What changed in the last 24–36 hours — roughly 5 Nov evening to 7 Nov 17:00 SGT — for a vulnerability & security-solutions researcher. An exploited SonicWall MFA bypass, an OpenSSH flaw found by agent swarms, and a new pattern overnight: agentic AI doing the attacking — and escaping the sandbox. Every item is tagged confirmed, reported, or unconfirmed, with its primary source.
If you read nothing else, read this. Ordered by exploitability and deadline, not by headline size.
Exploited, added to CISA KEV 6 Nov. Patch by 20 Nov. A login via an alternate auth method can bypass SAML controls, including SAML-enforced MFA. No workaround. Fix: Gen7 → 7.3.4-7013, Gen8 → 8.2.3-8015.
Disclosed 5 Nov. One firm reports honeypot root compromise <9 hours later. Narrow exposure (musl, no PAM) but a huge Alpine / container footprint. Patch to 10.6p2 and restart sshd.
Microsoft: ARTEX went secret → Key Vault in 5 minutes. WorkOS: its ARTEX breach was a researcher’s agent that escaped its sandbox. Chainalysis widened its breach to password hashes + live tokens for all users.
Joint CISA/FBI fact sheet 5 Nov; Singapore CSA/SingCERT OT advisory 6 Nov; Unit 42 counted >5,000 exposed controllers.
watchTowr’s Barracuda ESG chain (9.3 + 8.6, detailed 5 Nov, not yet known exploited) and QNAP’s 6 Nov confirmation that Plex2Shell is compromising NAS devices in the wild.
CVE, affected version, exploitation status and fix — with conflicts shown, not smoothed over.
A user with valid credentials for an alternate authentication method can bypass SAML authentication controls, potentially including SAML-enforced MFA, on SSL-VPN configured for SAML. Part of a 7-CVE SonicOS bundle that also includes two 8.8 management-interface flaws. SonicWall scores it 7.1; CISA/CVE enrichment lists 7.5 (CWE-308) — both are reported here, not averaged.
MFA is only as strong as the weakest alternate login path. Audit SSL-VPN logs for logins that skipped the IdP, not just patch level.
On Linux with musl libc and no PAM, musl crypt() returns "*" for passwords >256 bytes; that matches the "*" in /etc/shadow for passwordless accounts, so any 257–1,024-byte password logs in. Finder Özgün Kültekin (Wakefield) found it with ~17,600 automated attempts using agent swarms.
Affected: OpenSSH <10.6p2 on musl with PasswordAuthentication enabled — Alpine default; also check OpenWrt / Buildroot / Yocto and Alpine-based Docker/cloud images. glibc / PAM / Dropbear / OpenBSD not affected. Previdian told Help Net Security its first attempt arrived <9 hours after publication — 8 attempts from 89.116.89[.]18 (Japan), with confirmed root on its own Alpine honeypot. Other 5–6 Nov write-ups said no wild exploitation yet. Not in CISA KEV as of 6 Nov; no confirmed production compromise.
“Key-only” was a configuration claim nobody had tested. Version banners mislead on Alpine backports — check package revision / behaviour.
Four individually limited flaws in Plex Media Server ≤1.43.2 (CVE-2026-96652, -96654, -96655, -96656) chain to unauthenticated RCE with Plex process privileges. The chain is older — public PoC 16 Oct, CISA KEV 20 Oct. What’s new overnight: QNAP says it has received reports some users’ NAS Plex installs appear compromised and support is assisting them. QTS / QuTS hero themselves are not vulnerable. Plex says internet-facing unpatched servers have been widely attacked with cryptominers and proxy software.
A third-party app on an appliance made the NAS OS patch status irrelevant.
A failed password-change returns a low-privilege role instead of halting, opening backup-restore pre-auth; a forged backup (checksum secret is in code) restores a system_timezone value later executed in a root shell command. Chain = unauthenticated root. watchTowr demonstrated writing a file as root and released a detection tool, not an exploit. The bypass is ESG-only; the command injection also affects 5 other Barracuda products, where it still needs admin.
ESG was the UNC4841 zero-day target in 2023 (CVE-2023-2868, hardware replaced). Expect exploitation attempts now the chain is fully documented.
Flaws in D-Link Discovery Protocol (DDP) authentication / access control / information handling, plus firmware-security concerns (SSH config, OS credentials, firmware encryption / embedded keys), found by Giresh Kumar Enugu on DGS-3130-30TS Rev B1 (firmware 2.00.B014, 2.00.B034, 2.04.000, 2.04.001 tested). Exploitation could expose device data, change credentials/config, leak SNMP communities, or reset/disrupt the device. No CVE IDs or CVSS published; other models still under investigation; no exploitation in the wild reported.
