6 verified findings from 1 run · 5 updates to prior coverage · the settled record for this UTC day, in the classic brief order.
Criticality
Kind
Topic
Region
TL;DR · the day in one read
01Vaud: device-code phishing against Microsoft 365 is running in Romandie; several organisations already affected. The canton of Vaud said on 2026-11-04 that a Microsoft 365 device-code phishing campaign is running in French-speaking Switzerland and that several organisations are already affected: mail that appears to come from a company or a known contact leads the reader to type a code on a genuine Microsoft sign-in page, which gives the attacker access to the account. Microsoft documents a Conditional Access policy that blocks the device code flow for tenants that do not need it. →
02APT29-linked watering hole uses n-day iOS and Chrome chains; CISA lists CVE-2024-27834; updated devices resist. Sekoia reports a watering-hole campaign it assesses with moderate to high confidence to be APT29 or a subgroup, serving platform-specific exploit chains for iOS 16.7, a DarkSword-based iOS chain and Chrome 139 to 145 on Android through injected sites, clone domains and a one-week compromise of the Plerdy analytics script; Sekoia says none of the chains works against fully updated devices. CISA added the Apple WebKit pointer-authentication bypass CVE-2024-27834, the second step of the iOS 16.7 chain and fixed in May 2024, to its Known Exploited Vulnerabilities catalog on 2026-11-04; no Swiss victim is named. →
03SEPPmail gateway: unauthenticated sender reaches root RCE or file access; fixed in 15.1.1, 15.0.x has no fix. SEPPmail's patch release 15.1.1 of 2026-11-03 fixes five flaws in the Secure Email Gateway, with NCSC.ch as the CNA: CVE-2026-114424 lets an unauthenticated remote sender run operating-system commands as root through an active address-replacement rule that uses message-derived data, and CVE-2026-114425 lets one disclose, move or delete files as root when Large File Transfer is enabled (both CVSS 4.0 9.2). The vendor says 15.0.7 was the last 15.0 release, so 15.0.x gateways must move to the 15.1 branch; no source reports exploitation. →
The canton of Vaud said on 2026-11-04 that a phishing campaign is currently running in French-speaking Switzerland and that several organisations have already been affected (translated from French) (Canton of Vaud, 2026-11-04). The messages can appear to come from a company or a known contact and invite the reader to view an invoice, open a document or verify information through a link; the campaign uses device-code phishing, which gets the victim to type a code on a genuine Microsoft authentication page and so gives the attackers fraudulent access to the Microsoft 365 account (Canton of Vaud, 2026-11-04). The links printed in the notice combine a company-style name and a portal word on a workers.dev subdomain whose second label starts with a cloud-storage word and an identifier, and the canton says other addresses can be used too (Canton of Vaud, 2026-11-04); workers.dev is the route assigned to every Cloudflare Worker (Cloudflare Docs, 2026-09-22). The notice names no actor, kit, count of organisations, sector or start date.
Triage: Microsoft documents device code sign-in for shared devices and signage; a device-code sign-in by a user who has no such device, soon after that user received a mailed link, falls outside that use (Microsoft Learn, 2026-03-24).
A phishing campaign is currently running in French-speaking Switzerland. Several organisations have already been affected.
This campaign uses a technique called Device Code Phishing. It consists of getting you to enter a code on a legitimate Microsoft authentication page.
CISA added CVE-2024-27834, a WebKit flaw that lets an attacker with arbitrary read and write capability bypass Pointer Authentication and that Apple fixed on 2024-05-13, to its Known Exploited Vulnerabilities catalog on 2026-11-04, and names no victim or method (CISA KEV, 2026-11-04; Apple, 2024-05-13; Apple, 2024-05-13). The same day Sekoia reported a watering-hole campaign that it assesses with moderate to high confidence to be APT29 or one of its subgroups and in which that flaw is the pointer-authentication bypass of an iOS chain (Sekoia, 2026-11-04); the link between the listing and the campaign is the date alone. Sekoia retrieved three chains from the delivery host, which profiles the visitor and serves a platform-specific exploit without user interaction: an iOS 16.7 chain (CVE-2025-43529, then CVE-2024-27834) that steals the cookies of running apps; a DarkSword-based iOS chain that Sekoia's table labels iOS 18.5 (CVE-2025-43529 with CVE-2026-20700, then CVE-2025-14174 with CVE-2025-43510, then CVE-2025-43520) that harvests the phone; and an Android chain for Chrome 139 to 145 except 143 (CVE-2026-3910, then the Adreno driver flaw CVE-2025-27038) that takes Chrome cookies, saved logins, history and Wi-Fi configuration (Sekoia, 2026-11-04). The payloads exfiltrate data without establishing persistence, and Sekoia says none of the chains contains a zero-day or works against fully updated devices (Sekoia, 2026-11-04).
