01SonicWall SSL VPN bypasses SAML MFA and CISA lists it exploited; upgrade Gen7 to 7.3.4-7013, Gen8 to 8.2.3-8015. SonicWall's advisory SNWLID-2026-0014 of 2026-11-06 fixes CVE-2026-19868, an SSLVPN authentication enforcement flaw (CVSS 3.1 7.1) that lets a user with valid credentials for an alternate authentication method bypass SAML, MFA enforced through SAML included, on Gen7 firewalls up to 7.3.3-7015 and Gen8 up to 8.2.2-8015 when SAML is enabled for SSLVPN logins. SonicWall says it investigated a report indicating potential exploitation and CISA lists the flaw as exploited; there is no workaround, and 7.3.4-7013 and 8.2.3-8015 fix it. →
02Oneconsult: a site granted a folder in Chrome or Edge can steal tokens and plant VS Code and PowerShell persistence. Oneconsult's analysis of Chromium's Windows blocklist shows that a website granted a folder through the File System Access API after two clicks keeps a handle for as long as the tab is open, and that the blocklist leaves .vscode, .Azure, C:\Users\Public, SMB shares and, after a OneDrive Known Folder Move, the Desktop reachable. The paths it demonstrates are token and .env theft, a fake VS Code extension and PowerShell profile or module backdoors that need the Bypass or Unrestricted execution policy, and a file proxy through the open tab that EDR sees only as browser file activity. →
03Kaspersky: ESXi and Proxmox ransomware ran on a monitoring server's root password and admin notes, no VM escape. Kaspersky's Global Emergency Response Team describes two ransomware cases in virtualised estates. In the BlackNevas case a PRTG Network Monitor held ESXi root access and the same root password was reused across hosts, so the attacker connected over SSH, disabled the execInstalledOnly policy with esxcli, ran the encryptor and deleted logs; in the case attributed to The Gentlemen the actor found Proxmox root credentials in plaintext notes on an administrator workstation and used the VNC web socket to encrypt the cluster. Kaspersky stresses that no VM escape was needed. →
The Technical University of Munich says unknown persons attacked its myTUM portal and captured the passwords for the central login to TUM systems, among them login.tum.de and TUMonline, from all persons who had logged in to myTUM; among them were the access credentials of a system administrator for TUMonline, with which the attackers attacked the central campus-management system TUMonline, which TUM then took off the network (translated from German) (TUM, 2026-11-06). TUM says the attackers may have reached the account password, name, private address and date of birth of everyone affected, plus staff and student details, that the attackers' accesses within TUMonline were largely logged and that it currently assumes no further TUMonline data such as grades is affected, and that accounts with multi-factor authentication were protected in this attack (translated from German) (TUM, 2026-11-06). heise, quoting a TUM spokesperson, reports that the attackers entered through a legacy system and that whether data was exfiltrated is still being investigated, and adds that about 60,000 students and employees are concerned (translated from German) (heise online, 2026-11-06). Neither source states how the passwords were captured at myTUM.
In doing so they captured passwords for the central login to TUM systems (e.g. login.tum.de, TUMonline, etc.), namely from all persons who had logged in to myTUM. (translated from German)
Among these were also the access credentials of a system administrator for TUMonline. (translated from German)
User accounts with MFA were protected in this attack. (translated from German)
Technische Universität München
incident07 Nov 04:03Zsingle-source · victim disclosureOpen finding →
In the first case, Kaspersky's investigation began with BlackNevas ransomware activity on a Windows system in a virtualised domain-controller segment, where the execution of the AnyDesk remote tool and the GMER binary was recorded (Kaspersky GERT, 2026-11-06). The environment used PRTG Network Monitor, whose deployment had broad access to the ESXi hosts, and the same root password was reused across several nodes; after obtaining access to the monitoring environment the attacker used the ESXi credential to connect over SSH to the hosts that shared the password (Kaspersky GERT, 2026-11-06). On the first host, a file was uploaded during a root SSH session and its first execution failed with "Execution of non-installed file prevented"; the actor then disabled the execInstalledOnly policy with esxcli and ran it, while on a second host in another subnet with the same password the binary ran and the logs were cleared (Kaspersky GERT, 2026-11-06).
In the second case, a ransomware incident by The Gentlemen, the actor used information it had collected between initial access and visible impact: on a compromised system administrator's workstation it found Proxmox root credentials and access details in plain-text notes and logged in as root (Kaspersky GERT, 2026-11-06). It then activated the VNC web socket through the root account, which gave it control of the Proxmox environment, and used that access to download and run the ransomware in the cluster, encrypting the whole virtual environment (Kaspersky GERT, 2026-11-06). Kaspersky says a fully patched hypervisor can still be compromised through a shared password, an overprivileged monitoring account, an open SSH path or an administrator interface reachable from a general server network (Kaspersky GERT, 2026-11-06).
A monitoring system that could reach the virtualization layer also exposed a reusable root credential.
No VM escape was required.
Password reuse converted one recovered secret into farm-wide access.
Acronis TRU found an open attack workstation holding more than 90,000 files and describes BOSSAI as a mesh of 12 AI agents, nine active, driven by a changing roster of language models, with the operator acting as the bridge between agents and typing commands in Traditional Chinese (Acronis TRU, 2026-11-04). The agents that executed attacks ran almost exclusively on abliterated open-weight models run locally, after commercial models repeatedly refused offensive requests (Acronis TRU, 2026-11-04). In the 12 days TRU observed, the operator targeted government emergency services, banks and lenders, universities and military systems in 11 countries, with confirmed exfiltration or system access at roughly ten targets in three countries and about fifteen more attacked without confirmed compromise (Acronis TRU, 2026-11-04).