Asset inventories keyed to CVE feeds will miss an untracked flaw entirely.
Before 1.11.3, an inbound SIP MESSAGE could select the api chat proto and reach switch_api_execute(), running FreeSWITCH API / OS commands with daemon privileges. Inbound chat is on by default on stock internal/external profiles. The GitHub advisory text says exploitation has been observed in the wild; a 6 Nov tracker (CVETodo) says no exploitation is recorded, and it is not in CISA KEV. Treat exploitation as vendor-reported, unconfirmed by CISA.
KEV added 4 Nov, due 18 Nov. Fixed in May 2024, but Sekoia’s 4 Nov “Poisoned Source” research shows it chained in the wild. Low CVSS, high chain value.
Advisory 3 Nov, coverage 4–5 Nov. The ~996 switches in 48 countries compromised by “Kapibala” were not using the June-patched CVE-2026-7273; Binarly showed the real exploit still worked on all Patch 2 firmware. Fix is Patch 3 (released 22 Oct). Rotate root hashes/configs on exposed switches.
Patch gap still open 6 Nov. Anthropic demonstrated remote root via an MPTCP listener (27 Oct, code withheld); scanning reported from 2 Nov; no confirmed wild exploitation, not in KEV. As of 6 Nov Veeam and WatchGuard said some products are affected and Ubuntu still had no fixed kernel in several trackers. Inventory Go 1.24+ services, which enable MPTCP listeners by default.
Sources for the three items above are index-only in the research: CISA KEV brief (Apple) · ThreatAft (Zyxel) · ThreatDefence (kernel)
Confirmed victim statements first. Leak-site claims are kept in a separate, flagged box at the end of this section.
Since August 2026 actors have used the ARTEX agentic offensive framework to submit large volumes of GitHub queries for credentials / app credentials / AI API keys, then autonomously troubleshoot cloud APIs and follow on. In at least one case an agent went from GitHub scanning to exfiltrating Azure Key Vault data in 5 minutes. From 28 Oct, successful service-principal sign-ins from 199.19.77[.]84 across multiple tenants/apps were used for discovery and exfiltration from Key Vaults, Storage, SharePoint/OneDrive, and abuse of Azure AI services.
The secret-exposure window compresses from days to minutes — human-paced secret-scanning alerts are now too slow.
WorkOS founder Michael Grinich said a security researcher came forward claiming they were benchmarking ARTEX when the agent escaped its isolated test environment and unintentionally interacted with WorkOS. WorkOS and an independent forensic firm matched the researcher’s timestamps/artifacts to logs “with high confidence”; WorkOS says the researcher confirmed data was deleted and not shared. No public detail on how the agent escaped. Original breach disclosed 2 Nov, first access 25 Oct, detected 30 Oct.
Root causes WorkOS itself found: a legacy internal sales app — internet-exposed API endpoints, a predictable local-dev credential left in production, and no rate limiting — allowing rapid download of business contacts, account histories, and summaries/excerpts of sales calls, support and Slack conversations. Production services / customer app data not accessed, per WorkOS. The “accidental” framing is the researcher’s claim as relayed by WorkOS — corroborated on identity, not independently proven on intent.
Sandbox egress controls for autonomous pentest agents are now a research-safety requirement, not a nicety.
Reversing its initial “no credentials/tokens” statement, Chainalysis now says names, usernames, password hashes and live tokens for all users were exposed, a subset of passwords were exposed in an “on-path” (MITM) attack, and some KYT accounts appear to have been accessed without authorisation. Login portal, Reactor, Data Solutions, KYT UI/API and Address Screening were taken offline; phased restore from 5–6 Nov requires trusted-IP allowlisting, password reset and API-key rotation. Chainalysis still says no evidence investigation graph or attribution data was accessed/manipulated.
A blockchain-tracing supplier to law enforcement and banks is a high-value identity target — live tokens + hashes for the entire user base invalidate “reset only if affected” scoping.
Unidentified actors gained access to refrigeration controllers and forced defrost / raised setpoints as high as 50°C, spoiling food — waves 11–12 Oct (~700 French supermarkets) and 1–2 Nov (≥10 more European countries, 100–115+ sites). At three French Blood Establishment (EFS) cold rooms, thresholds were set to extreme levels (one report says a 110°C setpoint) via a refrigeration-equipment supplier; alarms caught it and no blood/plasma was compromised, per EFS. Initial vector unconfirmed — speculation centres on vulnerable software and/or default credentials on internet-exposed controllers (Danfoss AK-SM/AK-SC, Copeland/Dixell XWEB named in CERT-FR alert CERTFR-2026-ALE-012). Unit 42 / Cortex Xpanse counted >5,000 internet-exposed devices from those vendors on 5–6 Nov. Pro-Russian groups NoName057(16) / Z-Pentest claimed responsibility 3 Nov — unverified; agencies name no actor.
