Cyber Threat Brief — November 4 2026
⚠️ This report is AI-generated. Always validate findings.
1. WordPress Core — CVE-2026-119977
TL;DR: CISA added WordPress Core CVE-2026-119977 to the KEV catalog on 3 November, due 6 November, for a race during a full core upgrade. Deny web access to /wp-content/upgrade/ before you install the 28 October build for your branch, because that update still runs the old upgrader.
What’s New:
- CISA added CVE-2026-119977 on 3 November, due 6 November, and requires forensic triage as well as the patch. CISA says an unauthenticated attacker can run code during the upgrade window through predictable, web-accessible staging paths.
- WordPress fixed it in 7.1.4 on 28 October and backported the fix to every branch back to 4.7. WordPress’s advisory rates it Low; Wordfence, the CNA, scores it CVSS 8.1 with high attack complexity.
- HOL notes that the update which installs the fix still runs the old upgrader, so that update can be raced too. Check your web logs around your last core update.
- BleepingComputer quotes a Wordfence advisory update saying Wordfence blocked 13,095 attacks on this flaw in 24 hours.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| WordPress 4.7 through 7.1.3 | Vulnerable version | T1190 | Software inventory | Inventory each site’s core version and install the fixed build for that same branch from the rows below. |
| WordPress 7.1.4 | Fixed build | T1190 | Software inventory | On a 7.1 site, install WordPress 7.1.4. Download it from wordpress.org. |
| WordPress 7.0.8 | Fixed build | T1190 | Software inventory | On a 7.0 site, install WordPress 7.0.8. Download it from wordpress.org. |
| WordPress 6.9.11 | Fixed build | T1190 | Software inventory | On a 6.9 site, install WordPress 6.9.11. Download it from wordpress.org. |
| WordPress 6.8.12 | Fixed build | T1190 | Software inventory | On a 6.8 site, install WordPress 6.8.12. Download it from wordpress.org. |
| WordPress 6.7.11 | Fixed build | T1190 | Software inventory | On a 6.7 site, install WordPress 6.7.11. Download it from wordpress.org. |
| WordPress 6.6.11 | Fixed build | T1190 | Software inventory | On a 6.6 site, install WordPress 6.6.11. Download it from wordpress.org. |
| WordPress 6.5.14 | Fixed build | T1190 | Software inventory | On a 6.5 site, install WordPress 6.5.14. Download it from wordpress.org. |
| WordPress 6.4.14 | Fixed build | T1190 | Software inventory | On a 6.4 site, install WordPress 6.4.14. Download it from wordpress.org. |
| WordPress 6.3.14 | Fixed build | T1190 | Software inventory | On a 6.3 site, install WordPress 6.3.14. Download it from wordpress.org. |
| WordPress 6.2.15 | Fixed build | T1190 | Software inventory | On a 6.2 site, install WordPress 6.2.15. Download it from wordpress.org. |
| WordPress 6.1.16 | Fixed build | T1190 | Software inventory | On a 6.1 site, install WordPress 6.1.16. Download it from wordpress.org. |
| WordPress 6.0.18 | Fixed build | T1190 | Software inventory | On a 6.0 site, install WordPress 6.0.18. Download it from wordpress.org. |
| WordPress 5.9.20 | Fixed build | T1190 | Software inventory | On a 5.9 site, install WordPress 5.9.20. Download it from wordpress.org. |
| WordPress 5.8.19 | Fixed build | T1190 | Software inventory | On a 5.8 site, install WordPress 5.8.19. Download it from wordpress.org. |
| WordPress 5.7.21 | Fixed build | T1190 | Software inventory | On a 5.7 site, install WordPress 5.7.21. Download it from wordpress.org. |
| WordPress 5.6.23 | Fixed build | T1190 | Software inventory | On a 5.6 site, install WordPress 5.6.23. Download it from wordpress.org. |
| WordPress 5.5.24 | Fixed build | T1190 | Software inventory | On a 5.5 site, install WordPress 5.5.24. Download it from wordpress.org. |
| WordPress 5.4.25 | Fixed build | T1190 | Software inventory | On a 5.4 site, install WordPress 5.4.25. Download it from wordpress.org. |
| WordPress 5.3.27 | Fixed build | T1190 | Software inventory | On a 5.3 site, install WordPress 5.3.27. Download it from wordpress.org. |
| WordPress 5.2.30 | Fixed build | T1190 | Software inventory | On a 5.2 site, install WordPress 5.2.30. Download it from wordpress.org. |
| WordPress 5.1.28 | Fixed build | T1190 | Software inventory | On a 5.1 site, install WordPress 5.1.28. Download it from wordpress.org. |
| WordPress 5.0.31 | Fixed build | T1190 | Software inventory | On a 5.0 site, install WordPress 5.0.31. Download it from wordpress.org. |
| WordPress 4.9.35 | Fixed build | T1190 | Software inventory | On a 4.9 site, install WordPress 4.9.35. Download it from wordpress.org. |
| WordPress 4.8.34 | Fixed build | T1190 | Software inventory | On a 4.8 site, install WordPress 4.8.34. Download it from wordpress.org. |
| WordPress 4.7.39 | Fixed build | T1190 | Software inventory | On a 4.7 site, install WordPress 4.7.39. Download it from wordpress.org. |
| /wp-content/upgrade/ | Web path | T1190 | Web server config | Deny HTTP access to /wp-content/upgrade/ before the next core update. On nginx, add location ^~ /wp-content/upgrade/ { deny all; }. WordPress’s advisory says the update unpacks into this web-served folder. |
| /wp-content/upgrade/*/wordpress/wp-admin/setup-config.php | URL path | T1190 | Web access log | Alert on HTTP 200 for this path. A 200 near your last update time is a possible takeover; 403 and 404 responses are probing. |