The confirmed emergency-services harm is the part that matters here. A Taipei fire-department patient-care records platform exposed ECG readings, ambulance video and vital signs from 2018, accessible without credentials; a city's 119 dispatch system yielded case records with incident times, response types, status fields and street-level locations across seven districts from the system's API; and a fire-dispatch vendor's database administration panel opened with default root credentials, exposing 18 or more tables (Acronis TRU, 2026-11-04). In an emergency-management system the agents found a hardcoded AES-256 key in front-end JavaScript that exposed session-cookie contents, an administrator identity among them, and a partial server-side request forgery path, without confirming a full compromise (Acronis TRU, 2026-11-04). A brute-force run against a national fire agency's single sign-on portal gave no confirmed access, and the critical Apache flaw that the operator's vulnerability platform reported at a disaster-response centre was fabricated, because the port was filtered (Acronis TRU, 2026-11-04). TRU says the agents failed where authentication was enforced, where paywalls required valid sessions and where endpoints were properly filtered, and that obscurity no longer protects a system from agents that investigate hundreds of targets at once (Acronis TRU, 2026-11-04).
TRU assesses with high confidence that the infrastructure and activity were operated by a single individual based in Hualien City, Taiwan.
Confirmed data exfiltration or system access occurred at roughly 10 distinct targets across three countries.
The agents failed where authentication was enforced, where paywalls required valid sessions and where endpoints were properly filtered.
SonicWall's advisory SNWLID-2026-0014 of 2026-11-06 fixes seven SonicOS flaws on Gen7 and Gen8 firewalls, and one of them, CVE-2026-19868, is an authentication enforcement weakness in the SSLVPN service: a user with valid credentials for an alternate authentication method may bypass the SAML authentication controls, and successful exploitation may also bypass SAML-enforced multi-factor authentication (SonicWall PSIRT, 2026-11-06). SonicWall says the flaw only affects SSLVPN when SAML is enabled for SSLVPN logins, and scores it CVSS 3.1 7.1 as a use of single-factor authentication (CWE-308) (SonicWall PSIRT, 2026-11-06). The advisory says SonicWall PSIRT "has investigated a report indicating potential exploitation" and urges customers to upgrade, with no workaround available (SonicWall PSIRT, 2026-11-06); CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-11-06 "based on evidence of active exploitation" (CISA, 2026-11-06). SonicWall has not shared details about the reported exploitation (BleepingComputer, 2026-11-06).
The advisory applies one table to all seven flaws: Gen7 hardware firewalls (TZ, NSa and NSsp) and Gen7 NSv up to and including 7.3.3-7015 are fixed in 7.3.4-7013 and higher, and Gen8 hardware firewalls (TZ and NSa) and Gen8 NSv up to and including 8.2.2-8015 are fixed in 8.2.3-8015 and higher (SonicWall PSIRT, 2026-11-06). It also fixes two management-interface flaws scored 8.8 that in specific conditions could potentially let a remote unauthenticated attacker perform unauthorized operations, and that need user interaction, a pre-authentication heap overflow in the SSL-VPN service that could cause a denial of service, and three lower-severity flaws; no source reports them exploited (SonicWall PSIRT, 2026-11-06).
Triage: a legitimate SAML sign-in leaves an event at the identity provider; a login through the alternate path does not, which follows from the stated mechanism.
SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability.
NOTE: This vulnerability ONLY impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins.
The Brotli decoder flaw CVE-2026-111497 is an out-of-bounds write caused by improper handling of malformed compressed data (Mitel, 2026-10-28), and CISA lists it as exploited (CISA, 2026-10-27). Siemens' advisory SSA-045512, revised on 2026-11-06, lists Desigo CC V8 and V9, all versions, remedied by installing the latest .NET security updates via Windows Update, Gridscale X DSA from V5.3 below V5.4 (fixed in V5.4) and Gridscale X PSS®E below V36.8.0 (fixed in V36.8.0), and scores the flaw CVSS 3.1 9.8 (Siemens ProductCERT, 2026-10-30). Its Industrial Edge advisory SSA-443410 says an Industrial Edge Management setup with no Management Applications installed needs no action because the affected functionality is not used or exposed, gives fixed versions for six configurator and monitoring applications, and for Common Configurator, which has no fix, says to uninstall all Management Applications and protect the instance with a firewall or WAF, or on a device to stop the application, until a fix is available (Siemens ProductCERT, 2026-10-30).
Mitel's MISA-2026-0010, revision 5.0 of 2026-11-04, rates the flaw high (CVSS 3.1 8.1) and lists MiVoice Business 10.6.0.7 and earlier, its Solution Virtual Instance up to the build in Mitel's table, OpenScape SBC V11R3.4.4 and earlier, OpenScape SESAP V2 R1.1.9 and earlier, OpenScape Contact Center V12R0 to V12R0FR7, OpenScape Xpert V9 R0.2.0 and earlier and OpenScape Endpoint Management V1 R2.5.1 and earlier as affected; for each an update is planned, not released, and workaround articles exist for OpenScape SBC, SESAP and Contact Center (Mitel, 2026-10-28). Mitel rates the risk low for MiVoice Business, Xpert and Endpoint Management when deployed according to its guidelines (Mitel, 2026-10-28).
