cybr.cx — Daily Cybersecurity Intelligence Digest

November 7, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-19868 | SonicWall SonicOS SSLVPN | CVSS: N/A (KEV listed)
SonicWall's SonicOS SSLVPN contains an authentication bypass that allows an attacker with valid credentials for an alternate authentication method to sidestep SAML controls entirely — including SAML-enforced MFA. Added to CISA KEV on November 6, with a remediation deadline of November 20. If your organisation relies on SAML MFA through SonicWall SSLVPN, treat this as a fire drill: verify patch status immediately and audit recent VPN authentication logs for anomalous login patterns.

⚠️ Actively exploited — CVE-2026-119977 | WordPress Core | CVSS: N/A (KEV listed)
A TOCTOU race condition in WordPress Core's update mechanism allows unauthenticated attackers to drop attacker-controlled files into predictable, web-accessible staging paths during the core upgrade window — leading to remote code execution. CISA's remediation deadline has already passed (November 6), which means any unpatched WordPress instance that ran an auto-update recently may already have been targeted. Check your hosting environment's upgrade logs and validate file integrity against known-good checksums.

⚠️ Actively exploited — CVE-2026-118527 + CVE-2026-111357 | Ivanti Connect Secure | CVSS: N/A (KEV listed)
Two actively exploited vulnerabilities in Ivanti Connect Secure are being chained in the wild alongside a third (CVE-2026-104935). CVE-2026-118527 lets a remote authenticated attacker write files with controlled content to a known disk location via predictable identifier generation; CVE-2026-111357 provides local privilege escalation through a missing authentication check on a critical function. Together they form a reliable exploitation chain. CISA deadlines for both have passed — if you haven't patched, assume compromise and investigate.

⚠️ Actively exploited — CVE-2024-27834 | Apple iOS, iPadOS, macOS, Safari, tvOS, watchOS | CVSS: N/A (KEV listed)
An improper authentication flaw in Apple's pointer authentication implementation allows an attacker with arbitrary read/write capability to bypass PAC protections entirely. Added to KEV on November 4 with a deadline of November 18. While gaining the prerequisite read/write primitive is non-trivial, this is likely part of a broader exploit chain. Ensure all Apple devices are updated and apply particular scrutiny to any exposed Safari-based attack surface.

CVE-2026-123490 | Craft CMS 5.8.17–5.11.1 | CVSS: 8.8 (HIGH)
An authenticated control panel user in Craft CMS can abuse the getOwners() method by passing crafted criteria that invokes arbitrary static PHP callables — with the end result of promoting any account to administrator. Exploitation requires a panel login but no admin privileges, making compromised low-privilege accounts a critical pivot point. Update to 5.11.2 or later and audit panel users for unexpected role changes.

CVE-2026-123993 & CVE-2026-123998 | Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 | CVSS: 8.8 / 8.3 (HIGH)
Two related vulnerabilities in Hisense VIDAA firmware expose significant attack surface on the LAN. The first leaves a QA-build Google Cobalt WebDriver server listening unauthenticated on TCP 4444, allowing any adjacent host to execute arbitrary JavaScript, potentially accessing stored credentials and camera/microphone APIs. The second finds the MQTT-based remote-control broker on TCP 36669 accepting publicly documented default credentials and a 4-digit PIN with no rate limiting — brute-forceable in roughly five seconds. Corporate networks with smart TVs in conference rooms should treat these as a lateral movement risk.

CVE-2026-123786 | Agenta before 0.122.5 | CVSS: 8.5 (HIGH)
Workspace members with workflow edit permissions in the Agenta LLM platform can set arbitrary revision URLs, causing SSRF that captures the internal Authorization token used to resolve secrets. An attacker can then read provider API keys from the vault or pivot to cloud metadata endpoints (think IMDSv1-style). Upgrade to 0.122.5 and audit workflow revision URLs for unexpected external hosts.

CVE-2026-124040 | CivetWeb ≤ 1.16 (HTTP/2 enabled) | CVSS: 8.1 (HIGH)
A use-after-free in CivetWeb's handle_http2() retains stale :method and :path pointers after the initial HEADERS frame. Sending a follow-up HEADERS frame omitting those pseudo-headers can influence which path or method the access control layer evaluates — or simply crash the server. Unauthenticated, remotely triggerable. Disable HTTP/2 as a temporary mitigation if a patch is unavailable for your build.

CVE-2026-123784 | Fluxbox ≤ 1.3.7 | CVSS: 7.8 (HIGH)
Fluxbox passes style background values — including pixmap paths, gradient texture text, and random directories — directly into a shell command via $SHELL -c without sanitisation. An attacker who can deliver a malicious theme file (via a shared config repo, a compromised dotfile host, or social engineering) achieves OS command execution as the user running the window manager. If you're running Fluxbox in any multi-user or shared environment, audit your theme sources.

