Hackers tied to APT29 are serving exploits for already-patched flaws to out-of-date phones, the Zyxel looting exploit beats June's patch, and the White House network was a rentable proxy. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: What got your team to enforce a minimum phone OS version? Reply in the comments or at feedback@defensivesecurity.org.

1. APT29 hits out-of-date phones from hacked websites - CVE-2024-27834, CVE-2025-14174, CVE-2025-27038 (+ 5 more) - federal due 2026-11-18 - Do: Require current iOS and Android versions on phones - https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain

2. Update: Zyxel exploit beats the June patch - CVE-2026-107441, CVE-2026-7273 - Fixed: 2.90(xxxx.3)C0 - Do: Patch Zyxel GS1900 switches and change passwords - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026

3. DreamHost breach exposed FTP logins for two months - Do: Check DreamHost-hosted sites for changed files - https://www.dreamhost.com/news/announcements/october-security-incident/

4. APT flaw lets a tampered download run as root - CVE-2026-109518 - Fixed: 2.6.2, 3.0.4, 3.3.3ubuntu0.1, 3.2.1ubuntu0.1, 2.8.4ubuntu0.1, 2.4.15ubuntu0.1, 2.2.5 - Do: Update APT on Debian and Ubuntu servers - https://lists.debian.org/debian-security-announce/2026/msg00526.html

5. Xen flaws let one guest VM take the host - CVE-2026-102703, CVE-2026-102704 - Fixed: xen-4.17.7-4.2.xcpng8.3 - Do: Patch and reboot Xen and XenServer hosts - https://support.citrix.com/external/article/CTX697256

6. Web traffic ZIP files can hijack Snort 3 - CVE-2026-20043 - Fixed: FTD 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2; Snort 3.12.4.0 - Do: Upgrade Cisco Secure Firewall Threat Defense - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe

7. Foglight for Databases fixes three critical flaws - CVE-2026-92188, CVE-2026-92189, CVE-2026-92190 - Fixed: 8.3 - Do: Upgrade Quest Foglight for Databases - http://www.zerodayinitiative.com/advisories/ZDI-26-854/

8. SonicWall won't patch end-of-life GMS flaws - CVE-2026-109593, CVE-2026-109594 - Do: Replace SonicWall GMS with Network Security Manager - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019

9. DigiCert migration left internal system exposed - Do: Re-check what's reachable after every migration - https://bugzilla.mozilla.org/show_bug.cgi?id=2084460

10. White House network was a residential proxy exit - Do: Hunt for proxyware on company machines - https://krebsonsecurity.com/2026/11/want-to-rent-an-internet-address-at-the-white-house/

Thirteen stories for defenders. Every version number and every fix in this episode was checked against the vendor's advisory or the CVE record before it aired. Today's question: What got your team to give network appliances a named patch owner? Reply in the comments or at feedback@defensivesecurity.org.

1. Stolen Entra app secrets hit MSPs and customers - https://www.todyl.com/blog/stolen-app-credentials-real-access-an-actor-is-signing-into-entra-id-and-azure-devops-as-your-workloads

2. cPGuard's update channel pushed a backdoor - https://opsshield.com/notice/cpguard-update-channel-compromise.html

3. Update: open Node-RED editors are being exploited - CVE-2026-58115 - https://cert-portal.siemens.com/productcert/html/ssa-834709.html

4. WS_FTP fixes a 10.0 admin-credential leak - CVE-2026-84295, CVE-2026-90868 - https://cyber.gc.ca/en/alerts-advisories/progress-software-security-advisory-av26-1116

5. Barracuda fixes a flaw chain that reaches root - CVE-2026-116606, CVE-2026-111560 - https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection

6. Update: Linux TCP flaw fixed, Ubuntu still open - CVE-2026-98432 - https://access.redhat.com/security/vulnerabilities/RHSB-2026-016

7. Zyxel GS1900 switches get a command-execution fix - CVE-2026-107441, CVE-2026-76955 - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026

8. Chrome 157 ships 213 security fixes - CVE-2026-121156 - http://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html

9. Android's November patch fixes a no-tap code flaw - CVE-2026-58868 - https://source.android.com/docs/security/bulletin/2026/2026-11-01

10. Forged antd-img-crop commit planted a stealer - https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer

11. Network appliance flaws stay unpatched over a year - https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/

12. Defense firm pays $13M over cyber claims - https://www.justice.gov/opa/pr/defense-and-aerospace-contractors-ilc-dover-and-ilc-astrospace-agree-pay-13m-resolve

13. Fake job interview opened Binance's wallets - https://www.binance.com/en/blog/community/3229153443759566763

Ransomware is encrypting outdated Synology NAS boxes, attackers are running up six-figure AI bills with stolen cloud keys, and Trigger.dev customers need to rotate their secrets. Plus a Langflow login bypass, coding agents installing abandoned MCP servers, and a second wave of supermarket freezer attacks across Europe. Every version number and every fix in this episode was checked against the vendor's advisory or the CVE record before it aired. Today's question: Who in your shop finds out first when a cloud bill jumps overnight? Reply in the comments or at feedback@defensivesecurity.org.

