Wednesday, November 4, 2026 · generated · about 6 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Google 28 critical 216
- HP 3 critical 55
- WordPress 35
- Unknown 1 critical 33
- FreeRDP 27
- Linux 24
- Microsoft 19
- Tanium 19
- Quest 3 critical 16
- AM System 15
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News Russian APT29 Hackers Turn Trusted Websites Into Traps to Compromise iPhone and Android Users
A Russian state-linked hacking group is using trusted websites to quietly break into phones. Researchers say APT29, also known as Midnight Blizzard or Cozy Bear, planted hidden code on real and cloned sites in the US, Ukraine, the Czech Republic and Bulgaria. Visitors with out-of-date iPhones or Android phones can lose cookies, Wi-Fi passwords and, in some cases, almost all of their phone data. They only need to open the page. The campaign was found in mid-October 2026. It uses three entry routes: code added directly to hacked sites, lookalike sites that copy real ones, and a one-week…
Also in Cyber Security News Bleeping Computer The Hacker News +3
-
Microsoft Edge Now Automatically Blocks Malicious Websites Sending Fake Virus Alert Notifications
Microsoft Edge now automatically disables notifications from websites that send users to detected scam pages, cutting off a route used to deliver fake virus warnings. The protection connects Microsoft Defender SmartScreen and Scareware blocker detections with notification permissions, helping prevent malicious sites from repeatedly drawing people back into the same scam. The change arrived with Edge 156, according to Microsoft’s November 2 disclosure. Rather than simply warning about a dangerous destination, Edge can now stop further notifications from the website responsible for sending the…
Also in Ars Technica Security Zero Day Initiative Dark Reading +3
-
CISA Warns of WordPress Core Vulnerability Exploited in Attacks to Execute Malicious Code
The U.S. Cybersecurity and Infrastructure Security Agency has warned that attackers are exploiting a WordPress Core vulnerability that can allow malicious code to run on website servers. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 3, 2026, confirming evidence of active exploitation and raising the need for prompt patching. Tracked as CVE-2026-119977, the vulnerability affects WordPress Core versions 4.7 through 7.1.3 and carries a high severity CVSS score of 8.1. Attackers do not need a valid account or user interaction. However, exploitation requires…
Also in Bleeping Computer The Hacker News CCCS Alerts & Advisories +2
-
Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft
Binance on Tuesday said the record-setting theft of $6.43 billion in assets from the world's largest cryptocurrency exchange was the culmination of a "sophisticated, multi-stage campaign" that involved the use of a tampered Homebrew installation and recruitment-themed social engineering attack targeting two of its engineers. "It was not a single isolated breach or a simple phishing incident,"
Also in Bleeping Computer Kaspersky Securelist Check Point Research +1
-
Google Releases Major Chrome Security Update Fixing 213 Bugs, Including 7 Critical Vulnerabilities
Google has released Chrome 157 for Windows, macOS, and Linux, fixing 213 security bugs, including seven rated critical. Announced on November 3, 2026, the update addresses flaws across graphics, memory handling, browser features, and access controls. Google says the stable release will reach users over the coming days and weeks. The patched versions are 157.0.8103.38 for Linux and 157.0.8103.38/.39 for Windows and macOS. The release follows another large patch cycle covered in Cybersecuritynews.com’s report on Chrome 156 fixing 353 security flaws , showing the continued need to keep browser…
-
Cloudflare Launches Zero Wire to Track Critical CVEs, Active Exploits, and Security Fixes
Cloudflare has launched Zero Wire, a public vulnerability intelligence feed designed to help security teams track critical CVEs, understand exploitation activity, and find security fixes. Announced on November 3, 2026, the service sits within Cloudflare Radar’s security section and brings technical evidence, vendor guidance, and recommended actions into readable briefings. The platform addresses a familiar problem: when a serious vulnerability emerges, defenders must piece together scattered advisories while checking their own systems. Cloudflare’s launch announcement describes a service…
Also in Wiz Research The Hacker News
-
cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes
An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers. The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory. The attacker has since taken some of that data. cPGuard 5.88.25 and later versions
Also in The Hacker News The Register Security CCCS Alerts & Advisories +2
-
Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges
Google on Monday warned that threat actors are hijacking enterprise access to Large Language Models (LLMs) to fraudulently leverage expensive computing resources and AI services. The tactic is called LLMjacking, a form of resource hijacking adapted for the LLM era, where an attacker obtains an API key through phishing, source code leaks, misconfigured environments, or exposed client-side code
Also in Bleeping Computer Bleeping Computer Infosecurity Magazine +2
-
China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor
A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP). The campaign, observed starting July 1, 2026, is assessed to have targeted organizations and
Also in Dark Reading The Hacker News
-
Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors
A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code. "SIMATIC IoT2050 Advanced devices running
Also in CCCS Alerts & Advisories
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-121606 | D621-2Qihoo 360 | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipu… Attack
Exploitation
|
|||||||||
| CVE-2026-121607 | D603-2Qihoo 360 | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. The a… Attack
Exploitation
|
|||||||||
| CVE-2026-121609 | Whole Home Router M5Qihoo 360 | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitati… Attack
Exploitation
|
|||||||||
| CVE-2026-121615 | E5600Linksys | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA vulnerability was determined in Linksys E5600 1.1.0.26. Affected is an unknown function of the file /cgi-bin/mesh_login.cgi of the component Login Handler. Executing a manipulation can lead to improper authentication. The attack can be la… Attack
Exploitation
|
|||||||||
| CVE-2026-28336 | DamewareSolarWinds | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isSolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required. Attack
Exploitation
|
|||||||||
| CVE-2026-121597 | A950RGTOTOLINK | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isA weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setAppEasyWizardConfig of the file /cgi-bin/cstecgi.cgi of the component Easy Setup Wizard Handler. Executing a manipulation of the argument… Attack
Exploitation
|
|||||||||
| CVE-2026-121598 | A950RGTOTOLINK | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isA security vulnerability has been detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function strcpy of the file /cgi-bin/cstecgi.cgi of the component Basic Wireless Configuration Handler. The manipulation of the argument … Attack
Exploitation
|
|||||||||
| CVE-2026-121599 | A950RGTOTOLINK | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isA vulnerability was detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function setWiFiMultipleConfig/delWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi of the component Multi-SSID Configuration. The manipulation of the… Attack
Exploitation
|
|||||||||
| CVE-2026-121600 | A950RGTOTOLINK | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isA flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component MAC Filter Handler. This manipulation of the argument addEff… Attack
Exploitation
|
|||||||||
| CVE-2026-38600 | Unknown | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isA Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive. Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Worth reading quieter, still worth your time
-
Mutipath TCP: Use and Detection, (Mon, Nov 2nd)
Last week, an often-ignored TCP option, introduced in 2020, made the news due to a new vulnerability in Linux's implementation (RFC 8684, CVE-2026-98432)
Also in Fortinet PSIRT
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.