This brief covers the trailing ~48 hours (November 6–7, 2026). Every item below was traced to a primary source — a vendor advisory, the CVE record, the NVD/CISA KEV entry, or the original research — and the dates shown are the dates those primary sources carry.

SonicWall SonicOS SSLVPN SAML/MFA bypass (CVE-2026-19868) exploited in the wild, added to CISA KEV

SonicWall PSIRT / CISA · November 6, 2026

SonicWall published advisory SNWLID-2026-0014 for CVE-2026-19868, an authentication-enforcement flaw in the SonicOS SSLVPN service. A user holding valid credentials for an alternate authentication method can bypass SAML authentication controls, and SonicWall says successful exploitation may also bypass SAML-enforced multi-factor authentication. The bug is rated CVSS 3.1 7.5 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) and affects Gen7 SonicOS 7.3.3-7015 and older and Gen8 SonicOS 8.2.2-8015 and older; SonicWall urges upgrading to the latest release, with outlets citing the advisory listing SonicOS 7.3.4-7013 (Gen7) and 8.2.3-8015 (Gen8) as the fixed builds. CISA added the CVE to the Known Exploited Vulnerabilities catalog the same day as “SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability,” with a federal remediation deadline of November 20, 2026. Admins running SAML on SSLVPN should patch and review logins that skipped MFA.

“An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).” — CVE-2026-19868 record, SonicWall (CNA)

Source: SonicWall PSIRT SNWLID-2026-0014 · NVD CVE-2026-19868 (KEV: added 2026-11-06) · CISA alert · Security Affairs

OpenSSH “SSHole” password-authentication bypass (CVE-2026-123158) sees exploitation attempts within hours of disclosure

OpenSSH / Alpine Linux / Previdian · November 5–6, 2026

OpenSSH released 10.6p2 on November 5 to close CVE-2026-123158 (CVSS 3.1 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), a password-authentication bypass affecting sshd on Linux systems built with musl libc and PAM disabled — Alpine Linux’s default, with OpenWrt, Buildroot and Yocto also named. Per the CVE record, for some account configurations “any password between 256 and 1024 characters succeeds,” including on accounts whose password field is set to “*”. Reported by Özgün Kültekin of Wakefield, the root cause traces to a 2016 username-enumeration fix (CVE-2016-6210). Threat-intel firm Previdian’s honeypot sensors recorded the first exploitation attempt at 00:05 UTC on November 6, roughly eight hours after the CVE was published, and had logged 17 attempts from 11 IPs by November 7, confirming root access on an Alpine honeypot. Not yet in CISA KEV. Alpine notes that upgrading the package alone does not replace the running daemon — sshd must be restarted.

“An attacker who can reach your SSH port can log in without knowing any password. It takes one connection, works every time, and needs no retries.” — Alpine Linux security advisory, November 5, 2026

Source: OpenSSH 10.6p2 release notes · Alpine Linux advisory · NVD CVE-2026-123158 · Previdian telemetry · SecurityWeek · The Hacker News

QNAP confirms NAS compromises via “Plex2Shell” Plex Media Server chain (CVE-2026-96652/96654/96655/96656)

QNAP PSIRT · November 6, 2026

QNAP issued a security notice saying it has received reports from users that Plex Media Server running on their NAS devices appears to have been compromised through the Plex2Shell vulnerability chain — CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 — which affects Plex Media Server 1.43.2 and earlier and is fixed in 1.43.3.10861. The four CVEs were added to CISA KEV on October 20, 2026, after exploitation began following public disclosure of technical details on October 16; QTS, QuTS hero and other QNAP operating systems are not themselves affected. QNAP’s guidance is blunt: if a vulnerable Plex instance was reachable from the internet (Remote Access, forwarded port 32400, or UPnP), updating alone will not remove an attacker’s changes — users should check for indicators of compromise, perform a clean reinstall, and reset Plex and NAS credentials.