1. Ransomware hits outdated Synology NAS boxes - CVE-2024-10441, CVE-2026-13639, CVE-2026-13684 - Fixed: 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, 7.2.1-69057-12 - Do: Update Synology DSM and close its admin page - https://www.synology.com/en-global/security/advisory/Synology_SA_24_20

2. Stolen cloud keys run up $100K-a-day AI bills - Do: Alert when someone switches on cloud AI services - https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models/

3. Trigger.dev customers' secrets exposed - Do: Rotate every secret you keep in Trigger.dev - https://trigger.dev/blog/security-incident-nov-2026

4. Langflow fixes critical login bypass and RCE - CVE-2026-93680, CVE-2026-110186 - Fixed: 1.13.0 - Do: Upgrade Langflow and turn off auto-login - https://www.ibm.com/support/pages/node/7294467

5. Coding agents install unmaintained MCP servers - Do: Keep an approved list of MCP servers - https://www.glow.io/blogs/mcphantom-ai-coding-agents-are-installing-vulnerable-deprecated-mcp-servers-from-training-data

6. Update: freezer attacks hit six more countries - Do: Take vendor-managed controllers off the internet - https://censys.com/blog/european-refrigerator-controller-redux-a-new-wave-of-refrigeration-attacks/

Every version and fix here was checked against the vendor's advisory or the researcher's write-up before it aired. Today's question: Who approves your developers' editor extensions? Reply in the comments or at feedback@defensivesecurity.org.

1. Exploited Drupal Commerce flaw skips authorization - CVE-2026-118539 - https://www.drupal.org/sa-contrib-2026-254

2. Tampered Claude Code extension hit Cursor users - https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/

3. Update: Ivanti VPN needs a second patch - CVE-2026-111357, CVE-2026-118527 - https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935

4. Fake help desk call led to AD CS takeover - https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/

5. Northflank breach: rotate every stored secret - https://www.bleepingcomputer.com/news/security/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys/

6. TeamViewer host can run code on the viewer - CVE-2026-111585, CVE-2026-92372, CVE-2026-92374 - https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1011/

7. Swapped vendor script drained Polymarket users - https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html

8. Attackers run AI pentest frameworks in intrusions - https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks/

9. LXD flaw lets a public certificate log you in - CVE-2026-112816 - https://discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in-canonical-lxd-and-microcloud/90557

10. One text message crashes Android phone service - CVE-2026-58882 - https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/

11. Email to Request Tracker can hijack the reader - CVE-2026-105454, CVE-2026-105455, CVE-2026-105456 - https://cert.pl/en/posts/2026/10/CVE-2026-105454/

12. n0n ransomware got in on stolen credentials - https://www.theregister.com/security/2026/10/30/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see/5306754

13. GCHQ can't account for thousands of drives - https://therecord.media/gchq-cannot-account-for-thousands-of-data-devices

A GitLab flaw that runs code on the server is now being exploited, a Linux kernel TCP flaw gives remote root while Ubuntu and RHEL wait on a fix, and the browsers built into five AI coding tools could run code or read a developer's files. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: What's the strangest password you've ever found while cleaning up an environment? Reply in the comments or at feedback@defensivesecurity.org.

1. Update: GitLab 10.0 flaw now exploited - CVE-2026-97229 - Fixed: 19.4.2, 19.3.5 or 19.2.8; Ruby 3.3.13, 3.4.12 or 4.0.9 - federal due 2026-11-01 - Do: Upgrade self-managed GitLab and close open sign-up - https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/

2. Linux TCP flaw gives remote root, no Ubuntu fix - CVE-2026-98432 - Do: Install the fixed Linux kernel as it ships - https://ubuntu.com/security/CVE-2026-98432

3. Update: WordPress update flaw under attack - Fixed: 7.1.4 (backports to 4.7.39) - Do: Update WordPress core and block wp-content/upgrade - https://wordpress.org/news/2026/10/wordpress-7-1-4/