Delivery used JavaScript injected into legitimate sites, among them a Ukrainian gas producer, a US chemical-industry trade association, a Bulgarian military-related site and an Australian clinic; reverse-proxy clones of high-profile sites; and a one-week compromise, 27 August to 3 September 2026, of the Plerdy SEO tracker script, which Sekoia says exposed hundreds or thousands of sites, mostly Ukrainian (Sekoia, 2026-11-04). Sekoia names no Swiss victim, counts no infected devices and says it is working with national CERTs on victim identification.
None of them contain zero-days or work against fully updated devices.
These elements lead us to assess with moderate to high confidence that the intrusion set behind this watering hole campaign is APT29, or at least one of its subgroups.
Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.
On 2026-09-14 a Sophos employee cloned a public repository presented as a job-interview coding assignment and opened it as a workspace in VS Code; a weaponized workspace settings file replaced the editor's integrated terminal profile with a command that downloads and runs a remote script in a loop, delivery relied on the user opening the workspace as trusted, and no exploit or vulnerability was involved (Sophos RCA, 2026-11-04). Opening a terminal was enough: a shell script fetched a JavaScript component and a package manifest into a hidden directory in the user profile, a package-manager install ran, the JavaScript ran under Node.js and the final-stage backdoor lived in memory only, with no persistence found (Sophos RCA, 2026-11-04). SophosLabs identified the BeaverTail loader followed by the InvisibleFerret backdoor, able to steal browser-stored credentials, keychain data and SSH keys, and the JavaScript stage sent the process environment to an attacker web endpoint on a cloud application-hosting service (Sophos RCA, 2026-11-04).
Two gaps lengthened the exposure. The Sophos Endpoint agent was installed but its core services were not running, so it enforced nothing and reported nothing; the device was last seen in Sophos Central on 2026-06-11, the cause is still under investigation, and SophosLabs says a working agent would have blocked the chain at the first dropped file (Sophos RCA, 2026-11-04). A third-party application authorization on the employee's source-code platform account survived the session revocation and password reset of 2026-09-15 and made 27 read requests against two internal repositories from an address new to the user until it was revoked on 2026-09-16; Sophos found no other host, no cloud activity and no customer impact (Sophos RCA, 2026-11-04). The analysis names no group; Sophos CTU says the technique matches the tradecraft of NICKEL ALLEY, which it describes as running the Contagious Interview campaign of fake companies, fake recruiters and malicious code repositories (Sophos blog, 2026-11-04).
Triage: a terminal profile normally launches a shell executable; this one launched a command that downloads and runs a remote script in a loop; it came from the settings of a freshly cloned repository (Sophos RCA, 2026-11-04).
The repository contained a weaponized VS Code workspace settings file that replaced the editor’s integrated terminal profile. When a terminal opened in the workspace, the modified profile silently downloaded and ran a multi-stage payload.
The Sophos Endpoint agent was installed on the employee’s device but was not functional.
SEPPmail's revision history lists patch release 15.1.1 of 2026-11-03 with five security fixes in the Secure Email Gateway, all for versions before 15.1.1 (SEPPmail, 2026-11-03). Two are unauthenticated and rated 9.2: in CVE-2026-114424 attacker-influenced replacement text in sender or recipient address-replacement rules is evaluated as Perl code, so a remote sender can run operating-system commands in the mail-processing worker when an active rule uses message-derived replacement data and its search condition matches, and the validated worker context was root (ENISA EUVD, 2026-11-04); in CVE-2026-114425 a file path supplied in the attachment metadata of an incoming message lets the worker disclose, move or delete an accessible file when Large File Transfer is enabled, also as root (ENISA EUVD, 2026-11-04). CVE-2026-114426 lets an unauthenticated attacker exhaust workers and disk because the upload interface processed data before checking authentication (ENISA EUVD, 2026-11-04), and two flaws in the GINA webmail let an unauthenticated attacker take over a created but unregistered account with an empty initial password (CVE-2026-114421) and enumerate email addresses through an unescaped LDAP filter (CVE-2026-114420) (ENISA EUVD, 2026-11-04; ENISA EUVD, 2026-11-04). The vendor says 15.0.7 of 2026-09-02 is the last release of the 15.0 branch, so the fix for a 15.0.x gateway is the move to 15.1 (SEPPmail, 2026-11-03). None of the sources read reports exploitation.