“Plex has confirmed that these vulnerabilities are being actively and widely exploited.” — QNAP Security Notice, November 6, 2026

Source: QNAP security notice · QNAP remediation FAQ · Plex2Shell research (Zach Main) · BleepingComputer

WordPress core RCE (CVE-2026-119977): installing the fix can expose a site one last time; federal KEV deadline passes

Picus Security / The Hacker News · November 5–6, 2026

CVE-2026-119977 is an unauthenticated remote-code-execution flaw in WordPress core 4.7 through 7.1.3 (CVSS 3.1 8.1 per Wordfence, the CNA), caused by predictable, web-accessible staging paths under wp-content/upgrade/ during full-package core updates; it was fixed in 7.1.4 and added to CISA KEV on November 3 with a November 6 remediation deadline that has now passed. New analysis from Picus Security’s Umut Bayram, reported November 6, shows the update that installs the fix still unpacks files with the site’s old, unpatched updater, so a site on 5.9 or later is exposed one final time during that upgrade, and wp core update uses the same code path. Wordfence has observed attack attempts beginning minutes after its firewall rule shipped. Recommended mitigation: block web access to wp-content/upgrade/ (confirm a 403) before updating, or update manually outside the web-served root.

“WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.” — CVE-2026-119977 record, Wordfence (CNA)

Source: Picus Security analysis · WordPress security advisory GHSA-4w3m-c66w-69mg · NVD CVE-2026-119977 (KEV: added 2026-11-03) · The Hacker News

Still developing

Zyxel GS1900 switch zero-day (CVE-2026-107441) behind ~1,000 device compromises

Zyxel / Binarly · November 3, 2026

Zyxel’s November 3 advisory and a same-day Binarly write-up disclosed CVE-2026-107441 (CVSS 3.1 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), an unauthenticated out-of-bounds write in the CGI program of GS1900-series switch firmware through 2.90(xxxx.2)C0 that can lead to OS command execution via a crafted HTTP request; fixes are in the 2.90(xxxx.3)C0 “patch 3” firmware for ten models. Binarly determined that the intrusions earlier blamed on the June-patched CVE-2026-7273 — which SecurityWeek reports compromised almost 1,000 switches and deployed Jitterly and Sixzut malware — were in fact exploiting this previously unknown flaw, so the earlier patch did not stop the attackers. Not currently in CISA KEV.

Source: Zyxel advisory · Binarly research · SecurityWeek

APT29 watering holes deliver n-day iOS and Android exploit chains; Apple PAC bypass (CVE-2024-27834) lands in KEV

Sekoia / CISA · November 4, 2026

Sekoia attributes, with moderate-to-high confidence, a watering-hole campaign to APT29 (Midnight Blizzard) that served packaged exploit chains to iOS and Android visitors of compromised or cloned sites — including a Ukrainian gas producer, a Bulgarian military-related site, lookalikes of america250.org and a London hotel, and a supply-chain compromise of analytics provider Plerdy. The chains use only already-patched bugs, among them Apple’s CVE-2024-27834 (CVSS 5.5, Pointer Authentication bypass, fixed in iOS/iPadOS 17.5 and 16.7.8, macOS Sonoma 14.5, Safari 17.5), Chrome’s CVE-2026-3910 and Qualcomm’s CVE-2025-27038. CISA added CVE-2024-27834 to KEV on November 4 as “Apple Multiple Products Improper Authentication Vulnerability,” with a federal deadline of November 18, 2026.

“All three exploit chains rely entirely on known, already-patched vulnerabilities. None of them contain zero-days or work against fully updated devices.” — Sekoia, “Poisoned source,” November 4, 2026

Source: Sekoia research · NVD CVE-2024-27834 (KEV: added 2026-11-04) · SecurityWeek

This brief covers the trailing ~48 hours (November 6–7, 2026).

Primary sources: SonicWall SNWLID-2026-0014 · NVD CVE-2026-19868 · CISA KEV catalog · OpenSSH 10.6p2 release notes · Alpine Linux advisory · NVD CVE-2026-123158 · Previdian CVE-2026-123158 · QNAP security notice · Picus Security · WordPress GHSA-4w3m-c66w-69mg · NVD CVE-2026-119977 · Zyxel advisory · Binarly · Sekoia · NVD CVE-2024-27834

This brief covers the trailing ~48 hours (October 30 – November 1, 2026). Every item below was traced to a primary source — the vendor’s own disclosure, the CVE record, or the original research — and confirmed to fall inside the window.