Cisco's advisory, version 1.8 of 2026-11-06, says its PSIRT is aware that proof-of-concept exploit code is available and is not aware of any malicious use against any Cisco product; it lists Catalyst SD-WAN, IOS XE, IOS XR and Secure Firewall ASA, FMC and FTD as not impacted and Identity Services Engine as under investigation (Cisco PSIRT, 2026-10-27). Its single fix table, with no per-CVE column, lists Duo Network Gateway (3.4.2), Spaces (24.22.1), RoomOS on Board, Desk and Room Series devices (on-premises 11.41.2.3 and 26.7.4.3) and a longer list whose fixes are dated November 2026 to July 2027 (Cisco PSIRT, 2026-10-27).
The Cisco Product Security Incident Response Team (PSIRT) is aware that proof-of-concept exploit code is available for the vulnerabilities described in this advisory.
Siemens' revision of advisory SSA-045512 on 2026-11-06 also added two grid products: Gridscale X DSA from V5.3 up to but excluding V5.4, fixed in V5.4 or later, and Gridscale X PSS®E below V36.8.0, fixed in V36.8.0 or later (Siemens ProductCERT, 2026-10-30). Siemens describes Gridscale X DSA as real-time grid stability assessment and PSS®E as transmission planning and analysis software (Siemens ProductCERT, 2026-10-30).
The Aargau government council adopted the information-security ordinance (InfoSiV) and decided that the information-security legislation, the law (InfoSiG) and the ordinance, enters into force on 1 January 2027 (translated from German) (Kanton Aargau, 2026-11-06). The canton says the law anchors uniform standards and a holistic information-security system in the cantonal administration, that an information-security specialist unit is to advise the cantonal bodies and be equipped with directive and enforcement powers so that one detection and defence strategy can be implemented, and that a further specialist unit for personnel security vetting and a cantonal cyber coordination office are being set up, both at the cantonal police (translated from German) (Kanton Aargau, 2026-11-06). The government elected Bernhard Droz, currently head of IT forensics and cybercrime at the cantonal police, as head of the cyber coordination office from 1 January 2027 (translated from German) (Kanton Aargau, 2026-11-06).
The communiqué says nothing about communes or other bearers of public tasks. In February 2025 Netzwoche reported that a majority in the consultation approved bringing them into the law's scope and that entry into force was then planned for 1 July 2026, so the final text decides whether communal bodies are bound (Netzwoche, 2025-02-24).
The Government Council has adopted the ordinance on information security (InfoSiV) and at the same time decided that the information-security legislation (InfoSiG and InfoSiV) comes into force on 1 January 2027. (translated from German)
An information-security specialist unit is to advise the cantonal bodies and be equipped with powers to issue directives and to enforce, so that an effective, uniform detection and defence strategy can be implemented. (translated from German)
Oneconsult analyses, from the Chromium source and tests on Windows 11 with Chrome and Edge 150.0.7871.101, what a website can reach through the File System Access API once a user selects a folder and grants permission: the handle stays valid as long as the tab is open and is obtained after just two user clicks (Oneconsult, 2026-11-02). Chrome rejects blocklisted paths, but a path that is not in its table and not an ancestor of a blocked path is allowed, and the kDontBlockChildren rule leaves the subfolders of listed directories selectable; Oneconsult confirmed .vscode, the Azure token cache, C:\Users\Public and SMB shares as accessible (Oneconsult, 2026-11-02).
Oneconsult demonstrates these paths. A site can search a granted folder and take files such as cached Azure tokens and .env files. It can drop a fake VS Code extension into .vscode/extensions, which runs inside the normal code.exe process and is unaffected by Mark of the Web because Node.js does not check the Zone.Identifier stream. It can plant PowerShell profile and module backdoors, which work only with the Bypass or Unrestricted execution policy because the API stamps every written file with ZoneId=3 and RemoteSigned refuses such files. It can drop files on the public desktop, where they appear for all users and trigger a warning that a certain percentage of users acknowledge. And it can run an interactive file proxy through the still-open tab, where EDR sees only the browser reading and writing files (Oneconsult, 2026-11-02). A OneDrive Known Folder Move enabled while Chrome is running leaves a stale blocklist, so the redirected Desktop was writable; Oneconsult notes that the bypass has been reported to Google, which made the issue public, and that Google classed reading a single dragged file from a blocked folder as "not a security issue" (Oneconsult, 2026-11-02).
Daniel Oz's July write-up of the same technique has a website edit a file the user already holds. He says the user-gesture requirement does not prevent phishing, only automatic picker invocation, and that signed or complex files may fail, be blocked or break in a way that prevents execution (Oz, 2026-07-05).
Triage: browsers legitimately read and write files for web editors such as Google Docs and VS Code for Web, as Oneconsult notes; the signal is a browser process writing into a persistence location, not the file activity itself.
after just two user clicks (selecting the folder and granting permission) on the website, a handle to the files is obtained
A MotW (Mark of the Web) has no effect on the execution, since Node.js simply does not check the Zone.Identifier Alternate Data Stream (ADS).
EDR solutions only detect that Chrome is reading and writing files
NCSC Switzerland updated its advisory on 2026-11-06 with the Swiss incidents, Copeland and Dixell XWEB and healthcare, a four-point checklist for refrigeration management systems across all relevant operations, supplier-managed equipment included, and the statement that the public information does not establish a common attack method or confirm exploitation of the Danfoss CVEs it lists. Ransom-ISAC published the event log of one internet-reachable Copeland XWEB Pro compromise (743 parameter writes in two administrator sessions, default credentials claimed without published evidence), and Unit 42 counts over 5,000 exposed devices across countries on 5 and 6 November and a falling count in France since October.