An unauthenticated remote sender can execute operating-system commands in the mail-processing worker context when an active rule uses message-derived replacement data and its search condition matches. The validated worker context was root.
An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path. The validated workers ran as root.
SonicWall's advisory SNWLID-2026-0019 of 2026-11-03 covers the end-of-life Global Management System: an unauthenticated attacker with network access to GMS 9.5.2 and earlier may be able to read internal GMS files, potentially exposing sensitive information (CVE-2026-109593, CVSS 3.1 9.1), and a post-authentication SQL injection under specific conditions could let an authenticated attacker access or modify data (CVE-2026-109594, 6.8) (SonicWall, 2026-11-03). The advisory lists no workaround and no fixed version, says no remediation or security update will be released because the product has reached end of life, and strongly encourages migration to Network Security Manager (SonicWall, 2026-11-03). End of support was 2026-09-30 (SonicWall, 2025-05-05), and the previous GMS advisory of 2026-08-11 named 9.5.2 as the fixed build for its flaws, so the last fixed build is itself affected now (SonicWall, 2026-08-11). The advisory does not say which files are exposed or whether anyone exploits the flaw, and CERT-FR relays it (CERT-FR, 2026-11-04).
The affected product has reached End-of-Life (EOL). As a result, no remediation or security update will be released for these vulnerabilities.
An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.
SpecterOps shows that the Windows iSCSI Target Server role, set up as a community cluster guide describes it with the optional CHAP step skipped, accepts a login from any host that knows the target host, the target name and an authorised initiator name (SpecterOps, 2026-11-04). The post says the role registers a service principal name on its computer account, so a directory query lists the target hosts, that initiator names are built from the host's DNS name and are therefore predictable, and that in the author's experience the service has no rate limiting or brute-force protection (SpecterOps, 2026-11-04). Access is below the file system, so NTFS permissions do not apply, and volume encryption such as BitLocker defeats it (SpecterOps, 2026-11-04). The worst case the post shows is a volume that holds a Hyper-V domain controller's virtual disk, from which the local credential stores and the directory database can be taken (SpecterOps, 2026-11-04). The author has not tested the technique in production and warns that it can cause outages, and the post cites no Microsoft response.
Without CHAP authentication configured, all that’s required to “login” is to know what host has the iSCSI target service installed along with its iSCSI target IQN and its client initiator IQNs.
Arguably the most effective thing you can do is have proper network segmentation and host-based firewall configurations to isolate the drive
Citrix rates its XenServer bulletin Critical (XenServer 8.4 and 9, Workload Balancing and Conversion Manager affected, fixes named), XCP-ng released a kernel fix, MikroTik's RouterOS 7.25.1 and 7.24.6 list the CVE, and WatchGuard lists Fireware OS, AP and Dimension as potentially affected with no fix; Vates, XCP-ng and WatchGuard say a public exploit exists or circulates, which the MPTCP exploit being unable to run on XCP-ng and Fireware OS tempers, and no source reports attacks.
Citrix's bulletin CTX697256 of 2026-11-03, rated Critical, says an unauthenticated attacker on the management network may compromise a XenServer host and any running Workload Balancing or Conversion Manager appliance; it affects XenServer 8.4 and 9, Workload Balancing before 2026.1.1 and Conversion Manager before 2026.2.0, and Citrix has pushed updates to the Early Access and Normal channels of each XenServer line without naming a build and released Workload Balancing 2026.1.1 or later and Conversion Manager 2026.2.0 (Citrix, 2026-11-03). The bulletin states no exploitation.
