cybr.cx Daily Digest — November 06, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-119977 | WordPress Core | CVSS 9.8 (est.)
A TOCTOU race condition in WordPress Core's upgrade process allows unauthenticated attackers to execute code on the server by racing the predictable, web-accessible staging paths used during full-package core upgrades. CISA's remediation deadline was today — if you haven't patched or applied mitigations, treat this as on fire right now. Any internet-facing WordPress installation that auto-updates is a potential target during the upgrade window.

⚠️ Actively exploited — CVE-2026-118527 & CVE-2026-111357 | Ivanti Connect Secure | CVSS varies
Two Ivanti Connect Secure flaws being actively exploited in a documented chain alongside CVE-2026-104935. CVE-2026-118527 lets a remote authenticated attacker write attacker-controlled files to a known disk location via predictable identifier generation; CVE-2026-111357 then allows local privilege escalation through a missing authentication check. Chained together, these provide a reliable path from authenticated remote access to full compromise — Ivanti VPN infrastructure remains a high-priority target for nation-state actors.

⚠️ Actively exploited — CVE-2026-97229 | GitLab CE/EE | CVSS: Critical
An integer overflow in GitLab's CI/CD configuration parser allows unauthenticated remote code execution via a specially crafted regex. With GitLab instances frequently holding source code, secrets, and pipeline credentials, exploitation here can cascade across entire software supply chains. Patch immediately; unauthenticated exposure means no prior foothold is required.

⚠️ Actively exploited — CVE-2026-76418 | Cisco Secure Firewall ASA / FTD | CVSS varies
An unchecked return value leading to a NULL pointer dereference allows unauthenticated remote attackers to crash Cisco ASA and FTD devices, causing a denial of service. This is being actively exploited — firewall DoS is not just annoying, it's a classic precursor to network pivoting once security controls go dark.

⚠️ Actively exploited — CVE-2024-27834 | Apple iOS, iPadOS, macOS, Safari, tvOS, watchOS | CVSS varies
An improper authentication flaw in Apple's pointer authentication implementation allows an attacker with arbitrary read/write capability to bypass PAC protections entirely. While exploitation requires some prior access, this is the kind of primitive that gets chained into full device compromise — flag for mobile device management teams and anyone running unpatched Apple fleets.

CVE-2026-11376 & CVE-2026-13292 | IBM MQ | CVSS 8.8
Two separate high-severity flaws in IBM MQ affect all major LTS and CD release trains. CVE-2026-11376 is an integer overflow in subscription request processing that could lead to DoS or arbitrary code execution. CVE-2026-13292 allows authenticated attackers to execute arbitrary code by injecting malicious environment variables through transfer request metadata. IBM MQ is common middleware in financial and enterprise environments — both issues require authentication but should be patched urgently.

CVE-2026-122134 & CVE-2026-122135 | Mistral Vibe | CVSS 8.8
Two RCE vulnerabilities in the Mistral Vibe AI coding environment allow a malicious repository to execute arbitrary commands before any trust prompt is shown. CVE-2026-122134 abuses Git clean/process filter drivers; CVE-2026-122135 hijacks gpg.program during project context collection. Opening a crafted repo is sufficient — a timely reminder that AI-assisted dev tools expand the attack surface for supply chain and social engineering attacks targeting developers.

CVE-2026-97175 | Keycloak | CVSS 8.8
The idp-auto-link authenticator in Keycloak automatically links external identity provider accounts to local accounts based on email address without verifying that the external provider has actually validated that email. An attacker who controls an email address at a trusted IdP — or can register one — may be able to silently take over existing local accounts. Review your Keycloak federation configurations and disable auto-linking where not strictly necessary.

CVE-2026-118193 | GiveWP WordPress Plugin (≤ 4.19.1) | CVSS 8.8
The GiveWP donation plugin fails to properly enforce role restrictions via donor_default_user_role, performing only a narrow literal string check against 'administrator' while missing equivalent privileged roles. An authenticated attacker can escalate privileges to near-admin levels. With GiveWP installed on hundreds of thousands of sites, this is a meaningful attack surface.

CVE-2026-54372 | VitaFit Android App (< 2.8.1.0) | CVSS 8.8
The VitaFit fitness app ships a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname, making HTTPS traffic trivially interceptable on any network. Attackers can capture account sessions via MITM. Update the app; avoid using it on untrusted networks in the interim.