4. AI coding tools' built-in browsers leak files - Do: Keep long-lived secrets off developer laptops - https://forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers-technical

5. Malware bills its AI to your OpenAI key - Do: Alert on AI API calls from unexpected hosts - https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/

6. Report: personal AI agent got admin on DoD network - Do: Give AI agents their own scoped accounts - https://cybersecuritynews.com/accenture-contractor-allegedly-gave-claude-access/

7. Fake AI crawlers hunt for .env files and keys - Do: Block web requests for .env and key files - https://www.cequence.ai/blog/ai-agent-impersonation

8. MLflow fixes six flaws, one needs no login - CVE-2026-118628, CVE-2026-118627, CVE-2026-118626 (+ 3 more) - Fixed: 3.17.0 - Do: Upgrade MLflow and turn on its login - https://www.zerodayinitiative.com/advisories/ZDI-26-844/

9. Chrome update fixes 21 flaws, one critical - CVE-2026-76024 - Fixed: 156.0.8078.79/.80 - Do: Push the Chrome update and force the restart - https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html

10. Admin password insulted hackers, then let one in - Do: Keep admin accounts off legacy servers - https://support.microsoft.com/en-us/topic/microsoft-security-advisory-update-to-improve-credentials-protection-and-management-may-13-2014-93434251-04ac-b7f3-52aa-9f951c14b649

Attackers are using PHP2Shell against Palo Alto firewall management pages, an exploited flaw crashes Cisco ASA and FTD VPNs, and Talos found an SD-WAN implant that steals network keys. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: What finally got your certificate renewals automated? Reply in the comments or at feedback@defensivesecurity.org.

1. Update: PHP2Shell hits Palo Alto management pages - CVE-2026-109618, CVE-2026-109619, CVE-2026-46300 - federal due 2026-10-31 - Do: Take PAN-OS management off the internet - https://security.paloaltonetworks.com/CVE-2026-109618

2. Exploited flaw crashes Cisco ASA and FTD VPNs - CVE-2026-76418 - Do: Patch Cisco ASA and FTD VPN firewalls - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75

3. Attackers try a new Oracle EBS flaw - CVE-2026-101767 - Do: Apply Oracle's October patch to E-Business Suite - https://www.oracle.com/security-alerts/cpuoct2026.html

4. SD-WAN implant steals the network's keys - CVE-2026-20127 - Do: Hunt SD-WAN controllers for KeyDrift - https://blog.talosintelligence.com/uat-11473-keydrift/

5. Exploited ESX flaw hides admin actions from logs - CVE-2026-41709 - Fixed: ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389 - federal due 2026-11-11 - Do: Apply VMware's July ESX updates - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017

6. WatchGuard fixes seven critical Firebox flaws - CVE-2026-93857, CVE-2026-93865, CVE-2026-93866 (+ 4 more) - Fixed: Fireware 2026.4, 12.12.4, 12.5.22 (T15/T35) - Do: Update WatchGuard Fireware - https://psirt.watchguard.com/CVE-2026-93857/

7. Firefox 159 fixes 167 security flaws - Fixed: Firefox 159; ESR 153.6, 115.44; Thunderbird 159, 153.6 - Do: Push the Firefox update - https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/

8. Entra drops SMS and voice MFA in February - Do: Move Entra users off SMS and voice codes - https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement

9. WordPress 7.1.4 fixes an update-time RCE - Fixed: 7.1.4 (backports to 4.7.39) - Do: Update WordPress core - https://wordpress.org/news/2026/10/wordpress-7-1-4/

10. Seven unpatched Ultralytics code-execution flaws - CVE-2026-118613, CVE-2026-118614, CVE-2026-118615 (+ 4 more) - Do: Load Ultralytics files only from sources you control - http://www.zerodayinitiative.com/advisories/ZDI-26-818/

11. Few teams automate nearly all TLS renewals - Do: Automate your TLS certificate renewals - https://www.helpnetsecurity.com/2026/10/29/tls-certificate-automation-report/

Attackers are exploiting the Brotli flaw behind HTTP2Shell and Magento's PolyShell, and stolen GitHub tokens are dumping private repo secrets. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: How do you find the services that quietly bundle a library like Brotli? Reply in the comments or at feedback@defensivesecurity.org.

