Tuesday, 10 November 2026

CISA added CVE-2026-116779 to its Known Exploited Vulnerabilities catalog on 2026-11-09 on evidence of active exploitation it does not describe, so the vendor's exploitation claim now has an independent listing.

CISA added CVE-2026-116779 to its Known Exploited Vulnerabilities catalog on 2026-11-09 "based on evidence of active exploitation" that it does not describe (CISA, 2026-11-09). Until then SignalWire's advisory was the only source of the exploitation claim; the listing adds an authority's assessment, still without a victim, an actor or a count of affected systems. The compromise check in the Defender takeaway applies to any instance that SIP peers could reach before it was upgraded.

Huntress's follow-up on servers exploited between 8 and 11 October, before the hotfixes, describes five webshell families, a second miner and a host-bound Python implant, plus Veeam credential theft on a neighbouring server; it advises a full re-image from a trusted backup and rotation of the credentials the server held or could reach.

Huntress's follow-up covers an organisation whose AhsayCBS servers were exploited between 8 and 11 October 2026, before Ahsay's hotfixes; Huntress verified that 10.3.4.45 blocks the entry point it saw and ties the intrusion to the first campaign by webshell location, an exploit source address and matching files (Huntress, 2026-11-09). The operator planted five JSP webshell families under the console's web application directories (Huntress, 2026-11-09); Huntress reads the Linux-style copies, in directories such as /opt, /usr/local and /home, as showing that the exploit simply tried every likely location (Huntress, 2026-11-09). One family hides an AES-encrypted Java class in the least-significant bits of an uploaded PNG's pixels and runs it in memory, so no command parameter appears in access logs; another is a signed-API shell with command execution and chunked upload and download of up to 4 GB per file, a ready exfiltration channel on a backup host; a third can delete itself and any path it is given, so a missing file does not prove it was never there (Huntress, 2026-11-09).

Huntress also found a second XMRig miner kept alive by a SYSTEM scheduled task with a backdated start time that runs every minute, an embedded Python distribution under the SYSTEM profile started from a Run key whose wrapper only runs if a marker file named for the SHA-256 of the host's MachineGuid exists and which then loads a DLL whose strings are consistent with DNS-over-HTTPS lookups, the tunnelling tools gost and chisel, the remote access tools AnyDesk, Atera and Splashtop, a rogue local account, a Mimikatz package and Microsoft Defender exclusions that include the AhsayCBS service process (Huntress, 2026-11-09). On a Veeam server in the same environment it saw a command consistent with NetExec's Veeam credential-theft module, a PowerShell script launched through WMI that queried the VeeamBackup database for stored credentials and decrypted them; it cannot say how many credentials were retrieved, has not identified the implant family and cannot say what, if anything, was taken through the webshell's download action (Huntress, 2026-11-09). For any server exposed before the hotfix, Huntress recommends a full re-image from a trusted backup and rotating the credentials stored on or reachable from the server, including those saved in AhsayCBS and in any backup software on the same network (Huntress, 2026-11-09).

The Pensionskasse der Stadt Zug, whose administrator Libera AG uses PK Softech software, said on 2026-11-09 that there is an elevated, not yet confirmed risk that its insured persons' data left the supplier, and has informed its insured persons and the Federal Data Protection and Information Commissioner.

The Pensionskasse der Stadt Zug said on 2026-11-09 that its administration is outsourced to the consultancy Libera AG, which uses software from PK Softech; the fund says it was first informed of the incident in mid-October, believed it was not affected, and received only last week the information that data of its insured persons could be affected, an "elevated risk" that is not yet confirmed (translated from German) (Inside IT, 2026-11-09). It says names, AHV numbers, birth dates, addresses and salary details, in part also phone numbers and e-mail addresses, were stored at the supplier, that it has informed its insured persons and the Federal Data Protection and Information Commissioner, that retirement assets are safe and that particularly sensitive data such as documents on incapacity to work or disability are not affected (Inside IT, 2026-11-09).

France's foreign ministry and the C4 crisis cell attributed the 11 to 12 October refrigeration-controller campaign to Iran on 2026-11-09, naming the Revolutionary Guard unit Shahid Kaveh, and the Paris prosecutor requested arrest warrants against its leader and two deputies; the French documents cover that campaign only, and the later waves and the Swiss cases are not attributed in them.

France's foreign ministry said on 2026-11-09 that, following the investigation, France is able to attribute the destructive actions of the night of 11 to 12 October to Iran, carried out by the cyber-offensive unit Shahid Kaveh, affiliated with the electronic and cyber centre of the Islamic Revolutionary Guard Corps, and calls it the first cyber-offensive campaign run purely for sabotage on French soil (translated from French) (French Ministry for Europe and Foreign Affairs, 2026-11-09). The report of the C4 crisis cell, which CERT-FR published, words the case as a bundle of indicators that names the Revolutionary Guard as sponsor and Shahid Kaveh as executing unit (translated from French) (CERT-FR, 2026-11-09). The indicators it lists are attack infrastructure also used in the same period to reconnoitre Schneider Electric equipment, use of the FOFA scan tool, which it says the unit habitually uses, relay of the attack on the unit's CyberbanNews outlet from 13 October, and traces of Farsi in the attack infrastructure (CERT-FR, 2026-11-09).

