{"date_iso":"2026-11-04","date_human":"Wednesday, November 4, 2026","generated_utc":"2026-11-04 12:57 UTC","read_minutes":6,"patch_tuesday":false,"top_stories":[{"title":"Russian APT29 Hackers Turn Trusted Websites Into Traps to Compromise iPhone and Android Users","link":"https://cybersecuritynews.com/russian-apt29-hackers/","reason":"Android","category":"News","sources":["Ars Technica Security","Bleeping Computer","Cyber Security News","CyberScoop","Krebs On Security","Malwarebytes Labs","SecurityWeek","The Hacker News","The Record","The Register Security"],"coverage":10,"cve_ids":["CVE-2026-58868"],"summary":"A Russian state-linked hacking group is using trusted websites to quietly break into phones. Researchers say APT29, also known as Midnight Blizzard or Cozy Bear, planted hidden code on real and cloned sites in the US\u2026","source":"Cyber Security News","date_rel":"1h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/11/Russian-APT29-Hackers-Turn-Trusted-Websites-Into-Traps-to-Compromise-iPhone-and-Android-Users.webp","description":"A Russian state-linked hacking group is using trusted websites to quietly break into phones. Researchers say APT29, also known as Midnight Blizzard or Cozy Bear, planted hidden code on real and cloned sites in the US, Ukraine, the Czech Republic and Bulgaria. Visitors with out-of-date iPhones or Android phones can lose cookies, Wi-Fi passwords and, in some cases, almost all of their phone data. They only need to open the page. The campaign was found in mid-October 2026. It uses three entry routes: code added directly to hacked sites, lookalike sites that copy real ones, and a one-week\u2026","related":[{"title":"Google Patches Over 200 Android Vulnerabilities, Including Critical Zero-Click RCE Flaws","link":"https://cybersecuritynews.com/android-0-click-remote-code-execution-flaws/","source":"Cyber Security News","date_rel":"2h ago"},{"title":"Hackers use n-day exploits in zero-click attacks on iOS, Android devices","link":"https://www.bleepingcomputer.com/news/security/hackers-use-n-day-exploits-in-zero-click-attacks-on-ios-android-devices/","source":"Bleeping Computer","date_rel":"3h ago"},{"title":"Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction","link":"https://thehackernews.com/2026/11/google-patches-critical-android-flaw.html","source":"The Hacker News","date_rel":"5h ago"},{"title":"Google dismantles massive botnet hidden in Android TV boxes","link":"https://therecord.media/google-dismantles-botnet-hidden-android-tv-boxes","source":"The Record","date_rel":"17h ago"},{"title":"Google dismantles botnet secretly running on 1.3 million Android TV boxes","link":"https://arstechnica.com/google/2026/11/google-dismantles-botnet-secretly-running-on-1-3-million-android-tv-boxes/","source":"Ars Technica Security","date_rel":"19h ago"},{"title":"Android\u2019s November 2026 Updates Patch Over 200 Vulnerabilities","link":"https://www.securityweek.com/androids-november-2026-updates-patch-over-200-vulnerabilities/","source":"SecurityWeek","date_rel":"3 Nov"}]},{"title":"Microsoft Edge Now Automatically Blocks Malicious Websites Sending Fake Virus Alert Notifications","link":"https://cybersecuritynews.com/microsoft-edge/","reason":"Microsoft","category":"News","sources":["Ars Technica Security","Cyber Security News","Dark Reading","The Hacker News","Zero Day Initiative"],"coverage":5,"cve_ids":[],"summary":"Microsoft Edge now automatically disables notifications from websites that send users to detected scam pages, cutting off a route used to deliver fake virus warnings. The protection connects Microsoft Defender\u2026","source":"Cyber Security News","date_rel":"1h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/11/Microsoft-Edge-Now-Automatically-Blocks-Malicious-Websites-Sending-Fake-Virus-Alert-Notifications.webp","description":"Microsoft Edge now automatically disables notifications from websites that send