Vates's advisory VSA-2026-056, published on 2026-11-03 and updated on 2026-11-04, rates the flaw critical for XCP-ng 8.3 and the Xen Orchestra Appliance, lists the fixed packages kernel-4.19.19-8.0.46.14.xcpng8.3 and, for the appliance, linux 6.1.190-1, requires a reboot, and gives an interim mitigation that drops inbound IP options, because without IP options the vulnerable code path cannot be reached (Vates, 2026-11-04). XCP-ng's post of 2026-11-04 says anyone who can send TCP traffic to the host, for example from its management network, VMs on it included, can attempt the attack, and tells hosts that cannot reboot at once to apply the iptables-based mitigation and not yet the update (XCP-ng, 2026-11-04). XCP-ng says a public exploit exists that relies on MPTCP, which the XCP-ng 8.3 kernel does not have, so it does not work against XCP-ng, while the underlying bug is present and other ways to exploit it cannot be ruled out (XCP-ng, 2026-11-04); Vates says the exploit does not affect XCP-ng and the bug is not specific to MPTCP (Vates, 2026-11-04).
WatchGuard's advisory WGSA-2026-0033 of 2026-11-03 lists Fireware OS, AP and Dimension as potentially affected with no fix, says Fireware OS and AP do not enable MPTCP and are not affected by the exploit chain circulating online, and says it will update the advisory when Ubuntu ships a fix for Dimension (WatchGuard, 2026-11-03). MikroTik's RouterOS 7.25.1 of 2026-11-02 and RouterOS 7.24.6 of 2026-10-30 list the CVE under "improve stability" (MikroTik, 2026-11-02; MikroTik, 2026-10-30). NCSC Switzerland's advisory 13120 of 2026-10-29 rates exploitation unknown with vendor patches available and names MPTCP listeners as the target of the known exploits (NCSC Switzerland, 2026-10-29). Fortinet's advisory is unchanged: still investigating, with no fixed build, and Known Exploited: No (Fortinet, 2026-11-02).
The French blood service EFS confirmed that an incident at its refrigeration supplier on 2 November altered the temperature and defrost thresholds of cold rooms at three of its sites, caught by its own alarms with no loss of blood products, so the case no longer rests on Le Canard enchaîné alone; ENISA, the European Commission, Europol and the CSIRTs Network advised organisations on 2026-11-04 to take immediate action, CSIRT Italia issued cold-chain measures, and no source ties the blood-service case to the Danfoss, Copeland or Dixell controllers.
The French blood service EFS confirmed on 2026-11-03 that on 2 November a refrigeration-equipment supplier suffered a cybersecurity incident that affected the supervision and control installations of cold rooms at three EFS sites, with temperature and defrost thresholds raised to very high values (translated from French) (EFS, 2026-11-03). EFS says its own monitoring and alarm systems identified the anomalies quickly, the affected equipment was brought under control without impact on the products or neutralised, the products stored in those cold rooms were transferred preventively to other installations, and no health impact or loss of blood products is to be reported; it names no supplier and gives no temperature figure (translated from French) (EFS, 2026-11-03).
BleepingComputer, heise and SRF identify the supplier as Coolworld, and SRF reports that the attackers reportedly entered through its remote maintenance (BleepingComputer, 2026-11-04; heise, 2026-11-04; SRF, 2026-11-04). Coolworld's statement of 2026-11-04 says the incident involved remote monitoring software, that the vulnerability reported in the media relates to a component from a third-party supplier outside its control and that a limited number of its units were affected; it does not say that attackers exploited that component (Coolworld, 2026-11-04). BleepingComputer's account reads it the other way, saying Coolworld says the attackers exploited a vulnerability in a third-party component, which the statement does not state (BleepingComputer, 2026-11-04). No source names Danfoss, Copeland or Dixell equipment for this case.
ENISA, the European Commission (DG CNECT), Europol's EC3, the EU CSIRTs Network and EU-CyCLONe issued a joint statement on 2026-11-04: since 11 October 2026 several commercial refrigeration systems and similar devices have been hit in a number of EU Member States, a new wave occurred on 1 to 2 November, affected Member States are investigating and issuing guidance, and organisations are advised to take immediate action to mitigate exposure in the affected systems; it names no product, actor or count and does not mention Switzerland (ENISA, 2026-11-04). CSIRT Italia's bulletin of 2026-11-04 extends its call to every operator of cold-chain technology, whatever the sector, to apply its earlier measures urgently, removing direct internet exposure of administrative and control interfaces and verifying that operating parameters and alarms are intact first (CSIRT Italia, 2026-11-04). Its bulletin of 2026-10-13, re-issued on 2026-11-04 as version 1.2, asks operators to limit supplier access to authorised resources and periods, to require multi-factor authentication on remote access, applied on the mediating system when the device cannot do it, and to check actual temperatures and alarms with instruments independent of the supervision platform (CSIRT Italia, 2026-11-04). The BSI had urged operators of networked freezer controllers to disconnect them from the internet or at least secure and patch them (heise, 2026-11-04).
