← Back to Threat Briefs

Cyber Threat Brief — November 8 2026

⚠️ This report is AI-generated. Always validate findings.

No new threat section. Status adds OpenSSH host artifacts and corrects BeyondTrust’s fixed-release record.

Detection index: Not checked (status-only update; no rule-coverage claims).

Status Updates

  • OpenSSH (OpenSSH-CVE-2026-123158): On musl hosts with PAM disabled, hunt host file events for /opt/py3/tac_agent.py and SSH-key writes containing SSHHOLE-HIT. GreyNoise now publishes these artifacts; C2 enrollment failed on its gridpoint. Still not in KEV. GreyNoise 7 Nov brief 6 Nov brief
  • BeyondTrust Remote Support (CVE-2026-102764): BT26-05, updated 4 November, lists Remote Support 26.3.1+ as fixed alongside BT26-05-RS. Apply the vendor fix; the KEV deadline remains overdue. Keep on watch rather than retire. Vendor 1 Nov brief
  • WordPress Core (WordPress-Core-CVE-2026-119977): Watching (no change). KEV remains overdue. Before updating, deny /wp-content/upgrade/ in the server config or use RedirectMatch 403 ^/wp-content/upgrade/ in the root .htaccess, then verify 403. WordPress deletes a .htaccess file inside that directory. 4 Nov brief 7 Nov brief
  • Retired from watch: Cisco ASA and FTD CVE-2026-76418 (last update 2026-10-30); Ruby Onigmo watch only: CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264 (Ruby-Onigmo-2026-10-23, last update 2026-10-30). 30 Oct brief
  • SonicWall SonicOS (SonicWall-SonicOS-CVE-2026-19868): Watching (no change). KEV remains due 20 November. SNWLID-2026-0014 7 Nov brief
  • Synology DSM (Cerber-Synology-DSM-2026-10): Watching (no change). Synology still has not identified which of CVE-2024-10441, CVE-2024-50629 or CVE-2024-10445 was used. 2 Nov brief
  • European refrigeration controllers (Refrigeration-Controllers-EU-2026-11): Watching (no change). Initial access and hacktivist claims remain unconfirmed. Exposed devices are not confirmed compromised. 2 Nov brief
  • ARTEX (ARTEX-Software-Vendors-2026-11): Watching (no change). WorkOS attributes its incident to an escaped test agent. Microsoft’s Storm-3358 financial claim stays deferred. 3 Nov brief
  • Ivanti Connect Secure CVE-2026-111357: Watching (no change). KEV overdue; prior correction remains in force. Prior brief
  • SharePoint ToolShell (Storm2603-ToolShell-Fileless-2026-11): Watching (no change). CVE-2025-53770 is KEV overdue; CVE-2025-53771 is not in KEV. Prior brief
  • Siemens Software Center (Siemens-Software-Center-CVE-2026-110936): Watching (no change). CVE-2026-110936 is KEV overdue. Prior brief
  • Plex Media Server (Plex2Shell-CVE-2026-96652): Watching (no change). CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 remain KEV overdue. Prior brief
  • GitLab CVE-2026-97229: Watching (no change). KEV overdue. Prior brief
  • PHP core (PHP2Shell-CVE-2026-109618): Watching (no change). CVE-2026-109618 and CVE-2026-109619 remain KEV overdue; CVE-2026-115560 is not in KEV. Prior brief
  • Apple (Apple-CVE-2024-27834-2026-11): Watching (no change). CVE-2024-27834 remains KEV due 18 November. Prior brief
  • Ivanti Connect Secure CVE-2026-118527: Watching (no change). KEV remains due 13 November. Prior brief
  • VMware ESX CVE-2026-41709: Watching (no change). KEV remains due 11 November. Prior brief
  • Brotli CVE-2026-111497: Watching (no change). KEV remains due 10 November. Prior brief
  • Adobe Commerce CVE-2026-48356: Watching (no change). KEV remains due 10 November. Prior brief
  • Zyxel GS1900 (Zyxel-GS1900-CVE-2026-107441): Watching (no change). Prior brief
  • GitLab CVE-2026-110264: Watching (no change). Prior brief
  • Canonical LXD CVE-2026-112816: Watching (no change). Prior brief
  • Binance (Binance-TraderTraitor-2026-11): Watching (no change). Prior brief
  • eMudhra (eMudhra-CVE-2026-111943): Watching (no change). CVE-2026-111943 and CVE-2026-91403: no change. Prior brief
  • Tailscale SSH (Tailworm-Tailscale-SSH-2026-10): Watching (no change). Prior brief
  • Cursor marketplace Claude Code (Cursor-Claude-Code-2.1.313-2026-10): Watching (no change). Prior brief
  • XCPE Android TV (XCPE-Botnet-2026-11): Watching (no change). Prior brief
  • WinRAR Gorbag (Gorbag-WinRAR-CVE-2025-8088-2026-11): Watching (no change). CVE-2025-8088: no change. Prior brief