · Barracuda Campus · Mandiant (CVE-2026-116606 disclosure) · Mandiant (CVE-2026-111560 disclosure) · NCSC Switzerland (Security Hub post 13144)

03Updates to prior coverage6 items

HIGHupdatedNATOA2

PK Softech, software supplier of Swiss pension funds: malware and a data outflow at Publica, with the City of Zurich fund PKZH saying its insured persons' test data was stolen, the Bernese funds BPK and BLVK and Pensionskasse Post also reporting the supplier incident, and the Federal Prosecutor's Office investigating

First published 2026-10-09 · open finding →

Updaterun 2026-11-04T0256Z-intelsummarysourcesevidencebodysourcing_note

The Pensionskasse Stadt Zürich suspended its planned 2027 move to PK Softech's administration system; PK Softech, quoted by watson.ch, cannot rule out that non-pseudonymised data was temporarily present in project work, and the Federal Prosecutor's Office has added the case to its criminal proceeding against the Akira group.

The Pensionskasse Stadt Zürich's foundation board suspended the introduction of PK Softech's administration system planned for early 2027 because of the supplier's cyberattack and will keep operating its existing system in 2027; it will decide whether, when and under what conditions to introduce a new system only once the attack and the possible data loss are worked through (translated from German) (Inside IT, 2026-11-03). PK Softech, quoted by watson.ch, says it cannot rule out that non-pseudonymised data was temporarily present in project-related work, and the Federal Prosecutor's Office confirmed to watson.ch that a notorious extortion gang is behind the attack and has added the case to its criminal proceeding against the Akira group, open since April 2024 (translated from German) (watson.ch, 2026-11-03).

Sources: Swiss Federal Administration (admin.ch) · PK Softech AG · watson.ch · Netzwoche · Netzwoche (running story, update of 2026-10-21) · Bernische Pensionskasse (BPK) · Bernische Lehrerversicherungskasse (BLVK) · Pensionskasse Post · Inside IT (AWP) · Publica (Pensionskasse des Bundes) · cash.ch (AWP) · Pensionskasse Stadt Zürich (PKZH) · Publica (Pensionskasse des Bundes), page updated through 2026-10-21 · Cybercrimepolice (cantonal police platform) · SwissCybersecurity.net · Inside IT · NZZ · Blick (SonntagsBlick) · Tages-Anzeiger (Tamedia, paywalled) · Tages-Anzeiger (Tamedia, paywalled; summary lines readable) · 20 Minuten · Ticinonline (relaying Corriere del Ticino) · Istituto di previdenza del Cantone Ticino (IPCT, letter to its insured) · Ticinonline · TicinoNews · EDÖB (Federal Data Protection and Information Commissioner), press release · Der Bund (Tamedia) · Publica (newsletter of 2026-10-22, Cyberangriff auf Softwarelieferanten: Was wir wissen und was nicht) · watson.ch (analysis)
HIGHexploitedupdatedNATOA2

Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controllers compromised, with forced defrost at hundreds of French supermarkets, refrigeration failures at more than 115 shops in at least six more countries and first cases in Germany, and on 2026-11-02 altered settings in the cold rooms of the French blood service through a refrigeration supplier; responsibility not established; ENISA and Europol call for immediate action

First published 2026-10-13 · open finding →

Updaterun 2026-11-04T0256Z-inteltitleheadlinesummarysourcesevidencesourcing_notebodyactions

The attacks reached Germany: heise reports an Edeka market in Reisbach whose cooling systems were heated to 50 degrees overnight into 2 November, WDR quotes a CAP supermarket manager saying the attack hit the firm that maintains the cooling plants remotely and reports that Rewe's head office confirmed an attack aimed at Danfoss; SentinelLABS says responsibility has not been publicly established; and Le Canard enchaîné reports that cold rooms of a contractor of the French blood service were programmed to 110 degrees overnight on 1 to 2 November, with no source tying that case to these controllers.