users to detected scam pages, cutting off a route used to deliver fake virus warnings. The protection connects Microsoft Defender SmartScreen and Scareware blocker detections with notification permissions, helping prevent malicious sites from repeatedly drawing people back into the same scam. The change arrived with Edge 156, according to Microsoft\u2019s November 2 disclosure. Rather than simply warning about a dangerous destination, Edge can now stop further notifications from the website responsible for sending the\u2026","related":[{"title":"UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?","link":"https://arstechnica.com/security/2026/11/uefi-bootkit-infected-fully-patched-windows-machines-is-microsoft-to-blame/","source":"Ars Technica Security","date_rel":"20h ago"},{"title":"ZDI-26-868: Microsoft Windows Aero Theme Improper Handling Of Error Condition Denial-of-Service Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-868/","source":"Zero Day Initiative","date_rel":"3 Nov"},{"title":"Microsoft's AI Risk Report Misses This Key Detail","link":"https://www.darkreading.com/cyberattacks-data-breaches/microsoft-ai-cyber-risk-report-miss","source":"Dark Reading","date_rel":"2 Nov"},{"title":"Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data","link":"https://thehackernews.com/2026/11/attackers-pose-as-it-support-on.html","source":"The Hacker News","date_rel":"2 Nov"},{"title":"ZDI-26-850: Microsoft Qlib MLflowRecorder Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-850/","source":"Zero Day Initiative","date_rel":"2 Nov"},{"title":"ZDI-26-849: Microsoft Qlib RestrictedUnpickler Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-849/","source":"Zero Day Initiative","date_rel":"2 Nov"}]},{"title":"CISA Warns of WordPress Core Vulnerability Exploited in Attacks to Execute Malicious Code","link":"https://cybersecuritynews.com/wordpress-core-vulnerability-exploited/","reason":"Wordpress","category":"News","sources":["Bleeping Computer","CCCS Alerts & Advisories","CISA Alerts & Advisories","Cyber Security News","The Hacker News"],"coverage":5,"cve_ids":["CVE-2026-119977"],"summary":"The U.S. Cybersecurity and Infrastructure Security Agency has warned that attackers are exploiting a WordPress Core vulnerability that can allow malicious code to run on website servers. CISA added the flaw to its Known\u2026","source":"Cyber Security News","date_rel":"3h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/11/WordPress-Core-Vulnerability-Exploited.webp","description":"The U.S. Cybersecurity and Infrastructure Security Agency has warned that attackers are exploiting a WordPress Core vulnerability that can allow malicious code to run on website servers. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 3, 2026, confirming evidence of active exploitation and raising the need for prompt patching. Tracked as CVE-2026-119977, the vulnerability affects WordPress Core versions 4.7 through 7.1.3 and carries a high severity CVSS score of 8.1. Attackers do not need a valid account or user interaction. However, exploitation requires\u2026","related":[{"title":"CISA flags WordPress RCE flaw as actively exploited in attacks","link":"https://www.bleepingcomputer.com/news/security/cisa-flags-wordpress-rce-flaw-as-actively-exploited-in-attacks/","source":"Bleeping Computer","date_rel":"45m ago"},{"title":"CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades","link":"https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html","source":"The Hacker News","date_rel":"7h ago"},{"title":"WordPress security advisory (AV26-1117)","link":"https://cyber.gc.ca/en/alerts-advisories/wordpress-security-advisory-av26-1117","source":"CCCS Alerts & Advisories","date_rel":"15h ago"},{"title":"CISA Adds One Known Exploited Vulnerability to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/11/03/cisa-adds-one-known-exploited-vulnerability-catalog","source":"CISA