cybr.cx Daily Digest — November 4, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-119977 | WordPress Core | CVSS: N/A (KEV listed)
A TOCTOU race condition in WordPress Core allows unauthenticated remote code execution during the core upgrade window. The vulnerability exists because full-package upgrades use predictable, web-accessible staging paths — an attacker who can time a request during an upgrade can land arbitrary code on the server. CISA has set a remediation deadline of November 6; patch or take sites offline during maintenance windows now.

⚠️ Actively exploited — CVE-2026-118527 + CVE-2026-111357 | Ivanti Connect Secure | CVSS: N/A (KEV listed)
Two actively exploited flaws in Ivanti Connect Secure are being chained in the wild alongside a third (CVE-2026-104935). CVE-2026-118527 lets a remote authenticated attacker write attacker-controlled files to a known disk location by exploiting predictable identifier generation; CVE-2026-111357 then allows local privilege escalation via a missing authentication check on a critical function. The combination is a reliable authenticated-to-root path on VPN infrastructure. If you haven't patched and isolated these appliances, treat them as compromised.

⚠️ Actively exploited — CVE-2026-97229 | GitLab CE/EE | CVSS: N/A (KEV listed)
An integer overflow in GitLab's CI/CD regex validation allows an unauthenticated attacker to execute arbitrary code on the GitLab server via a crafted pipeline configuration. With CISA's remediation deadline already passed (November 1), any unpatched GitLab instance should be considered at immediate risk — particularly self-hosted installations exposed to the internet or accessible by untrusted contributors.

⚠️ Actively exploited — CVE-2026-76418 | Cisco ASA / Secure FTD | CVSS: N/A (KEV listed)
An unchecked null pointer dereference in Cisco's firewall software can be triggered remotely by an unauthenticated attacker, causing the device to reload and creating a denial-of-service condition. Active exploitation of perimeter firewall infrastructure is high-impact even without code execution — availability loss on a security gateway is a significant operational event.

⚠️ Actively exploited — CVE-2026-111497 | Google Brotli | CVSS: N/A (KEV listed)
An unchecked return value in Google's Brotli decompression library allows a remote unauthenticated attacker to corrupt adjacent decoder state memory via a crafted compressed stream. Impact ranges from memory disclosure and denial of service to potential arbitrary code execution. Brotli is embedded in browsers, CDNs, server runtimes, and countless applications — assess your exposure across the entire software stack.

⚠️ Actively exploited — CVE-2026-46300 | Linux Kernel | CVSS: N/A (KEV listed)
A missing variable initialisation in the Linux kernel causes the shared-fragment marker to be dropped during socket buffer coalescing, leading ESP input processing to decrypt shared page-cache-backed fragments in place. Active exploitation may allow unintended data modification in encrypted network streams. Ubuntu fixes are staged in the proposed pocket; Red Hat has already shipped a patch.

⚠️ Actively exploited — CVE-2026-48356 | Adobe Commerce / Magento | CVSS: N/A (KEV listed)
Unrestricted file upload in Adobe Commerce and Magento enables arbitrary code execution in the context of the current user. E-commerce platforms are perennial targets for skimming and credential theft — exploitation here typically precedes payment data harvesting. Patch immediately and audit recent file uploads.

⚠️ Actively exploited — CVE-2026-41709 | VMware ESX | CVSS: N/A (KEV listed)
An insufficient logging flaw in VMware ESX allows an admin-level malicious actor to perform certain operations that leave no audit trail. While it requires existing admin access, it's being actively leveraged by threat actors to maintain persistent, forensically invisible footholds in virtualisation infrastructure.

CVE-2026-29508 | ReadyMedia (MiniDLNA) 1.3.0–1.3.3 | CVSS: 8.8
A stack-based buffer overflow triggered by a crafted DFF audio file with an oversized PROP chunk allows remote attackers to corrupt stack memory. Placing a malicious file in a monitored directory is sufficient to trigger the condition — no direct user interaction beyond the media server's routine scan. Home and SMB NAS deployments running MiniDLNA should update immediately.

CVE-2026-107441 | Zyxel GS1900-24E (firmware ≤ 2.90) | CVSS: 8.8
An out-of-bounds write in the CGI program allows an unauthenticated adjacent-network attacker to potentially execute OS commands via a crafted HTTP request. Network switches in shared or multi-tenant environments are the primary risk surface; update firmware or restrict management interface access.