NCSC Switzerland edited its advisory on 2026-11-06 with the reason "added Swiss incidents, Copeland/Dixell XWEB and healthcare attacks" and states that "The public information reviewed does not establish a common attack method across these incidents or confirm exploitation of the specific Danfoss CVEs listed above"; it lists CVE-2025-41451, CVE-2025-41450 and CVE-2025-41452 as "alleged as potentially related" (NCSC Switzerland, 2026-10-13). Its checklist asks operators to review refrigeration management systems across all relevant operations, "including equipment managed by external service providers"; to remove direct internet access to management interfaces and provide remote access through a secure VPN; to check temperature settings, defrost schedules, alarm thresholds, notification recipients and user accounts, verify actual temperatures and test alarm delivery; and to apply current firmware and plan to replace equipment that no longer gets security updates (NCSC Switzerland, 2026-10-13). For a suspected compromise it says "A factory reset alone is insufficient if the system remains vulnerable and directly accessible from the internet" (NCSC Switzerland, 2026-10-13).
Ransom-ISAC published the event log of a Copeland XWEB Pro controller, reportedly on firmware 1.9.0 and reachable through a public address, compromised on 2 November: two Administrator sessions from different external addresses read parameters across 31 devices, then made 588 writes across 26 devices in about six minutes, which Ransom-ISAC reads as scripted or bulk programming rather than manual edits, and 155 further writes across five cold rooms, moving setpoints to 110 and 150 degrees C and recording keypad-lock, alarm-mute and defrost commands (Ransom-ISAC, 2026-11-06). The post says the controller still used its default Administrator credentials, publishes no evidence for that statement, says the log cannot show how the attackers got in or what temperatures were reached, and says it has no evidence linking the case to NoName057(16), Z-Pentest Alliance or the French attacks (Ransom-ISAC, 2026-11-06). Its suggested alerts are more than about 20 parameter-write events a minute from one account, writes to more than three devices within five minutes, and keypad-lock, alarm-mute or defrost commands that do not come from the scheduler (Ransom-ISAC, 2026-11-06).
Unit 42 counts over 5,000 internet-exposed devices across countries from the manufacturers CERT-FR names on 5 and 6 November, and for France alone 1,853 in the first half of October, 558 in the second half and 316 in the first six days of November, and says the claims of NoName057(16) and Z-Pentest Alliance remain unverified (Unit 42, 2026-11-06). The counts do not show which versions are vulnerable.
Previdian's page, as read on 2026-11-07, reports 15 exploitation attempts against CVE-2026-123158 from 10 addresses in 8 countries since 2026-11-06, and The Hacker News reports, quoting Previdian's chief executive, a successful root login on an Alpine Linux honeypot followed by reconnaissance commands; CISA does not list the flaw and no authority source reports attacks on production systems.
Previdian's page for CVE-2026-123158, as read on 2026-11-07, says its sensors observed 15 exploitation attempts from 10 addresses in 8 countries, first on 2026-11-06 and last on 2026-11-07, a live counter, and that these observations do not show that a target was vulnerable or that an attempt succeeded, and its timeline lists public proof-of-concept code from 2026-11-05 17:30 UTC (Previdian, 2026-11-07). The Hacker News, quoting a statement from Previdian's chief executive, reports that Previdian confirmed successful root access on a honeypot running Alpine Linux and OpenSSH, where the attacker used oversized passwords to bypass authentication and ran the reconnaissance commands id, uname and hostname in non-interactive SSH sessions, and that the first attempt came less than nine hours after the CVE was published (The Hacker News, 2026-11-06); the honeypot detail is not on Previdian's page, and the article's own total, eight attempts from one address geolocated to Japan, differs from the page's totals. Previdian's page lists the flaw as not in CISA's catalog (Previdian, 2026-11-07).
Alpine's advisory adds that updating the package does not restart a running sshd, so sshd must be restarted, and that on exposed machines the administrator should review doas use and recently created users, files and authorized keys, treating the machine as compromised if a login cannot be ruled out (Alpine Linux, 2026-11-05). No vendor or authority source reports attacks on production systems.
The discoverer, Umut Bayram of Picus Security, shows that the update installing WordPress 7.1.4 still unpacks with the site's old code, so the staging folder under wp-content/upgrade can be reachable at a predictable path during that update, while a partial package exposes the installer only if it contains the installer files; he advises denying web access to the folder and confirming it answers 403 before updating.
Umut Bayram of Picus Security, who found the flaw, shows that the update which installs the fix still unpacks its files with the site's old, unpatched code (Picus Security, 2026-11-05; The Hacker News, 2026-11-06). Picus says the new code's skip of wp-config.php already works in that first update but the randomised folder name does not, so the temporary installer sits at a predictable path on sites running 5.9 or later and, on 4.4 to 5.8, behind a random suffix that hides it unless the site leaks the path; an attacker who reaches it can no longer replace the live configuration but can still set up the temporary copy, log in to it, run PHP and from there read or write files in the live directory (Picus Security, 2026-11-05). Bayram told The Hacker News the deciding factor "isn’t partial versus complete. It’s whether the updater already installed on the site has been fixed", and that a partial package exposes the installer only if it contains the installer files; The Hacker News found WordPress.org offering an in-branch move such as 7.1.3 to 7.1.4 as a partial package, automatic updates included, so whether such an update is exposed depends on what that package contains, and only once 7.1.4 or the branch fix is installed do later updates use a random folder (The Hacker News, 2026-11-06). WordPress 4.6 and earlier get no fix (The Hacker News, 2026-11-06).