CVE-2026-122299 | Dulwich (< 1.2.20) / Poetry 2.5.1 | CVSS 8.8
A commit parsing flaw in Dulwich resolves duplicate tree headers to the last occurrence rather than the first, diverging from core Git's behaviour. Poetry 2.5.1 ships the vulnerable Dulwich version and uses it by default for Git dependency installation. An attacker who can craft a malicious commit in a dependency chain may be able to serve different code than what's reviewed — a subtle but potent supply chain risk.

Headline News

Binance Suffers $6.3 Billion Heist in Twenty-Minute Blitz

The largest crypto exchange theft on record unfolded last week when Binance lost approximately $6.3–6.4 billion in what appears to have been a meticulously pre-planned operation executed in roughly twenty minutes. Binance's post-incident assessment indicates the attackers spent months in reconnaissance and staging phases before triggering the actual exfiltration, suggesting a sophisticated threat actor with deep familiarity with Binance's internal architecture and transaction flow controls. The speed of execution points to automated tooling and pre-positioned access — not opportunistic exploitation. For practitioners, this underscores a persistent truth about high-value targets: the breach itself is often the last act of a very long play, and detection value lives in the pre-attack dwell period, not the final event.

Zyxel Zero-Day Compromises Nearly 1,000 Network Switches

A zero-day vulnerability in Zyxel's GS1900-series managed switches was exploited in the wild to compromise close to 1,000 devices globally before a patch was available, with attackers exfiltrating switch configuration files and stored credentials. Network switches are frequently overlooked in vulnerability management programmes — they sit at the edge of visibility, often run outdated firmware, and may expose administrative interfaces to untrusted networks. The stolen configuration data is particularly damaging: it typically contains VLAN topology, SNMP community strings, and administrative credentials that enable lateral movement deeper into network infrastructure. If you have GS1900 switches in your environment, patch now, rotate all credentials, and audit whether management interfaces are appropriately restricted.

OpenSSH Password Authentication Bypass Hits Alpine Linux

A critical vulnerability in the OpenSSH server package as shipped by Alpine Linux allows attackers to bypass password authentication entirely under certain configurations, prompting an emergency security advisory and the rapid release of OpenSSH 10.6p2 as a workaround. Alpine Linux is the base image of choice for a significant proportion of containerised workloads globally — Docker Hub alone hosts tens of thousands of Alpine-based images, many of which expose SSH for administrative access. The specific mechanism involves the way Alpine's musl libc interacts with OpenSSH's PAM and authentication stack, diverging from behaviour on glibc-based systems. Practitioners running Alpine containers or VMs with SSH exposed should treat this as urgent: apply the 10.6p2 workaround, audit exposed SSH services, and consider whether password authentication should be disabled entirely in favour of key-based auth.

Schrödinger's Feed

IBM Quantum and QuICS researchers have used AI agents paired with deterministic solvers to discover over 500 new "magic-state factories" — the specialised circuits required to produce the non-Clifford quantum states that fault-tolerant quantum computing depends on. The significance here is resource efficiency: magic-state distillation has long been one of the most expensive overheads in fault-tolerant architectures, and finding hundreds of lower-cost alternatives meaningfully accelerates the timeline to cryptographically relevant quantum machines. For security practitioners, this is the kind of under-the-radar algorithmic advance that quietly shortens the runway for Shor's algorithm to become a practical threat to RSA and ECC at scale. If your organisation's post-quantum migration planning still lives in a future-tense document, advances like this are a good reason to make it present tense.

/dev/random

Alpine Linux's OpenSSH advisory revealed something delightfully uncomfortable: the same stripped-down, security-conscious base image beloved by container minimalists for reducing attack surface was quietly allowing password authentication to be bypassed — because musl libc, Alpine's lean alternative to glibc, handles certain authentication calls differently enough that OpenSSH's assumptions break in precisely the wrong way. The fix, OpenSSH 10.6p2, is officially described as a "workaround," which in CVE parlance is the engineering equivalent of duct tape over a smoke alarm. The irony of Alpine — chosen specifically because less code means less risk — shipping a critical auth bypass in one of its most security-sensitive packages is the kind of thing that keeps threat modellers up at night. Minimalism, it turns out, only helps if everything that remains behaves exactly as documented.