Binance confirms ~$6.3 billion hot-wallet theft; TRM Labs points to North Korea’s TraderTraitor

Binance · October 30, 2026

Binance published a “Security Incident Update (2026-10-30)” stating that an attacker reached a service container via a compromised DevOps engineer’s laptop and submitted unauthorized withdrawals, with an estimated impact of about $6.3 billion. The exchange says it found no evidence of a wallet private-key leak, has suspended deposits and withdrawals, revoked the affected authorizations, and reports roughly $3 billion frozen on-chain by Tether, Circle, Ripple and others. TRM Labs and Chainalysis attribute the theft to DPRK’s TraderTraitor with high confidence; Elliptic urges caution because the laundering pattern differs from past DPRK cases and no root cause has been published. No CVE is involved.

“Initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop.” — Binance, Security Incident Update

Source: Binance announcement · The Hacker News · SecurityWeek

Northflank breach: customer environment variables decrypted, stored AI API keys abused

Northflank · October 30, 2026

Developer-platform Northflank opened a security incident at 13:40 UTC on October 30 after a Wiz threat alert, and within twenty minutes told customers to assume every environment variable had been decrypted and to disable or rotate all keys. By 23:38 UTC, customers were reporting unauthorized use of AI provider API keys that had been stored on the platform; Northflank linked the overlapping source IPs to the “Black October” wave of LLM-credential theft documented by Wiz. Mitigations so far include network-policy patches, one-click secret rotation for Postgres, MongoDB, MySQL and Redis add-ons, and audit logs enabled for all tiers. The incident remains in “Identified” status with no root cause published.

“Assume all environment variables have been decrypted. Disable/rotate all keys.” — Northflank status page, October 30, 13:58 UTC

Source: Northflank incident page · BleepingComputer

Chainalysis discloses intrusion into internal tools via “offensive agentic techniques”; customer identity data exposed

Chainalysis · October 30, 2026

Chainalysis published a disclosure at 21:14 UTC saying an external actor used AI-driven attack techniques to gain unauthorized access to its systems and internal tools, activity it detected in October. Accessed data is limited to user IDs, full names, email addresses and organization role labels for provisioned platform users; the company says investigation content (graphs, notes, cases), query results, cleartext passwords, MFA secrets, session tokens and authentication credentials were not touched. It is patching the exploited vulnerabilities, hardening with outside experts, has notified all customers, and states explicitly that the incident is unrelated to the Binance theft.

“Chainalysis detected an external actor using offensive agentic techniques to gain unauthorized access.” — Chainalysis security disclosure

Source: Chainalysis disclosure · The Hacker News

Trojanized “Claude Code” extension on Cursor Marketplace planted a persistent SSH backdoor

OpenSourceMalware · October 30, 2026

OpenSourceMalware (Jenn Gile and Paul McCarty) reported that version 2.1.313 of the anthropic.claude-code extension was published to Cursor’s marketplace on October 29 with a 66-line loader prepended to extension.js. The loader adds an Ed25519 key labeled “svc-telemetry” to ~/.ssh/authorized_keys, tries to enable SSH, opens a reverse SSH tunnel to 134.209.82.225 that reconnects every 60 seconds, installs persistence (LaunchAgent, crontab, or scheduled task), and beacons host reconnaissance over plain HTTP. Cursor says the malicious build was live for roughly 11 hours, affected at most 5,000 users, and later flagged 2.1.312 as malicious too; it rotated keys and is rebuilding the marketplace. Anthropic states its own systems were not compromised and that the VS Code Marketplace and Open VSX builds are unaffected. Users who installed from Cursor should treat the host as compromised and remove the rogue key and persistence.

“Malicious code is prepended to the normal extension bundle and executes before legitimate initialization.” — OpenSourceMalware

Source: OpenSourceMalware analysis · The Hacker News

CISA adds two more Ivanti Connect Secure flaws to KEV, completing the UTA0576 root-access chain

CISA / CVE.org · October 30, 2026

CISA added CVE-2026-111357 and CVE-2026-118527 to the Known Exploited Vulnerabilities catalog on October 30, with federal remediation deadlines of November 2 and November 13 respectively. CVE-2026-111357 is a privilege-escalation bug in which the dsinvoked broker trusts DSCache configuration data, yielding root; the CVE record carries CVSS 7.0 (AV:L/AC:H), while outlets citing Ivanti’s advisory report 8.8. CVE-2026-118527 is a lower-severity predictable-identifier flaw that lets an authenticated attacker upload files to a known location (reported CVSS 4.3). Volexity observed both chained with the already-listed authentication-bypass/RCE CVE-2026-104935 (KEV October 13) by the actor it tracks as UTA0576, who then harvested Active Directory credentials, LAPS passwords and BitLocker recovery keys. Ivanti’s fixed builds are 25.1.1.3 and 22.8R2.6; Volexity recommends forensic review of any appliance showing lateral movement.