Binarly shows the exploit GreyNoise described works against all ten June-fixed GS1900 builds because it targets a separate flaw, CVE-2026-107441, which Zyxel fixed in the .3C0 builds on 2026-10-22 and disclosed on 2026-11-03; the .3C0 builds replace the .2C0 builds as the remedy, and exploitation of the new CVE rests on Binarly's exploit match, which neither Zyxel nor CISA confirms.
Binarly reports that the Python exploit GreyNoise described, which it found in an exposed archive on infrastructure that BleepingComputer ties to Red Heron (BleepingComputer, 2026-11-04), targets a flaw in the request-parameter parser of the switches' CGI (dispatcher.cgi), not the stack overflow of CVE-2026-7273, and that it works without change against the "…(x).2C0" builds Zyxel advertised as the June fix; Binarly confirmed this against all ten builds on 2026-09-28 (Binarly, 2026-11-03). Zyxel treats the report as a separate vulnerability, CVE-2026-107441, fixed on 2026-10-22 in the "…(x).3C0" builds of GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48 and -48HPv2 and disclosed in an advisory of 2026-11-03 that credits Binarly and shows no score or exploitation statement (Zyxel PSIRT, 2026-11-03; Binarly, 2026-11-03). Binarly labels the flaw an in-the-wild zero-day on the strength of the exploit match, scores it 9.8 with a network vector against Zyxel's LAN-based wording, and says it will publish a minimised proof of concept; CISA's catalog of 2026-11-04 lists only CVE-2026-7273 (Binarly, 2026-11-03; Binarly, 2026-11-03; BleepingComputer, 2026-11-04; CISA KEV, 2026-11-04). Switches on the June build are therefore still exposed to the exploit until the "…(x).3C0" build is installed.
Splunk's advisory lists Splunk Enterprise 10.0 and lower, its Visual Exporter app, SOAR Automation Broker, UBA and Attack Analyzer as including packages affected by four Node.js flaws, CVE-2026-111497 among them, with Splunk Enterprise 10.2 or higher as the upgrade target and the Visual Exporter app to be disabled, and Citrix names Unicon eLux Scout with hotfix 2609.1, 2508 CU2 LTSR and 2605.1-3 as the fixes.
Splunk's advisory SVD-2026-1015, published on 2026-10-28 and updated on 2026-11-04, lists Splunk Enterprise, the Splunk Visual Exporter app, SOAR Automation Broker, UBA, Attack Analyzer, Python for Scientific Computing, several AppDynamics components and Smartlook as including packages affected by four Node.js flaws, CVE-2026-111497 among them; the page gives no CVSS score, no attacker position and no exploitation statement, and it covers the Brotli flaw and three DNS and TLS hostname-validation flaws together, so it does not show which of them reaches a given product (Splunk, 2026-10-28). Splunk Enterprise 10.0 and lower is vulnerable, Splunk recommends upgrading to 10.2 or higher for the bundled Node.js runtime and plans to upgrade the packages in a future 10.0 release, and the upgrade does not remediate the Visual Exporter app, which every Splunk Enterprise version includes and which Splunk says to disable or remove (Splunk, 2026-10-28). The page gives no fix for the other listed products.
Citrix bulletin CTX697300, published on 2026-10-30 and revised on 2026-11-03 with remediation for the LTSR and Cloud Gateway products, lists Unicon eLux Scout as affected by CVE-2026-111497 alone and names the fixes as hotfix 2609.1 for Scout On-Prem, 2508 CU2 LTSR for Scout On-Prem LTSR and 2605.1-3 for Scout Cloud Gateway On-Prem, without a vulnerable version range or an exploitation statement (Citrix, 2026-10-30). Neither Splunk nor Citrix says anything on malicious use against its products.