The order matters: Picus advises denying web access to wp-content/upgrade/ in the web server configuration first, confirming that the path answers 403, and only then updating; this does not break updates, because WordPress reaches the folder through the filesystem (Picus Security, 2026-11-05). An .htaccess file placed inside the folder does not work, because the old updater deletes the folder's contents before unpacking, and WP-CLI's wp core update is no substitute because it uses the same updater and folder (Picus Security, 2026-11-05). For sites that stayed on an affected version, Wordfence suggests looking for unexpected requests to PHP files under wp-content/upgrade, administrator accounts no one recognises, plugins no one installed and PHP files in wp-content/upgrade that no one put there (The Hacker News, 2026-11-06).
Code that its authors describe as an exploit has appeared in public GitHub repositories since earlier this week, and whether it works has not been established; WordPress's own advisory rates the flaw low, against Wordfence's CVSS 8.1 and CISA's listing as exploited (The Hacker News, 2026-11-06). None of these sources reports a compromise through the update that installs the fix; CISA's listing and Wordfence's probing telemetry above are unchanged.
Microsoft reports that Storm-3358, a Cambodia-based, financially motivated cluster, has used ARTEX since October 2026 against financial organisations, pairing it with conventional scanners and installing the open-source remote access tools WISP, vshell and AdaptixC2; Check Point Research reads ten exposed operator consoles showing campaigns that run almost autonomously once a goal is set, and Microsoft says honeypots, decoys, tarpits and fake wins helped reduce the attack traffic reaching real assets.
Microsoft Threat Intelligence reports that Storm-3358, a Cambodia-based intrusion cluster that primarily targets financial organisations in Southeast Asia and a smaller number of large financial organisations globally, began using ARTEX against the financial sector in October 2026 (Microsoft, 2026-11-06). Microsoft says the cluster combines ARTEX with conventional automated tools to scan internet-facing systems, exploit flaws including anonymous file upload and server-side request forgery, and install the open-source remote access tools WISP, vshell and AdaptixC2, which ARTEX agents download with netcat and curl (Microsoft, 2026-11-06). Microsoft's tell for an agent on a scanned system is "a wide variety of requests in a brief time", retries of variations on one technique and a move to next-stage actions at machine speed; ARTEX by default drives Nmap, curl, wget, Python HTTP clients and headless Chromium through Playwright, and blocking their default traits will not stop an agent, which "will quickly change them" (Microsoft, 2026-11-06). In Microsoft's testing, honeypots, decoys, tarpits and fake wins helped reduce the attack traffic reaching real assets, with no figures given (Microsoft, 2026-11-06).
Check Point Research counts 2,557 systems that host or hosted ARTEX panels, 1,608 of them live and public, and ten that exposed the full database; in those ten consoles the operators set a goal and then "barely interacted with their agent fleets" (Check Point, 2026-11-05). The campaigns it reads are opportunistic crime, not espionage: iOS signing certificates from grey-market shops, a cryptocurrency-service campaign and game-account credentials. In the signing-shop campaign the agents got in through hardcoded administrator passwords in JavaScript bundles, missing API authentication, command injection, insecure direct object references, weak administrative credentials and template injection (Check Point, 2026-11-05). Check Point does not name Storm-3358.
Rapid7's Metasploit framework now carries public modules for two unauthenticated SQL injections on Cisco Secure Email Gateway that end in root command execution: one merged on 2026-11-05 for the injection its author matches, at medium confidence, to the exploited CVE-2026-76461 and which needs URL Filtering and URL Retrospective Service enabled, and one for the non-default S/MIME public-key harvesting feature that Rapid7 believes is CVE-2026-76443. A clean mail_logs check does not rule out the S/MIME injection, and Cisco's hardening advisory names no fixed 16.0 build.
Rapid7's Metasploit framework now carries public exploit modules for two unauthenticated SQL injections on Cisco Secure Email Gateway that end in command execution as root. The first, merged on 2026-11-05, targets an injection in the Email Cloud Scanner URL-retrospective message database and its documentation says "URL Filtering and URL Retrospective Service must both be enabled" (Rapid7 Metasploit module documentation, 2026-10-16), which sits against Cisco's statement that the flaw affects the gateway "regardless of device configuration" (Cisco PSIRT, 2026-09-14); its author says it can only be assessed with medium confidence that this is CVE-2026-76461, the flaw CISA lists, and that of the injections reproduced from the patch diff it was the only one that left the pattern COPY.*TO PROGRAM in mail_logs, the check Cisco's own advisory names (Rapid7 Metasploit pull request 22024, 2026-10-16). The second targets an injection in the S/MIME public-key harvesting feature, "we have reason to believe this maps to CVE-2026-76443" according to Rapid7's wrap-up of 2026-11-06 (Rapid7, 2026-11-06). The S/MIME module was merged on 2026-10-28; its author tested a gateway on AsyncOS 15.5.1-055 with the S/MIME Public Key Harvesting feature enabled for inbound mail, and the module sends one signed S/MIME email carrying 500 certificate addresses to the gateway's SMTP listener (Rapid7 Metasploit pull request 22018, 2026-10-15). Its documentation says "Public-key harvesting must be enabled on the inbound mail flow policy for the target to be exploitable" (Rapid7 Metasploit module documentation, 2026-10-15), and the author of the first module calls that feature "a different non-default feature" (Rapid7 Metasploit pull request 22024, 2026-10-16).