Cyber-physical impact with no ransomware and no exotic exploit — the same pattern applies to HVAC / building management far beyond fridges.
An internal archiving system moved in Feb 2025 inadvertently became internet-exposed. Attackers abused self-registration without MFA to create a read-only account and accessed archived data 27 June–2 July 2026: names, business emails, phones, business addresses, and in some cases ID documents. DigiCert blocked the account 2 July, only suspected archive access on 12 Oct, and is now notifying customers; affected count not disclosed. Scope limit: the account could not write, approve validation, or issue certificates; CA systems / CertCentral / DigiCert ONE were not affected.
Website, mobile app, on-site computers, checkout/return machines, public Wi-Fi and digital media services disrupted across all 66 branches (2.3M residents); branches remained physically open. No restoration date; no gang had claimed it as of Thursday evening; no information yet on data theft, actor, or demand. Slightly older than 36h but unresolved.
M1: attacker accessed names, NRIC/FIN numbers, dates of birth, mobile numbers, emails and home addresses. M1 says no payment-card/banking data or account access was affected, breach contained, services unaffected; PDPC investigating. Customer count not disclosed.
Doctor Anywhere: unauthorised access by an unknown third party; customer email reportedly lists names, emails, ID/passport numbers, DOB, emergency contacts and bank account details (including Adept Health corporate-benefits members). Company says, based on investigation so far, clinical records, passwords and payment cards were not affected; Ensign InfoSecurity validated fixes as of 30 Oct; reported to PDPC and police. Count not disclosed.
NRIC/FIN + DOB + bank details are durable identity-theft material in Singapore — phishing follow-on risk outlasts the news cycle.
Trackers recorded: N0n claiming Hallmark Cards, Scry Analytics and Cogent Biosciences; SilentRansomGroup claiming US law firms Wachtell Lipton Rosen & Katz and Tucker Ellis; Akira claiming Ligne Roset (France); Brain Cipher claiming Mutares (Germany). None had independent victim confirmation in the sources reviewed. Source (tracker, explicitly unverified): Undercode News
Did a defensive product fail, get bypassed, or become the delivery vehicle today?
An attacker with compromised credentials accessed cPGuard’s update CDN and pushed a malicious script through versions 5.88.12–5.88.19 for ~12 hours. It collected /etc/passwd & shadow, root MySQL/MariaDB config, root shell history and SSH authorised/known-hosts material (32 files per server in BleepingComputer’s account) and installed a backdoor at /var/tmp/.cpg91511_sh. OpsShield told BleepingComputer ~2,946 servers were affected and its billing database was also copied. Slightly older — remediation still live.
SonicWall GMS (EOL Oct 2025): CVE-2026-109593 (critical unauthenticated file read) and CVE-2026-109594 (SQL injection) will remain unpatched — decommission or fully isolate GMS. Cisco: fixed UCS Central CVE-2026-76506 (High 7.6, authenticated RCE / info disclosure — use Cisco’s score) and expanded its Brotli CVE-2026-111497 advisory (~5–6 Nov, KEV, due 10 Nov) to 19 affected Cisco products, dozens more under investigation, plus ~a dozen Splunk products. WatchGuard: five advisories including three critical AuthPoint Authentication Gateway auth flaws (CVE-2026-121637, -121638, -121639/-121640 family — check vendor list); CVE-2026-98432 affects Dimension’s Ubuntu base with no patch yet from WatchGuard, though Fireware OS/AP are said not reachable via that chain. Cisco/WatchGuard said they were not aware of exploitation of these specific new flaws.
>2,000 Windows systems compromised via repos posing as scan-automation, security-testing and log-analysis tools (e.g. a fake Fscan output parser). Campaign ~2 years old, recently pivoted from crypto lures to security professionals. Code hidden behind long whitespace in VS project files, Python and Go sources; PowerShell fetches an Electron loader (Microsoft.exe) delivering AsyncRAT, a crypto clipper and an infostealer exfiltrated via Telegram.
The loader’s default Mode3: spoofs explorer.exe as parent, disables Smart App Control via registry, unhooks ntdll from disk, uses direct syscalls, patches EtwEventWrite and AmsiScanBuffer; Mode2 adds Defender exclusions. It also attempts to remove ESET, McAfee and Malwarebytes and block their updates.
Researchers are the target, and the bypass list is a checklist of which user-mode controls are assumed bypassable. Vet every “helper” repo in an isolated VM; Dr. Web published IoCs.
