cybr.cx Daily Digest — November 05, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-119977 | WordPress Core | CVSS: N/A
CISA has added this WordPress Core TOCTOU race condition to KEV with a remediation deadline of tomorrow, November 6. During full-package core upgrade windows, unauthenticated attackers can hit predictable, web-accessible staging paths to execute arbitrary code on the server. If you manage WordPress instances and haven't patched, this is your only task today. The deadline is not a suggestion.

⚠️ Actively exploited — CVE-2026-118527 + CVE-2026-111357 | Ivanti Connect Secure | CVSS: N/A
Two Ivanti Connect Secure flaws are being chained in the wild alongside a third (CVE-2026-104935). CVE-2026-118527 allows a remote authenticated attacker to write attacker-controlled files to a known disk location by exploiting predictable identifier generation. CVE-2026-111357 then enables local privilege escalation via a missing authentication check on a critical function. Together, the chain likely allows persistent implant staging. Remediation deadline for CVE-2026-111357 has already passed — treat as urgent regardless.

⚠️ Actively exploited — CVE-2026-97229 | GitLab CE/EE | CVSS: N/A
An integer overflow in GitLab's CI/CD configuration parser allows unauthenticated remote code execution via a crafted regular expression — a worst-case entry point for supply chain attacks. With GitLab's remediation deadline already expired, any unpatched self-hosted instance should be considered compromised until verified otherwise. Pipeline poisoning at scale is the realistic threat model here.

⚠️ Actively exploited — CVE-2024-27834 | Apple iOS, iPadOS, macOS, Safari, tvOS, watchOS | CVSS: N/A
Apple's pointer authentication bypass — now confirmed actively exploited — allows an attacker with arbitrary read/write capability to circumvent a core memory safety mechanism. While the exploit chain requires prior memory access, this effectively nullifies a significant hardware-level mitigation. Update all Apple platforms now; this appears in a wider exploit kit context.

⚠️ Actively exploited — CVE-2026-76418 | Cisco Secure Firewall ASA / FTD | CVSS: N/A
An unauthenticated remote attacker can crash Cisco ASA and FTD devices via a null pointer dereference, resulting in a reload loop and sustained denial of service. Perimeter firewall availability is non-negotiable; with active exploitation confirmed, attackers may be using this to blind network defenses ahead of follow-on activity.

⚠️ Actively exploited — CVE-2026-46300 | Linux Kernel | CVSS: N/A
A missing variable initialization in socket buffer coalescing causes ESP input processing to decrypt shared page-cache fragments in place, potentially exposing or corrupting data across process boundaries. Active exploitation of a kernel cryptographic processing flaw at this level warrants immediate patching across all Linux-based infrastructure.

⚠️ Actively exploited — CVE-2026-41709 | VMware ESX | CVSS: N/A
Broadcom's VMware ESX contains an insufficient logging flaw that allows an admin-level attacker to perform operations that leave no audit trail. In practice, this is an attacker's anti-forensics gift — anyone who has already gained admin access can operate invisibly. Hypervisor environments should be treated as potentially compromised if this remains unpatched.

CVE-2026-121731 | RosarioSIS < 12.9 | CVSS: 8.8
Authenticated non-student users — including parents with portal access — can inject SQL via an unquoted period_id parameter in StudentSummary.php. Payloads don't require single quotes, enabling time-based extraction of admin password hashes and student records, or data modification via stacked statements. Schools running any version below 12.9 should patch immediately; the attack surface includes any external stakeholder with a login.

CVE-2026-120554 | WordPress "Import and Export Users and Customers" plugin ≤ 2.5.11 | CVSS: 8.8
A non-atomic write sequence in ACUI_Cron::save_settings() persists privileged session options before authorization is verified, allowing privilege escalation. Combined with the actively exploited WordPress Core TOCTOU bug above, WordPress sites face a genuinely bad 24 hours. Audit all active plugins against their current versions.

CVE-2026-57853 | DataGerry < 3.3.0 | CVSS: 8.8
Server-side template injection via unsandboxed Jinja2 rendering — authenticated attackers with template permissions can store malicious payloads that execute at render time, achieving full RCE on the server. CMDB/asset management platforms like DataGerry often sit with broad network visibility; treat this as high-priority.

