Hackers tied to APT29 are serving exploits for already-patched flaws to out-of-date phones, the Zyxel looting exploit beats June's patch, and the White House network was a rentable proxy. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: What got your team to enforce a minimum phone OS version? Reply in the comments or at feedback@defensivesecurity.org.

1. APT29 hits out-of-date phones from hacked websites - CVE-2024-27834, CVE-2025-14174, CVE-2025-27038 (+ 5 more) - federal due 2026-11-18 - Do: Require current iOS and Android versions on phones - https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain

2. Update: Zyxel exploit beats the June patch - CVE-2026-107441, CVE-2026-7273 - Fixed: 2.90(xxxx.3)C0 - Do: Patch Zyxel GS1900 switches and change passwords - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026

3. DreamHost breach exposed FTP logins for two months - Do: Check DreamHost-hosted sites for changed files - https://www.dreamhost.com/news/announcements/october-security-incident/

4. APT flaw lets a tampered download run as root - CVE-2026-109518 - Fixed: 2.6.2, 3.0.4, 3.3.3ubuntu0.1, 3.2.1ubuntu0.1, 2.8.4ubuntu0.1, 2.4.15ubuntu0.1, 2.2.5 - Do: Update APT on Debian and Ubuntu servers - https://lists.debian.org/debian-security-announce/2026/msg00526.html

5. Xen flaws let one guest VM take the host - CVE-2026-102703, CVE-2026-102704 - Fixed: xen-4.17.7-4.2.xcpng8.3 - Do: Patch and reboot Xen and XenServer hosts - https://support.citrix.com/external/article/CTX697256

6. Web traffic ZIP files can hijack Snort 3 - CVE-2026-20043 - Fixed: FTD 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2; Snort 3.12.4.0 - Do: Upgrade Cisco Secure Firewall Threat Defense - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe

7. Foglight for Databases fixes three critical flaws - CVE-2026-92188, CVE-2026-92189, CVE-2026-92190 - Fixed: 8.3 - Do: Upgrade Quest Foglight for Databases - http://www.zerodayinitiative.com/advisories/ZDI-26-854/

8. SonicWall won't patch end-of-life GMS flaws - CVE-2026-109593, CVE-2026-109594 - Do: Replace SonicWall GMS with Network Security Manager - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019

9. DigiCert migration left internal system exposed - Do: Re-check what's reachable after every migration - https://bugzilla.mozilla.org/show_bug.cgi?id=2084460

10. White House network was a residential proxy exit - Do: Hunt for proxyware on company machines - https://krebsonsecurity.com/2026/11/want-to-rent-an-internet-address-at-the-white-house/

Thirteen stories for defenders. Every version number and every fix in this episode was checked against the vendor's advisory or the CVE record before it aired. Today's question: What got your team to give network appliances a named patch owner? Reply in the comments or at feedback@defensivesecurity.org.

1. Stolen Entra app secrets hit MSPs and customers - https://www.todyl.com/blog/stolen-app-credentials-real-access-an-actor-is-signing-into-entra-id-and-azure-devops-as-your-workloads

2. cPGuard's update channel pushed a backdoor - https://opsshield.com/notice/cpguard-update-channel-compromise.html

3. Update: open Node-RED editors are being exploited - CVE-2026-58115 - https://cert-portal.siemens.com/productcert/html/ssa-834709.html

4. WS_FTP fixes a 10.0 admin-credential leak - CVE-2026-84295, CVE-2026-90868 - https://cyber.gc.ca/en/alerts-advisories/progress-software-security-advisory-av26-1116

5. Barracuda fixes a flaw chain that reaches root - CVE-2026-116606, CVE-2026-111560 - https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection

6. Update: Linux TCP flaw fixed, Ubuntu still open - CVE-2026-98432 - https://access.redhat.com/security/vulnerabilities/RHSB-2026-016

7. Zyxel GS1900 switches get a command-execution fix - CVE-2026-107441, CVE-2026-76955 - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026

8. Chrome 157 ships 213 security fixes - CVE-2026-121156 - http://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html

9. Android's November patch fixes a no-tap code flaw - CVE-2026-58868 - https://source.android.com/docs/security/bulletin/2026/2026-11-01

10. Forged antd-img-crop commit planted a stealer - https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer

11. Network appliance flaws stay unpatched over a year - https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/

12. Defense firm pays $13M over cyber claims - https://www.justice.gov/opa/pr/defense-and-aerospace-contractors-ilc-dover-and-ilc-astrospace-agree-pay-13m-resolve

13. Fake job interview opened Binance's wallets - https://www.binance.com/en/blog/community/3229153443759566763

Ransomware is encrypting outdated Synology NAS boxes, attackers are running up six-figure AI bills with stolen cloud keys, and Trigger.dev customers need to rotate their secrets. Plus a Langflow login bypass, coding agents installing abandoned MCP servers, and a second wave of supermarket freezer attacks across Europe. Every version number and every fix in this episode was checked against the vendor's advisory or the CVE record before it aired. Today's question: Who in your shop finds out first when a cloud bill jumps overnight? Reply in the comments or at feedback@defensivesecurity.org.

1. Ransomware hits outdated Synology NAS boxes - CVE-2024-10441, CVE-2026-13639, CVE-2026-13684 - Fixed: 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, 7.2.1-69057-12 - Do: Update Synology DSM and close its admin page - https://www.synology.com/en-global/security/advisory/Synology_SA_24_20

2. Stolen cloud keys run up $100K-a-day AI bills - Do: Alert when someone switches on cloud AI services - https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models/

3. Trigger.dev customers' secrets exposed - Do: Rotate every secret you keep in Trigger.dev - https://trigger.dev/blog/security-incident-nov-2026

4. Langflow fixes critical login bypass and RCE - CVE-2026-93680, CVE-2026-110186 - Fixed: 1.13.0 - Do: Upgrade Langflow and turn off auto-login - https://www.ibm.com/support/pages/node/7294467

5. Coding agents install unmaintained MCP servers - Do: Keep an approved list of MCP servers - https://www.glow.io/blogs/mcphantom-ai-coding-agents-are-installing-vulnerable-deprecated-mcp-servers-from-training-data

6. Update: freezer attacks hit six more countries - Do: Take vendor-managed controllers off the internet - https://censys.com/blog/european-refrigerator-controller-redux-a-new-wave-of-refrigeration-attacks/