The first German cases followed on 2026-11-02: heise reports that the cooling systems of an Edeka market in Reisbach, Lower Bavaria, were heated to 50 degrees overnight into Monday and that the police have not confirmed a cyberattack as the cause, and WDR quotes a division manager at a CAP supermarket in North Rhine-Westphalia saying the actual attack hit the firm that maintains the cooling plants remotely, which is the operator's statement and not an authority finding, and Rewe's head office confirmed to WDR a cyberattack aimed specifically at the cooling-system supplier Danfoss, whose technology only a few regional Rewe stores use (translated from German) (heise, 2026-11-03; WDR, 2026-11-03). SentinelLABS' assessment of 2026-11-03 says responsibility for the European incidents has not been publicly established, calls Russian-aligned disruptive groups one credible hypothesis based on precedent, and says shared maintenance access deserves scrutiny (SentinelLABS, 2026-11-03). Le Canard enchaîné reports that Coolworld, a company that maintains refrigerated storage containers for the French blood service, was hacked overnight on 1 to 2 November and that cold rooms held at minus 30 degrees were programmed to reach 110 degrees; the blood service says an on-duty technician saw the temperature rise and acknowledges that frozen plasma intended for transfusion was among the products, and the Health Ministry says there was zero operational consequence because the situation was spotted (translated from French) (Le Canard enchaîné, 2026-11-03). The 110 degrees is the programmed set-point and not a measured temperature, and no source names the equipment, the vendor or the access method, or ties this case to the Danfoss and Copeland controllers.

Sources: CERT-FR (alert CERTFR-2026-ALE-012) · AFP (via Khaleej Times) · BFMTV · Infosecurity Magazine · BleepingComputer · CERT-FR (alert CERTFR-2026-ALE-012, revised version) · NCSC Switzerland (Security Hub advisory 13054) · Cooling Post · Blick · Censys · CERT-FR (alert CERTFR-2026-ALE-012, third version) · Dixell France (Copeland) · Le Monde · SecurityWeek · Cybersecurity Dive · Public Sénat · Le Monde Informatique · Forescout Research (Vedere Labs) · Reuters (republished by Internazionale) · Nextgov · The Guardian · Euronews · Tagesschau (ARD) · CyberInsider · 20 Minuten · heise online · WDR · SentinelLABS · Le Canard enchaîné · Établissement français du sang (press release, in French) · Coolworld International (statement) · ENISA (joint statement) · BleepingComputer (blood-storage refrigeration) · heise online (blood-bank cooling) · SRF · franceinfo · CSIRT Italia (bulletin BL02/261104/CSIRT-ITA) · CSIRT Italia (bulletin BL01/261013/CSIRT-ITA, version of 2026-11-04)
CRITICALCVE-2026-104935 +2exploitedupdatedNATOA1

CVE-2026-104935, Ivanti Connect Secure: an authentication bypass chained to code execution is exploited as a zero-day, the root-escalation step was patched on 2026-10-29 and CISA lists all three chain flaws (CVSS 8.6)

First published 2026-10-14 · open finding →

Improvementrun 2026-11-04T0256Z-intelcvessourcesevidencesourcing_notebody

Ivanti's own CVE record for CVE-2026-118527 (published 2026-11-03) now describes it as predictable filenames in Connect Secure before 25.1.1.3 and 22.8R2.6 that let a remote authenticated attacker upload files to a known location, and CERT-FR relays Ivanti's statement that all three chain flaws are actively exploited; the target builds and the compromise check are unchanged.

Ivanti's own CVE record for CVE-2026-118527, published on 2026-11-03, describes predictable filenames in Connect Secure before 25.1.1.3 and 22.8R2.6 that let a remote authenticated attacker upload files with attacker-controlled content to a known location on disk (ENISA EUVD, 2026-11-03). CERT-FR's advisory of 2026-11-02 relays Ivanti's statement that CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 are all actively exploited, lists Connect Secure 22.8Rx before 22.8R2.6, 25.1.1.x before 25.1.1.3 and 25.1.2.x before 25.1.3.1 as affected, and says Ivanti states that the 25.1.3.x releases are not affected by the last two (translated from French) (CERT-FR, 2026-11-02). The target builds and the compromise check above are unchanged.