Xerox's bulletin of 2026-11-03 adds two interim measures for AltaLink, EC81xx, VersaLink and WorkCentre devices, restricting the web interface to trusted networks or management hosts or disabling HTTP/HTTPS, and says the vulnerable PHP component serves a limited number of pages of the embedded web server; fix dates are unchanged.
Xerox revised bulletin XRX26-016 on 2026-11-03 and added a mitigation section for AltaLink, EC81xx, VersaLink and WorkCentre devices, which the version of 2026-10-28 did not carry (Xerox, 2026-11-03; Xerox, 2026-10-28). It says the vulnerable PHP component is used by a limited number of pages in the device's embedded web server, and that until the fix is installed customers can restrict the web interface (HTTP/HTTPS) to trusted networks or management hosts, for example with a firewall or segmentation, or disable HTTP/HTTPS if remote web administration is not required, which also disables the embedded web server and the features that depend on it (Xerox, 2026-11-03). The section does not cover the Fiery Digital Front End or the Worldwide Ticketing Tool, and the affected table and the fix dates are unchanged.
In every Microsoft 365 tenant your organisation runs or administers, audit device code sign-ins with the authentication protocol filter of the sign-in logs and, where no documented device needs the flow, create a Conditional Access policy with the Authentication flows condition set to Device code flow and Block access, starting in report-only mode and excluding emergency-access accounts and, where devices register through it, the Device Registration Service.
Move every managed iPhone and iPad to the newest iOS available for its model and every managed Android phone to Chrome 146 or later and the OEM patch level that fixes CVE-2025-27038, and list the devices that cannot go past iOS 16.7.x (iPhone 8, 8 Plus, X, iPad 5th generation, iPad Pro 9.7-inch and 12.9-inch 1st generation per Apple), because Sekoia's chains do not work against fully updated devices and CISA lists all eight flaws they deliver as exploited.
Upgrade every SEPPmail Secure Email Gateway to 15.1.1 now, moving 15.0.x gateways to the 15.1 branch because 15.0.7 is the last 15.0 release, and check each gateway's active address-replacement rules for values taken from the message and its Large File Transfer setting, the two conditions the CNA names.
Update every Node.js 22.x, 24.x and 26.x runtime to 22.23.4, 24.22.1 or 26.12.1, including the Node binary inside container images (a Dockerfile that pins 24.22.0 keeps the flaw until the pin changes), and upgrade the PyPI Brotli package to 1.2.1 and brotlicffi to 1.2.1.0 wherever either is installed; judge a Node.js build by its release version, because process.versions.brotli reads 1.2.0 on patched builds too, and move any application on an end-of-life Node.js line to a supported release. On every WordPress host, upgrade the operating system's libbrotli package to a patched revision (check the package revision, because Debian and Ubuntu backport the fix into 1.1.0) and rebuild WordPress container images, since the official wordpress:latest image still carried a vulnerable libbrotli1 when Patchstack wrote.
Update every Envoy proxy that has the Brotli decompressor configured to v1.40.0, v1.39.3, v1.38.6, v1.37.8 or v1.36.12; the advisory names v1.39.2, v1.38.5, v1.37.7 and v1.36.11 as vulnerable. On every VMware Cloud Foundation SDDC Manager apply Broadcom's workaround, KB460732 on 9.1.1 and KB460734 on 9.1.0, 9.0.x and 5.2.x, until its patch ships. Upgrade every Splunk Enterprise 10.0 and lower to 10.2 or higher and disable or remove the Splunk Visual Exporter app on every Splunk Enterprise instance, because the upgrade does not remediate it, and install Citrix hotfix 2609.1, 2508 CU2 LTSR or 2605.1-3 on Unicon eLux Scout.
On every PA-Series and VM-Series firewall on PAN-OS 12.2, 12.1 or 11.2 that has TLS decryption enabled, run show system setting brotli and, where it returns Enabled: yes, run set system setting brotli-encoding disable until the hotfix for the release is installed; Palo Alto's timeline of 2026-10-29 lists every PAN-OS hotfix for this flaw as released.
Install each Zyxel GS1900 switch's "…(x).3C0" build now (2.90(AAHL.3)C0 on the GS1900-24, for example), including switches already moved to the June "…(x).2C0" build, which Binarly shows still carries the flaw the recovered exploit targets, and audit and rotate any switch still on its factory-default admin credentials: GreyNoise found 564 of 996 exploited switches (57%) had never had theirs changed, which lets the actor re-enter even after the hashed credential set is rotated.