Alerts & Advisories","date_rel":"3 Nov"},{"title":"Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials","link":"https://thehackernews.com/2026/11/attackers-target-unpatched.html","source":"The Hacker News","date_rel":"3 Nov"}]},{"title":"Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft","link":"https://thehackernews.com/2026/11/binance-reveals-how-fake-job-interviews.html","reason":"Exchange","category":"News","sources":["Bleeping Computer","Check Point Research","Kaspersky Securelist","The Hacker News","The Register Security"],"coverage":5,"cve_ids":[],"summary":"Binance on Tuesday said the record-setting theft of $6.43 billion in assets from the world's largest cryptocurrency exchange was the culmination of a \"sophisticated, multi-stage campaign\" that involved the use of a\u2026","source":"The Hacker News","date_rel":"20h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZCMCR8h3YCPcfY8Fbe54ckYKh_YUt_Yd7v82dAHobZtMNlQl_JVKWUX4OUPwR0dEmYsLNfeKsW6rUthk8pYRVhIddbPXx86sHCcNBRL9E-9LJTPrYSYwJ_V66EwGJNFeoWgDPbjcGfeJ4w2qn_gfTjXBoNAnfWq4GZ8rq7VOhnqt4QlItYEBr3Zar7XL1/s1600/bin.jpg","description":"Binance on Tuesday said the record-setting theft of $6.43 billion in assets from the world's largest cryptocurrency exchange was the culmination of a \"sophisticated, multi-stage campaign\" that involved the use of a tampered Homebrew installation and recruitment-themed social engineering attack targeting two of its engineers. \"It was not a single isolated breach or a simple phishing incident,\"","related":[{"title":"Binance says fake job interview led to $6.3 billion crypto heist","link":"https://www.bleepingcomputer.com/news/security/binance-says-fake-job-interview-led-to-63-billion-crypto-heist/","source":"Bleeping Computer","date_rel":"16h ago"},{"title":"MLEP in KICS for Networks 5.0: how machine learning helps track network behavior of OT devices","link":"https://securelist.com/tr/machine-learning-event-processor-in-kics-for-networks/121794/","source":"Kaspersky Securelist","date_rel":"3 Nov"},{"title":"2nd November \u2013 Threat Intelligence Report","link":"https://research.checkpoint.com/2026/2nd-november-threat-intelligence-report/","source":"Check Point Research","date_rel":"2 Nov"},{"title":"FBI pins $6.3B Binance crypto heist on North Korean hackers","link":"https://www.theregister.com/security/2026/11/02/fbi-pins-63b-binance-crypto-heist-on-north-korean-hackers/5306889","source":"The Register Security","date_rel":"2 Nov"}]},{"title":"Google Releases Major Chrome Security Update Fixing 213 Bugs, Including 7 Critical Vulnerabilities","link":"https://cybersecuritynews.com/google-releases-major-chrome-security-update/","reason":"Chrome","category":"News","sources":["Cyber Security News","Malwarebytes Labs","SecurityWeek"],"coverage":3,"cve_ids":[],"summary":"Google has released Chrome 157 for Windows, macOS, and Linux, fixing 213 security bugs, including seven rated critical. Announced on November 3, 2026, the update addresses flaws across graphics, memory handling, browser\u2026","source":"Cyber Security News","date_rel":"1h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/11/Major-Chrome-Security-Update.webp","description":"Google has released Chrome 157 for Windows, macOS, and Linux, fixing 213 security bugs, including seven rated critical. Announced on November 3, 2026, the update addresses flaws across graphics, memory handling, browser features, and access controls. Google says the stable release will reach users over the coming days and weeks. The patched versions are 157.0.8103.38 for Linux and 157.0.8103.38/.39 for Windows and macOS. The release follows another large patch cycle covered in Cybersecuritynews.com\u2019s report on Chrome 156 fixing 353 security flaws , showing the continued need to keep browser\u2026","related":[{"title":"Chrome 157 fixes 213 security issues, including 7 critical