cybr.cx Daily Digest — November 03, 2026

Critical Vulnerabilities

⚠️ Actively exploited — Ivanti Connect Secure (CVE-2026-118527 + CVE-2026-111357)
Two chained vulnerabilities in Ivanti Connect Secure are being weaponised in the wild right now. CVE-2026-118527 allows a remote authenticated attacker to write files to a known disk location by exploiting predictable identifier generation. CVE-2026-111357 compounds the damage with a missing authentication check enabling local privilege escalation. Both chain with a third flaw (CVE-2026-104935) to form a full compromise path. CISA's remediation deadline for CVE-2026-111357 has already passed — if you haven't patched, assume exposure.

⚠️ Actively exploited — GitLab CE/EE (CVE-2026-97229)
An integer overflow in GitLab's CI/CD regex validation allows unauthenticated attackers to execute arbitrary code on the server by submitting a crafted .gitlab-ci.yml. No authentication required. Given how widely GitLab instances are internet-exposed, blast radius is significant. Patch immediately and audit recent pipeline activity for anomalous jobs.

⚠️ Actively exploited — Cisco Secure Firewall ASA / FTD (CVE-2026-76418)
An unchecked NULL pointer dereference in Cisco's ASA and Firepower Threat Defense software allows unauthenticated remote attackers to crash affected devices, causing denial of service. This is being actively exploited — perimeter firewall availability is on the line. Apply Cisco's advisory patches and review device logs for unexpected reload events.

⚠️ Actively exploited — Adobe Commerce / Magento (CVE-2026-48356)
Unrestricted file upload in Adobe Commerce and Magento allows arbitrary code execution in the context of the current user, with potential for privilege escalation. Active exploitation is confirmed — e-commerce platforms are high-value targets for skimmers and ransomware operators alike. Patch and immediately audit your upload directories and recently modified PHP files.

⚠️ Actively exploited — Google Brotli (CVE-2026-111497)
A missed return value check in the Brotli decompression library allows a remote unauthenticated attacker to corrupt adjacent decoder state memory via a crafted compressed stream — enabling memory disclosure, DoS, or potentially code execution. Brotli is embedded in browsers, CDNs, and countless server stacks, so the attack surface is enormous. Update any dependency that bundles Brotli and review your supply chain exposure.

⚠️ Actively exploited — PHP (CVE-2026-109618 / CVE-2026-109619)
Two distinct actively exploited PHP flaws: an out-of-memory corruption bug and a stale internal request-state vulnerability, both enabling unauthenticated remote code execution. CISA's remediation deadlines have already passed. Any PHP-based web application — which is most of the internet — is potentially in scope. Upgrade PHP runtimes immediately.

⚠️ Actively exploited — Linux Kernel (CVE-2026-46300)
A missing variable initialisation in socket buffer coalescing causes ESP input processing to decrypt shared page-cache fragments in place, potentially exposing or corrupting data across process boundaries. Actively exploited against Linux-based infrastructure. Apply the relevant kernel patch and prioritise any internet-facing Linux hosts running IPsec.

⚠️ Actively exploited — VMware ESX (CVE-2026-41709)
An insufficient logging vulnerability in Broadcom VMware ESX allows admin-level attackers to perform privileged operations that leave no audit trail. This is being exploited in active campaigns — likely as a post-compromise anti-forensics step. Check your hypervisor audit logs for gaps and ensure ESX management interfaces are network-restricted.

Control Web Panel — Multiple Critical Flaws (CVE-2026-104080, CVE-2026-77878, CVE-2026-77880, CVE-2026-73695, CVE-2026-73697)
CWP, a widely used Linux hosting control panel, has a cluster of critical unpatched vulnerabilities spanning versions before 1.16 and 1.30. The most severe (CVE-2026-104080, CVSS 8.4) is an unauthenticated OS command injection via the /valid_token/ loopback API route — shell metacharacters in the user parameter execute as root. CVE-2026-77880 and CVE-2026-77878 add two more root RCE paths via the password change and database restore routes. CVE-2026-73697 adds arbitrary file write and command injection via the PHP INI editor. CVE-2026-73695 allows local file inclusion via unsanitised module path traversal. Upgrade to CWP webpanel 1.30 or later immediately — shared hosting providers are at particular risk.

Network-AI Path Traversal (CVE-2026-120311, CVSS 8.8)
Versions 5.13.4–5.15.4 of Network-AI allow attackers to read or delete arbitrary .json files by injecting traversal sequences into job IDs passed to FileJobStore methods. Credential files and auth tokens are directly in scope. Upgrade to 5.15.5.

