Cybersecurity briefing, 2026-11-05

Here's the uncomfortable part of the Binance story.

• APT29's Plerdy tracker compromise reached hundreds of sites
• WordPress upgrade window opens a path to server code
• Supplier attack altered blood-service cold rooms at three sites
• PHP2Shell chain now reaches root on firewalls
• Proxy traffic puts Executive Office IP attribution in doubt
• Zyxel GS1900 Patch 2 missed the exploited flaw
• Storm-2603's SharePoint foothold hid in IIS memory
• SlippyNunchucks uses Sogou to deliver DarkVigil
• Drupal Commerce Core authorization flaw is actively exploited
• cPGuard update hijack left Linux server credentials exposed
• Cursor auto-updates could spread a trojanized Claude Code extension
• Rails upload flaw can expose secrets beyond the server
• Gorbag shifts to WinRAR archives for quick credential theft
• Fortinet exploit adds 13 payloads for account creation and persistence
• HPE Fabric Composer flaws expose admin access and code execution
• 3AM ransomware crossed school domains with AI-like command work
• VAPOR PANDA coordinated parallel intrusions across 14 countries
• Dameware update covers flaws beyond its own code
• OpenSSH fixes musl flaw exposing passwordless accounts
• Barracuda flaws make reachable admin interfaces a root path

Recent editions

• Wednesday, November 4, 2026: Gorbag shifts to WinRAR archives for quick credential theft · 19 stories
• Tuesday, November 3, 2026: Node-RED attacks add persistent command backdoors · 18 stories
• Monday, November 2, 2026: Ivanti's second patch closes the chain, not prior exposure · 20 stories
• Sunday, November 1, 2026: DebugBear snippet let attackers trade through Polymarket sessions · 6 stories
• Saturday, October 31, 2026: PAN-OS PHP2Shell chain stole Active Directory credentials · 16 stories
• Friday, October 30, 2026: Cisco VPN flaw reboots firewalls as Volt Typhoon targets control planes · 19 stories
• Thursday, October 29, 2026: DHS leak maps undercover work and application access · 18 stories