List the computers in Active Directory that carry the service principal name the iSCSI Target Server registers and every host that listens on TCP 3260, then enable CHAP on each target and restrict TCP 3260 to the addresses of the cluster nodes, starting with targets whose volumes hold Hyper-V disks of domain controllers.
Until Xerox's fixes ship (AltaLink, EC81xx and VersaLink expected 2026-11-06; WorkCentre 3655, EC7836 and EC7856 in development), limit the web interface (HTTP/HTTPS) of those printers to trusted networks or management hosts with a firewall or segmentation, or disable HTTP/HTTPS where remote web administration is not needed, accepting that this also disables the embedded web server and the features that depend on it.
On every internet-facing Linux server and every XenServer or XCP-ng host with its Workload Balancing and Conversion Manager appliances, install the vendor's fix and reboot as soon as it ships, then confirm the running version; Red Hat, Debian, CIQ, Amazon Linux, XCP-ng, MikroTik and Citrix updates are out, and XCP-ng says that a host which cannot reboot at once should take its iptables-based mitigation first and the update later.
On hosts that cannot reboot yet, drop IPv4 TCP packets that carry IP options ahead of the TCP stack as CIQ, AWS and Vates describe, after testing on one non-production host because it also drops legitimate option-bearing traffic; disabling MPTCP alone does not close the path.
Find every SonicWall GMS instance on 9.5.2 or earlier, Virtual Appliance or Windows, cut its reachability from untrusted networks and schedule its replacement with Network Security Manager, because SonicWall will release no fix and names no workaround.
2026-11-05T0255Z-intel· Sonnet 5.5 · window 26 h · 6 entries published
Verification & coverage notes
Coverage window: standard, 26 h (previous intel run 2026-11-04T0256Z-intel, gap 24.0 h); no outage backfill. Source rotation ranked on the cursor; the previous two fires' attempts excluded 27 (S1), 31 (S2) and 37 (S3) standard records, and the exclusion was waived for S4 because all 14 breach-domain sources had been attempted by those fires.
The entity registry (704 KB) was grepped by key and alias, not read whole; the 14-day coverage index, the state digest and the taxonomy were read in full. S5 intake: no closed-source drops.
Backlog: the ARX Group SA row stays held (S4 re-checked the ransomware.live record, a breach tracker, the ARX site, German and Italian searches and the Inside IT, Netzwoche and SRF feeds: no confirmation; expiry 2026-11-07 unchanged). The ChimeraZ row stays held (no commune, canton, zone or Swiss press confirmation; FrenchBreaches still calls the hack unconfirmed; expiry 2026-11-17 unchanged). Neither row changed state, so nothing is appended to them. The Amadeus hold of 2026-11-04 stays dropped (six Asian carriers, no European confirmation).
KEV sweep (work/2026-11-05T0255Z-intel/kev-window.txt): one addition in the window, CVE-2024-27834, NOT COVERED, published as the new entry on the Sekoia APT29-linked watering hole. No RANSOMWARE row for a covered CVE appeared in the window. S1's diff against the 2026-07-29 snapshot found 26 older flips; the one that touches covered ground, CVE-2025-8088 (WinRAR, ClamAV's bundled UnRAR), is a borderline-drop below.
borderline-drop: S2-2 Federal Supreme Court blocking ruling: no obligation change for defenders
borderline-drop: S2-3 EFK audit of BACS reporting platform: oversight, no change to reporting obligation
borderline-drop: S2-4 Eye-Able supplier incident: no public-sector customer shown, no vector
borderline-drop: S2-5/S4-2 Holcim + Emperador: private multinational, no vector or TTP (incident floor)
borderline-drop: S2-6 SiK-N motion 26.4717: filing-stage motion, no obligation
borderline-drop: CVE-2025-8088 ransomware flag, the KEV record reads Known in catalog 2026.08.07 and Unknown in 2026.07.29 (FU4 bracketed the flip from committed snapshots), so it is not a development of this window; CISA names no group, and no source names a ransomware actor using the flaw. Four store entries cite the CVE and none mentions ransomware; the 2026-10-29 MDaemon and ClamAV entry is the natural home if the audit judges it worth a line. FU4 also found two older defects for the audit: the 2026-06-02 Sekoia/Gamaredon entry dates the WinRAR 7.13 fix to "August 2025" while ESET says 2025-07-30, and the 2026-06-27 Turla STOCKSTAY entry says "Patch WinRAR to 7.11+" while ESET names 7.13 as the fix.
