Cybersecurity briefing, 2026-11-06

Nearly a thousand network switches were running the patched firmware, and attackers got in anyway, because the fix checked too late.

• APT29's Plerdy tracker compromise reached hundreds of sites
• Zyxel GS1900 Patch 2 missed the exploited flaw
• Fortinet exploit adds 13 payloads for account creation and persistence
• Storm-2603's SharePoint foothold hid in IIS memory
• Proxy traffic puts Executive Office IP attribution in doubt
• Supplier attack altered blood-service cold rooms at three sites
• ChatGPT previews opened a route to data theft and phishing
• Drupal Commerce Core authorization flaw is actively exploited
• VAPOR PANDA coordinated parallel intrusions across 14 countries
• Binance breach widens beyond a laptop entry
• OpenSSH fixes musl flaw exposing passwordless accounts
• GhostMap can crash Pixel 10 before an app runs

Recent editions

• Thursday, November 5, 2026: WordPress upgrade window opens a path to server code · 20 stories
• Wednesday, November 4, 2026: Gorbag shifts to WinRAR archives for quick credential theft · 19 stories
• Tuesday, November 3, 2026: Node-RED attacks add persistent command backdoors · 18 stories
• Monday, November 2, 2026: Ivanti's second patch closes the chain, not prior exposure · 20 stories
• Sunday, November 1, 2026: DebugBear snippet let attackers trade through Polymarket sessions · 6 stories
• Saturday, October 31, 2026: PAN-OS PHP2Shell chain stole Active Directory credentials · 16 stories
• Friday, October 30, 2026: Cisco VPN flaw reboots firewalls as Volt Typhoon targets control planes · 19 stories