flaws","link":"https://www.malwarebytes.com/blog/bugs/2026/11/chrome-157-fixes-213-security-issues-including-7-critical-flaws","source":"Malwarebytes Labs","date_rel":"40m ago"},{"title":"Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical","link":"https://www.securityweek.com/chrome-157-rolls-out-with-213-security-fixes-seven-rated-critical/","source":"SecurityWeek","date_rel":"2h ago"},{"title":"A week in security (October 26 \u2013 November 1)","link":"https://www.malwarebytes.com/blog/news/2026/11/a-week-in-security-october-26-november-1-2","source":"Malwarebytes Labs","date_rel":"2 Nov"}]},{"title":"Cloudflare Launches Zero Wire to Track Critical CVEs, Active Exploits, and Security Fixes","link":"https://cybersecuritynews.com/cloudflare-launches-zero-wire/","reason":"Teams","category":"News","sources":["Cyber Security News","The Hacker News","Wiz Research"],"coverage":3,"cve_ids":[],"summary":"Cloudflare has launched Zero Wire, a public vulnerability intelligence feed designed to help security teams track critical CVEs, understand exploitation activity, and find security fixes. Announced on November 3, 2026\u2026","source":"Cyber Security News","date_rel":"1h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/11/Cloudflare-Launches-Zero-Wire-to-Track-Critical-CVEs-Active-Exploits-and-Security-Fixes.webp","description":"Cloudflare has launched Zero Wire, a public vulnerability intelligence feed designed to help security teams track critical CVEs, understand exploitation activity, and find security fixes. Announced on November 3, 2026, the service sits within Cloudflare Radar\u2019s security section and brings technical evidence, vendor guidance, and recommended actions into readable briefings. The platform addresses a familiar problem: when a serious vulnerability emerges, defenders must piece together scattered advisories while checking their own systems. Cloudflare\u2019s launch announcement describes a service\u2026","related":[{"title":"From Reactive to Proactive: Empowering SOC Teams with the Wiz Red and Blue Agents","link":"https://www.wiz.io/blog/soc-alerts-red-and-blue-agents","source":"Wiz Research","date_rel":"2 Nov"},{"title":"Is Your SOC Ready for AI Agents? A Maturity Check Before You Deploy","link":"https://thehackernews.com/2026/11/is-your-soc-ready-for-ai-agents.html","source":"The Hacker News","date_rel":"2 Nov"}]},{"title":"cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes","link":"https://thehackernews.com/2026/11/cpguard-update-channel-hijacked-to.html","reason":"Linux","category":"News","sources":["CCCS Alerts & Advisories","The Hacker News","The Register Security","Trail of Bits"],"coverage":4,"cve_ids":[],"summary":"An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers. The script installed a backdoor and collected password hashes and\u2026","source":"The Hacker News","date_rel":"21h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtc3HOtWwxZPk7V8yva9o6Oe5lWAPX8KZsWHG27ohycqrb04wAKSDSSdk6ta6y284N9gT6Ab6QKIWwTPss2bBK4PtS3Fm7gSI9QG5kec2AvEgQPjQnc0YlhlUQx0uZKt2ygn576BQ3aburL-IhrMRFVm1vEpTR5ol06R0BtjySvifD05Q_dQGUPvyPLxs/s1600/cpgaurd.png","description":"An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers. The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory. The attacker has since taken some of that data. cPGuard 5.88.25 and later versions","related":[{"title":"Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing","link":"https://thehackernews.com/2026/11/red-hat-patches-98-rated-linux-tcp-rce.html","source":"The Hacker News","date_rel":"3 Nov"},{"title":"Max-severity bug in widely used OT programming tool exploited to deliver Linux malware","link":"https://www.theregister.com/security/2026/11/02/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware/5307086","source":"The Register Security","date_rel":"2 Nov"},{"title":"SUSE Linux security advisory (AV26-1113)","link":"https://cyber.gc.ca/en/alerts-advisories/suse-linux-security-advisory-av26-1113","source":"CCCS