cybr.cx Daily Digest — November 8, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-19868 | SonicWall SonicOS SSLVPN | CVSS: N/A (KEV listed)
SonicWall's SonicOS SSLVPN contains an authentication bypass flaw that allows an attacker holding valid credentials for an alternate auth method to sidestep SAML controls entirely — including SAML-enforced MFA. CISA added this to the Known Exploited Vulnerabilities catalogue on November 6 with a remediation deadline of November 20. If you're running SonicWall SSLVPN in a SAML/MFA configuration, treat this as a fire drill: patch or restrict access now.

⚠️ Actively exploited — CVE-2026-119977 | WordPress Core | CVSS: N/A (KEV listed)
A TOCTOU race condition in WordPress Core's upgrade mechanism lets unauthenticated attackers drop and execute code during the brief window when a full-package update is staged in a predictable, web-accessible path. Active exploitation is confirmed; CISA's remediation deadline has already passed (November 6). If you manage WordPress instances — especially on shared or internet-facing hosts — verify your core version and audit recent upgrade logs for anomalous file writes.

⚠️ Actively exploited — CVE-2024-27834 | Apple iOS, iPadOS, macOS, Safari, tvOS, watchOS | CVSS: N/A (KEV listed)
An improper authentication flaw in Apple's pointer authentication implementation allows an attacker with arbitrary read/write memory access to bypass PAC protections — a meaningful step toward reliable code execution on hardened Apple platforms. This one resurfaced in the KEV catalogue on November 4, suggesting fresh exploitation activity. Ensure all Apple devices in your fleet are on the latest OS releases; this is especially critical for unmanaged BYOD endpoints.

CVE-2026-17280 | IBM API Connect 10.0.8.0–10.0.8.12, 12.1.0.0–12.1.1.2 | CVSS: 8.9
No authentication required: an attacker can brute-force valid credentials against IBM API Connect due to missing rate-limiting on authentication endpoints. The 8.9 score reflects the low attack complexity and wide exposure surface of API management platforms. Apply IBM's fix and enforce account lockout policies or WAF-level rate limiting immediately.

CVE-2026-17335 | IBM API Connect 12.1.0.0–12.1.1.2 | CVSS: 8.8
Authenticated remote code execution via path traversal in uploaded content — file paths aren't validated, so a malicious upload can write files outside the intended directory and trigger execution. Combined with the brute-force issue above, an attacker could chain unauthenticated credential access into full RCE. This is an IBM API Connect cluster fire: patch across the board.

CVE-2026-50240 | OpenShift Pipelines-as-Code | CVSS: 8.8
A namespace-scoped user with only Repository and Secret create/delete permissions can craft a Repository custom resource that causes Pipelines-as-Code to execute attacker-controlled PipelineRuns under the auto-provisioned ServiceAccount — which carries ClusterRole/edit by default. The privilege escalation path from namespace-limited user to cluster-wide editor is clean and reliable. Audit PAC RBAC configurations and restrict who can create Repository objects in multi-tenant clusters.

CVE-2026-17405 | IBM API Connect 10.0.8.0–10.0.8.12, 12.1.0.0–12.1.1.2 | CVSS: 8.8
Broken object-level authorization on keystore objects means any authenticated user can read keystores they don't own. In an API management context, that's private keys and certificates belonging to other tenants or system accounts — a significant lateral movement enabler.

CVE-2026-87112 | QA Assistants WordPress Plugin ≤5.3.0 | CVSS: 8.8
PHP Object Injection via the dlevent_ver parameter, compounded by a serialization helper that fails to strip path traversal sequences. Unrestricted unserialize() calls without an allowed_classes restriction make this a reliable gadget-chain hunting ground. Remove or update the plugin; WordPress exploitation is hot right now (see KEV above).

Headline News

GPT-6 Cyber: AI-driven vulnerability research crosses a new threshold
OpenAI's GPT-6 Cyber model, deployed as part of an automated security research pipeline, has identified 1,724 security flaws in the Linux kernel — exploiting 948 of them to achieve administrator-level access in testing, including at least 10 previously undisclosed techniques. The system also independently found 81 high-severity vulnerabilities in Firefox. What makes this significant for practitioners is the scale and autonomy: this isn't AI assisting a researcher, it's AI conducting a complete exploit-development cycle from discovery to working proof-of-concept. The capability gap between well-resourced offensive AI and typical defensive tooling is widening rapidly. Expect this to accelerate pressure on kernel and browser maintainers and to reshape assumptions about how quickly zero-days can be industrialised.

Binance suffers $6.3 billion theft attributed to North Korean actors
The record-breaking $6.3 billion theft from Binance has drawn characterisation from blockchain intelligence analysts as an act of "cyber war" rather than conventional financial crime, given the scale, sophistication, and attribution pointing toward North Korean state-linked threat actors. TRM Labs analysts publicly called on governments to shift from a reactive tracking posture to active offensive operations against DPRK hacking infrastructure. For security teams at crypto exchanges and custodians, this incident underscores that nation-state adversaries are targeting DeFi and centralised exchange infrastructure with the same rigour they bring to espionage operations. Transaction monitoring, multi-party key management, and withdrawal anomaly detection all warrant immediate review against this threat model.

Gnosis Pay breach exposes card and wallet data
Gnosis Pay, the crypto debit card platform, disclosed a breach that exposed customer names, physical addresses, payment card details, and linked crypto wallet information. While the company stated that funds were not directly affected, the combination of card credentials and wallet addresses creates a potent phishing and social engineering surface for follow-on attacks. For practitioners, this is a reminder that hybrid crypto-fiat products carry a combined threat surface: traditional PCI-scope card data exposure and blockchain-linked identity data in the same breach. Customers holding Gnosis Pay accounts should rotate card credentials and be alert to targeted phishing using the exposed personal data.

Schrödinger's Feed

The UK's Financial Conduct Authority is standing up a Quantum Experimentation Group in Q1 2027, bringing together financial institutions, quantum hardware vendors, and research labs to test whether quantum machine learning can meaningfully improve financial crime detection. It's an interesting inversion of the usual quantum-security conversation: rather than quantum threatening existing cryptography, here regulators are exploring quantum as a tool for detecting adversarial financial behaviour. The practical results are likely years away from production deployment, but the FCA formalising this experimentation signals that quantum capability is being treated as a near-term policy consideration, not a distant research curiosity. Practitioners in financial sector security should track this — the same QML pipelines designed to catch money laundering could eventually be pointed at other anomaly detection problems, including network intrusion and insider threat.

/dev/random

Microsoft Research quietly shuttered its AI Frontiers group this week, the team responsible for some of the company's most ambitious long-horizon research. The closure follows a broader pattern of large tech labs pruning blue-sky research divisions in favour of product-adjacent work — which is fine until you realise that "blue-sky research" is historically where the security community's best weird ideas come from. It's the kind of organisational decision that looks rational in a spreadsheet and only hurts four years later when nobody has a good answer to whatever the next novel attack class turns out to be. Peer institutions and independent labs, your moment to poach talent and pick up abandoned threads is now.