“We made the decision to not delay getting a fix to customers that resolved the primary exploitation path.” — Ivanti advisory, as quoted by The Hacker News

Source: CISA alert · CVE-2026-111357 record · Ivanti advisory · Volexity · The Hacker News

WordPress core upgrade-staging RCE draws ~63,000 attack attempts in 24 hours

Wordfence / The Hacker News · October 30, 2026

Wordfence reported blocking 62,969 attempts in a single day to reach the web-accessible staging directory used during full-package WordPress core upgrades, the path behind GHSA-4w3m-c66w-69mg. The flaw, a race condition during core updates in which an unauthenticated attacker who wins the race against package extraction can achieve remote code execution, affects WordPress 4.7 through 7.1.3 and is fixed in 7.1.4 with backports to every branch back to 4.7.39. No CVE has been assigned; Wordfence scores it CVSS 8.1 while the GitHub advisory labels it “Low”. Attackers are probing paths such as setup-config.php; no confirmed compromises have been reported. Not in KEV.

“An unauthenticated attacker who wins a race against that extraction could reach remote code execution.” — WordPress security advisory GHSA-4w3m-c66w-69mg

Source: WordPress advisory · Wordfence · The Hacker News

Still developing

GitLab CVE-2026-97229 exploited against Alpine Linux infrastructure — GitLab / CISA · October 12 (patch), October 29 (KEV), 2026
The CVSS 10.0 regex-compiler RCE in GitLab CE/EE (fixed in 19.2.8, 19.3.5 and 19.4.2) entered KEV on October 29 with a November 1 federal deadline. Alpine Linux maintainers disclosed that an attacker hit their unpatched GitLab instance on October 20–21 with crafted CI configurations, crashing workers eight times and pulling the container image; later attempts on October 25–26 were blocked. Alpine found no evidence of success but rebuilt the instance from scratch and verified aports, packages and the October 21 releases were untampered. Source: GitLab patch release · CISA KEV · The Hacker News

Cisco ASA/FTD SSL VPN zero-day CVE-2026-76418 under active exploitation — Cisco / CISA · October 28–29, 2026
Cisco’s advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 describes a CVSS 8.6 unauthenticated denial-of-service (device reload) in the Remote Access SSL VPN service when secondary authentication is configured on a tunnel group; Cisco says it became aware of exploitation in October. CISA added it to KEV on October 29 with a November 1 due date. Fixed releases span ASA 9.16.4.104 through 9.24.1.27 and FTD 7.0.11 through 10.1.1. Source: Cisco advisory · CISA KEV

Drupal Commerce Core access bypass CVE-2026-118539 exploited against online stores — Drupal Security Team · October 28, 2026
SA-CONTRIB-2026-254 (rated Highly critical, 21/25) says the module “doesn’t sufficiently protect certain routes and entity fields,” allowing an access bypass that can financially impact the vendor, and states the vulnerability “is being actively exploited in the wild.” Affected: Commerce Core before 2.41 and 3.0.0 through 3.3.12; fixed in 8.x-2.41 and 3.3.13. Not in KEV. Source: Drupal advisory · SecurityWeek

This brief covers the trailing ~48 hours (October 30 – November 1, 2026).

Primary sources: Binance Security Incident Update · Northflank incident page · Chainalysis disclosure · OpenSourceMalware · CISA KEV alert (Oct 30) · CVE-2026-111357 · Volexity · WordPress GHSA-4w3m-c66w-69mg · GitLab 19.4.2 patch release · Cisco cisco-sa-asaftd-tunnel-dos-s6mgkb75 · Drupal SA-CONTRIB-2026-254

This brief covers the trailing ~48 hours (October 29–31, 2026). Every item below was traced to a primary source — the vendor advisory, CISA’s KEV catalog, the CVE record, or the affected organization’s own statement — and the dates were confirmed on those pages.

