Cyber Threat Brief — November 10 2026
1. GPUStack — CVE-2026-102895
TL;DR: CISA added GPUStack CVE-2026-102895 to the Known Exploited Vulnerabilities catalog on 9 November, due 12 November. Upgrade every build before 2.2.0 to 2.3.0 or a later stable release, then review new admin API keys and POST /v2/inference-backends/from-yaml.
What’s New:
- CISA added CVE-2026-102895 on 9 November. The federal due date is 12 November.
- Before 2.2.0, GPUStack treats a loopback source as the built-in administrator when
force_auth_localhostis false, which is the default. A same-host reverse proxy, or a client headerX-GPUStack-Real-IPset to127.0.0.1, can create that source. - GPUStack says this was seen on a v2.1.1 deployment, where the attacker created custom backends that ran reverse shells. The first fixed build is 2.2.0.
- The releases page marks v2.3.0 (23 Oct) as Latest. The v2.2.2 notes fix two more authorization bugs that reach v2.2.1, with CVEs still pending, so do not stop at 2.2.0 or 2.2.1. Pre-release v2.3.1rc1 is not the fix.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| GPUStack before 2.2.0 | Vulnerable version | T1190 | Software inventory | Upgrade GPUStack before 2.2.0 to 2.3.0 or a later stable release. The GHSA fixes CVE-2026-102895 in 2.2.0 and later. |
| GPUStack 2.3.0 | Fixed build | T1190 | Software inventory | Install GPUStack 2.3.0 or a later stable release from the releases page. Do not deploy pre-release 2.3.1rc1 as this fix. |
| X-GPUStack-Real-IP | HTTP header | T1190 | Reverse-proxy access log | Drop a client-supplied X-GPUStack-Real-IP header at the proxy, and alert when that header arrives from outside the proxy. |
| POST /v2/inference-backends/from-yaml | API path | T1059 | GPUStack API access log | Review POST /v2/inference-backends/from-yaml for backends your operators did not create. |
| admin API key scope [”*“] | API key | T1098 | GPUStack API key inventory | List admin API keys with scope [”*”] that were created while the server was exposed, and revoke keys you do not recognize. |
| force_auth_localhost=true | Configuration | T1190 | GPUStack config | Set force_auth_localhost=true until the upgrade to 2.3.0 or later is in place. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No rule names GPUStack, the real-IP header, or from-yaml. |
| Elastic | None — verified | No rule names GPUStack, the real-IP header, or from-yaml. |
| Sigma | None — verified | No rule names GPUStack, the real-IP header, or from-yaml. |
Hunt hint: Inventory GPUStack and upgrade every build before 2.2.0 to 2.3.0 or a later stable release. Set force_auth_localhost to true until that upgrade is in place. At the reverse proxy, strip a client-supplied X-GPUStack-Real-IP header and stop presenting external clients to GPUStack as TCP peer 127.0.0.1. List administrator API keys whose scope is [”*”] and that appeared while the host was exposed. Review POST /v2/inference-backends/from-yaml for backends your operators did not create. On worker hosts, look for new custom backends and unexpected shells under the GPUStack service account.
Sources: CISA KEV catalog · GPUStack GHSA-gj9m-f8ph-pmhr · GPUStack releases · SecurityWeek
2. FreeSWITCH — CVE-2026-116779
TL;DR: CISA added SignalWire FreeSWITCH CVE-2026-116779 to the Known Exploited Vulnerabilities catalog on 9 November, due 12 November. Upgrade to 1.11.3 or later, or set enable-chat=false on profiles that do not need inbound SIP chat.
What’s New:
- CISA added CVE-2026-116779 on 9 November. The federal due date is 12 November.
