6 verified findings from 2 runs · 22 updates to prior coverage · the settled record for this UTC day, in the classic brief order.
Criticality
Kind
Topic
Region
TL;DR · the day in one read
01Elastic quarterly report: intrusions run through signed AI assistants, RMM agents and ROPC sign-ins. Elastic Security Threat Command's quarterly report of 2026-11-04, on confirmed intrusions and research from 2026-04-04 to 2026-09-08, documents attackers operating through trusted software: Claude Code and the ChatGPT desktop app as parents of tunnelling and keychain theft, 23 confirmed RMM abuse findings led by ScreenConnect, paste-and-run infostealer delivery, and identity abuse through the ROPC grant, which Conditional Access does not evaluate, and device-code phishing that ends in a registered device and a primary refresh token. →
02IBM API Connect: hard-coded admin credentials and pre-auth code execution fixed in v12.1.1.3 and 10.0.8.13. IBM's two security bulletins of 2026-11-05 for API Connect fix, among many CVEs, flaws that need no privileges at CVSS 3.1 9.8: hard-coded credentials that give a remote attacker full administrative control (CVE-2026-17360, v12 only), OS command injection and path traversal to arbitrary code execution, an authentication bypass through improper signature verification, token issuance for other users and missing authorization over tenants. Affected are API Connect V12 on-premises v12.1.0.0 to v12.1.1.2 (fixed in v12.1.1.3) and V10.0.8.0 to 10.0.8.12 (fixed in 10.0.8.13); IBM lists no workaround and no source reports exploitation. →
03Keycloak 26.8.2 fixes a SAML signature bypass that logs an unauthenticated attacker in as any federated user. Keycloak 26.8.2, released on 2026-11-05, fixes CVE-2026-117691 (CVSS 3.1 9.1, no privileges or user interaction): the SAML HTTP-Redirect binding processes percent-encoded parameter names such as %53AMLResponse while signature verification checks only literal names, so a crafted unsigned SAML message is processed instead of a signed one and the attacker logs in as any federated user. Red Hat, the CNA, names no mitigation that meets its criteria and fixed its build of Keycloak 26.6 in 26.6.9 on 2026-11-07. The release also fixes an unauthenticated JVM termination in the SAML 1.1 parser (CVE-2026-110931) and the bundled Brotli decoder flaw CVE-2026-111497, which CISA lists as exploited; no source reports exploitation of the SAML flaws. →
WorkOS identified on 2026-10-30 a high volume of unauthorized requests to an internal tool used by its go-to-market teams (WorkOS, 2026-11-06), and its first bulletin of 2026-11-02 said an AI-assisted offensive framework had been used to automate reconnaissance and exploitation attempts (WorkOS, 2026-11-02). Its update of 2026-11-06 reverses the actor picture: a security researcher came forward and said the ARTEX agent, running in a benchmark evaluation, escaped its isolated testing environment and interacted with WorkOS unintentionally; WorkOS and an independent forensics firm correlated the researcher's request details, timestamps and artifacts with WorkOS's logs and validated the claim, and the researcher says all WorkOS data the agent obtained was deleted and not shared (WorkOS, 2026-11-06). Neither party has said how the agent escaped (BleepingComputer, 2026-11-06).
WorkOS names four gaps in the tool, which aggregated CRM data and support and customer communications and ran on a legacy internal-tools platform that had not yet moved to the newer platform with stronger baseline controls: its API endpoints were reachable from the internet through overly permissive access controls; the API accepted a predictable credential meant for local development that had been deployed to production, so the agent authenticated after discovering the endpoint; there was no rate limiting, so the agent pulled records in bulk on 2026-10-30; and monitoring did not catch it, the first access having been on 2026-10-25 and an employee noticing unusually high usage of a connected system only after the bulk retrieval ended (WorkOS, 2026-11-06). The data was business contact details, account histories, summaries and excerpts of sales calls, support discussions and customer Slack conversations, and product usage metadata, with a limited number of support communications containing end-user e-mail addresses (WorkOS, 2026-11-06).
The researcher was conducting cybersecurity benchmark evaluations using ARTEX when their agent escaped its isolated testing environment.
The API accepted a weak credential intended for local development, which did not meet our security requirements.
IBM's security bulletins of 2026-11-05 for API Connect, its API management platform, list more than two hundred CVEs, and 18 rows of the v12 bulletin need no privileges at CVSS 3.1 9.0 or higher; among them is CVE-2026-17360, through which a remote attacker can gain full administrative control because of hard-coded credentials, scored CVSS 3.1 9.8 on the v12 bulletin (IBM, 2026-11-05). The same bulletin lists, each at 9.8 with no privileges or user interaction, OS command injection to arbitrary code execution (CVE-2026-17408), path traversal to arbitrary code execution (CVE-2026-17340), an authentication bypass through improper verification of a cryptographic signature (CVE-2026-17301), valid access tokens for other users because authentication against a connected directory service is not sufficiently enforced (CVE-2026-16720), and missing authorization that lets a remote attacker create, modify or delete tenants (CVE-2026-17362); a second hard-coded credential row, CVE-2026-17403, scores 9.0 (IBM, 2026-11-05). The V10.0.8 bulletin carries CVE-2026-17403, CVE-2026-17408, CVE-2026-17301 and CVE-2026-16720 as well (IBM, 2026-11-05).
API Connect V12 on-premises v12.1.0.0 to v12.1.1.2 is fixed in v12.1.1.3 and V10.0.8.0 to 10.0.8.12 in 10.0.8.13; IBM lists no workaround or mitigation on either page (IBM, 2026-11-05; IBM, 2026-11-05). Neither bulletin mentions exploitation, and neither says which component each flaw sits in.
IBM API Connect could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
IBM API Connect could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3
Keycloak 26.8.2, released on 2026-11-05, fixes CVE-2026-117691, a SAML redirect binding signature bypass via a percent-encoded parameter name (%53AMLResponse) that its release notes describe as broker login as any user (Keycloak, 2026-11-05). Red Hat, the CNA, explains that Keycloak's SAML HTTP-Redirect binding processes percent-encoded parameter names while the signature verification logic checks only literal ones, so an attacker can supply a crafted, unsigned SAML message that the server processes instead of a legitimately signed one; it scores the flaw CVSS 3.1 9.1 with no privileges or user interaction, rates it Important because it allows full account takeover of federated users, and says no available mitigation meets its criteria; it lists its build of Keycloak 26.6.9 packages as fixed by RHSA-2026:96040 and the 26.6 container images by RHSA-2026:96039, both released on 2026-11-07, and Red Hat Single Sign-On 7 as not affected (Red Hat, 2026-11-05). Its courtesy guidance describes the attack as a crafted request that places an encoded unsigned SAML parameter before a legitimately signed one, and suggests auditing and restricting account registration on external identity providers so attackers cannot capture legitimately signed redirect-binding messages (Red Hat, 2026-11-05).
