Our weekly round-up of significant threats and actively exploited vulnerabilities. It is awareness content, not a monitored threat intelligence service: always check vendor advisories against your own environment.
This week at a glance
Attacks on everyday infrastructure dominated the week. A second wave of attacks on internet-connected refrigeration controllers forced supermarkets across Europe to throw away food, and the NCSC alerted UK organisations that could be at risk. CISA confirmed attacks on a WordPress core flaw and a SonicWall VPN flaw that can get around multi-factor authentication, and Zyxel patched a switch zero-day that slipped past an earlier fix. Two phishing operations showed how attackers now steal live Microsoft and Google sessions rather than passwords. In its annual review on 3 November, the NCSC said the threat to the UK has grown faster than its defences.
Actively exploited vulnerabilities
WordPress core (CVE-2026-119977)
A race condition in the way WordPress applies core updates (CVSS 8.1 per Wordfence) lets an unauthenticated attacker run code if they reach the predictable staging folder while a site is updating. It affects WordPress 4.7 to 7.1.3. WordPress fixed it on 28 October and CISA added it to its catalogue on 3 November; Wordfence reports blocking thousands of attempts a day. We published an urgent alert on 5 November. Fix: update to WordPress 7.1.4, or the fixed release for your branch (for example 7.0.8, 6.9.11, or 6.8.12), and block public web access to the wp-content/upgrade/ folder.
Source: CISA alert, 3 November 2026
SonicWall SonicOS SSL VPN (CVE-2026-19868)
This flaw affects SonicWall firewalls whose SSL VPN uses SAML sign-in. A user with valid credentials for another login method may be able to get past the SAML checks, including multi-factor authentication enforced through SAML. SonicWall said it was investigating a report of possible exploitation, and CISA added the flaw to its catalogue on 6 November. Neither has published details of the attacks. Fix: upgrade to SonicOS 7.3.4-7013 (Gen 7) or 8.2.3-8015 (Gen 8) or later; SonicWall says there is no workaround.
Source: Canadian Centre for Cyber Security, AV26-1133
Zyxel GS1900 series switches (CVE-2026-107441)
Zyxel disclosed on 3 November that an out-of-bounds write in the switches’ web management program (CVSS 8.8 per Zyxel; Binarly rates it 9.8) was exploited before a fix existed. Researchers at Binarly found that June’s patch for a related flaw, CVE-2026-7273, left this one open, so switches updated only to June’s firmware are still vulnerable. Reports link it to a campaign that compromised 996 switches in 48 countries. Fix: install firmware V2.90 Patch 3 (for example 2.90(AAHH.3)C0 for the GS1900-8) on all ten affected models, and keep switch management interfaces off the internet.
Source: Zyxel security advisory
Siemens SIMATIC IoT2050 with Node-RED (CVE-2026-58115)
Siemens disclosed this maximum-severity flaw (CVSS 10.0) in August: on SIMATIC IoT2050 Advanced devices with Node-RED installed, the Node-RED web interface needs no login, so a remote attacker can run code. VulnCheck reported that attackers began exploiting it on 30 October, installing a Linux bot or a Node-RED backdoor that survives a reboot. Fix: update to V4.3.4.1 or later; until then, uninstall or harden Node-RED and keep these devices off the internet. A later Siemens revision reportedly adds other IoT2050 models, so check the current advisory (SSA-834709).
Source: The Hacker News
Apple WebKit (CVE-2024-27834)
CISA added this 2024 WebKit pointer authentication bypass to its catalogue on 4 November, after Sekoia reported attackers, possibly linked to Russia, chaining it with a WebKit code execution flaw to steal browser cookies from iPhones running iOS 16.7. Apple fixed it in May 2024. Fix: make sure iPhones, iPads, and Macs run a current, supported version of iOS, iPadOS, macOS, and Safari, and retire devices that can no longer be updated.
Source: The Hacker News
Notable threats and campaigns
Attacks on supermarket refrigeration controllers in Europe
Overnight into 2 November, attackers changed the settings of internet-connected refrigeration controllers in supermarkets and food shops in Belgium, the Netherlands, Luxembourg, Sweden, Estonia, Ireland, and other European countries, forcing units into defrost mode so that stores had to throw away stock. It follows a similar attack on French supermarkets in October. Danfoss said its controllers were involved, and France’s CERT has also named Copeland and Dixell controllers. The NCSC has alerted UK organisations that could be at risk and said vulnerable technology had been exploited in a couple of UK cases. No one has been publicly blamed. See our Top story.
Source: SecurityWeek
Operation CloudFire steals Google sessions through calendar invites
Material Security reported a phishing operation, active since mid-August, that sent Google Calendar invitations linking to a reverse-proxy page in front of the real Google sign-in. This captured live sessions from corporate users and so got around multi-factor authentication. Material says it blocked more than 68,000 messages and that the group has since moved to Google Drive share invitations. It named no particular region.
Source: BleepingComputer
Fake OpenAI, SpaceX, and Anthropic event invitations
Push Security reported on 5 November that attackers are advertising fake AI events, such as an “OpenAI Academy” livestream and a private SpaceX briefing, to steal work accounts. Registration pages use the Kali365 phishing service to trick Microsoft users into entering a device code, and the VoidProxy service to intercept Google sign-ins. Both get around most multi-factor authentication.
Source: Push Security
Also reported this week
- 3AM ransomware at a UK school group: Bitdefender reported that a 3AM ransomware affiliate encrypted about 37 machines at a UK school estate in September, possibly using AI-generated commands; how the attacker got in is not known. (BleepingComputer)
- Investment fraud platform supplier disrupted: police in Germany and other European countries, supported by Europol and Eurojust, arrested seven people and seized more than 100 servers used to supply ready-made fake trading websites to scam call centres, with potential victims in at least 50 countries. (Europol)
Other patches worth knowing
- Synology DSM: Synology is urging customers to update DSM after C3RB3R ransomware attacks on out-of-date NAS devices; install a build covering advisory SA-26:13 and keep DSM management off the internet.
- Danfoss and other refrigeration controllers: Danfoss advises disconnecting AK-SC and AK-SM controllers from the internet and says a factory reset alone does not stop repeat attacks.
- Sogou Input Method for Windows (CVE-2026-120422): version 16.10 moves update traffic to HTTPS after ESET found a China-aligned group hijacking it to install malware on users in Asia and the Middle East.
- Android: Google released its November Android security bulletin on 2 November; install updates as handset makers ship them.
- Coming up: Microsoft’s November Patch Tuesday is on 10 November.
Practical steps to consider
- Find every internet-connected building, refrigeration, and industrial controller in your estate (including those managed by suppliers), take management interfaces off the internet, and change default passwords (ISO/IEC 27001 controls A.5.9 and A.8.20).
- Patch the WordPress, SonicWall, and Zyxel flaws above as a priority, and check that firmware for switches and other network devices is included in your patching process (control A.8.8 and Cyber Essentials security update management).
- Move administrators and other high-risk users to phishing-resistant sign-in such as passkeys or FIDO2 keys, block device code sign-in where you don’t need it, and stop unknown calendar invitations being added automatically.
This round-up is for general awareness only and is not a monitored threat intelligence service. If you would like help reviewing your vulnerability management or incident readiness, contact us.