Cisco's hardening advisory lists CVE-2026-76443 with the other grouped CVEs and its fixed-release table gives 15.5.5-014 for 15.5 and earlier, 16.5.0-780 for 16.5 and "Migrate to a fixed release." for 16.0 (Cisco PSIRT, hardening-release advisory, 2026-09-14). A 16.0 appliance on 16.0.4-302 therefore has no named fix for the flaw the S/MIME module most likely uses; moving to 16.5.0-780 closes it. Rapid7 does not report exploitation of the S/MIME module's flaw, and Cisco does not say whether the injection it lists as exploited is the one in either module.
Siemens revised its advisory SSA-834709 to V1.1 on 2026-11-04 and now lists the SIMATIC IoT2050 Advanced, Basic, M.2 and SM variants as affected, all versions below V4.3.4-1 with Node-RED installed; the fix and interim mitigations are unchanged, so owners of the three further variants are in scope as well.
Siemens revised SSA-834709 to V1.1 on 2026-11-04, describing the change as "Clarified Affected products list. Updated title. Updated summary." (Siemens ProductCERT, 2026-08-11). The current advisory lists SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2), Basic (6ES7647-0BA00-0YA2), M.2 (6ES7647-0BB00-1YA2) and SM (6ES7647-0CA00-1AA2), each in all versions below V4.3.4-1 running Industrial OS with Node-RED installed, with "Update to V4.3.4-1 or later version" as the fix (Siemens ProductCERT, 2026-08-11). Owners of the Basic, M.2 and SM variants are therefore in scope for the update and for the exposure and detection points above; the 10.0 scores and the two interim mitigations are unchanged.
Find every Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controller, and any other refrigeration controller with a remote management interface because not every second-wave site's vendor is confirmed, in facilities you own or that a contractor manages for you and take its management interface off the internet now, restoring access only through a secure VPN or protected network (filtering to the contractor's source addresses is an emergency stop-gap, and CERT-FR asks you to check your insurance conditions before cutting the contractor's data uplink); an end-of-life unit that gets no fixes needs replacing, because a factory reset leaves it vulnerable and probably compromised again.
On every such controller that was reachable from the internet, check the whole configuration, defrost ranges, alarm thresholds and notification recipients included, against the intended one, verify the actual temperatures and test that alarms reach staff; for a Danfoss unit that may have been taken over, restart it or otherwise factory-reset it, restore access only through a secure VPN or protected network and reconfigure it for service, then update its firmware, set the security level to Strict and replace the default and any weak passwords, and on every Copeland or Dixell XWEB unit confirm the factory Admin password was changed and give each contractor a named account with an expiry date.
Update every SIMATIC IoT2050 (Advanced, Basic, M.2 and SM) to V4.3.4-1 or later now; where that cannot happen at once, uninstall Node-RED on units that do not use it, since Siemens names uninstalling or hardening Node-RED as its interim mitigations and exploitation takes a single unauthenticated request.
On every Node-RED instance that was reachable from an untrusted network, review the deployed flows for exec nodes and http-in endpoints that nobody built, and the access logs for POST requests to /flows from non-engineering addresses.
Upgrade every Cisco Secure Email Gateway appliance (physical and virtual) to AsyncOS 15.5.5-014 as re-released on 2026-10-31 (on an appliance that took the earlier build, confirm with retroscannerstatus that Retro Remediation Engine runs 4.0.2 or later), 16.0.4-302, or 16.5.0-780 (Cisco's recommended target) now; 16.0.4-302 closes CVE-2026-76461 only, because the hardening advisory names no fixed 16.0 release, so move a 16.0 appliance to 16.5.0-780 to close the five hardening-release CVEs (CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, CVE-2026-76443, CVE-2026-76442) as well, one of which, CVE-2026-76443, has a public Metasploit module according to its author.
Grep every appliance's mail_logs (and, if clustered, every cluster member's logs) for the pattern "COPY.*TO PROGRAM" and cross-check firewall/network logs external to the appliance for unexpected outbound connections; a successful exploit grants root, so an attacker may have removed local log evidence of their own access; a clean result does not rule out the S/MIME injection, which did not leave that pattern in the module author's reproduction.
Secure Email Cloud customers should confirm directly with Cisco whether their instance is among those where indicators of compromise were identified; Cisco states it has already proactively contacted affected Cloud customers and upgraded all Cloud instances.
Upgrade every SonicWall Gen7 firewall and NSv that serves SAML SSLVPN logins to SonicOS 7.3.4-7013 or later and every Gen8 firewall and NSv to 8.2.3-8015 or later now, because SonicWall lists no workaround and CISA lists the flaw as exploited.
On every WordPress site your organisation, its web agencies or its hosting suppliers run, deny web access to wp-content/upgrade/ in the web server configuration (not with an .htaccess file inside that folder) and confirm it answers 403 before installing 7.1.4 or the fixed release of its branch, because the update itself still unpacks with the old code and a firewall that WordPress itself loads does not run for that request; then confirm in Dashboard > Updates that each site is on 7.1.4 or the fixed release of its branch.
List every monitoring server, script, scheduled task and connection manager that stores an ESXi, vCenter or Proxmox root password, replace each with a least-privilege monitoring account, and rotate the root passwords that were stored or reused across hosts.