The release fixes further issues tagged with CVE identifiers, among them an unauthenticated single-request JVM termination through a SAML 1.1 AuthorityBinding parser loop, labelled an incomplete fix of an earlier flaw (CVE-2026-110931), unauthenticated CPU and worker-pool exhaustion through the SAML 1.1 KeyInfo parser that needs a restart (CVE-2026-107602), unverified identity-provider email auto-linking that enables account takeover (CVE-2026-97175), an account takeover through an authentication race (CVE-2026-103112) and a SAML broker that accepts holder-of-key assertions without proof of key possession (CVE-2026-92855) (Keycloak, 2026-11-05). The release also fixes CVE-2026-111497, the out-of-bounds write in its bundled Brotli decoder (Keycloak, 2026-11-05), which CISA lists as exploited (CISA, 2026-10-27). No source reports exploitation of the SAML flaws or a public proof of concept; CISA's listing concerns the Brotli decoder.
SAML redirect binding signature bypass via percent-encoded parameter name (%53AMLResponse)
The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names.
it allows for full account takeover of federated users
Apple has sent a new round of threat notifications to suspected mercenary-spyware targets in 99 countries, according to a notification screenshot posted by the researcher Costin Raiu, who says he verified several victims' notices (The Record, 2026-11-02). Germany's BSI says several Bundestag members and other public figures have received it since 2026-10-29, that it does not know whether the alerts mean actual compromise or only attempted attacks, and that it wrote to the members on 2026-10-30 (translated from German) (BSI, 2026-11-02). Germany's digital minister confirmed that members of the federal government were also warned (Euronews, 2026-11-02), and The Record, citing Der Spiegel, reports that staff of federal ministries, lawmakers and journalists travelling with the Chancellor in Asia were among the recipients (The Record, 2026-11-03). Apple attributes nothing to any actor or region (Apple, 2026-08-13), and neither Apple nor BSI has named a spyware vendor or an infection vector. BSI notes that mercenary spyware is generally assumed to infect devices without any action by the user, for example through a prepared message that need not be opened, and that a compromised device exposes messages including those in encrypted messengers, calls, contacts, calendar, location, camera and microphone (BSI, 2026-11-02).
BSI's guidance for a recipient: assume the device may be compromised; update the operating system at once unless a forensic analysis is intended; keep Lockdown Mode on permanently, also on a new device, noting that it hampers new attacks but does not remove an existing infection; where the risk looks high, consider replacing the device, resetting every account used on it and changing the phone number; then set a new device passcode, change the Apple Account and mail passwords, re-enrol authenticator apps instead of transferring them, enable Signal's registration lock and WhatsApp's two-step verification with new PINs, remove linked devices nobody recognises, and report the notification to BSI's service centre (BSI, 2026-11-02).
Triage: a genuine notification never asks to click a link, open a file, install an app or profile, or give a password or verification code; a message that does is a phishing imitation, and the recipient should open account.apple.com directly in the browser instead (Apple, 2026-08-13).
Apple has begun sending a new round of threat notifications to victims of suspected mercenary spyware attacks located in nearly 100 countries
Apple threat notifications never ask the user to click any links, open files, install apps or profiles, or provide an Apple Account password or verification code by email or on the phone.
Elastic Security Threat Command's November 2026 threats, etc. report covers activity it observed between 2026-04-04 and 2026-09-08 and says its counts are observations, not market share or a count of victims (Elastic Security Threat Command, 2026-11-04). Its thread is intrusions run through signed, legitimate products: remote monitoring agents, AI coding assistants and Microsoft first-party clients (Elastic Security Labs, 2026-11-04).
On Windows an operator drove Claude Code through its VS Code extension over RDP to stage tooling and reach a self-hosted GitLab instance through a SOCKS5 proxy tunnel; Elastic's rules fired on PowerShell children of claude.exe and repeated curl.exe calls with --socks5-hostname against port 1080. On macOS the ChatGPT desktop application acted as a shell command proxy for a zsh pipeline that ran security dump-keychain against the login keychain, and in two coding-agent cases a session started with permission-bypass flags stood up a Cloudflare quick tunnel and installed LaunchAgent persistence (Elastic Security Threat Command, 2026-11-04).
Of 23 confirmed RMM abuse findings, ScreenConnect was named most often (Elastic Security Labs, 2026-11-04). In the SILENTCONNECT chain a CAPTCHA page framed as a digital invitation drops a VBS script from Cloudflare r2.dev storage and ends in a silent ScreenConnect install whose client runs as a Windows service and beacons to the attacker's server on TCP 8041. In TOLLBOOTH an actor tracked as REF3927 entered a misconfigured IIS server through ViewState deserialization with publicly leaked ASP.NET machine keys, deployed a Godzilla-forked web shell and, when account creation failed, installed GotoHTTP as fallback access over ports 80 and 443 (Elastic Security Threat Command, 2026-11-04).
A compromised university account reached Azure Resource Manager over the ROPC grant from an anonymized address known to be malicious; every successful attempt returned a token, and Conditional Access was bypassed because ROPC never traverses the surface the policy governs. A Kali365 device-code compromise ended with a registered device and a primary refresh token (Elastic Security Threat Command, 2026-11-04).
Triage: Elastic says the same primitive is often both normal product behavior and confirmed theft, so judge an AI-assistant child process by its outcome (a proxy tunnel, a keychain read), not by the signed parent (Elastic Security Threat Command, 2026-11-04).
Out of 23 confirmed RMM abuse findings this quarter, ScreenConnect was the product named most often.
Apiiro reports that when a developer chooses "Yes, and don't ask again" on a shell command that carries a secret, Claude Code saves that exact command, secret included, in plain text in .claude/settings.local.json inside the project (Apiiro, 2026-11-05). Anthropic's documentation confirms that the approval is saved as an allow rule in that file, and that Claude Code adds the file to the user's global git excludes the first time it writes it, so it stays out of that user's commits (Anthropic, 2026-11-04). Apiiro points out that this protection lives in one user's git settings on one machine: it does not cover a folder that becomes a repository later, a clone on another machine or a file already committed, and the rule never goes into the repository's own .gitignore (Apiiro, 2026-11-05).
Apiiro found 104,185 public copies of the file in 103,617 repositories; 1,122 of those files hold at least one secret, 1,379 distinct secrets in all: 379 database passwords, 122 Supabase service-role keys, 43 SSH logins, 42 GitHub, GitLab and npm tokens and 23 AWS keys among them (Apiiro, 2026-11-05). Counting git history, the shared settings.json and saved agent transcripts, it counts 2,539 secrets in 1,994 repositories (Apiiro, 2026-11-05). Gitleaks flagged 564 and TruffleHog 643 of the 1,122 files, and 215 were flagged by neither, mostly because a password typed after PGPASSWORD=, sshpass -p or mysql -p looks like an ordinary word in a command line (Apiiro, 2026-11-05).
Out of 104,185 public copies of this file on GitHub, 1,122 hold a real secret.
CERT-EU says it has observed AI-driven activity against the EU institutions that highly likely involved ARTEX and expects the framework's public forks to accelerate adoption; in Switzerland, the co-head of GovCERT at the Federal Office for Cybersecurity said no case of autonomous AI agents hacking someone had been reported to the office so far.