| /wp-content/upgrade/*/wordpress/wp-admin/install.php | URL path | T1190 | Web access log | Alert on HTTP 200 for this path. Treat a 200 near your last update time as a possible takeover. |
| DB_HOST in wp-config.php | Config value | T1190 | File on the WordPress host | Compare DB_HOST, DB_NAME, and DB_USER in wp-config.php with your own database. Treat an unknown database host as a compromised site. |
| Files under wp-content/upgrade/ other than index.php | File | T1505.003 | File on the WordPress host | Run find wp-content/upgrade -type f ! -name index.php -ls and investigate any leftover PHP file. |
| WordPress administrator accounts created since the last core update | Account | T1136 | WordPress user list | Run wp user list --role=administrator --fields=user_login,user_registered and investigate administrators registered after the update. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | Bricks Builder POST only; misses the upgrade path. |
| Elastic | None — verified | Plugin-directory PHP writes only; misses the upgrade path. |
| Sigma | None — verified | Wp2shell plugin path only; misses this upgrade race. |
Detection index: ESCU 4c1652e (2026-11-03) · elastic detection-rules 99bbf62 (2026-11-04) · SigmaHQ c68bb91 (2026-11-04).
Hunt hint: Get the last update time from the mtime of wp-includes/version.php. Search the web log around that time for HTTP 200 to setup-config.php or install.php under /wp-content/upgrade/. Check DB_HOST in wp-config.php and list administrators registered since the update. Run wp core verify-checksums and investigate any mismatch.
Sources: CISA alert, 3 November · CISA KEV · WordPress 7.1.4, 28 October · WordPress releases · GHSA-4w3m-c66w-69mg · NVD · BleepingComputer, 4 November · HOL hunt guide
2. Binance — TraderTraitor intrusion chain
TL;DR: The FBI says North Korea’s TraderTraitor stole more than $6 billion from Binance on or about 29 October. Binance says the intrusion ran through engineers’ work computers, so hunt for the pyenv file swap below and for a deployment token used from a second workstation.
What’s New:
- The FBI attributes the theft to North Korea and calls the activity TraderTraitor. Its alert lists laundering addresses but does not describe how the intrusion started.
- Binance’s 3 November report puts the loss at about $6.34 billion, with about $2.85 billion frozen or intercepted. Binance says the investigation is ongoing and an independent review will follow.
- Per Binance, one engineer installed a tampered Homebrew package in June. In September, a fake recruiter’s coding assignment replaced a pyenv component on another engineer’s work computer, contacted an attacker server, and went undetected by endpoint tools.
- Per Binance, on 20 October that computer and an internal AI tool gave the attacker control of two more engineers’ computers. On 29 October a deployment token from one engineer launched a container from another’s computer, and the wallet signing service then made unauthorized transfers and EIP-7702 delegations.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_ | File | T1554 | macOS endpoint file events | Alert on creation of pyenv_ in this directory. Per Binance, the malware wrote it at 3,414 bytes and renamed it over pyenv. |
| /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv | File | T1554 | macOS endpoint file events | Hash this file and compare it with a trusted pyenv 2.8.0 copy. Per Binance, the legitimate file was 3,344 bytes and the replacement 3,414 bytes. |
| /opt/homebrew/bin/pyenv | Symlink | T1554 | macOS endpoint file events | Alert when /opt/homebrew/bin/pyenv is deleted and recreated outside a brew upgrade. Per Binance, the script recreated this link after the swap. |
| zsh started right after /opt/homebrew/bin/pyenv is recreated | Process | T1059.004 | macOS process events | Alert when zsh starts from the process tree that just rewrote /opt/homebrew/bin/pyenv. Per Binance, the script spawned zsh after creating the link. |
| Container deployment token | Credential use | T1550.001 | Container platform audit log | Alert when a deployment token is used from a host other than its owner’s workstation. Per Binance, one engineer’s token deployed a container from another engineer’s computer between 17:15 and 19:56 on 29 October. |
| EIP-7702 delegation on a hot wallet | On-chain delegation | T1657 | Wallet signing audit | Alert on any EIP-7702 authorization signed for a hot wallet. Per Binance, 50 signing transactions set up the delegation, which was cleared by authorizing the zero address. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No pyenv, Homebrew, or deployment-token rule. |
| Elastic | None — verified | No pyenv swap or deployment-token reuse rule. |
| Sigma | None — verified | No pyenv file swap or symlink-rewrite rule. |
Hunt hint: Hash /opt/homebrew/Cellar/pyenv/*/libexec/pyenv across your Macs and compare it with a trusted copy of the same build. Search file events for a pyenv_ file beside it. Look for zsh starting right after /opt/homebrew/bin/pyenv is recreated. In container-platform audit logs, find deployment tokens used from a second workstation. List the machines your internal AI tools can run commands on.