Install the latest .NET security updates through Windows Update on every Siemens Desigo CC V8 and V9 host, and update Siemens Gridscale X DSA V5.3 to V5.4 and Gridscale X PSS®E to V36.8.0.
On every Industrial Edge Management instance running Common Configurator, uninstall all Management Applications and put the instance behind a firewall or WAF, and stop Common Configurator on Edge devices, until Siemens ships a fix, because Siemens lists no fix for it.
Apply Mitel's workaround articles KB000129034 (OpenScape SESAP), KB000129100 (OpenScape SBC) and KB000129114 (OpenScape Contact Center) on the OpenScape SESAP, SBC and Contact Center systems in use, because Mitel has released no update for them.
2026-11-07T0256Z-intel· Sonnet 5.5 · window 26 h · 7 entries published
Verification & coverage notes
Standard 24.0 h gap, 26 h window; seven new entries and six changelog records. No deep dive and no critical today: nothing met the stop-and-act bar. The will-publish set exceeded eight items, so the Phase 4 deep read of the 18 primaries was delegated to three scoped cti-research follow-ups (FU1 to FU3, labelled DR1 to DR3 in their work files) that saved every body under work/2026-11-07T0256Z-intel/bodies/; the claim tables they returned were literal-substring verified by those agents, and the main agent composed from them.
KEV sweep: kev_window_diff.py listed one addition in the window, CVE-2026-19868 (SonicWall SonicOS SSLVPN), NOT COVERED; published as 2026-11-07/cve-2026-19868-sonicwall-sonicos-sslvpn-saml-mfa-bypass-kev. S1 confirmed with the catalogue (2026.11.06) that nothing else was added; no RANSOMWARE rows. Cross-check of the catalogue against the store since 2026-08-15 found the four Plex Media Server CVEs and SiteGuard CVE-2026-106931, both previously dropped (below), and four old CVEs added on 2026-08-26 (CVE-2015-3246, CVE-2015-5287, CVE-2022-0995, CVE-2019-1068) that S1 lists as absent from the CVE index and that the 2026-08-30 audit covers in prose.
Backlog rows: ARX Group SA (Aurora leak-site claim) struck, unconfirmed at its 2026-11-07 expiry after DE/FR/IT/EN searches. ChimeraZ row: Ebikon, Gersau, Meggen and Wil struck as a non-incident (their provider found only public Open Government Data content), Solnet and Destination Davos Klosters struck below the incident floor (confirmed data, no stated access route), the Belgian rescue zone Hainaut-Est held to its 2026-11-17 expiry.
Updates and what each moved: danfoss refrigeration entry (NCSC Switzerland edit of 2026-11-06, Ransom-ISAC controller log, Unit 42 exposure counts), OpenSSH CVE-2026-123158 (Previdian's exploitation attempts and one honeypot compromise reported by one telemetry vendor; status poc-public, not exploited, because CISA does not list it), WordPress CVE-2026-119977 (the update that installs the fix is itself exposed; block wp-content/upgrade/ first), Cisco Secure Email Gateway (public Metasploit modules for two injections: one merged 2026-11-05 and matched at medium confidence to the exploited CVE-2026-76461, which needs URL Filtering and URL Retrospective Service enabled, and an S/MIME one believed to be CVE-2026-76443; CVE-2026-76461 gains poc-public; Cisco names no fixed 16.0 build), SIMATIC IoT2050 CVE-2026-58115 (Siemens V1.1 lists Basic, M.2 and SM beside Advanced; fix string is V4.3.4-1), ARTEX (Storm-3358 and Check Point's operator-console count).
Single-source: 2026-11-07/bossai-ai-agent-mesh-emergency-services-data-taiwan (Acronis TRU only; reliability B, credibility 3, confidence medium; included under the emergency-services nexus, out-of-nexus gate clause (b)/(d): AI-agent TTP transferable to dispatch and records systems); 2026-11-07/kaspersky-esxi-proxmox-ransomware-monitoring-root-password (Kaspersky only; neither case states the initial access); 2026-11-07/aargau-infosiv-adopted-information-security-law-2027-01-01 (single-source: the canton's own communiqué, primary for its own legislation); 2026-11-07/tum-mytum-legacy-portal-credential-harvest-tumonline (single-source-victim: TUM's own notice, heise relays a spokesperson).
Borderline includes and their org-relevance in one clause: TUM (public university in DACH, transferable legacy-portal credential-capture lesson, MFA held; routine), Aargau InfoSiV (cantonal public-sector governance, the standing policy watch; routine), Brotli vendor wave (Desigo CC and Mitel telephony are common in public buildings and administrations; the flaw is CISA-listed; notable), Oneconsult File System Access API research (new technique with browser-policy levers; notable).