- An inbound SIP MESSAGE can choose the
apichat proto and run FreeSWITCH API commands as the freeswitch process. Stock mod_lua is a second place that command can land, as inline Lua. - SignalWire says this path has been observed exploited. The fix is 1.11.3 or later. That release adds
enable-chat-api-proto, which stays off unless you set it. - Chat is on in the stock internal and external profiles. Setting
auth-messagesdoes not close the path. The stock directory user iddefaulthas no password.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| FreeSWITCH 1.11.2 and earlier | Vulnerable version | T1190 | Package inventory | Upgrade FreeSWITCH 1.11.2 and earlier to 1.11.3 or later. GHSA-mg63-h38w-8p9p. |
| FreeSWITCH 1.11.3 | Fixed build | T1190 | Package inventory | Install FreeSWITCH 1.11.3 or later. v1.11.3 release. |
| SIP MESSAGE api chat proto | Call behavior | T1190 | FreeSWITCH log | Alert when an inbound SIP MESSAGE selects the api chat proto, including the 403 that 1.11.3 logs for that selection. |
| enable-chat=false | Configuration | T1190 | Sofia profile config | Set enable-chat=false on every Sofia profile that does not need inbound SIP chat. |
| conf/vanilla/directory/default/default.xml user id default | Configuration | T1078 | FreeSWITCH directory | Remove or password the stock user id default in conf/vanilla/directory/default/default.xml, which ships with no password and no a1-hash. |
| freeswitch child shell | Process behavior | T1059 | Sysmon 1 or EDR process | Hunt a freeswitch process spawning a shell or the lua interpreter. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No rule matches the api chat proto on SIP MESSAGE. |
| Elastic | None — verified | No rule matches the api chat proto on SIP MESSAGE. |
| Sigma | None — verified | No rule matches the api chat proto on SIP MESSAGE. |
Hunt hint: Upgrade FreeSWITCH to 1.11.3 or later. Where you cannot upgrade yet, set enable-chat=false on every Sofia profile that does not need inbound SIP chat. Search logs for an inbound SIP MESSAGE whose To user selects the api chat proto. After the upgrade, also alert on the 403 the fix logs when that proto is selected. Remove directory users that have neither a password nor an a1-hash, including the stock user id default. Hunt a freeswitch process spawning a shell or the lua interpreter.
Sources: CISA KEV catalog · FreeSWITCH GHSA-mg63-h38w-8p9p · FreeSWITCH v1.11.3 · The Hacker News
3. IBM Aspera Faspex — CVE-2026-123218
TL;DR: CISA added IBM Aspera Faspex CVE-2026-123218 to the Known Exploited Vulnerabilities catalog on 9 November, due 12 November. Upgrade Faspex 5.0.0 through 5.0.19 to 5.0.19 PL1 and confirm faspex-core is 5.0.19 (1ce4b13, Fix Pack 1).
What’s New:
- CISA added CVE-2026-123218 on 9 November. The federal due date is 12 November.
- IBM’s summary says an authenticated user can craft a message that bypasses authorization; its description says an authorized user can gain full administrative privileges.
- Affected releases are Faspex 5.0.0 through 5.0.19. The fix is 5.0.19 PL1 on Linux, and the bulletin says to validate faspex-core 5.0.19 (1ce4b13, Fix Pack 1).
- IBM’s own CVSS vector (9.8) scores privileges required as none, and IBM does not explain the gap. The KEV text also says authenticated user. The bulletin lists no workaround.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| IBM Aspera Faspex 5.0.0 through 5.0.19 | Vulnerable version | T1068 | Application inventory | Upgrade IBM Aspera Faspex 5.0.0 through 5.0.19 to 5.0.19 PL1. IBM bulletin. |
| IBM Aspera Faspex 5.0.19 PL1 | Fixed build | T1068 | Application inventory | Install IBM Aspera Faspex 5.0.19 PL1 from the IBM bulletin. Plain 5.0.19 is still in the affected range. |
| faspex-core 5.0.19 (1ce4b13, Fix Pack 1) | Fixed image | T1068 | Container image inventory | Confirm the running faspex-core image is 5.0.19 (1ce4b13, Fix Pack 1), as the IBM bulletin requires. |
| Faspex administrator role grant | Account behavior | T1098 | Faspex admin audit log | List every Faspex administrator role grant and recent promotion, and remove any administrator you do not recognize. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No rule matches this Linux Faspex authorization bypass. |
| Elastic | None — verified | No rule matches this Linux Faspex authorization bypass. |
| Sigma | None — verified | 2023 rule needs a Windows Ruby parent, so it misses. |
Hunt hint: Upgrade IBM Aspera Faspex 5.0.0 through 5.0.19 to 5.0.19 PL1. Confirm the faspex-core container image is 5.0.19 with commit 1ce4b13 and Fix Pack 1. List every Faspex administrator and recent role promotion, and remove any you do not recognize. IBM has not dated first exploitation, so do not limit the review to the bulletin date. Keep Faspex off the public internet until the image check passes, because the bulletin lists no workaround. IBM says an authenticated user can trigger it, so review every account that can log in, including external users.
Sources: CISA KEV catalog · IBM bulletin 7295921 · SecurityWeek
Detection index: ESCU 4c1652e (2026-11-03) · elastic detection-rules 0aacc5e (2026-11-06) · SigmaHQ d7c9da1 (2026-11-10). Code search for GPUStack, FreeSWITCH, X-GPUStack, inference-backends and sofia found no rule in any of the three repos. The Sigma rule “Mint Sandstorm - AsperaFaspex Suspicious Process Execution” was read: it requires a Windows parent image containing both aspera and \ruby, so it does not cover this Linux faspex-core bug. Mirrors were not cloned.
