cybr.cx — Daily Digest | November 09, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-19868 | SonicWall SonicOS SSLVPN
CISA added this to the KEV catalogue on November 6th with a remediation deadline of November 20th. The flaw allows an attacker with valid credentials for an alternate authentication method to bypass SAML authentication entirely — including SAML-enforced MFA. If your perimeter relies on SonicWall SSLVPN with SAML/MFA, treat this as a fire drill: patch or restrict access now.

⚠️ Actively exploited — CVE-2026-119977 | WordPress Core
An unauthenticated TOCTOU race condition during WordPress core upgrades allows remote code execution by exploiting predictable, web-accessible staging paths used during full-package updates. CISA's remediation deadline has already passed (November 6th), meaning any unpatched instance should be considered potentially compromised. Hosting providers with auto-update pipelines should audit upgrade staging directory permissions immediately.

⚠️ Actively exploited — CVE-2024-27834 | Apple iOS, iPadOS, macOS, Safari, tvOS, watchOS
An improper authentication flaw allows an attacker who already has arbitrary read/write capability to bypass pointer authentication — a core memory safety mechanism. KEV-listed since November 4th with a deadline of November 18th. Apply Apple's latest platform updates across the board; the breadth of affected products makes this a broad enterprise exposure.

CVE-2026-124430 | Craft CMS 5.10.0–5.11.1 | CVSS 8.8
Non-administrator control panel users can retrieve HMAC-signed Twig templates via the app/render-elements endpoint and feed them back through the login redirect parameter, triggering unsandboxed renderObjectTemplate() execution — full OS command execution as the PHP worker. Any Craft CMS deployment allowing untrusted users control-panel access should upgrade to 5.11.2 immediately.

CVE-2026-124467 & CVE-2026-124446 | OpenEMR < 8.4.0 / < 8.3.0 | CVSS 8.8
Two separate high-severity flaws in OpenEMR's ESign router and FaxSMS module. The first is a local file inclusion allowing authenticated low-privilege users to upload a PHP file and trigger it via an unsanitised module parameter. The second is a path traversal that lets attackers download cleartext database credentials from sqlconf.php. Healthcare operators running OpenEMR should prioritise patching — these are chained well for privilege escalation.

CVE-2026-124441 | Kyverno < 1.19.2 | CVSS 8.8
Namespaced Kubernetes tenants can abuse Kyverno's generate rule by templating kind and namespace fields with variables, causing the privileged background-controller to write arbitrary resources — NetworkPolicies, RoleBindings — into any namespace including kube-system. Multi-tenant Kubernetes clusters running Kyverno should upgrade to 1.19.2 and audit existing policies for variable-templated generate rules.

CVE-2026-123531 | Vikunja 1.0.0–2.7.0 | CVSS 8.8
Authenticated users (self-registration permitted by default) can send page=0 to any /api/v1 list endpoint, bypassing the maxitemsperpage limit and triggering unbounded SQL queries with per-row fan-out. The result is denial of service for all other users. Upgrade to 2.7.1 or disable self-registration if upgrading is not immediately possible.

CVE-2026-123595, CVE-2026-123596, CVE-2026-123605 | Hickory DNS | CVSS 8.8
Three distinct DNSSEC validation flaws in Hickory DNS's validating recursor. The NSEC3 handler matches closest enclosers by hash alone without checking type bitmaps; the NSEC handler accepts parent-zone records as proof of nonexistence for child names; and the signature validator accepts RRSIGs signed by any DNSKEY regardless of zone authority. Together these allow an on-path attacker or rogue nameserver to forge NXDOMAIN responses or spoof arbitrary DNS records. Upgrade hickory-proto and hickory-net to 0.26.2 or later.

Headline News

ARTEX: AI-Augmented Intrusion Tooling Behind South Korean Banking Breaches

Between late September and early October 2026, seven South Korean financial institutions suffered confirmed data breaches traced back to infrastructure linked to a threat cluster researchers are calling ARTEX. Investigators identified internet-exposed servers hosting AI-powered hacking toolkits — purpose-built offensive platforms that appear to automate reconnaissance, credential stuffing, and lateral movement at scale. The use of AI-assisted tooling represents a qualitative shift in attacker capability: tasks that previously required skilled operators can now be delegated to automated pipelines, compressing the time between initial access and data exfiltration. For defenders, the implication is clear — dwell-time-based detection strategies need recalibration when attackers can move faster than traditional alert triage cycles. Financial sector security teams should treat this as a signal, not an outlier.

Consumer Brain-Wave Headsets Are Harvesting Neural Data for AI Training

Researchers have documented that multiple consumer EEG and brain-computer interface headset manufacturers are collecting raw neural signal data from users and feeding it into AI training pipelines — without meaningful disclosure in their terms of service. The data involved includes electroencephalographic recordings that can reveal emotional states, cognitive load, and potentially infer health conditions. Unlike browser cookies or location data, neural signals are deeply personal and essentially immutable; there is no "reset your brainwaves" option. For security practitioners, the attack surface extends beyond the device itself: companion apps with excessive permissions, unencrypted BLE transmission of raw signal data, and cloud backends with weak access controls have all been observed in this product category. As BCI hardware edges into workplace wellness and productivity monitoring, this deserves immediate attention from enterprise security and privacy teams alike.

Schrödinger's Feed

SLAC scientists have announced what they describe as conclusive evidence of a third distinct type of magnetism — a quantum phenomenon that also reveals a hard limit on how precisely electrons can be tracked simultaneously in space and time. The discovery touches on fundamental quantum uncertainty in a way that has direct implications for the design of future electronics, with researchers suggesting processors potentially hundreds of thousands of times faster than current silicon. From a cryptographic standpoint, deeper understanding of electron behaviour at the quantum scale feeds into the broader engineering trajectory toward fault-tolerant quantum computers — the class of machine that would eventually threaten RSA and ECC at meaningful key sizes. Practitioners not yet tracking post-quantum migration timelines should note that hardware surprises tend to accelerate those timelines unexpectedly.

/dev/random

A blog post making the rounds this week tackles "AI brain fry" — the cognitive fatigue that sets in after extended sessions of prompting, reviewing, and second-guessing AI-generated output. The author's core observation is that context-switching between trusting the AI and auditing the AI is itself the exhausting part, essentially forcing the brain to hold two simultaneous models of correctness. The proposed mitigations are aggressively low-tech: scheduled review-free writing blocks, deliberate output-free thinking time, and treating AI tools more like a compiler than a colleague. Security practitioners who've spent the last year reviewing AI-generated code for subtle logic flaws will find the whole thing uncomfortably relatable.