Sources: Ivanti · Volexity · Rapid7 · CISA · Canadian Centre for Cyber Security · ANSSI / CERT-FR (CERTFR-2026-ALE-013) · GitHub Advisory Database · ENISA EUVD (EUVD-2026-98816, Ivanti as numbering authority) · CISA KEV catalog · ANSSI / CERT-FR (CERTFR-2026-AVI-1442) · ENISA EUVD (EUVD-2026-115872, Ivanti as CNA)
ROUTINEupdatedNATOA2

Canton Vaud: unauthorised access to the IT-support platform of its Gymnases and professional schools copied the names, school e-mail addresses and support requests of about 3,500 teachers and 38,000 pupils; police arrested a 16-year-old pupil of the schools on 2026-10-31

First published 2026-11-01 · open finding →

Updaterun 2026-11-04T0256Z-inteltitleheadlinesummarytagssourcesevidencesourcing_noteverificationbody

Vaud cantonal police announced on 2026-11-03 the arrest, on 2026-10-31, of a 16-year-old pupil of the affected schools, suspected of the intrusion into the IT-support platform between 23 and 26 October; he was questioned and released, his equipment was seized, and the juvenile court leads an investigation into how the intrusion happened and whether data were downloaded or passed to third parties.

Vaud's cantonal police announced on 2026-11-03 that a 16-year-old was arrested on Saturday 2026-10-31, suspected of intruding into the IT-support platform of the canton's post-compulsory schools and extracting data from it between 23 and 26 October 2026 (translated from French) (Le Temps, 2026-11-03). The education directorate says the suspect is one of its pupils and faces an administrative sanction, up to exclusion, that runs apart from the criminal case; he was questioned and released, his IT equipment was seized and is being analysed, and the investigation, led by the juvenile court, aims to establish the circumstances of the intrusion and whether data were downloaded or passed to third parties (Le Temps, 2026-11-03; Inside IT, 2026-11-03). The platform was disconnected from the internet on detection and then secured with the support of the canton's security operations centre, according to the police communiqué; the access method and the platform product are still not stated (Le Temps, 2026-11-03).

Sources: Etat de Vaud (press release of the Bureau d'information et de communication) · RTS · Inside IT (relaying Keystone-SDA) · Le Temps (ATS, relaying the Vaud cantonal police communiqué)
CRITICALCVE-2026-76461 +5exploitedupdatedNATOA1

CVE-2026-76461: Cisco Secure Email Gateway unauthenticated SQL injection in email parsing reaches root command execution, exploited before disclosure (CVSS 9.8)

First published 2026-09-15 · open finding →

Updaterun 2026-11-04T0256Z-intelcvesactionssummarybodyimmediate_actionreferencesheadline

Cisco re-released the 15.5.5-014 fix on 2026-10-31 in light of new information related to exploit code available online, and advisory revision 1.2 of 2026-11-03 tells administrators of 15.5 appliances patched earlier to confirm with retroscannerstatus that the Retro Remediation Engine runs version 4.0.2 or later; 16.5.0-780 needs no such check. Cisco's hardening advisory, revised on 2026-10-14, also says two vulnerabilities from its internal review are known to be actively exploited, this SQL injection and the arbitrary file write CVE-2026-76519, and names no fixed 16.0 release for the hardening CVEs.

Cisco revised the advisory to version 1.2 on 2026-11-03 with the note "Updated information related to Release 15.5.5-014 in the Fixed Releases table"; its footnote says that, in light of new information related to exploit code that is available online, Cisco released an updated version of the 15.5.5-014 fix on 2026-10-31, and it does not say what the earlier build missed (Cisco PSIRT, 2026-09-14). An appliance on the 15.5 branch that took 15.5.5-014 before 2026-10-31 must run the CLI command retroscannerstatus and confirm that Cisco Retro Remediation Engine runs version 4.0.2 or later, while 16.5.0-780 addresses the flaw regardless of that version and Cisco still recommends that releases earlier than 16.5 migrate to it (Cisco PSIRT, 2026-09-14). Cisco's hardening advisory, in its revision of 2026-10-14, says two vulnerabilities from its internal review are known to be actively exploited, the SQL injection above and the separately advised arbitrary file write (Cisco PSIRT, hardening-release advisory, 2026-09-14). For a 16.0 appliance the hardening advisory's table names no fixed release and says to migrate to one, so 16.0.4-302 closes the SQL injection only (Cisco PSIRT, hardening-release advisory, 2026-09-14). The statement that exploit code is available online is Cisco's alone.