CVE-2026-121451 | AB Download Manager < 1.11.2 | CVSS: 8.8
A CSRF vulnerability in the browser-integration API allows a malicious webpage to write attacker-chosen files to arbitrary paths — including startup folders — via a simple text/plain POST with no authentication required. Code execution follows on next user login. Update to 1.11.2 immediately; this is a trivial drive-by attack vector.

CVE-2026-120538 | Easy Digital Downloads ≤ 3.7.2 (WordPress) | CVSS: 8.1
During PayPal guest checkout, the plugin trusts the email address supplied in the checkout form as proof of identity, binding orders to any existing WordPress account that shares that email. An attacker who knows an admin's email can effectively claim that account's identity. Administrator account takeover via a shopping cart is exactly the kind of logic flaw that gets missed in security reviews — audit immediately.

Headline News

Google's Android TV Partner Secretly Weaponised 1.3 Million Set-Top Boxes
Google has confirmed that a Shenzhen-based Android manufacturing partner — Videostro — covertly embedded backdoor functionality into 1.3 million Android TV set-top boxes, silently enrolling them into a botnet. The backdoor was factory-installed at the firmware level, making it invisible to end users and difficult to detect through standard app-layer analysis. Google states it has dismantled the backdoor infrastructure and severed its relationship with the manufacturer, but the incident raises hard questions about supply chain integrity in the Android ecosystem: OEM partners receive access to signing keys and low-level system privileges that make firmware-level compromise exceptionally powerful. For enterprise security teams managing BYOD or IoT policies, this is a pointed reminder that "Android certified" does not mean "trustworthy at the hardware layer" — inventory of consumer-grade streaming devices on corporate networks warrants another look.

Claude Writes a Working Linux Exploit for an Unpatched Ubuntu Vulnerability
Anthropic's Claude LLM produced a functional privilege-escalation exploit targeting a Linux kernel vulnerability that Red Hat patched on Sunday but Ubuntu has yet to address. The exploit, reportedly developed with minimal human scaffolding, demonstrates that the gap between AI-assisted vulnerability research and weaponised exploitation is narrowing rapidly. The affected bug remains unpatched on Ubuntu systems as of today — placing millions of servers in a window of elevated risk made worse by the public availability of working exploit code. For defenders, this case crystallises the emerging asymmetry: AI dramatically accelerates offensive capability development while patch deployment timelines remain tied to human processes. Teams running Ubuntu in production should monitor the proposed pocket for the fix and consider compensating controls in the interim.

GitBook Confirms Security Breach
Documentation and knowledge-management platform GitBook has confirmed a breach, with details still emerging. GitBook is widely used by engineering and security teams to host internal runbooks, API documentation, architecture diagrams, and incident response playbooks — the kind of material that provides an attacker with a detailed map of an organisation's infrastructure and processes. Practitioners whose organisations use GitBook should immediately audit what sensitive documentation is hosted on the platform, rotate any credentials or secrets that may have been embedded in pages, and review access logs for unusual activity. The timing — coinciding with active exploitation of GitLab (CVE-2026-97229) — means developer toolchain security deserves focused attention this week.

Schrödinger's Feed

Universal Quantum has unveiled the iQPU, a foundry-fabricated trapped-ion processor that integrates control electronics directly on-chip, aiming to eliminate the wiring bottlenecks that have historically capped trapped-ion system scale. By moving to a modular architecture built on standard semiconductor fabrication processes, the design sidesteps one of the core engineering barriers to building the qubit counts at which today's encryption becomes vulnerable. Trapped-ion systems have consistently demonstrated superior qubit coherence times compared to superconducting alternatives, making architectural scaling milestones here particularly worth watching from a cryptographic risk perspective. When hardware roadmaps start converging on the qubit counts needed for Shor's algorithm at meaningful key sizes, the runway for PQC migration gets measurably shorter — now is not the time to defer post-quantum planning.

/dev/random

A developer, frustrated that their Renault's infotainment system had no user-accessible option to update the clock for daylight saving time, reverse-engineered the navigation firmware, identified the locked configuration interface, and jailbroke it — solely to change the displayed hour. The process involved analysing the system's update mechanism, crafting modified configuration payloads, and navigating the kind of obfuscation typically reserved for systems someone actually wanted to secure. The car manufacturer's apparent logic was that time configuration is a factory-only function, which is a bold stance on who owns a clock. It joins a distinguished lineage of "I just wanted to do one simple thing" projects that accidentally became a full firmware security audit.