The same report says the unit is known mainly through hacktivist personas, CyberAveng3rs among them, and the CyberbanNews outlet, and that it has held scripts since at least June 2024 to scan, access and control Schneider Electric, Siemens and Rockwell industrial equipment; in April 2026 it was seen using Modbus on TCP port 502 for mass reconnaissance of Schneider Electric systems, including in France (CERT-FR, 2026-11-09). The C4 links to the same attack the concurrent targeting of Schneider Electric equipment at small hydroelectric installations in France, with moderate effects on the targeted equipment (CERT-FR, 2026-11-09). Industrial controllers of that class, reachable on Modbus, belong in the same internet-exposure check as the refrigeration controllers.

The attribution covers the French campaign of 11 to 12 October. Sekoia's honeypots recorded unauthenticated requests to the controllers' xml.cgi endpoint from 26 addresses, password spraying of the Supervisor and admin accounts and, on 2026-11-01, an attempt to use a non-public flaw that renames an account by its numerical identifier; Sekoia says the evidence shows similarities between the October and November waves that suggest they may share an actor, and that it assesses the NoName057(16) and Z-Pentest Alliance claim with doubts (Sekoia, 2026-11-10). Reuters reports that the Paris prosecutor's office said it had requested international arrest warrants against the leader of Shahid Kaveh and his two deputies, and that it could not establish exactly how the French made their determination (Reuters via NBC News, 2026-11-09). NCSC Switzerland's advisory still says the public information does not establish a common attack method across the incidents (NCSC Switzerland, 2026-10-13).

SonicWall revised advisory SNWLID-2026-0014 on 2026-11-09 to add an interim workaround for SAML deployments that cannot upgrade: disable or delete every active LDAP, RADIUS and TACACS+ authentication server. The upgrade stays the primary action.

SonicWall revised advisory SNWLID-2026-0014 on 2026-11-09 and added a workaround for CVE-2026-19868: if SAML authentication is in use and upgrading the firmware is not possible, disable or delete any active LDAP, RADIUS and TACACS+ authentication server configured on the firewall, through Device, Users, Settings, Authentication and the Configure page of each of the three methods (SonicWall PSIRT, 2026-11-09). The advisory's first version named no workaround (BleepingComputer, 2026-11-06). It still urges upgrading; the workaround removes the alternate authentication methods through which the bypass works, which means any administrator or VPN login that relies on those servers stops working until SAML is the only method (an inference from the mechanism, not a SonicWall statement).

CISA added CVE-2026-123158 to its Known Exploited Vulnerabilities catalog on 2026-11-09, and GreyNoise records hands-on logins on its gridpoints from 2026-11-07, including key planting and a dropped Python agent; BleepingComputer relays watchTowr's observation of botnet and cryptomining use. Still no source reports a compromised production host.

CISA added CVE-2026-123158 to its Known Exploited Vulnerabilities catalog on 2026-11-09 on evidence of active exploitation, without describing a victim or the behavior (CISA, 2026-11-09); the Canadian Centre for Cyber Security repeats the listing (Canadian Centre for Cyber Security, 2026-11-09). NCSC Switzerland's advisory, last edited on 2026-11-06, still rates the exploitation status unknown (NCSC Switzerland, 2026-11-05). GreyNoise, which holds the telemetry, says its first successful exploitation came on 2026-11-07 at 00:46 UTC against one of its vulnerable gridpoints, and the sessions it records there show reconnaissance, attempts to read root's SSH keys and /etc/shadow through doas, a new key written into authorized_keys, and in some sessions a Python runtime installed with apk and an init-script service for a Python agent that polls an HTTPS server every 150 seconds; on the host it describes, the agent never enrolled and never received a task (GreyNoise, 2026-11-10). GreyNoise's confirmed successes are on its own gridpoints, and no source reports a compromised production host.

Barracuda's advisory now says it has identified exploitation activity affecting a small number of organizations without naming the flaw, and the Canadian Cyber Centre says open-source reporting indicates CVE-2026-116606 is exploited in the wild, so the earlier statement that no source reports attacks no longer holds.

Barracuda added on 2026-11-09 to its advisory that it has identified exploitation activity affecting a small number of organizations; the advisory does not say which flaw, how many organizations, since when or what the attacker did afterwards (Barracuda, 2026-11-09). The Canadian Centre for Cyber Security's update of the same day says open-source reporting indicates that CVE-2026-116606 is exploited in the wild, without naming the reporting (Canadian Centre for Cyber Security, 2026-11-09). Barracuda's lever is unchanged: organizations whose administrative interfaces are not publicly accessible from the internet are less exposed to this attack path (Barracuda, 2026-11-09), so an appliance whose interface was reachable before patching should also be checked for a restore nobody made and a timezone value that is not a timezone name.