Alerts & Advisories","date_rel":"2 Nov"},{"title":"Backporting security fixes at scale with Codex","link":"https://blog.trailofbits.com/2026/11/02/backporting-security-fixes-at-scale-with-codex/","source":"Trail of Bits","date_rel":"2 Nov"},{"title":"Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts","link":"https://thehackernews.com/2026/11/government-linux-servers-targeted-with.html","source":"The Hacker News","date_rel":"2 Nov"}]},{"title":"Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges","link":"https://thehackernews.com/2026/11/google-warns-llmjacking-attacks-are.html","reason":"Google","category":"News","sources":["Bleeping Computer","CCCS Alerts & Advisories","Infosecurity Magazine","The Hacker News"],"coverage":4,"cve_ids":[],"summary":"Google on Monday warned that threat actors are hijacking enterprise access to Large Language Models (LLMs) to fraudulently leverage expensive computing resources and AI services. The tactic is called LLMjacking, a form\u2026","source":"The Hacker News","date_rel":"21h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjvqwPJPXsflyvqykVK3Pd1lLXLzEJ6vpLudxQUyYbWkS4nQ0dr9dhcSlMCPwgqfAkyadPSj28XReqkeiymKG5RAZMWpx5Hqhg_XI0HNp3jRMRpaO-wVIRbyJyS8MaaqDNOxXvk8aUENx_aiNMqrqm9SWjtJVpXR2uaP-LNp5deG4U_4YvSxpPKtdJLRNoh/s1600/llmjacking.png","description":"Google on Monday warned that threat actors are hijacking enterprise access to Large Language Models (LLMs) to fraudulently leverage expensive computing resources and AI services. The tactic is called LLMjacking, a form of resource hijacking adapted for the LLM era, where an attacker obtains an API key through phishing, source code leaks, misconfigured environments, or exposed client-side code","related":[{"title":"Google: LLMjacking attacks rack up $1 million in cloud AI charges","link":"https://www.bleepingcomputer.com/news/security/google-llmjacking-attacks-rack-up-1-million-in-cloud-ai-charges/","source":"Bleeping Computer","date_rel":"18h ago"},{"title":"Google adds new $250,000 Cloud VRP reward for Root-in-Cloud bugs","link":"https://www.bleepingcomputer.com/news/google/google-adds-new-250-000-cloud-vrp-reward-for-root-in-cloud-bugs/","source":"Bleeping Computer","date_rel":"3 Nov"},{"title":"LLMJacking is Costing Some Businesses Up to $1m, Warns Google","link":"https://www.infosecurity-magazine.com/news/llmjacking-cost-business-1m-warns/","source":"Infosecurity Magazine","date_rel":"3 Nov"},{"title":"Police and Tech Firms Team Up to Dismantle XCPE Botnet","link":"https://www.infosecurity-magazine.com/news/police-tech-firms-team-up-to/","source":"Infosecurity Magazine","date_rel":"3 Nov"},{"title":"Google security advisory (AV26-1109)","link":"https://cyber.gc.ca/en/alerts-advisories/google-security-advisory-av26-1109","source":"CCCS Alerts & Advisories","date_rel":"2 Nov"}]},{"title":"China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor","link":"https://thehackernews.com/2026/11/china-aligned-hackers-hijack-sogou.html","reason":"Windows","category":"News","sources":["Dark Reading","The Hacker News"],"coverage":2,"cve_ids":[],"summary":"A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a\u2026","source":"The Hacker News","date_rel":"1h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhMawvNNOvRYRm-k7ii9yDdw214v4kwQ7h5fAfOaUVkvMetNwArral8qumlObtaftjOcBsibL9vkqM1UT0-9l9jYPjj3M3C9NcPfg5pdIuENUfdKlK7lyseCS30AVhgLLs6a-2fdXlSDymSVeyIziO7IC13HFCaOf1v4sjbgmkeKfewWNsbTJCJ0WR2zLBZ/s1600/key.jpg","description":"A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP). The campaign, observed starting July 1, 2026, is assessed to have targeted organizations and","related":[{"title":"PapRAT Cyber-Espionage Campaign Leaves a 'Bitter' Taste in South Asia","link":"https://www.darkreading.com/cyberattacks-data-breaches/paprat-cyberespionage-campaign-bitter-south-asia","source":"Dark Reading","date_rel":"2 