CISA adds GitLab CVSS 10.0 RCE and Cisco ASA/FTD VPN DoS to the KEV catalog

CISA / GitLab / Cisco PSIRT · October 29, 2026

CISA’s catalog update 2026.10.29 added two entries with a federal remediation deadline of November 1, 2026. CVE-2026-97229 (CVSS 10.0) is an integer overflow in GitLab CE/EE’s CI/CD regular-expression compiler that lets an unauthenticated attacker execute code on the server; GitLab fixed it on October 12 in 19.4.2, 19.3.5 and 19.2.8, and Rapid7 independently reproduced code execution against an official CE image. CVE-2026-76418 (CVSS 8.6) is a NULL-pointer dereference in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD that lets an unauthenticated remote attacker reload the device; Cisco published the advisory on October 28 with fixed releases across ASA 9.16–9.24 and FTD 7.0–10.1, and exposure requires secondary authentication on a tunnel group. Both are actively exploited and now on KEV.

“In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” — Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75

Source: CISA alert · GitLab patch release 19.4.2 · Cisco advisory · The Hacker News

Trojanized Claude Code extension on Cursor Marketplace planted a persistent SSH backdoor

Cursor / Microsoft Security / OpenSourceMalware · October 29, 2026

Malicious builds of Anthropic’s anthropic.claude-code extension (versions 2.1.312 and 2.1.313, Windows and macOS) were served from the Cursor VS Code Extension Marketplace under the extension’s real publisher identity between roughly 2:27 a.m. and 1:35 p.m. PT on October 29. The payload added an attacker-controlled SSH key labeled svc-telemetry to authorized_keys, attempted a reverse SSH tunnel to 134.209.82[.]225, installed persistence via cron, LaunchAgent or a SysMon scheduled task, and beaconed host details over HTTP to port 8099. Anthropic and Cursor say Anthropic’s systems were not compromised; Cursor removed the version, temporarily shut the marketplace, rotated keys and had the attacker server taken offline. Microsoft confirmed the build never reached the Visual Studio Marketplace or npm, and Socket found no trace on Open VSX. The legitimate current version is 2.1.314. Cursor published IoCs, hashes and remediation scripts.

“Removing or updating the extension does not remove artifacts written outside its installation directory.” — Microsoft Security Research

Source: Cursor security notice · Microsoft Security Blog · OpenSourceMalware · The Hacker News

Binance discloses ~$6.3B hot-wallet theft; ~$3B frozen on-chain

Binance · October 30, 2026

Binance’s incident update puts the total impact at around $6.3 billion, with roughly $3 billion frozen on-chain so far (Tether ~1.567B USDT, Circle ~800M USDC, and Arbitrum’s Security Council ~$30.5M). The exchange says its initial investigation points to a compromised DevOps engineer’s laptop that gave the attacker access to a service container used to submit unauthorized withdrawals, and that no wallet private key leaked; it later said it found additional points of breach and has not yet published a root cause. Withdrawals were suspended pending a security revamp, with deposits unaffected, and Binance says it will cover losses from the SAFU fund and company funds. TRM Labs and Chainalysis attribute the theft to North Korea’s TraderTraitor with high confidence; Elliptic urged caution absent a root cause.

“Initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container.” — Binance, Security Incident Update (2026-10-30)

Source: Binance announcement · The Hacker News

WordPress core upgrade-window RCE draws ~63,000 attack attempts in 24 hours

WordPress Security Team / Wordfence · October 29, 2026

WordPress 7.1.4 (October 28) fixed a race condition in which full-package core upgrades extracted files, including the installer, to a predictable web-accessible path under wp-content/upgrade; the GitHub advisory GHSA-4w3m-c66w-69mg was published October 29 and the CVE record, CVE-2026-119977 (CVSS 8.1, AV:N/AC:H/PR:N/UI:N), was published by Wordfence as CNA on October 31. All versions 4.7.0 through 7.1.3 are affected, with backports from 7.0.8 down to 4.7.39. The WordPress project rates the issue Low, but Wordfence reported 62,969 blocked exploitation attempts in a 24-hour window as attackers polled staging paths such as setup-config.php. The CVE is not in CISA’s KEV catalog.

“An unauthenticated attacker who wins a race against that extraction could reach remote code execution.” — WordPress security advisory GHSA-4w3m-c66w-69mg

Source: WordPress GHSA advisory · WordPress 7.1.4 release · CVE-2026-119977 · Wordfence · The Hacker News

CrowdStrike: China-nexus Vapor Panda uses AI pentest tool ARTEX against 200+ organizations

CrowdStrike · October 29, 2026

CrowdStrike reports that Vapor Panda (formerly VexatiousTemper, overlapping Trend Micro’s Earth Estries) has used ARTEX, a closed-source Go-based agentic penetration-testing framework that coordinates multiple LLM backends for reconnaissance, vulnerability identification and exploitation, against more than 200 organizations since October 17. Targets include foreign ministries across Latin America, Europe, Asia and the Middle East, a Middle East interior ministry, U.S. semiconductor, defense, pharmaceutical, nuclear and financial organizations, and telecoms in the U.S., Belgium and the Philippines. Post-exploitation activity was confirmed at nine organizations, where the group deployed BLOODALCHEMY, a ShadowPad derivative.

