cybr.cx Daily Digest — November 01, 2026

Critical Vulnerabilities

⚠️ Actively exploited — Ivanti Connect Secure (CVE-2026-118527 + CVE-2026-111357)
These two CVEs are being chained in the wild right now, with a patch deadline of November 13 and November 2 respectively — the latter is already overdue. CVE-2026-118527 allows a remote authenticated attacker to upload attacker-controlled files to a known disk location by exploiting predictable identifier generation; CVE-2026-111357 then provides a missing-authentication privilege escalation path locally. Combined with a third bug (CVE-2026-104935), this forms a full exploitation chain. If you're running Ivanti Connect Secure and haven't patched, treat this as a five-alarm fire.

⚠️ Actively exploited — GitLab CE/EE (CVE-2026-97229)
An integer overflow in GitLab's CI/CD regex validation engine allows an unauthenticated attacker to execute arbitrary code on the GitLab server by embedding a specially crafted regular expression in a pipeline configuration file. The CISA remediation deadline has already passed (November 1). Any public-facing GitLab instance should be considered compromised until patched and audited.

⚠️ Actively exploited — Cisco Secure Firewall ASA / FTD (CVE-2026-76418)
An unchecked NULL pointer dereference allows unauthenticated remote attackers to crash affected Cisco ASA and FTD devices, causing a denial-of-service condition. With exploitation confirmed in the wild, perimeter security devices going dark is a worst-case scenario — patch or mitigate access to management interfaces immediately.

⚠️ Actively exploited — Google Brotli (CVE-2026-111497)
A missing return-value check in the Brotli decompression library allows a remote unauthenticated attacker to corrupt adjacent decoder state memory via a crafted compressed stream — with potential for memory disclosure, DoS, or code execution. Brotli is embedded in an enormous number of HTTP stacks, CDNs, and runtimes, making the attack surface extremely wide.

⚠️ Actively exploited — Linux Kernel (CVE-2026-46300)
A missing variable initialisation in socket buffer coalescing causes ESP input processing to decrypt shared page-cache fragments in-place, potentially allowing unintended data modification across process boundaries. The CISA deadline was October 31 — yesterday. Prioritise kernel updates on any Linux systems handling IPsec traffic.

⚠️ Actively exploited — Adobe Commerce / Magento (CVE-2026-48356)
Unrestricted file upload in Adobe Commerce and Magento allows arbitrary code execution in the context of the current user. E-commerce platforms running unpatched Magento instances should audit upload endpoints and review server logs for indicators of webshell activity now.

⚠️ Actively exploited — PHP (CVE-2026-109618 / CVE-2026-109619)
Two separate PHP RCE vulnerabilities — an out-of-memory corruption and a stale internal request-state flaw — both allow unauthenticated remote code execution. Both CISA deadlines have passed. PHP underpins a staggering portion of the web; check your version and patch immediately.

WordPress Core RCE (CVE-2026-119977) — CVSS 8.1
WordPress versions 4.7 through 7.1.3 expose predictable, web-accessible staging paths during full-package core upgrades, allowing unauthenticated attackers to execute code on the server during that upgrade window. The attack surface is time-limited but trivially exploitable. Ensure upgrade processes are protected and completed quickly, and verify web server configuration blocks access to staging directories.

NextGEN Gallery WordPress Plugin RCE (CVE-2026-76010) — CVSS 8.8
The popular NextGEN Gallery plugin (up to version 4.4.1) is vulnerable to remote code execution via unrestricted mass assignment of caller-supplied metadata keys, bypassed path containment in image rendering, and a weak signature check. Any WordPress site using this plugin should update or disable it immediately.

ShowDoc Code Injection (CVE-2026-120203) — CVSS 8.8
ShowDoc versions before 3.9.6 allow authenticated users to inject shell commands through Mock feature templates using escaped parentheses evaluated by eval(). Critically, the official Docker image runs as root, meaning successful exploitation yields full container compromise. Update or restrict access to authenticated users only.

Headline News

Supply Chain Attack Targets Anthropic Claude Developer Extensions

A supply chain attack successfully trojanised Claude AI extensions and distributed them to approximately 5,000 developer machines before being caught. The malicious extensions were designed with worm-like propagation capabilities, though a coding flaw in the payload inadvertently prevented full execution on a significant portion of affected hosts — a lucky break that limited the damage. Developer tooling and IDE extensions remain a high-value supply chain target because they run with elevated trust in environments that typically contain source code, credentials, and cloud access tokens. Security teams should audit installed AI assistant extensions across developer fleets, verify package provenance, and treat any extension update from the past several weeks as potentially suspect until investigated.

Northflank and Scribd Report Security Breaches

Two platforms disclosed breaches in close succession: Northflank, a developer infrastructure and deployment platform, confirmed unauthorised access via its status page, while Scribd, the document-sharing and audiobook service, also reported a breach. For practitioners, Northflank's exposure is particularly notable given that deployment platforms typically hold environment variables, secrets, and cloud provider credentials — the blast radius of a compromised CI/CD hosting provider can extend well beyond the platform itself into customer infrastructure. Scribd's exposure likely affects user account data and potentially payment information for its subscriber base. Teams using Northflank should immediately rotate all secrets, API keys, and cloud credentials stored within the platform and review recent deployment activity for anomalies.

LLM-Powered Infostealer Prioritises Victims by Financial Value

A newly documented infostealer family dubbed Volta has been found using an embedded large language model to automatically score and rank exfiltrated victim data by estimated financial worth before reporting back to its operators. Rather than dumping everything indiscriminately, Volta uses the LLM to analyse harvested credentials, banking data, and account details to prioritise high-value targets for manual follow-up — a significant step toward automated, scalable victim triage. This represents a meaningful evolution in infostealer sophistication: attackers no longer need to manually sort through stolen data dumps, reducing their operational overhead and increasing the speed at which high-value victims face follow-on attacks. Defenders should expect this capability to proliferate rapidly across the threat actor ecosystem.

Schrödinger's Feed

Physicists at Chalmers University of Technology have demonstrated a method to suppress microwave crosstalk in superconducting quantum processors at the hardware level, using engineered on-chip parasitic capacitances to produce destructive interference among parasitic channels. Crosstalk is one of the primary sources of gate error in superconducting systems and a key obstacle to scaling toward the qubit counts needed to run cryptographically relevant algorithms — including Shor's algorithm against RSA and elliptic curve keys. Better crosstalk suppression means more reliable, higher-qubit processors arriving sooner than current roadmaps might suggest. Practitioners planning long-horizon cryptographic migration timelines should factor in that hardware progress is consistently outpacing expectations — PQC migration is not a 2030 problem.

/dev/random

Andrej Karpathy built HackerTube — a YouTube front-end that surfaces only videos that have been linked and upvoted on Hacker News — on the theory that the collective curation of a technically literate community is a better recommendation algorithm than an engagement-maximising neural network optimised to keep you watching forever. The result is essentially YouTube with the junk food removed: lectures, demos, and technical deep-dives instead of outrage and thumbnails with open mouths. It's a quietly elegant inversion: using human social signals to constrain an algorithmic platform rather than the other way around. Threat model: you will still lose an afternoon to it, just to more edifying content.