CVE-2026-121617 | Linksys E5600 firmware 1.1.0.26 | CVSS: 7.5
An out-of-bounds write in the firmware upload CGI header parser is remotely exploitable, and a public exploit is already circulating. Consumer routers with no patch response from the vendor are a persistent problem; if this device is in any professional or hybrid work context, replace or isolate it.

Headline News

Revolve Data Breach Exposes 200,000 Customers' Payment Card Data
Online fashion retailer Revolve has disclosed a breach affecting at least 200,000 customers, with personal information and payment card data stolen during a September intrusion that went undetected for weeks before notification. The timeline suggests attackers had sustained access to live transaction data, raising questions about network segmentation between the retail platform and payment processing infrastructure. For practitioners, this is another reminder that e-commerce platforms — with their complex third-party integrations, seasonal traffic spikes, and sprawling CDN dependencies — remain high-value targets with inconsistent detection maturity. Card data theft of this scale typically surfaces on carding forums within 30–90 days; affected customers should be treated as high-risk for follow-on fraud regardless of issuer response.

Rusty Stealer: Rust-Based RAT with Aggressive Defense Evasion Detailed
A detailed reverse engineering analysis of "Rusty Stealer" reveals a capable Rust-based remote access trojan combining keylogging, live screen streaming, and a notably aggressive persistence mechanism that actively kills Windows Defender processes and hijacks legitimate services. The use of Rust is increasingly common in commodity malware as threat actors leverage the language's performance characteristics and the relative scarcity of mature detection signatures for Rust binaries in older EDR rule sets. The malware's service hijacking technique — replacing legitimate service executables rather than creating new ones — is specifically designed to blend into standard process lists and survive reboots without raising UAC prompts. Defenders should review EDR coverage for Rust-compiled binaries and audit service binary integrity, particularly for services running under SYSTEM context.

Debian apt Patched Against Man-in-the-Middle Attack Vector
A security update to Debian's apt package manager addresses a man-in-the-middle vulnerability that could allow an attacker with a network position between the host and its configured mirrors to intercept and manipulate package downloads. The implications are significant for any automated update pipelines, CI/CD infrastructure pulling from Debian mirrors, or cloud instances relying on apt for bootstrapping — all scenarios where TLS validation or repository signature checking may have been silently degraded. Practitioners managing Debian-based fleets should prioritise this update and verify that package signature verification (APT::Get::AllowUnauthenticated) has not been set permissively in any automation scripts. Supply chain integrity at the OS package level is foundational; a compromised apt transaction can silently undermine every security control built on top of it.

Schrödinger's Feed

IonQ has completed a $1.15 billion acquisition of zero-trust security firm Elisity, explicitly framing the deal as an integration of real-time breach containment with quantum-resistant encryption capabilities — one of the first major moves by a pure-play quantum hardware company directly into enterprise security operations. The pairing is strategically interesting: Elisity's microsegmentation and identity-based access controls address today's threat landscape, while IonQ's quantum security portfolio is positioned for the post-quantum transition that NIST finalised with its PQC standards. This signals that quantum companies are no longer willing to wait for the industry to come to them — they're buying their way into the security stack now. Practitioners evaluating zero-trust vendors over the next 12 months should expect quantum-readiness claims to become a standard part of the pitch deck, with varying degrees of substance behind them.

/dev/random

An IEEE Spectrum deep-dive this week made the case that AI coding assistants are doing something unexpectedly useful: forcing organisations to finally confront four decades of accumulated technical debt, specifically by exposing the sheer volume of PHP codebases that were quietly translating user input directly into shell commands — a pattern so old that many teams assumed it had simply died out. It hadn't. Apparently when you ask an LLM to help modernise a legacy web application, it starts finding shell_exec($_GET['cmd']) patterns that nobody had looked at since 2003, because nobody had needed to look at them, because they worked. The good news is that AI-assisted code review is surfacing vulnerabilities that manual audit economics made invisible for a generation. The bad news is that the vulnerabilities were there the whole time, and so was everyone else who was looking.