“Beginning on October 17, 2026, the adversary used ARTEX against more than 200 distinct organizations worldwide.” — CrowdStrike

Source: CrowdStrike blog · The Hacker News

Chainalysis discloses security incident exposing customer contact data

Chainalysis · October 30, 2026

Chainalysis says it was the target of a cybersecurity incident in which an external actor accessed internal systems; customer notifications cite exposed user IDs, full names, email addresses and organizational role labels. The company reports no evidence of unauthorized access to investigation content, authentication credentials or session tokens, says it is working with outside experts to harden its systems, and states the incident is unrelated to the Binance theft. No technical details on the entry point or dwell time have been released.

“no evidence of unauthorized access to investigation content, authentication credentials, or session tokens” — Chainalysis

Source: Chainalysis statement · BleepingComputer

Trezor warns of suspected hardware implant in a Safe 5 sold by reseller CryptoBilis

Trezor · October 30, 2026

A customer in Indonesia reported an extra circuit board, described as including a cellular module and antenna, fitted inside a Trezor Safe 5 purchased from reseller CryptoBilis via Tokopedia in August; the report says the board captures the recovery phrase from the screen and transmits it. Trezor has not yet examined the device but ended its relationship with CryptoBilis on October 9 and is advising anyone who bought a Trezor from CryptoBilis or its supplied stores since March 2026 to move funds to a new wallet with a new seed. No losses have been reported.

“Move your funds to a new wallet with a new seed as soon as possible.” — Trezor

Source: Trezor blog · The Hacker News

Still developing

Drupal Commerce Core access bypass (CVE-2026-118539) actively exploited

Drupal Security Team · October 28, 2026

SA-CONTRIB-2026-254 rates the flaw Highly critical (21/25) and says it is being exploited in the wild; the CVE record was published October 30 with a CISA ADP CVSS 3.1 score of 6.5 (Missing Authorization, CWE-862). The module fails to protect certain routes and entity fields, allowing an access bypass that can financially impact the vendor. Affected: Commerce Core below 2.41 and 3.0.0 through 3.3.12; fixed in 3.3.13 and 8.x-2.41. Drupal also advises auditing orders for inconsistencies. Not in CISA’s KEV catalog as of the 2026.10.29 update.

“This vulnerability is being actively exploited in the wild.” — Drupal Security Advisory SA-CONTRIB-2026-254

Source: Drupal advisory · CVE-2026-118539 · The Hacker News

Linux kernel IPv4 TCP race (CVE-2026-98432) still unpatched on Ubuntu and RHEL

Anthropic / kernel.org · October 27, 2026

The kernel CVE team scores this race condition in IPv4 TCP connection setup at 9.8; Red Hat, Oracle and SUSE score it 8.1. Anthropic says Claude produced a working exploit giving an unauthenticated remote attacker root on servers with an MPTCP listener, though the proof of concept takes 48 minutes to leak a kernel pointer and no in-the-wild exploitation has been reported. Fixed upstream October 5 in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3; Debian, Oracle and Amazon Linux have shipped fixes, while Ubuntu and RHEL 8/9/10 still listed fixes as in progress as of October 30. Not in KEV.

Source: Anthropic research post · CVE-2026-98432 · The Hacker News

This brief covers the trailing ~48 hours (October 29–31, 2026).

Primary sources: CISA KEV alert (Oct 29) · GitLab 19.4.2 patch release · Cisco cisco-sa-asaftd-tunnel-dos-s6mgkb75 · Cursor security notice · Microsoft Security Blog · OpenSourceMalware · Binance incident update · WordPress GHSA-4w3m-c66w-69mg · WordPress 7.1.4 · CVE-2026-119977 · CrowdStrike · Chainalysis · Trezor · Drupal SA-CONTRIB-2026-254 · CVE-2026-118539 · Anthropic · CVE-2026-98432