Sources: FBI alert, 31 October · Binance incident report on X, 3 November · SecurityWeek, 4 November · StepSecurity · SafeDep
Status Updates
- Ivanti Connect Secure (CVE-2026-111357): AmberWolf’s Rich Warren shared the in-the-wild privilege-escalation exploit for CVE-2026-111357 on 4 November and notes the attacker left comments in it. Fix guidance is unchanged from the 1 November correction. CVE-2026-118527 stays due 13 November. Warren on X. 1 November brief.
- Plex Media Server (Plex2Shell-CVE-2026-96652): KEV for CVE-2026-96652 and CVE-2026-96655 was due 3 November and is now overdue, as are CVE-2026-96654 and CVE-2026-96656. The fix is still 1.43.3.10861. Plex. 21 October brief.
- Siemens Software Center (Siemens-Software-Center-CVE-2026-110936): KEV for CVE-2026-110936 was due 3 November and is now overdue. The fix is still V4.0.9.8. Siemens SSA-580366. 21 October brief.
- ARTEX (ARTEX-Software-Vendors-2026-11): WorkOS CEO Michael Grinich says user agents artex-enrich/1.0 and norma/0.4 appeared in the actor’s web requests and are likely attributable to ARTEX. Treat them as a weak, easily changed signal. Grinich on X. 3 November brief.
- GitBook: GitBook says an attacker using AI agents reached some infrastructure credentials at 19:00 CET on 2 November. GitBook revoked customer API tokens and asks customers to rotate GitBook API tokens and connected third-party secrets. GitBook does not name ARTEX. Not yet briefed. GitBook status.
- Retired from watch: UpdraftCentral (UpdraftCentral-2026-10) (last update 2026-10-21). No new report since 21 October. 19 October brief.
- Watching (no change): KEV overdue: BeyondTrust Remote Support CVE-2026-102764 (11-01); GitLab CVE-2026-97229 (11-02); Ruby Onigmo regex engine (Ruby-Onigmo-2026-10-23, 11-02); Cisco ASA/FTD CVE-2026-76418 (11-02); PHP core (PHP2Shell-CVE-2026-109618, 11-02); Linux kernel Fragnesia (CVE-2026-46300, 10-29, retire-eligible 2026-11-07).
- Watching (no change): KEV overdue: Cisco Catalyst SD-WAN CVE-2026-20127 (10-29, retire-eligible 2026-11-05). Not in KEV: GitLab CVE-2026-110264 (11-02); Synology DSM C3RB3R (Cerber-Synology-DSM-2026-10, 11-02); European refrigeration controllers (Refrigeration-Controllers-EU-2026-11, 11-02).
- Watching (no change): KEV due: VMware ESX CVE-2026-41709 (10-29, due 2026-11-11); Brotli CVE-2026-111497 (10-28, due 2026-11-10); Adobe Commerce CVE-2026-48356 (10-28, due 2026-11-10). Not in KEV: Canonical LXD (CVE-2026-112816, 11-01); LMCache (CVE-2026-105192, 10-22, stale-eligible 2026-11-05).
- Watching (no change): LiteLLM (LiteLLM-1.107.0-2026-10, 10-22); ConnectWise Cloud Backup (ConnectWise-CloudBackup-SkyKick-2026-10, 10-22); eMudhra (eMudhra-CVE-2026-111943, 10-27); Tailscale SSH (Tailworm-Tailscale-SSH-2026-10, 10-28).
- Watching (no change): Cursor marketplace Claude Code (Cursor-Claude-Code-2.1.313-2026-10, 10-31); XCPE Android TV boxes (XCPE-Botnet-2026-11, 11-03); WinRAR Gorbag (Gorbag-WinRAR-CVE-2025-8088-2026-11, 11-03).