Status Updates
- OpenSSH (OpenSSH-CVE-2026-123158): CISA added it to KEV on 9 Nov, due 12 Nov. Reports citing GreyNoise give 16 or 18 exploitation chains from six IPs; figures vary by source, and GreyNoise’s page was unreachable today. Scope remains musl with PAM disabled. Fix remains 10.6p2. KEV catalog OpenSSH notes 9 Nov brief
- European refrigeration controllers (Refrigeration-Controllers-EU-2026-11): France’s C4 attributes the 11–12 Oct attacks on about 700 French retail sites to IRGC unit Shahid Kaveh; Paris prosecutors seek arrest warrants. This covers October only, not the November wave. ANSSI 5/5 CERT-FR 7 Nov brief
- LNbits (LNbits-server-shutdown-2026-11): Watching (no change). The latest release is still v1.6.2 from 18 Sep, so there is no fixed release. Keep self-hosted LNbits stopped and the Paywall extension disabled. Releases 9 Nov brief
- Plex Media Server (Plex2Shell-CVE-2026-96652): Watching (no change). QNAP’s 6 Nov FAQ still applies: install 1.43.3.10861 or later, and clean-reinstall any NAS whose Plex was reachable from the internet. CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 remain KEV overdue. QNAP FAQ 6 Nov brief
- Brotli (CVE-2026-111497): KEV is due today. Palo Alto’s advisory shows every PAN-OS fix build as released, the last (12.1.4-h13, 12.1.10-h3, 11.2.4-h23) on 29 Oct. Its 9 Nov update only added cloud products. Exposure still needs Brotli inspection plus decryption. Palo Alto 28 Oct brief
- Adobe Commerce (CVE-2026-48356): KEV is due today, 10 November. No new material today. Prior brief
- VMware ESX (CVE-2026-41709): Watching (no change). KEV remains due 11 November. Prior brief
- N-able N-central: Not yet briefed. N-able took hosted N-central offline on 9 Nov and told on-premises customers to take their servers offline until further notice. A hotfix is still in progress. BleepingComputer
- Retired from watch: Siemens Software Center Siemens-Software-Center-CVE-2026-110936 (last update 2026-10-21); WinRAR Gorbag Gorbag-WinRAR-CVE-2025-8088-2026-11 (last update 2026-11-03). 21 Oct brief 3 Nov brief
- BeyondTrust Remote Support (CVE-2026-102764): Watching (no change). The KEV deadline remains overdue. The 8 Nov fixed-release correction still stands. 8 Nov brief
- WordPress Core (WordPress-Core-CVE-2026-119977): Watching (no change). KEV remains overdue. Before a full-package update, deny
/wp-content/upgrade/and verify 403. 7 Nov brief - SonicWall SonicOS (SonicWall-SonicOS-CVE-2026-19868): Watching (no change). KEV remains due 20 November. SNWLID-2026-0014 7 Nov brief
- Synology DSM (Cerber-Synology-DSM-2026-10): Watching (no change). Synology still has not identified which of CVE-2024-10441, CVE-2024-50629 or CVE-2024-10445 was used. 2 Nov brief
- ARTEX (ARTEX-Software-Vendors-2026-11): Watching (no change). WorkOS attributes its incident to an escaped test agent. Microsoft’s Storm-3358 financial claim stays deferred. 3 Nov brief
- Ivanti Connect Secure (CVE-2026-111357): Watching (no change). CVE-2026-111357 stays KEV overdue, and CVE-2026-118527 stays due 13 November. Prior brief
- SharePoint ToolShell (Storm2603-ToolShell-Fileless-2026-11): Watching (no change). CVE-2025-53770 is KEV overdue; CVE-2025-53771 is not in KEV. Prior brief
- Apple (Apple-CVE-2024-27834-2026-11): Watching (no change). CVE-2024-27834 remains KEV due 18 November. Prior brief
- Zyxel GS1900 (Zyxel-GS1900-CVE-2026-107441): Watching (no change). The 3 Nov advisory and the separate CVE-2026-7273 KEV bug remain as briefed. Prior brief
- GitLab (CVE-2026-110264): Watching (no change). Prior brief
- Canonical LXD (CVE-2026-112816): Watching (no change). Prior brief
- Binance (Binance-TraderTraitor-2026-11): Watching (no change). Prior brief
- eMudhra (eMudhra-CVE-2026-111943): Watching (no change). CVE-2026-111943 and CVE-2026-91403 remain unchanged. Prior brief
- Tailscale SSH (Tailworm-Tailscale-SSH-2026-10): Watching (no change). Prior brief
- Cursor marketplace Claude Code (Cursor-Claude-Code-2.1.313-2026-10): Watching (no change). Prior brief
- XCPE Android TV (XCPE-Botnet-2026-11): Watching (no change). Prior brief