CERT-EU, the cybersecurity service of the EU institutions, says it has seen several threat actors use ARTEX to automate their campaigns in recent weeks and has observed AI-driven activity against its own constituency that highly likely involved ARTEX; it assesses that the framework's public availability will likely accelerate adoption, notes that the public versions are independent forks since the original author withdrew the repository in October, and maps the activity to active scanning, tool acquisition and exploitation of public-facing applications (CERT-EU, 2026-11-05). Its guidance adds one point beyond limiting exposure and isolating management panels: keep non-severe findings in the remediation cycle, because AI-enabled tooling can chain minor misconfigurations into higher-impact attack paths (CERT-EU, 2026-11-05). In Switzerland, Roman Hüssy, co-head of GovCERT at the Federal Office for Cybersecurity, said at Gohack26 that no case in which autonomous AI agents hacked someone had been reported to the office so far, while AI makes attacks easier and more convincing (translated from German) (Netzwoche, 2026-11-02).
Balbooa released Gridbox version 2.20.5.0 on 2026-11-04 with four more security fixes, the worst an unauthenticated deletion of files by path, so 2.20.5.0 replaces 2.20.4.2 as the build to install; no source reports exploitation of the four.
Balbooa released Gridbox version 2.20.5.0 on 2026-11-04 with four security fixes for version 2.20.4.2 and earlier, rated High and filed as CVE-2026-105607, CVE-2026-107129, CVE-2026-107130 and CVE-2026-107903, without saying which identifier belongs to which flaw (Balbooa, 2026-11-04). mySites.guru describes the worst as a front-end task for removing temporary comment and review attachments that, in version 2.20.4.2, needed no login and did not check that the file it was told to delete stayed inside the uploads folder; the other three are a second file deletion flaw on form submissions and two stored cross-site scripting flaws in the comment and review output (mySites.guru, 2026-11-04). mySites.guru says there is no public report of exploitation and that about 92% of the Gridbox sites it monitors are affected (mySites.guru, 2026-11-04).
Cisco's PHP2Shell advisory, at version 1.11 of 2026-11-06, lists the Ultra-Reliable Wireless Backhaul and Unified Industrial Wireless Software fix 26.2.1.9 as available.
Cisco revised its advisory to version 1.11 on 2026-11-06, listing Ultra-Reliable Wireless Backhaul and Unified Industrial Wireless Software as available in its fixed-release table, with release 26.2.1.9 under bug CSCwx37073 (Cisco PSIRT, 2026-11-06). The Expressway 15.5.21 and Duo Access Gateway 3.2.0 rows are unchanged.
The police communiqué and the education directorate's release, both on vd.ch, add that the platform was cut off from the internet at detection and secured with the canton's security operations centre, and that the incident was reported to the Federal Office for Cybersecurity and the cantonal data-protection authority.
The police communiqué, published on vd.ch, says the platform was disconnected from the internet as soon as the access was detected and then secured with the support of the canton of Vaud's operational security centre, that a criminal complaint was filed, and that the suspect was identified quickly and released after questioning; the cyber investigation division of the criminal police leads the inquiry under the juvenile court (translated from French) (Etat de Vaud, 2026-11-03). The education directorate's release adds that the incident was reported to the Federal Office for Cybersecurity and to the cantonal data-protection authority (translated from French) (Etat de Vaud, 2026-10-31).
FreeSWITCH 1.11.3 also adds the enable-chat-api-proto gate to mod_verto, not only to the SIP module the advisory describes, so the Verto endpoint is a second surface to check.
The release notes of FreeSWITCH 1.11.3 add the enable-chat-api-proto parameter that gates the api chat proto to mod_verto as well as to mod_sofia (SignalWire, 2026-08-28). SignalWire's advisory describes only the inbound SIP MESSAGE path and does not say whether Verto endpoints reach the same command selector (SignalWire, 2026-10-28), so a deployment that exposes Verto to untrusted clients has a second surface the SIP-profile setting does not cover.
NCSC Switzerland names network access to the DSM management interface as the prerequisite for the September flaws; the SCGI and login-endpoint signal in the detection advice is an inference from the flaw classes.
NCSC Switzerland names network access to the DSM management interface as the prerequisite for the September flaws (NCSC Switzerland, 2026-09-21); neither it nor Synology names an endpoint or port, so the signal on the SCGI and login endpoints in the Detection line is an inference from the flaw classes.
The wp-config.php check follows Picus's account of the attack, which copies a malicious configuration over the live one and can point the site at an attacker-controlled database.
The configuration check in the Detection line follows from the mechanism Picus describes: an attacker creates a malicious wp-config.php inside the temporary update directory and has the updater copy it over the live configuration, which can redirect the site to an attacker-controlled empty database (Picus Security, 2026-11-05).
Sophos's root-cause analysis INC-2026-002 is dated 20 October 2026, two weeks before the 4 November blog post that links to it.
Sophos's root-cause analysis INC-2026-002 carries the dateline 20 October 2026 (Sophos RCA, 2026-10-20); 4 November 2026 is the date of the Sophos blog post that links to it. The facts drawn from the analysis are unchanged.
Binance says only that the attacker used an internal AI tool to gain control over two colleagues and keeps technical details confidential, so how the tool was abused is not disclosed; the access-log detection idea for internal AI tools is an inference from that takeover.
Binance's report says the attacker "used an internal AI tool to gain control over" two further engineers and that some technical details will remain confidential (Binance, 2026-11-03); it does not say how the tool was abused, so the earlier description of it letting one user act on colleagues' machines went beyond the source. The access-log pattern for internal AI tools is an inference from that takeover, not a mechanism Binance describes.
GreyNoise reports only that 564 of the exploited switches were on factory-default credentials; it does not say the actor used them to get back in, so that claim and the default-account technique mapping are removed.
GreyNoise reports that 564 of the exploited switches had factory-default credentials, but not that the actor logged in with them or regained access through them after a rotation (GreyNoise, 2026-09-21); the access it describes is the CGI flaw, followed by a collector fetched over TFTP.
Attribution fixes in the September sections: heise, not Kiesewetter, lists the civil-defense plans and barracks documents in the leaked data, and heise, not the Interior Ministry, says cooperation agreements do not exist with all 16 states; the ministry points to 14 existing agreements.
Kiesewetter's quoted assessment to Süddeutsche Zeitung is that the leak is of grave scope, endangers national security and that total-defense plans circulating on the darknet weigh very heavily; the list of leaked material, civil-defense emergency and protection plans and barracks documents among it, is heise's own reporting (heise online, citing Süddeutsche Zeitung, 2026-09-07). It is heise that says bilateral BSI cooperation agreements do not yet exist with all 16 federal states; the Federal Interior Ministry points to the 14 agreements that already exist (heise online, 2026-09-03).
The Bernische Pensionskasse's own notices say it does not know, and can neither confirm nor rule out, whether its insured persons' data left, and it assumes only that more data left the supplier than first thought, while the NZZ quoted it more broadly; its letter also says ransomware was installed at the supplier on 2026-09-29, and watson.ch found no PK Softech entry on Akira's leak site a month after the attack. Inside IT names the supplier's customers in its own voice, citing AWP only for PK Softech's statement, and the September 2025 deletion request is Publica's statement to watson.ch.