Nov"},{"title":"New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value","link":"https://thehackernews.com/2026/11/new-volta-infostealer-uses-claude.html","source":"The Hacker News","date_rel":"2 Nov"}]},{"title":"Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors","link":"https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html","reason":"Siemens","category":"News","sources":["CCCS Alerts & Advisories","The Hacker News"],"coverage":2,"cve_ids":["CVE-2026-58115"],"summary":"A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case\u2026","source":"The Hacker News","date_rel":"3 Nov","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLg0QvfH0SD_sz2pFnyrG6Zcs-ltrKaf42ZY7PYKTsA26Nu4alNeqarZZ9HGEjO0UJFr5Wfsb7WBSDYoRnGi6X1jXZ8_4xx1VJtYshtPXYX9DVJYu4lln_IqEhf-NQJC7MKWI1JVzzR5heu6O_OnWezfKsj3AnBs5NKVp5dOVgR-7XuKMIAiyiKflPlT9E/s1600/siemens-hack.jpg","description":"A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code. \"SIMATIC IoT2050 Advanced devices running","related":[{"title":"[Control systems] Siemens security advisory (AV26-802) \u2013 Update 1","link":"https://cyber.gc.ca/en/alerts-advisories/control-systems-siemens-security-advisory-av26-802","source":"CCCS Alerts & Advisories","date_rel":"22h ago"}]}],"worth_reading":[{"title":"Mutipath TCP: Use and Detection, (Mon, Nov 2nd)","link":"https://isc.sans.edu/diary/rss/33482","reason":"CVE-2026-98432","category":"Research","sources":["Fortinet PSIRT","SANS Internet Storm Center"],"coverage":2,"cve_ids":["CVE-2026-98432"],"summary":"Last week, an often-ignored TCP option, introduced in 2020, made the news due to a new vulnerability in Linux's implementation (RFC 8684, CVE-2026-98432)","source":"SANS Internet Storm Center","date_rel":"2 Nov","thumbnail":"","description":"","related":[{"title":"Linux kernel RCE CVE-2026-98432","link":"https://fortiguard.fortinet.com/psirt/FG-IR-26-188","source":"Fortinet PSIRT","date_rel":"2 Nov"}]}],"kev_watch":[],"vuln_watch":[{"id":"CVE-2026-121606","vendor":"Qihoo 360","product":"D621-2","severity":"CRITICAL","score":10.0,"description":"A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipu\u2026","cwe":"CWE-345","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://gist.github.com/gajgdm6-cpu/cf98af20ddb77f27a7c112214a6280f7","https://vuldb.com/cve/CVE-2026-121606","https://vuldb.com/submit/1023261"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-121606"},{"id":"CVE-2026-121607","vendor":"Qihoo 360","product":"D603-2","severity":"CRITICAL","score":10.0,"description":"A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. The a\u2026","cwe":"CWE-77","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://gist.github.com/gajgdm6-cpu/e8ef7f512bebb987b0119562873afd5a","https://vuldb.com/cve/CVE-2026-121607","https://vuldb.com/submit/1023262"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-121607"},{"id":"CVE-2026-121609","vendor":"Qihoo 360","product":"Whole Home Router M5","severity":"CRITICAL","score":10.0,"description":"A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitati\u2026","cwe":"CWE-259","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://gist.github.com/gajgdm6-cpu/c8c3bbdeb51c076317834b41c3a919f2","https://vuldb.com/cve/CVE-2026-121609","https://vuldb.com/submit/1023264"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-121609"},{"id":"CVE-2026-121615","vendor":"Linksys","product":"E5600","severity":"CRITICAL","score":10.0,"description":"A vulnerability was determined in Linksys E5600 1.1.0.26. Affected is an unknown function of the file /cgi-bin/mesh_login.cgi of the component Login Handler. Executing a manipulation can lead to improper authentication. The attack can be