CVE-2026-123620 | Usermin ≤ 2.570 | CVSS: 7.5 (HIGH)
Usermin's Read Mail module passes IMAP folder names to shell commands without sanitisation. An attacker can create a maliciously named folder (containing shell metacharacters) via any external IMAP client, then trigger execution by deleting the folder in Usermin — running commands as the user's system account. This effectively breaks webmail sandboxing assumptions. Patch or disable the Read Mail module.

CVE-2025-71458 | FTS3 Web Monitoring 3.12.0–3.14.0 | CVSS: 7.5 (HIGH)
The /linkinfo endpoint in the FTS3 file transfer monitoring web app is vulnerable to unauthenticated blind SQL injection via the source_se and dest_se query parameters. Exploitation can expose stored cloud storage credentials and OAuth client secrets. If you operate grid/HPC infrastructure using FTS3, patch immediately and rotate any secrets stored in the database.

Headline News

MS Paint Gets a CVE — And the Security Community Cannot Look Away
CVE-2026-83844 is real, it's been published, and it's exactly what it sounds like: a remote code execution vulnerability in Microsoft Paint. While full technical details are still emerging, the flaw has attracted enormous practitioner attention — a testament to how unexpected attack surfaces remain hiding in plain sight within operating systems. For decades, Paint has been the archetypal "harmless" built-in application, which is precisely why it's rarely scrutinised. The vulnerability serves as a timely reminder that the Windows component attack surface extends well beyond traditional targets like Office macros or browser engines, and that any application capable of parsing complex file formats is a potential exploit vector. Blue teams should monitor for Paint being invoked from unusual parent processes or network-facing workflows.

BrainCipher Ransomware Claims Attack on Canadian Healthcare Provider
The BrainCipher ransomware group has claimed responsibility for a November 4 attack on Hamilton Health Centre in the Toronto area, alleging theft of patient records and posting data to their leak site within days of the initial compromise. The speed of the data publication — less than 72 hours after the stated attack date — suggests either pre-positioned access or a highly rehearsed exfiltration workflow. Healthcare remains one of the most targeted sectors globally, and BrainCipher has demonstrated a willingness to weaponise patient data as leverage with minimal delay. The claim remains unverified by the organisation, but the pattern is consistent with double-extortion tactics designed to maximise pressure before defences are fully assessed. Practitioners in the health sector should review their data exfiltration detection controls and confirm backup integrity is not dependent on network-accessible storage.

1.4 Million Live Secrets Targeted for Revocation in Industry Initiative
Truffle Security has launched a coordinated Secrets Revocation Program aimed at killing 1.4 million API keys and tokens that remain valid despite being publicly exposed — in repositories, paste sites, and other public surfaces. The programme works directly with API key issuers to enable bulk revocation rather than relying on individual developers to notice and rotate their own leaked credentials. The scale here is striking: 1.4 million live secrets implies that a substantial proportion of publicly leaked credentials are never rotated, leaving persistent backdoors into services and cloud environments. For practitioners, this reinforces the case for secret scanning in CI/CD pipelines and enforcing short-lived, automatically rotating credentials wherever possible. The initiative also highlights the growing role of third-party security firms in operationalising what has historically been an industry coordination problem.

Schrödinger's Feed

Quantinuum has unveiled its Nexus roadmap, committing to a platform that automates fault-tolerant quantum application deployment through 2029 — transitioning developers from physical qubit experimentation to logical, error-corrected execution as underlying hardware matures. The ambition here is significant: automating the abstraction layer between noisy physical qubits and the clean logical qubits that cryptographically relevant algorithms actually require. If that transition happens on schedule, the timeline for quantum systems capable of threatening RSA and ECC key sizes moves from "theoretical" to "scheduled product release." Security practitioners who haven't begun evaluating NIST's finalised post-quantum cryptography standards — CRYSTALS-Kyber and CRYSTALS-Dilithium among them — now have a concrete roadmap milestone to measure their own migration timelines against.

/dev/random

The US Federal Aviation Administration has officially announced it will phase out floppy disks from air traffic control systems by 2028 — meaning that until then, some portion of the infrastructure coordinating aircraft in US airspace is still reading 1.44MB magnetic disks. The FAA's explanation centres on the age and stability of legacy systems that were simply never replaced, a phenomenon affectionately known in reliability engineering as "if it isn't broken, don't touch it." The irony is that air-gapped floppy-based systems are, in a narrow sense, immune to a wide class of modern cyberattacks — no network interface, no problem. Still, 2028 is the target, which gives threat actors approximately two years to develop highly specialised sneakernet attack tooling.