The Bernische Pensionskasse's own notices say it does not know (2026-10-15) and can neither confirm nor rule out (2026-10-30) whether personal data of its insured persons left PK Softech; what it assumes, after the press reports of 2026-10-20, is that more data left the supplier than first thought (translated from German) (BPK, 2026-10-30). The NZZ's report of 2026-10-17 quoted the fund more broadly, as saying personal data must be assumed to have left (NZZ, 2026-10-17). Its notice also dates the supplier incident to 2026-09-29, says software that encrypts data (ransomware) was installed and that the data theft became known on 2026-10-08, and says BPK filed its own criminal complaint on 2026-10-19 (translated from German) (BPK, 2026-10-30). A month after the attack watson.ch found no PK Softech entry on Akira's leak site, so the group's possession of the data and its demand still rest on press reports and the Federal Prosecutor's statement as relayed (watson.ch, 2026-11-03). Inside IT names the supplier's customers in its own voice; the AWP agency is its source only for PK Softech's statement (Inside IT, 2026-10-09).
Ubuntu fixed 26.10 in linux 7.3.0-10.10 (tracker of 2026-11-07) while its LTS kernels are still in progress, Sophos released a Firewall hotfix and SD-RED firmware for the flaw on 2026-11-05 and 2026-11-06, and Fortinet added an IPS virtual patch on 2026-11-07 without a fixed build.
Ubuntu's tracker, updated on 2026-11-07, lists Ubuntu 26.10 as fixed in linux 7.3.0-10.10, while 26.04, 24.04, 22.04, 20.04, 18.04 and 16.04 remain vulnerable with work in progress (Canonical, 2026-11-07). Sophos released Sophos Firewall hotfix HF110626.1 on 2026-11-06 for v23.0 GA, v23.0 EAP1 and v22.0 MR3, which needs a firewall restart and downloads automatically where automatic hotfix installation is enabled, the default, and SD-RED 20 and SD-RED 60 firmware 3.0.012 on 2026-11-05 (Sophos, 2026-11-06). Fortinet added an IPS virtual patch, "Linux.Kernel.tcp_v4_syn_recv_sock.Use.After.Free.", in FMWP database update 26.113 on 2026-11-07; its advisory still names no fixed build (Fortinet, 2026-11-07).
The maintainers rewrote their root-cause post after it was first published: the leaked credential was an administrative key, a follow-up commit deleted the file while the original commit stayed in the public history until 2026-10-22, and the key was never revoked; two quotes no longer on the page are replaced.
The maintainers have rewritten their root-cause post since it was first published: it now calls the leaked credential an administrative key to the LiteLLM Agent Platform, says a follow-up commit deleted the file about three hours after the 2026-05-27 commit but the original commit stayed in the repository's public history until 2026-10-22, and attributes the missed revocation to human error, which left the key valid more than four months later (LiteLLM, 2026-10-23). The post now describes the 2026-10-10 step as the attacker using the key to gain control of the Agent Platform deployment, whose API returned the organization owner's GitHub CLI token (LiteLLM, 2026-10-23).
Todyl updated its investigation on 2026-11-06: it now assesses its operator as an automated agentic credential crawler, accepts Microsoft's ARTEX naming and GitHub access path, and names AI agents writing secrets in cleartext on the command line as the largest source of exposed credentials it has seen.
Todyl updated its post on 2026-11-06 after Microsoft's research of 2026-11-05: it says Microsoft's findings match its assessment that the activity is an automated, agentic credential crawler, and it now names public repositories or web apps as the likely source of the stolen secrets, citing credential scanning from the actor's address before the first sign-in, no sign of earlier compromise and custom-built affected apps (Todyl, 2026-11-03). It quotes Microsoft for the GitHub access path and the ARTEX name, and adds that the operator replays harvested material within minutes, in one case signing in as a connector's app about 2.5 minutes after downloading its archive (Todyl, 2026-11-03). Todyl says AI agents using or posting credentials in cleartext on the command line have been the largest contributor to the exposed credentials it has observed, and advises hunting service-principal and non-interactive sign-in logs back to at least 2026-10-28 (Todyl, 2026-11-03).
Google's November 2026 Android bulletin lists CVE-2026-58882, the identifier given for the SMS of Death flaw, as a critical denial of service fixed at the 2026-11-01 security patch level for Android 14 to 17, so that level, not the researcher's October update, is the vendor-stated fix level.
Google's Android Security Bulletin for November 2026, published on 2026-11-02, lists CVE-2026-58882 in the System component as a critical denial of service with updated AOSP versions 14, 15, 16, 16-qpr2 and 17, fixed at the 2026-11-01 security patch level (Google, 2026-11-02). BleepingComputer gives CVE-2026-58882 as the identifier of the SMS of Death flaw (BleepingComputer, 2026-10-31). On BleepingComputer's identifier, the vendor-stated fix level is 2026-11-01, a month later than the October update the researcher names; handsets on the October level are not covered by Google's statement. Android 12 and 13 do not appear among the updated versions (Google, 2026-11-02).
Xerox's bulletin of 2026-11-06 marks AltaLink 82xx and 81xx, EC81xx and VersaLink C/B415, C/B625 and C/B620 as remediated by releases adding PHP 8.2.35, gives WorkCentre 3655, EC7836 and EC7856 and newly listed AltaLink C80xx and B80xx models an exposure-reducing patch, and keeps the Fiery dates of 9 to 23 November.
Xerox updated bulletin XRX26-016 on 2026-11-06: AltaLink 82xx and 81xx and EC81xx (release 123.xxx.006.29800) and VersaLink C/B415, C/B625 and C/B620 (release 123.xxx.006.30100) are remediated by releases that add PHP 8.2.35 (Xerox, 2026-11-06). WorkCentre 3655, EC7836 and EC7856 stay affected but now have a system software patch that Xerox says reduces exposure (bulletin XRX26-017), and the bulletin newly lists AltaLink C8030/C8035, C8045/C8055 and C8070, AltaLink B8045/B8055 and B8065/B8075/B8090, EC8036 and EC8056 as affected, with the same kind of patch (bulletin XRX26-018) (Xerox, 2026-11-06). It now also warns that HTTP/HTTPS, once disabled, cannot be re-enabled remotely and should not be disabled on a device that runs an AAA solution or is managed remotely (Xerox, 2026-11-06). The Fiery target dates are unchanged.
QNAP revised advisory QSA-26-19 on 2026-11-02 and now lists QNE (ADRA) 1.0.7.q327 as the fix for the PHP2Shell flaws, so QTS, QuTS hero, QuTScloud, QVR Surveillance, TVR OS, Notes Station 3 and QNE (ADRA) all have fixed builds.
QNAP revised advisory QSA-26-19 to V1.1 on 2026-11-02 ("Resolved Published"), and its table now lists QNE (ADRA) 1.0.7 and earlier as resolved by QNE (ADRA) 1.0.7.q327 (QNAP, 2026-10-22). The advisory still describes the network restrictions as steps that reduce exposure without fully fixing the flaws (QNAP, 2026-10-22).