la\u2026","cwe":"CWE-287","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/Zimo-666/E5600-cves/tree/main/02-mesh-login-auth-bypass","https://vuldb.com/cve/CVE-2026-121615","https://vuldb.com/submit/1023310"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-121615"},{"id":"CVE-2026-28336","vendor":"SolarWinds","product":"Dameware","severity":"CRITICAL","score":9.9,"description":"SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required.","cwe":"CWE-20","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28336"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-28336"},{"id":"CVE-2026-121597","vendor":"TOTOLINK","product":"A950RG","severity":"CRITICAL","score":9.9,"description":"A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setAppEasyWizardConfig of the file /cgi-bin/cstecgi.cgi of the component Easy Setup Wizard Handler. Executing a manipulation of the argument\u2026","cwe":"CWE-119","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://gist.github.com/H3rmesk1t/49d6ccded59379651568e0bdc6b5624c","https://vuldb.com/cve/CVE-2026-121597","https://vuldb.com/submit/1022558"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-121597"},{"id":"CVE-2026-121598","vendor":"TOTOLINK","product":"A950RG","severity":"CRITICAL","score":9.9,"description":"A security vulnerability has been detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function strcpy of the file /cgi-bin/cstecgi.cgi of the component Basic Wireless Configuration Handler. The manipulation of the argument \u2026","cwe":"CWE-119","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://gist.github.com/H3rmesk1t/e283a4f3224cbd0a57d4392de60bd2c6","https://vuldb.com/cve/CVE-2026-121598","https://vuldb.com/submit/1022559"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-121598"},{"id":"CVE-2026-121599","vendor":"TOTOLINK","product":"A950RG","severity":"CRITICAL","score":9.9,"description":"A vulnerability was detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function setWiFiMultipleConfig/delWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi of the component Multi-SSID Configuration. The manipulation of the\u2026","cwe":"CWE-119","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://gist.github.com/H3rmesk1t/44673654282c9b21bc8971bab7e4b8a3","https://vuldb.com/cve/CVE-2026-121599","https://vuldb.com/submit/1022561"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-121599"},{"id":"CVE-2026-121600","vendor":"TOTOLINK","product":"A950RG","severity":"CRITICAL","score":9.9,"description":"A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component MAC Filter Handler. This manipulation of the argument addEff\u2026","cwe":"CWE-119","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://gist.github.com/H3rmesk1t/217c00b12e04fcde07c453a55579f808","https://vuldb.com/cve/CVE-2026-121600","https://vuldb.com/submit/1022562"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-121600"},{"id":"CVE-2026-38600","vendor":"Unknown","product":"","severity":"CRITICAL","score":9.8,"description":"A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive.","cwe":"CWE-22","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-001-zipslip.md","https://github.com/codeskyblue/gohttpserver","https://github.com/codeskyblue/gohttpserver/issues/232"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-38600"}],"vendor_spikes":[{"vendor":"Google","count":216,"critical_count":28},{"vendor":"HP","count":55,"critical_count":3},{"vendor":"WordPress","count":35,"critical_count":0},{"vendor":"Unknown","count":33,"critical_count":1},{"vendor":"FreeRDP","count":27,"critical_count":0},{"vendor":"Linux","count":24,"critical_count":0},{"vendor":"Microsoft","count":19,"critical_count":0},{"vendor":"Tanium","count":19,"critical_count":0},{"vendor":"Quest","count":16,"critical_count":3},{"vendor":"AM System","count":15,"critical_count":0}],"epss_risers":[],"developing_map":{},"trending_count":13,"new_cve_count":825,"has_news_data":true,"has_cve_data":true,"news_for_cve":{"CVE-2026-58868":{"anchor":"#dev-1","rank":1,"coverage":10},"CVE-2026-119977":{"anchor":"#dev-3","rank":3,"coverage":5},"CVE-2026-58115":{"anchor":"#dev-10","rank":10,"coverage":2}}}