LobeHub Chat Arbitrary File Write (CVE-2026-120315, CVSS 8.8)
Authenticated users of LobeHub Chat before 2.1.49 can write arbitrary files by supplying traversal sequences to writeTempFile(). By creating a file record with a crafted name and triggering document parsing, attackers can overwrite application files like startServer.js to achieve code execution. Upgrade immediately.

Headline News

North Korea's Biggest Payday: $6.3 Billion Binance Heist Attributed to TraderTraitor

The FBI has formally attributed the largest cryptocurrency theft in history to TraderTraitor, a North Korean state-sponsored threat group operating under the Lazarus umbrella. The attack resulted in $6.3 billion stolen from Binance, eclipsing previous records and underscoring the DPRK's systematic use of crypto heists to fund its weapons programmes. TraderTraitor's playbook is well-documented — social engineering targeting developers and administrators, followed by malicious package delivery or credential theft to gain foothold in high-value financial infrastructure. For practitioners, the takeaway is that even tier-one exchanges with mature security programmes remain vulnerable to patient, well-resourced adversaries who invest heavily in pre-attack reconnaissance. Organisations handling significant crypto assets should treat their developer workforce as a primary attack surface and re-examine third-party dependency controls.

VOLTA Infostealer Uses Claude to Rank Stolen Assets Before Self-Destructing

Cisco Talos has documented a novel Windows infostealer dubbed VOLTA that exfiltrates victim data and then passes it to Anthropic's Claude Opus 4.6 API to automatically rank the victim's assets by monetisation value before deleting itself from the host. The malware is designed with model-agnostic fallback logic — if one AI provider refuses to process the data, VOLTA switches to an alternative model or skips the AI triage step entirely and proceeds with raw output. This represents a meaningful shift in attacker economics: rather than requiring a human analyst to sift through stolen data, the AI layer dramatically accelerates the prioritisation of high-value targets for follow-on attacks. From a detection standpoint, the self-deletion behaviour means endpoint forensics will often find no payload, and the AI API calls may blend into legitimate outbound HTTPS traffic. Defenders should review egress monitoring for unexpected API calls to LLM endpoints and treat any anomalous outbound traffic to AI provider infrastructure with heightened suspicion.

Cyber-Attack Hits Supermarket Freezer Systems Across Europe — Second Incident in the Series

A suspected cyber-attack disrupted refrigeration control systems in supermarkets across Belgium and Sweden, marking the second such incident targeting cold-chain infrastructure in the region. The attacks caused freezer units to malfunction, raising immediate food safety concerns and resulting in significant product losses. While attribution has not been publicly confirmed, the pattern of targeting operational technology in the food supply chain is consistent with campaigns designed to cause economic disruption and erode public confidence in critical infrastructure. For OT and ICS security practitioners, the incidents reinforce that retail and food logistics environments — often running legacy SCADA systems with minimal network segmentation — represent a growing and underappreciated attack surface. Incident responders should be aware that OT environments in this sector frequently lack the telemetry needed for rapid detection and containment.

Schrödinger's Feed

Researchers at the University of Stuttgart, in collaboration with Saarland University and Leibniz IFW Dresden, have deployed a live entanglement-based quantum key distribution link over campus fibre using a quantum dot photon source — generating 14.2 Mbit of secure key material over a 1.59 km link. Unlike theoretical demonstrations, this is real-world QKD operating on existing fibre infrastructure, which matters enormously for practical deployment viability. The use of frequency conversion to make quantum dot emission compatible with telecom fibre is a significant technical hurdle that this work appears to have cleared. Practitioners planning long-term cryptographic infrastructure strategy should watch QKD deployment timelines closely — the gap between lab curiosity and operational network tool is narrowing faster than most roadmaps assumed.

/dev/random

A coordinated hack hit digital billboards across multiple countries simultaneously, replacing standard advertising content with pornography — and when questioned, the attackers reportedly described the intrusion as trivially easy, suggesting the display management systems were either internet-exposed with default credentials or running unpatched software with public exploits. The attackers' candid commentary that "anyone with two brain cells" could have done it is, frankly, the most damning part of the incident — less a sophisticated attack than a public audit of just how poorly secured out-of-home advertising infrastructure tends to be. It's a useful reminder that the attack surface isn't just servers and endpoints: any networked device driving a public display, HVAC unit, or vending machine is fair game for someone who's bored and has a Shodan subscription. The billboards have since been restored to their usual content, which depending on your views on advertising may or may not represent an improvement.