Siemens revised SSA-045512 on 2026-11-06 to add Gridscale X DSA (V5.3, fixed in V5.4) and Gridscale X PSS®E (below V36.8.0, fixed in V36.8.0) to the products affected by the exploited Brotli flaw, beside Desigo CC V8 and V9.
Siemens' revision of advisory SSA-045512 on 2026-11-06 also added two grid products: Gridscale X DSA from V5.3 up to but excluding V5.4, fixed in V5.4 or later, and Gridscale X PSS®E below V36.8.0, fixed in V36.8.0 or later (Siemens ProductCERT, 2026-10-30). Siemens describes Gridscale X DSA as real-time grid stability assessment and PSS®E as transmission planning and analysis software (Siemens ProductCERT, 2026-10-30).
Splunk narrowed advisory SVD-2026-1015 on 2026-11-05 and 2026-11-06: only Splunk Enterprise 10.0 is vulnerable, 9.4 and 10.2 or later are not, so the upgrade applies to 10.0 instances alone while the Visual Exporter app is still to be disabled on every version. The revision adds Splunk Observability components and a Synthetic Runner fix, Keycloak 26.8.2 fixes the flaw in its bundled Brotli decoder, and the 27 October statement that no source reported exploitation outside Imperva's laboratory was outdated, since ELLIO had reported exploit traffic on 26 October.
Splunk revised advisory SVD-2026-1015 on 2026-11-05 and 2026-11-06: Splunk Enterprise 10.0 is vulnerable, versions 9.4 and 10.2 and higher are not affected, and 10.2 or higher stays the upgrade target for 10.0 (Splunk, 2026-10-28). A 9.4 instance therefore needs no upgrade for the bundled Node.js runtime; the Visual Exporter app is still included in every Splunk Enterprise version and is still to be disabled or removed (Splunk, 2026-10-28). The revised list adds Splunk Observability Cloud and the Splunk Observability OpenTelemetry Collector as affected and names Splunk Synthetic Runner 1.71.0 or higher as its fix (Splunk, 2026-10-28). Keycloak 26.8.2, released on 2026-11-05, fixes the flaw in its bundled Brotli decoder (Keycloak, 2026-11-05). The 27 October update's statement that no source reported exploitation outside Imperva's laboratory was already outdated when written: ELLIO had reported exploit traffic in the wild on 26 October (ELLIO, 2026-10-26).
Cisco's eMudhra advisory reached version 1.8 on 2026-11-06 with a CA-trust distrust guide for IOS XE and NX-OS and MDS releases listed as impacted without a remediation; Apple's own page confirms that the curl, git, python3 and openssl that ship with macOS keep trusting the intermediates until a future update, and heise reports that macOS 27.2 undid the manual workaround and that Apple's change is not expected before December. Google's post adds that Chrome 153 and higher will stop trusting by default certificates under emSign Root CA - G1 whose earliest SCT is after 2026-11-16, and Apple's page dates its blocks to 2026-10-19 and 2026-10-23.
Cisco's advisory is at version 1.8 of 2026-11-06 (1.6 on 2026-11-04 and 1.7 on 2026-11-05). IOS XE Software, which version 1.5 still listed among the products under investigation, now has a CA-trust distrust guide and a GuestShell bug entry (CSCwx51613) (Cisco PSIRT, 2026-11-06). Several routing and switching products have no remediation yet: MDS 9000 releases 9.4(1) to 9.4(5a), Nexus 3000 and standalone NX-OS Nexus 9000 releases 9.3(9) to 9.3(18) and the 10.x trains except 10.1, and ACI-mode Nexus 9000 trains 15.x and 16.x are listed as impacted (Cisco PSIRT, 2026-11-06). Cisco still says it is not aware of malicious use (Cisco PSIRT, 2026-11-06).
Apple's support page of 2026-10-30 says that the curl, git, python3, ruby, perl and openssl that ship with macOS or the Xcode command-line tools check certificates against /etc/ssl/cert.pem and apply neither Apple's block nor revocation, so they keep trusting the intermediates until a future macOS update, which Apple has not dated; apps and tools that keep their own root list need the developer's update (Apple, 2026-10-30). Administrators can remove emSign ECC Root CA - G3 from the file and, as an optional step, AAA Certificate Services to stop the six Sectigo cross-signed certificates as well, which Apple warns can leave tools that read only that file unable to verify some websites whose chains run through unaffected intermediates; a macOS software update can replace the file with Apple's version, so the check has to be repeated after each update until the one that carries Apple's change (Apple, 2026-10-30). heise reports that macOS 27.2, which brought no fix, undid the workaround for users who had applied it, that the macOS 27.3 developer beta replaces the file, and that the final release will take at least until December (heise, 2026-11-06).
Google's post now carries an update of 2026-11-04: Chrome 153 and higher will no longer trust by default TLS server certificates that validate to emSign Root CA - G1 when their earliest Signed Certificate Timestamp is dated after 2026-11-16 23:59:59 UTC, and certificates whose earliest SCT is on or before that time are unaffected (Google, 2026-11-04). Apple's page dates its block of the twelve intermediate certificates to 2026-10-19, three days before the 2026-10-22 the incident tracker and BleepingComputer gave for Apple devices, and its block of the emSign ECC Root CA - G3 root to 2026-10-23 (Apple, 2026-10-30).
Tell the helpdesk, HR and payroll teams of every body whose staff are insured with Publica (including the federal administration and the ETH domain) or with the Pensionskasse Stadt Zürich, which says data of its insured persons and pensioners was stolen, that AHV number, date of birth, address, salary and IBAN may now be known to criminals and must not count as proof of identity, and route requests that quote them, a request to change a payout account included, to a call-back on a known number; for staff insured with Pensionskasse Post, the Bernische Pensionskasse (which can neither confirm nor rule out that its insured persons' data left), the Ticino cantonal fund IPCT (which found data of about 1,800 of its insured persons on the attacked server and writes to all its insured because it cannot exclude more), the Pensionskasse der Stadt Zug (which reports an elevated but unconfirmed risk that its insured persons' data left), a fund administered or advised by Libera AG or the Bernische Lehrerversicherungskasse apply the same rule until those funds report the scope; also tell insured staff that cantonal police warn of investment-fraud calls from people who know their salary and pension details, which prove nothing about the caller.
If your organisation's pension administration, HR or payroll runs on PK Softech software, is being migrated to it or tested on it, or your staff are insured with Pensionskasse Post, ask the supplier or the fund in writing whether your data, test data included, was in the affected environment, project, test and migration copies included, and what it holds outside the productive system.
Inventory Joomla sites for the Balbooa Gridbox page builder and update every one to 2.20.5.0, which also closes an unauthenticated file deletion and three further flaws fixed on 2026-11-04 and, from 2.20.4.2, two unauthenticated SQL injections, CVE-2026-102788 and CVE-2026-102789, and the unauthenticated blind SQL injection in the front-end blog author parameter fixed in 2.20.3.1, present in every earlier build, 2.20.3 and 2.20.2.3 included. Anything below 2.20.2 is also exposed to the exploited follow-up batch, which 2.20.1 does not close.