Sources: Cisco PSIRT · CISA Known Exploited Vulnerabilities catalog (catalogue version 2026.09.14) · Cisco PSIRT (hardening-release advisory) · NCSC-NL
HIGHCVE-2026-119977exploitedupdatedNATOA2

WordPress core 4.7 to 7.1.3: an unauthenticated race in the core update process can lead to remote code execution, fixed in 7.1.4 and backported to every supported branch, listed by CISA as exploited; Wordfence assigned CVE-2026-119977

First published 2026-10-30 · open finding →

Updaterun 2026-11-04T0256Z-intelcvesprioritytagsheadlinesummarytitlesourcesevidencesourcing_notebody

CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on 2026-11-03 on evidence of active exploitation, so the flaw is now listed as exploited; the catalog entry names no victim or method, and Wordfence's probing telemetry remains the only described activity.

CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on 2026-11-03 on evidence of active exploitation (CISA, 2026-11-03), and the Canadian Cyber Centre's advisory of the same day relays the listing for WordPress Core before 7.1.4 (Canadian Centre for Cyber Security, 2026-11-03). The listing names no victim, attacker behaviour or exploitation method, so Wordfence's probing telemetry above remains the only described activity and Patchstack's high-complexity rating still stands. A site that ran a full-package core update on 4.7 to 7.1.3 while wp-content/upgrade/ was reachable needs the compromise check in the Detection line, not only the update.

Sources: WordPress.org · Wordfence · Patchstack · Wordfence Intelligence (CVE-2026-119977) · CISA · Canadian Centre for Cyber Security

04Action items8 items

Verification & coverage notes1 run

2026-11-04T0256Z-intel · Sonnet 5.5 · window 26 h · 4 entries published

Verification & coverage notes

Coverage window: standard (gap 24.0 h, previous run 2026-11-03T0256Z-intel; window 26 h; the 24.003 h gap is daily-cadence jitter, not an outage, so no outage-backfill sweep). Four new entries and six changelog records (5 update, 1 improvement); no deep dive (no candidate met the bar), no critical. The four new entries are Barracuda ESG (CVE-2026-116606 and CVE-2026-111560, notable), the cPGuard update-channel compromise (notable), Binance's own account of the 2026-10-29 theft (notable) and the 3AM affiliate intrusion into a UK school estate (notable).

Changelog records. update: CISA's KEV listing of CVE-2026-119977 on the WordPress core entry (the mechanical sweep's one COVERED-STALE row; priority notable to high); Cisco's re-release of the 15.5.5-014 fix and revision 1.2 on the Secure Email Gateway entry (critical stays; the exploit-code statement is Cisco's alone, and the pre-existing KEV-deadline wording in that entry was removed under the zero-warning rule, with immediate_action declared on the record); the arrest of a 16-year-old pupil on the Vaud school entry; the German cases, SentinelLABS' "responsibility not established" assessment and Le Canard enchaîné's blood-service cold-room report on the refrigeration entry (main analysis 737 words before and 736 after, so no growth; the entry stays over the 550 bound and is a candidate for the audit's trim); PKZH's suspended migration, PK Softech's non-pseudonymised-data statement and the Federal Prosecutor's addition of the case to its Akira proceeding on the Publica entry (the analysis is 1,148 words after 1,158, so it was not grown, the superseded PKZH sentence was rewritten in place). improvement (no float): CVE-2026-118527's CNA record and CERT-FR's confirmation that Ivanti calls all three chain flaws exploited, on the Ivanti Connect Secure entry.

KEV disposition. CVE-2026-119977 (COVERED-STALE) shipped as the update above; no RANSOMWARE rows and no NOT COVERED or MENTION-ONLY rows. Backlog. ARX Group SA / Aurora and the ChimeraZ commune claims were re-checked by S2 and S4: no victim, client, regulator or Swiss-press confirmation, so both stay held under their stated conditions (expiry 2026-11-07 and 2026-11-17) and no note was appended.