1. Update: Brotli flaw now listed as exploited - CVE-2026-111497 - Do: Patch every service that decompresses Brotli - https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

2. Stolen GitHub tokens dump private repo secrets - Do: Search GitHub for ci-sync branches - https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles

3. Magento PolyShell flaw now listed as exploited - CVE-2026-48356 - Do: Patch Magento and audit its admin accounts - https://helpx.adobe.com/security/products/magento/apsb26-73.html

4. Apple fixes 304 flaws, backports exploited fix - CVE-2026-86950, CVE-2026-86990 - Do: Require supported OS versions on mobile devices - https://support.apple.com/en-us/149225

5. Skimmer hid in a store platform's analytics script - CVE-2026-8467 - Do: List every script your checkout page loads - https://github.com/plausible/analytics/releases/tag/v3.2.1

6. Camera management software led to malware on PCs - Do: Find camera management software on your PCs - https://www.huntress.com/blog/camera-management-software-compromise-malware

7. Veeam fixes critical flaw in Backup & Replication - CVE-2026-108142, CVE-2026-106076, CVE-2026-106078 - Do: Upgrade Veeam B&R and Backup for Microsoft 365 - https://www.veeam.com/kb4948

8. Chrome update fixes 52 flaws, four critical - CVE-2026-118306, CVE-2026-118331, CVE-2026-118344 (+ 1 more) - Do: Push the Chrome update and force the restart - http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html

9. Update: Tailscale fixes the Tailworm SSH flaws - Do: Upgrade Tailscale on servers that run Tailscale SSH - https://tailscale.com/security-bulletins

10. UEFI network boot flaw runs code before the OS - CVE-2026-97631 - Do: Turn off network boot where it's unused - https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m

11. Desktop host breach: customers told to unplug PCs - Do: Turn off drive sharing on hosted desktop sessions - https://www.bleepingcomputer.com/news/security/japans-gmo-urges-customers-to-shut-down-pcs-amid-ransomware-threat/

12. Attack agent built to run on victims' AI models - Do: Require authentication on every AI model endpoint - https://www.security.com/threat-intelligence/ai-llmjacking-skynet

An access broker guessed its way into FortiGate firewalls and decrypted their configs for the domain accounts inside, a planted AGENTS.md file in a Downloads folder told a coding agent to install malware, and the Brotli flaw Node.js patched last week turns out to live in Google's decoder. Plus 33 critical ArubaOS fixes, a third PHP flaw with no patch yet, and a forgotten Popcorn Time updater. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: Where does your team let coding agents start, and who decided? Reply in the comments or at feedback@defensivesecurity.org.

1. Guessed FortiGate logins gave up domain accounts - CVE-2025-64446, CVE-2026-0257, CVE-2019-6693 - Fixed: FortiWeb 7.0.12, 7.2.12, 7.4.10, 7.6.5 or 8.0.2 - Do: Take Fortinet admin logins off the internet - https://fortiguard.fortinet.com/psirt/FG-IR-25-910

2. AGENTS.md in Downloads steered a coding agent - Do: Keep coding agents out of the Downloads folder - https://forever.security/blog/hijacking-ai-agents-via-downloads-folder

3. Update: the Brotli flaw reaches far past Node.js - CVE-2026-111497 - Fixed: Brotli 1.0.10, 1.1.1 or 1.2.1 - Do: Patch every copy of the Brotli decoder - https://research.jfrog.com/post/brotli2shell-beyond-node2shell-and-http2shell/

4. ArubaOS fixes 33 critical flaws - CVE-2026-79844, CVE-2026-79845, CVE-2026-79846 (+ 2 more) - Fixed: 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24 - Do: Upgrade ArubaOS and restrict management access - https://cyber.gc.ca/en/alerts-advisories/hpe-security-advisory-av26-1079

5. Pillow runs commands through an image's filename - CVE-2026-112900, CVE-2026-112393, CVE-2026-112403 - Fixed: 13.0.0 - Do: Upgrade Pillow in every Python project - https://github.com/python-pillow/Pillow/security/advisories/GHSA-w889-685w-c8fh

6. Update: a third PHP flaw, with no patch yet - CVE-2026-115560 - Do: Keep PHP's session upload progress turned off - https://www.php.net/archive/2026.php#2026-10-23-1

7. Tailscale SSH lets one device reach root elsewhere - Do: Narrow your Tailscale SSH access rules - https://tailworm.com/

8. Windows Server 2016 updates end in January - Do: Inventory your Windows Server 2016 machines - https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2016

9. Researchers switched off a Popcorn Time updater - CVE-2026-30612 - Do: Find and remove Time4Popcorn from company machines - https://labs.eye.security/operation-ixim-preventing-a-botnet-of-millions-of-popcorn-time-users/