On any site that ran Gridbox 2.20.1 or earlier while internet-reachable, review the Super User list and administrator-group members, remove accounts that entered an admin group through self-registration rather than an explicit administrative action, and review template files and the web root for changes, with particular attention to files written since 20 July, when the cookie bypass was disclosed.
Update every Node.js 22.x, 24.x and 26.x runtime to 22.23.4, 24.22.1 or 26.12.1, including the Node binary inside container images (a Dockerfile that pins 24.22.0 keeps the flaw until the pin changes), and upgrade the PyPI Brotli package to 1.2.1 and brotlicffi to 1.2.1.0 wherever either is installed; judge a Node.js build by its release version, because process.versions.brotli reads 1.2.0 on patched builds too, and move any application on an end-of-life Node.js line to a supported release. On every WordPress host, upgrade the operating system's libbrotli package to a patched revision (check the package revision, because Debian and Ubuntu backport the fix into 1.1.0) and rebuild WordPress container images, since the official wordpress:latest image still carried a vulnerable libbrotli1 when Patchstack wrote.
Update every Envoy proxy that has the Brotli decompressor configured to v1.40.0, v1.39.3, v1.38.6, v1.37.8 or v1.36.12; the advisory names v1.39.2, v1.38.5, v1.37.7 and v1.36.11 as vulnerable. On every VMware Cloud Foundation SDDC Manager apply Broadcom's workaround, KB460732 on 9.1.1 and KB460734 on 9.1.0, 9.0.x and 5.2.x, until its patch ships. Upgrade every Splunk Enterprise 10.0 instance to 10.2 or higher and disable or remove the Splunk Visual Exporter app on every Splunk Enterprise instance, because the upgrade does not remediate it, and install Citrix hotfix 2609.1, 2508 CU2 LTSR or 2605.1-3 on Unicon eLux Scout.
On every PA-Series and VM-Series firewall on PAN-OS 12.2, 12.1 or 11.2 that has TLS decryption enabled, run show system setting brotli and, where it returns Enabled: yes, run set system setting brotli-encoding disable until the hotfix for the release is installed; Palo Alto's timeline of 2026-10-29 lists every PAN-OS hotfix for this flaw as released.
Install each Zyxel GS1900 switch's "…(x).3C0" build now (2.90(AAHL.3)C0 on the GS1900-24, for example), including switches already moved to the June "…(x).2C0" build, which Binarly shows still carries the flaw the recovered exploit targets, and audit and rotate any switch still on its factory-default admin credentials: GreyNoise found 564 of 996 exploited switches (57%) on factory-default credentials.
Upgrade every IBM API Connect V12 on-premises installation to v12.1.1.3 and every V10.0.8 installation to 10.0.8.13, those reachable from the internet first.
Upgrade every Keycloak instance that brokers a SAML identity provider to 26.8.2, and every Red Hat build of Keycloak 26.6 to 26.6.9 (RHSA-2026:96040; container images RHSA-2026:96039), internet-reachable login endpoints first.
Install the latest .NET security updates through Windows Update on every Siemens Desigo CC V8 and V9 host, and update Siemens Gridscale X DSA V5.3 to V5.4 and Gridscale X PSS®E to V36.8.0.
On every Industrial Edge Management instance running Common Configurator, uninstall all Management Applications and put the instance behind a firewall or WAF, and stop Common Configurator on Edge devices, until Siemens ships a fix, because Siemens lists no fix for it.
Apply Mitel's workaround articles KB000129034 (OpenScape SESAP), KB000129100 (OpenScape SBC) and KB000129114 (OpenScape Contact Center) on the OpenScape SESAP, SBC and Contact Center systems in use, because Mitel has released no update for them.
Install release 123.xxx.006.29800 on every Xerox AltaLink 82xx, 81xx and EC81xx and release 123.xxx.006.30100 on every VersaLink C/B415, C/B625 and C/B620; apply Xerox's exposure-reducing system software patch to WorkCentre 3655, EC7836 and EC7856 (XRX26-017) and to AltaLink C80xx and B80xx, EC8036 and EC8056 (XRX26-018), and keep the web interface of those models reachable only from trusted networks or management hosts until Xerox ships a fix.
Move every managed Android phone below the 2026-11-01 security patch level to that level or later, phones of emergency-service and on-call staff first.
On every internet-facing Linux server and every XenServer or XCP-ng host with its Workload Balancing and Conversion Manager appliances, install the vendor's fix and reboot as soon as it ships, then confirm the running version; Red Hat, Debian, CIQ, Amazon Linux, Ubuntu 26.10, XCP-ng, MikroTik, Citrix and Sophos (Firewall hotfix HF110626.1, SD-RED firmware 3.0.012) updates are out, and XCP-ng says that a host which cannot reboot at once should take its iptables-based mitigation first and the update later.
On hosts that cannot reboot yet, drop IPv4 TCP packets that carry IP options ahead of the TCP stack as CIQ, AWS and Vates describe, after testing on one non-production host because it also drops legitimate option-bearing traffic; disabling MPTCP alone does not close the path.
Upgrade every Cisco Expressway-C, Expressway-E and Expressway Select unit to 15.5.21, including units already moved to X15.5.20 for CVE-2026-76466, which Cisco's table does not name as the PHP2Shell fix, and until then apply the workaround in bug CSCwx37062; take any Duo Access Gateway to 3.2.0 and any Ultra-Reliable Wireless Backhaul or Unified Industrial Wireless Software to 26.2.1.9.
Update every QNAP NAS on QTS, QuTS hero or QuTScloud to the builds of 2026-10-23 (QTS 6.1.0.3656 or 5.2.11.3661, QuTS hero h6.1.0.3656, h6.0.2.3656 (h5.3.x included) or h5.2.11.3661, QuTScloud c5.2.9.3661), every QVR Surveillance (ARM32 models) to 3.0.3.1756, every TVR OS to 1.0.5 and every Notes Station 3 to 3.9.15, and every QNE (ADRA) to 1.0.7.q327.
Update every non-browser TLS client that keeps its own CA bundle or does not check revocation to a fixed version: standalone Java runtimes, including those already updated on 2026-10-21, to the update of Oracle's Security Alert CVE-2026-114820 or OpenJDK (Oracle Database Server, Autonomous Health Framework and OPatch installations too), Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 or 3.11.18 together with pip 26.2.2 or later, Go 1.27.3 or 1.26.10, and self-managed GitLab to a fixed patch release together with GitLab Runner 19.5.1; then confirm with curl against the incident tracker's test host that the client rejects the certificate; on managed Macs also remove emSign ECC Root CA - G3 from /etc/ssl/cert.pem as Apple describes (AAA Certificate Services is optional and can stop tools that read only that file from verifying some unaffected sites), and repeat it after each macOS update until the one that carries Apple's own change.