Source tension. Barracuda's Campus page names firmware 9.4.0.029 as the gateway fix while the CVE record lists builds before 9.4.0.030 as affected; the entry states both and resolves neither, and the mechanism and the per-product affected ranges come from Mandiant's per-vulnerability disclosures (the EUVD record returned an application-unavailable page). The vendor table calls CVE-2026-116606 pre-authentication while listing administrative access as the requirement, as NCSC Switzerland points out. cPGuard's earlier advisory estimate (32 retrieved files) and the spokesperson's 2,946 servers are kept only in the sourcing note, superseded by the vendor's later disclosure (about 2,950 servers and about 7,900 billing-portal accounts). The blood-service report rests on one weekly (Le Canard enchaîné); the 110 degrees is a programmed set-point. A composed BSI/Apple mercenary-spyware entry was withdrawn before the gate to match the 2026-11-03 incident-floor drop (see below).

  • borderline-drop: Control Web Panel CWP2Shell (ten VulnCheck CVEs, unauth chain to root, fixed 1.29), no constituency nexus established, no exploitation, niche hosting panel; marginal niche disclosure
  • borderline-drop: HPE Networking Fabric Composer HPESBNW05172 (46 CVEs, three 9.6-9.8), fix in regular cycle, no exploitation, no exposure-driven urgency, no constituency nexus
  • borderline-drop: Zyxel GS1900 CVE-2026-107441 and AP/FWA7 CVE-2026-76955, LAN-adjacent only (AV:A), no exploitation; regular patch cycle
  • borderline-drop: Kaspersky CyberStrikeAI (LLM orchestrator on the C2, education sector in Africa and Latin America), published 2026-11-02 08:00Z, outside the window; no constituency nexus; LLM-operated intrusion already covered (ARTEX, VAPOR PANDA, the 3AM entry)
  • borderline-drop: CERT-EU AI-agent harness backdoor lab experiment, lab experiment, no in-the-wild use; the in-the-wild analogue (Cursor marketplace extension) is covered
  • borderline-drop: GTIG/Mandiant LLMjacking, stolen cloud tokens drive fraudulent LLM spend, no constituency nexus; generic cloud-identity detection; unresolved CVE-2026-40217 mapping
  • borderline-drop: GTIG XCPE Android set-top-box botnet takedown, consumer/IoT residential-proxy botnet, no constituency nexus, no new decision for a SOC
  • borderline-drop: ESET APT Activity Report Q2-Q3 2026 (PD-9 periodic report), periodic recap; highly relevant findings already covered (UAC-0099/Sandworm entry); no Swiss-public-sector nexus; only the summary page read
  • borderline-drop: ESET Gorbag (Ukraine law-enforcement/defence targets), Ukraine-only victims, WinRAR CVE-2025-8088 already covered
  • borderline-drop: Team Cymru Cl0p second edition, planning-grade pattern recap of covered campaigns (first published 12 Aug, updated October), no new finding
  • borderline-drop: Check Point prompt adware (Codex jailbreak bundle), dual-use adware-style bundle, no constituency nexus
  • borderline-drop: WorkOS internal sales-app breach (ARTEX named by founder), CRM/support data only, no access path stated, no constituency nexus; ARTEX is already tracked
  • borderline-drop: Holcim confirms data theft, Emperador claim (~360 GB), incident floor: no access vector, actor behaviour or transferable lesson beyond the impact; private company
  • borderline-drop: Ukraine and Russia emergency-alert apps hacked (false nuclear warnings), already dropped on 2026-11-03; no vector, AP primary not read; no new fact in window
  • borderline-drop: Swiss GitLab exposure count (Inside IT relaying Shadowserver: 48 instances on CVE-2026-110264, 8 also on CVE-2026-97229), single secondary source, exposure count changes no action on an entry that already tells reader to patch now
  • borderline-drop: SiK-N motion 26.4717 (digital dependencies in procurement), a submitted parliamentary motion, no obligation or deadline for the constituency
  • borderline-drop: Federal Council transitional authorisation model for e-evidence to EU authorities, obligation concerns Swiss providers' legal handover, no defender-side consequence for the constituency
  • borderline-drop: BACS week 44 review (Plex and home-network compromises), private home networks, no public-sector nexus; Plex2Shell KEV date rests on search snippets
  • borderline-drop: Vaud CYBER26 crisis exercise 2026-11-12, an exercise invitation, not threat intelligence
  • borderline-drop: Zimperium Coruna/DarkSword chains by iOS version (update-of DeadTag), no change to the patch decision, the entry already tells readers to update iOS
  • borderline-drop: Android November bulletin (Framework RCE CVE-2026-58868 Critical), Chrome 157, Dell DSA-2026-416, Juniper JSA112183, Canonical LXD CVE-2026-112816, no exploitation reported or outside the window; regular patch cycle
  • borderline-drop: Amadeus breach, hold condition (Swiss or European carrier confirmation) unmet
  • borderline-drop: BSI: Apple mercenary-spyware threat notifications to Bundestag and government members (Apple: 99 countries), dropped on 2026-11-03 under the incident floor and nothing materially new in window beyond Apple's reach statement: no vector, actor or behaviour is public and no ATT&CK id is evidence-bound; the BSI guidance is individual-device hygiene and no source states a Swiss recipient or Swiss authority statement (composed as an entry in this fire, then withdrawn before the gate to stay consistent with the incident floor)