Contradiction handling: the ARTEX update gives Check Point's three different exposed-panel figures only as its body counts (2,557, 1,608, ten); the SonicWall exploitation wording stops at "potential exploitation" and the exploited status rests on CISA's listing, stated in the sourcing note; Cisco's hardening advisory lists CVE-2026-76443 in the injection class it says contains one exploited flaw, so the Cisco record says Rapid7's mapping is the author's belief and does not say whether the exploited injection is the one either module uses.
borderline-drop: Plex2Shell (CVE-2026-96652/-96654/-96655/-96656) QNAP NAS compromise notice, consumer media server, no public-sector deployment shown; dropped by 2026-10-21/22 fires and 2026-10-25 audit; QNAP QTS/QuTS hero themselves not affected
borderline-drop: Windows Paint CVE-2026-83844, not exploited, not publicly disclosed, AC:H, Exploitation Less Likely; Store-delivery blind spot is awareness-level, regular update path applies
borderline-drop: Siemens PHP2Shell SSA-166980 V1.3 (Spectrum Power, AMIS TS, Energy Engage, blueplanet), grid/energy-utility software outside the constituency estate, no exploitation against these products
borderline-drop: Citrix NetScaler CVE-2026-88771 Metasploit module, exploited zero-day already at top urgency, module changes no decision
borderline-drop: EHRA phishing (BACS warning), generic lure aimed at companies, no transferable technique
borderline-drop: Canonical LXD/MicroCloud CVE-2026-112816 (CVSS 4.0 10.0), needs a trusted client's public certificate and API reachability, no exploitation, regular patch cycle
borderline-drop: Veeam Management Pack for System Center CVE-2023-22793/-107238/-107239, niche product, no exploitation, patch-cycle
borderline-drop: cwpdoor (Control Web Panel), niche hosting panel, single vendor, spread vector unknown, no constituency exposure shown
borderline-drop: DigiCert validation-archive exposure, no certificate impact, no defender action
borderline-drop: Eye-Able dashboard intrusion, single customer-mail relay by one outlet, no vector, no code-integrity impact stated
borderline-drop: Solnet and Destination Davos Klosters confirmations (ChimeraZ), confirmed but no vector (a gap), incident floor; the four communes denied intrusion (public OGD content); ZOHE unconfirmed
borderline-drop: Holcim/Emperador, Gleis D Chur/Cloak, Myriad Genetics 8-K, Maileva, French public-service claims, Swiss leak-site claims (Erowa, Labatec, HighTec), impact-only or unconfirmed; incident floor / PD-6
borderline-drop: Dameware CVE-2026-28336, authenticated, no exploitation
borderline-drop: Apache OFBiz 24.09.08, Rails Active Storage, Xen XSA-523, APT CVE-2026-109518, HPE Fabric Composer, Chrome 157, Next.js Nov release, Entra CVE-2026-109469, previously dropped or no customer action, no new development
borderline-drop: SiteGuard CVE-2026-106931 (KEV 2026-10-20), Japanese WAF module, previously dropped, no new development
reduced-confidence inclusion: BOSSAI and Kaspersky GERT, included on a single source (above); nothing else.
out-of-window: none dropped on date alone; lookback items from rotational sources (Oneconsult, CCB-sourced items) were judged on relevance.
Coverage gaps: connectwise-trust-center (403 on every transport, sixth run); sygnia (403, reader pool dead); ico-uk (403 on every rung including WebFetch, fourth run); prodaft (no dated listing on any transport); ag.ch listing pages (404; the sitemap recipe in the new ag-ch-medienmitteilungen record reaches the communiqués); cert.at HTML pages (403; its feeds read); apple-security (WebFetch returned a page that may be a cached copy; nothing in the lookback; KEV and the store cover the one Apple item of the week).
Essential-coverage: all 21 essential sources were attempted (14 in S1, 7 in S2); none missed.
Slice-completion: every slice record of S1 to S4 has a ledger row (26, 19, 14, 10); no continuation was needed. Rotation: the previous two fires' attempts were excluded from the rotational slices (115 records) as the belt-and-braces rule; for S4 the exclusion left one record of a 21-record domain, so S4 was ranked on the rotation cursor alone.
Environment: the jina reader pool answered HTTP 402 on every key this fire; no read needed it (feed, extract, url --direct, WebFetch sufficed). entities/registry.yaml is 714 KB and was queried by key and alias instead of read whole; the prior-coverage index (89 records) was read in full for the 40 newest records and as headline, CVE and entity lines for the rest.
Recipe findings logged in sources.json this run: sonicwall-psirt (PSIRT API feed and vulndetail JSON), crowdstrike (feed), synology-security-advisories (dead feed, listing recipe), blick-ch (news.xml), rapid7-research (malformed feed), msft-ti (raw listing), previdian, ox-security, esentire, inside-it-ch, qnap-security-advisories, zimbra-security-advisories; oss-security promoted to active on the digest's promotion_due; two candidates added (ag-ch-medienmitteilungen, picus-security-blog). S4 asked for piyolog to be promoted; the digest does not list it as due, so it stays a candidate.
Source health: tools/source_health.py probed 298 of 298 sources; the two flagged records were fixed in this run (shadowserver: low-cadence publisher, max_staleness_days: 120, no moved blog; ec-presscorner-api: content_scope: general-news) and the re-run ended with no UNSOLVED entries.
Verification outcome: the loop ran to the 8-iteration cap. Iteration 7 returned CLEAN (zero truth and editorial findings), the confirmation pass at iteration 8 returned NEEDS_FIXES (2 truth, 1 editorial, 1 advisory) and the run publishes under the cap fail-open with those three as residuals. The BOSSAI, OpenSSH and Danfoss fixes were applied after the final pass and the gate re-run (0 warnings); no verifier re-read them. The catalogue-feed citation finding on the Cisco entry is declined (pre-existing form, reasons in the iteration record).
Notes for the next audit: the Danfoss refrigeration entry (13 records) and the ARTEX entry have main analyses well over the word bound (this fire only appended sections, none grew either analysis); the Plex2Shell chain was dropped a fourth time and the audit may want to confirm that call against the QNAP notice of 2026-11-06.