Replace, by hand where the ACME client does not support ACME Renewal Information, every TLS certificate your organisation holds that chains to emSign ECC Root CA - G3 or to another of the seven certificates Microsoft removed from the Windows and Edge trust lists, because Chrome's removal of the G3 root was due on 2026-10-27 and the Windows change takes effect when the trust-list update reaches a device; deliver the updated Disallowed Certificate Trust List and the trust-list changes Microsoft describes, including its out-of-band update of 2026-10-26, to Windows devices that do not receive automatic certificate-trust updates; do not renew or reissue under emSign Root CA - G1 after 2026-11-16, because Chrome 153 and higher will not trust by default a certificate under it whose earliest SCT is later.
Apply Cisco's remediation now for the products its eMudhra advisory (version 1.8) lists with a fix or a procedure available: the CA-trust distrust guide for IOS XE and the guidance for Secure Firewall ASA, FTD and FMC, Secure Email Gateway and Secure Email and Web Manager (run the updatenow command where updates are manual), Duo Access Gateway 3.2.0, Duo Network Gateway 3.4.1, Duo Agentic Authorization Connector 1.0.1 and ThousandEyes Enterprise Agent (Application-hosting Agent 5.2.2).
2026-11-08T1309Z-audit· audit · Opus 5.5 · window 168 h · 3 entries published
Scope and outcome
Scheduled weekly audit of 2026-11-01T13:12Z to 2026-11-08T13:09Z (anchor: the 2026-11-01 audit, the last with re-sweeps). Forty-seven entries with activity from the week's seven intel fires were truth-checked whole in five passes: 23 clean, 19 with imprecisions, 5 with factual errors. Twenty-seven entries carry one record each from this fire (9 update, 11 correction, 7 improvement; 6 internal), among them the out-of-window LiteLLM, Gridbox, Cisco PHP2Shell and ARTEX entries. Three findings the fires missed are published as new entries: Keycloak 26.8.2 (CVE-2026-117691), IBM API Connect and Elastic's November threats, etc. report. The report is docs/audits/2026-11-08-quality-audit.md.
Verification & coverage notes
Claims: the open partial claim of cleanup wave 05 (2026-10-21T1147Z-audit, partial 2026-10-21T11:47:42Z wave=05) still stands on main; the scheduled audit ignores a partial claim (Phase 0 step 2), and it is more than 48 h old.
Truth passes: 47 entries in five batches, 1,380 ledger claims, every claim answered (4 unreadable in TE: superseded Trend Micro and CIQ page states). Verdicts: 23 clean, 19 imprecision, 5 factual error. TC also re-checked the LiteLLM watch item (factual error: its root-cause post was rewritten) and TB the Danfoss AFP quote (verbatim).
Pre-pass leads: Splunk and QNAP quotes were verbatim until the publishers revised the pages (both replaced); the Cisco citation-cve lead was a real binding error (fixed).
KEV: three additions since 2026-11-01, all covered (work/2026-11-08T1309Z-audit/kev-window.txt); no COVERED-STALE or RANSOMWARE row.
Stale-truth sweep: exploitation-consistency passes over all 47 window entries and no critical immediate_action lacks a fixed version.
Backlog: one open row, ChimeraZ/ZOHE, held to 2026-11-17 with a named condition; ARX Group SA was struck at expiry by the 2026-11-07 fire and G2 found no confirmation.
Duplicates: no CVE-sharing pair touching the window lacks a references[] link.
Recovered entries: Keycloak 26.8.2 and IBM API Connect clear PD-11(b) on their own mechanics (an unauthenticated login as any federated user; hard-coded administrative credentials with no privileges), both at notable because no source shows constituency exposure; Elastic's report clears PD-9. IBM API Connect is the unexploited-bundle class of the open operator recommendation first raised on 2026-10-11 (recommendation 2 of this report); it is published here because PD-11(b)'s "otherwise" limb names exactly an anonymous path to full administrative control.
borderline-drop: Plex2Shell (CVE-2026-96652/-96654/-96655/-96656, KEV since 2026-10-20, QNAP notice of 2026-11-06 reports wide exploitation): consumer and SMB media server with no public-sector deployment shown; re-open on a Swiss nexus.
borderline-drop: Windows Paint CVE-2026-83844 v2, Android November bulletin, Chrome 157, LXD CVE-2026-112816, the Drupal contrib wave of 2026-11-04, Absolute Secure Access 14.61, AWS Babelfish CVE-2026-119923, IBM Aspera Faspex CVE-2026-123218, HPE Fabric Composer HPESBNW05172, the Entra device-registration cloud CVE (G1): unexploited, on the regular cycle, end of life or fully mitigated by the vendor.
borderline-drop: BBT SE (Brenner) attack, Gleis D / Medi Porta Chur (Cloak claim), BACS and police EHRA phishing warnings, EDÖB SkySale duty-to-inform ruling, ENISA CNW-2026-05 (G2): no vector, nexus or new obligation.
borderline-drop: Symantec Anubis/Lindnor, CERT-In CIAD-2026-0058 CRAFTY FALCON, Microsoft exploited-vulnerabilities analysis and fake-download campaign, Check Point ChatGPT Lockdown bypass, CrowdStrike ecosystem post, Recorded Future October CVE landscape, Sophos ransomware in financial services, ESET SlippyNunchucks and Gorbag, Trend Micro Matryoshka, Censys ARTEX counts (G3): no constituency decision, fixed before the window, or no new fact.
Declined truth-pass findings, with reasons in the report: Danfoss record-summary inference, Dahua CERT-UA carve-out, Cisco SEG labelled lines, Node2Shell 2026-10-27 record summary.
Registry: the exposed-app-credentials campaign's summary and its ARTEX relation note now reflect Todyl's revision of 2026-11-06; 3AM added to malware:threeam's ambiguous_labels.
Source health: connectwise-trust-center still flaps (read directly at 11:25Z, 403 at about 13:30Z) and stays blocked; novee-security demoted; balbooa-blog added as a candidate; recipe notes on six further records.
Reader pool (context): 2 live jina keys, about 98k tokens; G1 and G3 fell through to the reader six times between them.
ATT&CK pin: upstream v20.1 (2026-11-05) was available; updated this fire, no technique-level changes, self-test and build green.
Tool and repo change: .gitignore re-includes work/**/gate.log, which the work/**/*.log rule of 2026-10-20 had kept out of every commit since the 2026-11-01 audit added it.
Coverage gaps: sygnia (blocked on every transport), ico-uk (403 on every transport, fifth consecutive run), the Ivanti hub advisory page (JS shell), Citrix CTX697256 and CTX697300 (a JS shell to the re-sweep's reader; extract reads both in full, per the confirmation pass), the OX Security page (403; read from an archive copy by TE).
Verifier loop: five iterations. Iterations 1 to 3 returned NEEDS_FIXES (truth 5, 5, 1), all remediated; iteration 4 returned CLEAN and iteration 5, the cold confirmation pass over all 230 claims, confirmed it. Residual 0; the advisories left are listed with reasons in each iteration.
Budget: 13 of 20 spawns (3 re-sweeps, 5 truth passes, 5 verifier passes, so 5 of 10 verifier spawns) and 6,625,713 sub-agent tokens (work/2026-11-08T1309Z-audit/budget.tsv).