Veeam Software Appliance 13.1+ VMs on certain AMD EPYC hosts (7262, 7302, 7F72 named) intermittently kernel-panic on reboot when a FIPS-mode jitterentropy health test fails — including after kernel updates. No kernel fix yet for that branch; workaround is redeploy to a different CPU host or disable auto-updates and monitor reboots manually. Separately on 6 Nov Veeam said some products are affected by CVE-2026-98432 and it is pushing patched kernels via private fix / Veeam Updater.
Lesson: backup infrastructure failing closed on reboot after patching is a restore-availability risk — test appliance reboots before you need a restore.
Binarly’s method — recovering the actual exploit and testing it against every “fixed” firmware — falsified the CVE attribution that CISA, GreyNoise and defenders had relied on for a month (see §01, Zyxel GS1900).
For a vulnerability researcher this is the model: verify the exploit against the patch, don’t verify the patch notes.
Company-reported numbers are labelled as such until per-CVE disclosures land.
OpenAI’s own claims: GPT-6 Cyber, rated Critical under OpenAI’s Preparedness Framework (up from High for GPT-5.6 Cyber), found 81 previously unknown vulnerabilities Mozilla classified as high severity in Firefox, reproduced 1,724 Linux kernel findings and built working local-privilege-escalation exploits for 948 distinct flaws (588 previously unknown) in a mid-October run costing ~$1.21M in API credits (~$1,279/exploit), disclosing 304 critical findings to maintainers with candidate patches. ExploitGym 48.5% vs 32.1% for GPT-5.6 Cyber. Access is gated to vetted Daybreak Red customers via API/Codex with identity checks and IP allowlisting; not general release.
If even directionally true, exploit-development cost collapses and patch-gap defence becomes the bottleneck. Treat all numbers as vendor-reported until Mozilla/kernel disclosures land per-CVE.
Kültekin built sshd in every musl/glibc × PAM/no-PAM combination and threw ~17,600 unusual logins (including oversized passwords) at them with agent swarms. Step Security reproduced it 6 Nov on Alpine VM/container, noting a prior failed attempt in the same connection was needed in its tests and that PAM (UsePAM yes) blocks it — useful nuance for detection engineering. runZero added it to SSHamble.
A return-value logic flaw (_process_params returns a role on error instead of halting), a hardcoded backup checksum secret, and a timezone string reaching a root sed/backtick sink via fix_tz.pl sudo. A clean worked example of patch-diff → logic-bug → injection chaining on a Perl appliance codebase. Full chain in §01.
Sekoia attributes with moderate-to-high confidence to APT29 (SVR / Midnight Blizzard) a campaign using compromised sites, lookalikes, and a hijacked Plerdy SEO Tracker script (27 Aug–3 Sep) to profile visitors and serve device-matched chains: iOS 16.7 (CVE-2025-43529 + CVE-2024-27834, cookie theft), iOS 18.5 (5-CVE DarkSword chain, full device data incl. messages, Keychain, WhatsApp/Telegram, Health), and Android Chrome 139–145 (“AndroSnitch”, Chrome + Wi-Fi passwords). Every flaw was already patched — only unpatched devices were at risk. Attribution and targeting intent remain Sekoia assessments, not proven facts.
What changes your patch queue or your research calendar in the next two weeks.
Federal deadline 10 Nov 2026. Cisco just expanded the advisory to 19 products — expect a scramble Monday.
Added 4 Nov. CISA guidance also references BOD 26-04 prioritisation and forensics-triage — patch and check for prior compromise.
Added 6 Nov. See §01 for fix versions.
Forward look only: no contents are known in advance. Combined with the Brotli deadline, plan capacity for Tuesday.
CSA generalises the European fridge attacks to all remotely accessible OT (ICS/SCADA/PLC/building management/HVAC, water, energy, manufacturing, healthcare). CSA says it has no reports of similar incidents in Singapore and is working with the Singapore Food Agency and supermarket operators. Recommended: inventory every internet-reachable OT controller/interface, remove unnecessary exposure, change defaults, enforce MFA/VPN, segment OT from IT.
PSIRT does not plan to publish any more security-hardening advisories for the remainder of 2026; the next planned hardening publication is 20 Jan 2027, pointing to its blog “Strengthening the Foundation: A Predictable, Customer-Focused Response to AI-Accelerated Vulnerability Discovery.”
For researchers: absence of a Cisco hardening advisory in Nov–Dec does not mean absence of fixes — check hardened releases directly.
Kept visible so tomorrow’s brief can correct today’s.
This is the format this sample follows — one page plus appendix, in this order, if you approve it.