Source health: 291 probed; 287 relevant, 1 stale, 3 unreadable, every non-relevant record already handled (action breakdown 291 none), so no repair order was open. One new candidate, cert-eu-blog (S3: CERT-EU's own research blog outside the cert-eu advisories record); recipe notes added for zimperium-zlabs (working RSS feed set), bitdefender-threat-debrief, kaspersky-securelist, sentinellabs and nau-ch. extract fell back to the metered reader for the EUVD, CISA alert, Binance, FBI, SentinelLABS and Le Canard enchaîné pages in the deep read (eight reader calls: the three EUVD records, the CISA alert, Binance, FBI, SentinelLABS and Le Canard enchaîné); no WebFetch was needed by the main agent. The rotation ranked on the cursor (recent_attempts exclusion count 0, the cursor already spreads the pool).

Coverage gaps: ico-uk (403 on every transport, fourth run), connectwise-trust-center (403 on every transport; status page read), sygnia (blocked), rapid7-research (feed not well-formed, outside the slice), lab52 (SSL EOF, outside the slice), ox-security (feed lists dated items, bodies 403, lead-only), edoeb-ch-press (stale listing). Completeness note for the next audit: the 14-day prior-coverage index was loaded in full for its first 40 records and as an id/headline/CVE/entity/last-development projection for the remaining 47 to keep the main context compositional (the sub-agents read the whole file).

Operator note: an early command of this fire used a stale run id and overwrote three tracked files in work/2026-W26-b78503e7/ (prior_coverage.json, prior_coverage_keys.json, state-summary.json) in the working tree; they are not staged and are not part of this commit (restore with git checkout -- work/2026-W26-b78503e7/).

Verification. Eight iterations. Iteration 1 returned NEEDS_FIXES (22 findings, two truth-class rewrites: the cPGuard entry was rebuilt around the vendor's fuller 2026-11-03 disclosure, and the Barracuda entry around Mandiant's per-vulnerability records); iterations 2 to 6 closed the remaining truth findings (the iteration-2 spawn was lost to a container restart and respawned with the same scope; iteration 3 left 18 claims unanswered and was followed by a pass that covered them); iteration 7 returned CLEAN and the cold, full-scope confirmation pass of iteration 8 (231 of 231 claims) returned CLEAN, so the entries publish on a confirmed double-CLEAN with no residual truth or editorial finding. The advisory items left open, all low confidence: four Bitdefender-mapped technique ids unmapped on the 3AM entry, "five further internally-found vulnerabilities" counting CVE ids on the Cisco entry, Cisco's "proactively contacted" wording, the Wordfence Intelligence citation date on the WordPress entry, the 57-case figure's victim-statistic character on the Binance entry, and the attribution of the mechanism sentence in the Barracuda summary. Improvements noticed and not needed this fire, for the next audit: the refrigeration (736 words) and Publica (1,148 words) analyses are far over the 550-word bound and want a trim; a quality-audit pass could add OPSSHIELD to sources/sources.json.

Gate note: the one remaining source-urls warning is the two Mandiant disclosure pages on github.com answering 403 to the gate's own link check (a UA filter); the main agent and the verifier read both through extract and the raw files.