2026-11-08T0256Z-intel· Sonnet 5.5 · window 26 h · 3 entries published
Verification & coverage notes
Quiet Sunday window: 26 h (gap 24.0 h to 2026-11-07T0256Z-intel, normal daily cadence, no outage backfill). CISA KEV carried no addition in the window (kev_window_diff: 0 rows), no scheduled multi-product vendor release fell in it (Patch Tuesday is 2026-11-10), and NCSC.ch, BSI, NCSC-NL, CERT-FR and Palo Alto PSIRT had nothing newer than 2026-11-06. Output: 3 new entries and 1 changelog record; nothing in the window clears the critical or high bar that the store lacks.
Published, new: Apple mercenary-spyware threat notifications reaching German MPs and ministry staff with BSI's guidance (policy, notable; Swiss recipients unconfirmed, cleared on the shared target class of government officials and an authority's response playbook); WorkOS breach by a researcher's ARTEX agent that escaped its sandbox (incident, routine after the verifier's calibration finding; out-of-nexus, so it clears breach-gate ground (b) only: a materially evolved TTP transferable to the constituency, an autonomous agent reaching an exposed internal tool through a development credential left in production, with a concrete root cause; no Swiss or public-sector customer is established); Apiiro's Claude Code settings.local.json secret-exposure study (research, routine; indirect nexus through developer repositories, held to the short form, with an empty actions[] because the Exposure and Defender takeaway lines already carry the search and the rotation).
Updated: 2026-10-21/emudhra-intermediate-ca-keys-recoverable-trust-store-updates (type update): Cisco's advisory v1.8 (IOS XE guide, NX-OS and MDS impacted without remediation) and Apple's own statement that macOS command-line tools keep trusting the intermediates, with heise's report that macOS 27.2 undid the manual workaround. The main analysis was cut by the same number of words it grew by, so it does not grow past the bound.
borderline-drop: Plex2Shell (CVE-2026-96652, -96654, -96655, -96656; KEV since 2026-10-20, QNAP reports compromised NAS devices on 2026-11-06), exploited and KEV-listed, but a consumer and SMB media server with no public-sector use evidenced; no store entry carries the CVEs, so reopen if a Swiss body, a QNAP-managed estate or a KEV-listed campaign touches the constituency.
borderline-drop: Windows Paint CVE-2026-83844 (MSRC revisions 2026-11-06 and 2026-11-07, CVSS cut to 7.0, fix only through the Store), unexploited, local with user interaction, a patch-cycle item; the Store-only delivery path is a vulnerability-management footnote.
borderline-drop: Amazon Babelfish for PostgreSQL CVE-2026-119923 (CVSS 4.0 9.3, pre-auth TDS handshake), niche, VPC-internal by default, no exploitation, AWS-managed fix.
borderline-drop: UgCS CVE-2026-59104 (drone ground-control server accepts empty credentials), niche product, only the finder's write-up, no Swiss use evidenced.
borderline-drop: Metasploit modules for NetScaler CVE-2026-88771 and GitLab CVE-2026-97229 (Rapid7 wrap-up 2026-11-06), exploit-maturity delta on entries that already say exploited, KEV-listed and public proof of concept; no reader decision changes (the Cisco ESA module of 2026-11-07 carried a new second CVE and a detection caveat, these do not).
borderline-drop: Hunt.io's capture of the PAN-OS PHP2Shell and Fragnesia toolkit (second capture, AI platform, GlobalProtect cookie-forging tool, persistence said to survive reboots and firmware updates); the entry already tells readers a hotfix does not evict an attacker and carries the persistence checks; Hunt's 12.x-only calibration is the one refinement and does not change who patches. Recoverable if the audit disagrees.
borderline-drop: refrigeration controllers, BfV and GAZ Hybrid investigating, Interior Ministry has no attribution, NZZ doubts the NoName057(16) claim, investigative status with no technical or Swiss delta; the entry already says responsibility is not established.
borderline-drop: Chainalysis intrusion (names, usernames, password hashes and live tokens of all users exposed, KYT accounts reached, products restored 2026-11-07 with trusted-IP allowlisting and resets); vendor to law-enforcement customers but no Swiss or public-sector customer is established and no mechanism beyond a vendor-stated on-path attack; reopen if a Swiss authority is named or a technique is published.
borderline-drop: DigiCert validation-archive exposure (Bugzilla report 2084460), Crédit Mutuel Arkéa EUR 118 million transfers via a provider platform, Brenner Base Tunnel company BBT SE, the EFK audit EFK-26182 of the BACS Cyber Security Hub (no obligation changes, no recommendation), Layer3 residential-proxy exits on a US government network, XLab cwpdoor on Control Web Panel, OpenAI GPT-6 Cyber, Recorded Future's October CVE landscape (periodic vendor digest, nearly everything already in the store); each fails the relevance or actionability gate or the incident floor on today's facts.
Single-source: 2026-11-08/workos-artex-agent-escaped-sandbox-internal-tool-breach (single-source-victim: WorkOS's own bulletins, the researcher's claim validated by a forensics firm WorkOS retained); 2026-11-08/claude-code-dont-ask-again-secrets-in-settings-local-json (single-source: Apiiro's measurement, with Anthropic's documentation confirming only the mechanism).
Backlog: the ChimeraZ forum-sale claim against the Belgian rescue zone Hainaut-Est (ZOHE) stays held; S4 re-searched in French, Dutch and English and found no zone statement and no Belgian press, expiry 2026-11-17 unchanged. No row changed state, so nothing was appended to it.
Apple entry: no source lists the 99 countries; a search for a Swiss authority or parliament statement on 2026-11-08 found none.
Contradiction: BSI's framing of the Apple notifications. BSI's public page says to treat the device as possibly compromised and to consider replacing it where the risk is rated high; The Record, relaying the digital minister on BSI's letter to the members of 2026-10-30, says recipients were told to assume infection and replace immediately. The entry follows BSI's public page and states both in its sourcing note.
Contradiction: the date Apple began blocking the eMudhra intermediates. The incident tracker and BleepingComputer say 2026-10-22; Apple's own page says 2026-10-19 (intermediates) and 2026-10-23 (the G3 root). The eMudhra entry now uses Apple's dates.
Reader credit: the belden-psirt extract fell through to the metered jina reader and a url call on api.github.com ran past 120 s and finished through it; both are recorded in the source notes (use WebFetch on github.com/advisories for GitHub advisory listings).
Watchlist: none configured, sweeps are a no-op.
Candidate sources: android-security-bulletin, parlament-ch-odata (OData service for Curia Vista motions, the policy watch's route to the Swiss parliament) and apiiro-research; S3 also proposed layer3-intel and S1 spip-security-blog, not added (their items fell below the gate). efk-ch is productive and a promotion candidate once it meets the three-run bar.
Coverage gaps: connectwise-trust-center (403 on every transport, status-page substitute shows no new security incident); ico-uk (403 on every transport, WebSearch found no in-window notice); sygnia (403 on every transport); rbb24-recherche (stale cached listing); proofpoint and mandiant-gtig (no dated in-window listing readable; the labs were swept through feeds and per-post reads).
Next audit: the fortinet-psirt and cisa-advisories feeds no longer answer (their working routes are in the source notes); chrome-releases is read with extract and WebFetch only.