WEEKLY TOP TEN: November 09, 2026, 16:00 GMT
- SonicWall SSL-VPN Flaw Bypasses MFA in Attacks
SonicWall fixed seven SonicOS vulnerabilities, including CVE-2026-19868, a 7.1-rated authentication enforcement flaw in the SSL VPN service that lets a user holding valid credentials for another login method bypass SAML controls, including SAML-enforced multifactor authentication. It affects Gen7 firewalls on SonicOS 7.3.3-7015 or older and Gen8 firewalls on 8.2.2-8015 or older when SAML login is enabled. SonicWall investigated a report of exploitation, and CISA added the flaw to its Known Exploited Vulnerabilities catalog with a November 20 federal deadline. Neither SonicWall nor CISA has shared details of the attacks. No workarounds exist, so customers using SAML login should upgrade promptly to SonicOS 7.3.4-7013 or 8.2.3-8015. - Zyxel Switch Zero-Day Behind Nearly 1,000 Hacked Devices
Binarly reports that attacks on Zyxel GS1900 series switches, earlier blamed on a patched flaw, actually exploited a previously unknown vulnerability, CVE-2026-107441. The 8.8-rated out-of-bounds write in the switch firmware’s CGI program lets unauthenticated attackers run operating system commands through crafted HTTP requests and affects 10 GS1900 models. Almost 1,000 devices were compromised with Jitterly and Sixzut malware variants, and the earlier patch for CVE-2026-7273 did not stop the attackers. Zyxel released fixes on October 23 and published its advisory on November 3. Administrators should install the fixed firmware and remove switch management interfaces from the internet. - Unpatched D-Link DGS-3130 Switch Flaws Disclosed
D-Link warned that multiple unpatched vulnerabilities affect its DGS-3130 series managed Gigabit stackable switches, with the DGS-3130-30TS confirmed. Network engineer Giresh Kumar Enugu of Spectrum Community Solutions reported flaws in D-Link Discovery Protocol authentication, access control and information handling that could let an attacker on the network obtain device data, change credentials or configurations, leak SNMP communities, or reset devices. No firmware fix or CVE identifiers exist yet, and D-Link reports no exploitation. Interim guidance is to disable DDP, remove default SNMP strings, restrict management access to isolated admin hosts, and keep offline configuration backups. - OpenSSH SSHole Flaw Lets Long Passwords Bypass Logins
OpenSSH shipped emergency version 10.6p2 to fix SSHole, CVE-2026-123158, an 8.1-rated authentication bypass affecting Linux distributions that use musl libc with PAM disabled, including Alpine Linux, OpenWrt, Buildroot and Yocto. Attackers can log in to accounts with a locked password field, such as root or key-only users, by entering any password between 257 and 1,024 characters, provided another local account has a $5$ or $6$ hash. OpenSSH developer Damien Miller said the fix was rushed because AI agents are rediscovering bugs within hours. No exploitation was reported, but scanning is expected. Patch and restart sshd, or disable password logins. - DigiCert Exposed Customer Archive for 16 Months
DigiCert, the certificate authority, disclosed that a February 2025 server migration left an internal archive system reachable from the internet. Attackers used a self-registration feature without multifactor authentication to create a read-only account that accessed archived records between June 27 and July 2, 2026. DigiCert found unauthorized accounts in June but dismissed them, and confirmed data access only on October 19. Exposed data includes business customers’ names, email addresses, phone numbers and addresses, and in some cases passports, driver’s licenses or utility bills. DigiCert says certificate issuance and validation systems were unaffected, has disabled self-registration, and has not said how many customers are affected. - Ransomware Knocks Out Queens Public Library Network
Queens Public Library in New York City confirmed a ransomware attack on the evening of November 4 that took down its website, on-site computers, check-out and return machines, public Wi-Fi, mobile app and digital media services. All 66 branches stayed open, but renewals are unavailable and the library says restoring its network and systems will take time. No ransomware group has claimed responsibility, and no ransom demand has been disclosed. Publicly funded institutions rarely pay ransoms and often face long rebuilds, as the British Library did after its 2023 Rhysida attack. - APT29 Hits Phones Through Compromised and Cloned Websites
Sekoia attributes with moderate to high confidence a watering-hole campaign to APT29, the Russia-linked group tied to the SVR. Attackers injected JavaScript into hacked sites, including a Ukrainian gas producer, a major US chemical industry association and a Bulgarian military-linked site, cloned others, and compromised the Ukrainian analytics tracker Plerdy. A profiling script serves iOS and Android Chrome exploit chains that steal cookies, device data and Wi-Fi passwords, including one linked to the DarkSword exploit kit. All flaws were patched before the campaign began, so updated devices are not vulnerable. CISA added the Apple flaw CVE-2024-27834 to its Known Exploited Vulnerabilities catalog with a November 18 federal deadline. - Max-Severity Node-RED Flaw Exploited on Industrial Systems
VulnCheck reported in-the-wild exploitation of CVE-2026-58115, a maximum-severity missing authentication flaw in Node-RED that Siemens disclosed in August for its SIMATIC IoT2050 Advanced devices running Industrial OS. Starting October 30, an attacker scanning for instances without adminAuth sent a single HTTP request that deployed a flow downloading a Linux bot, and by November 1 VulnCheck had seen 15 more attacks from the same address, including persistent webshells. Node-RED is widely used in industrial control and operational technology environments. Siemens fixed the flaw in version 4.3.4.1, and defenders should confirm exposure and review flows for unexpected exec nodes. - Apple Warns German Lawmakers of Mercenary Spyware
Germany’s Federal Office for Information Security, the BSI, told members of the Bundestag and other public figures to assume their iPhones may be compromised after Apple sent threat notifications beginning October 29 about an attack using mercenary spyware. The agency has not established whether the attempts succeeded, and neither Apple nor German authorities have said who is behind them or how many people were warned. Recipients were urged to contact the BSI directly and take protective measures. The alerts add to growing evidence of commercial spyware targeting government officials, and high-risk users should keep devices updated and act promptly on any Apple threat notification. - Fake Security Tools on GitHub Target Defenders
Dr. Web researchers report that a threat actor is posting infected security projects on GitHub to target cybersecurity professionals, with more than 2,000 Windows systems compromised. One fake repository poses as a lightweight script for formatting Fscan network scanner output. Malicious code hides behind long stretches of whitespace in Visual Studio, Python and Go files, and PowerShell fetches an Electron-based loader that installs the AsyncRAT backdoor, a crypto clipper and an information stealer. The loader disables Smart App Control, restores ntdll.dll to remove security hooks, and patches Windows scanning functions. The campaign began about two years ago against crypto users, and defenders should vet tools before running them.
Our Threat Operations and Intelligence team compiles a daily digest of the most recent online cybersecurity risks. The previous 10 stories were determined to be most significant during the course of the week, ranked by highest risk, and using multiple sources when available.