Single-source and carve-outs: the Vaud device-code notice (single-source, first-party cantonal authority, no corroboration found in nine German and French searches and the NCSC.ch hub); SEPPmail (single-source: NCSC.ch is the CNA and the vendor page describes the same flaws, one assessor); the APT29-linked watering hole (single-source Sekoia; The Hacker News and BleepingComputer relay it); the Windows iSCSI Target Server research (single-source SpecterOps, Pen Test Partners 2016 only for the port); Sophos RCA INC-2026-002 (single-source-victim); SonicWall GMS (single-source vendor, CERT-FR relays it).
Contradictions disclosed in the entries and not resolved: Zyxel calls the attacker LAN-based while Binarly and BleepingComputer say network access suffices, and Binarly, with BleepingComputer repeating it, calls CVE-2026-107441 an exploited zero-day on the strength of the exploit match while Zyxel and CISA do not connect the activity to it; Vates, XCP-ng and WatchGuard say a public exploit exists or circulates while Akamai knows of none and the MPTCP exploit does not run on XCP-ng or Fireware OS; SEPPmail's vendor page lists the CVSS scores of CVE-2026-114420 and CVE-2026-114421 the wrong way round against the NCSC.ch CNA records.
Advisory items left for the next quality audit (low-confidence F11, each marked may-be-left by the verifier): the Vaud wording of the notice's company placeholder, the CloudLinux and AWS date labels on the kernel entry, the iSCSI sourcing note's Pen Test Partners remark, the APT29 CVE-2025-43529 fixed-field wording, the kernel sourcing-note capital, the SEPPmail 'two are unauthenticated' phrasing and the four vendor tasks bundled in Node2Shell actions[1].
Reduced confidence: none. Entries whose primary needed a non-default transport: the Binarly pages (rendered from the page payload), the SonicWall PSIRT tables (reader, html mode) and the Sophos RCA analysis sections (raw page; extract truncates them), so a verifier reading them with extract will not see those passages.
Deep read: the will-publish set was 12 items (6 new, 6 changelog records), above the eight the prompt names, so the deep read ran as four scoped cti-research follow-ups (FU1 to FU4) after Phase 1 returned; the main agent composed from their claim tables. One follow-up (FU2) reports a classifier stop on its first write of the SpecterOps attack steps and rebuilt the item at awareness level, which is the level the entry keeps.
One planned changelog record was dropped after the deep read (CVE-2025-8088, above), leaving 5 updates: Danfoss (update), Zyxel GS1900 (update), CVE-2026-98432 (update), Node2Shell/Splunk (update) and the Xerox PHP2Shell entry (update: bulletin v5 of 2026-11-03 is a post-publication development, so it floats).
Entry rewrites replaced text instead of adding it: the Danfoss (736 to 735 words), Node2Shell (549 to 539), CVE-2026-98432 (546 to 546) and Zyxel (641 to 613) analyses did not grow.
Sources: three new candidates (seppmail-gateway-revision-history, enisa-cnw, binarly-blog), each with its reason in sources_changed[]; cert-eu-blog promoted to active on the digest's promotion_due (10 contributing runs); recipe notes appended for ox-security, sekoia, cisa-advisories, sonicwall-psirt, xerox-security-bulletins, fuitesinfos, netzwoche, cyberinsider, bitdefender-threat-debrief, ransomware-live and trellix. The CISA recipe note records that WebFetch returned 403 on every cisa.gov HTML path today, so the 2026-10-21 and 2026-10-23 notes that WebFetch reads the listing no longer hold.
Coverage gaps: ico-uk (403 on every transport, WebSearch found nothing in the window); connectwise-trust-center (403, status page substituted); cisa-advisories HTML pages (403; cisa-kev and cisa csaf-recent worked and WebSearch found no AA-series advisory); ibm-support-security-bulletins (not attempted, no listing transport; a relay sweep through BSI found only a QRadar XSS and a WebSphere DoS); Inside IT body (paywalled, in the page's embedded data); cyber.gouv.fr RSS (XML parse failure); securityweek and therecord feeds too short for the 168 h lookback; crowdstrike feed carries product news only; Rapid7 feed unparseable.