> infrastructure security
for people who build things
Tracking vulnerabilities, supply chain attacks, and threat intelligence that matters to engineers running real infrastructure.
Red Hat Quay CVE-2026-123710 + CVE-2026-110697: Signing-Key Takeover and Cross-Tenant Robot Token Theft
Two critical Quay flaws let attackers plant a trusted signing key and mint tokens for any repository, or steal other tenants' robot credentials. Upgrade and audit service keys now.
Your RMM Is a Domain Controller With a Web Server: A Field Guide to Locking Down the MSP Control Plane
N-central went offline worldwide, SCKit pushed rogue ScreenConnect clients to nearly 500 hosts, and SimpleHelp and BeyondTrust took their turns. This is a hardening and hunting guide for the remote-management layer, written for the people who have to run it.
Qubole's Trusted AWS Account Turned Against Its Customers: Dormant Cross-Account Roles Used to Loot Secrets and S3
From October 14 to 26, an attacker holding two compromised Qubole IAM users assumed customer cross-account roles, many dormant since spring, and pulled Secrets Manager, SSM, Lambda env vars and S3 data. Expedia has since confirmed a breach through an unnamed data-platform vendor.
Cursor Traces Backdoored Claude Code Extension to a Leaked Fireworks AI Key
Cursor's incident update says a key it issued to inference provider Fireworks AI exposed agent traces with credentials, which let an attacker plant trojanized Claude Code 2.1.312/2.1.313 builds with an SSH reverse-tunnel backdoor in Cursor's extension marketplace.
SCKit: Blank RMM+ Access Key Lets Attackers Push Rogue ScreenConnect Clients to Nearly 500 MSP-Managed Hosts
A third-party ScreenConnect extension, RMM+ 1.0.31-1.0.32, accepted an empty access key. Attackers used it to run SCKit through Run Command on 288 hosts in 90 minutes, then hit 205 more on November 13 from new infrastructure.
Check Point Gaia CVE-2026-123039: DynamicCLI Root Zero-Day Chained With PHP2Shell to Backdoor Gateways and Wipe ESXi
Attackers used PHP2Shell against Check Point Mobile Access portals, then an unauthenticated root socket in Gaia's DynamicCLI daemon (CVE-2026-123039), to backdoor gateways and wipe VMware ESXi hosts. Install the November Jumbo Hotfix and hunt for compromise.
Barracuda ESG CVE-2026-116606 + CVE-2026-111560: Pre-Auth Root Chain Now Exploited, CISA KEV Deadline Today
Barracuda confirms exploitation of an ESG authorization bypass chained with a root command injection; CISA added both to KEV with a November 13 federal deadline.
N-able N-central Under Siege: 4EverAble2Shell and Agent2Shell Bypass Hotfix 2 Days After the Able2Shell Zero-Day Dump
A researcher's Able2Shell dump of 33 alleged N-central zero-days forced N-able to take its hosted RMM cloud offline; new 4EverAble2Shell (root RCE) and Agent2Shell (SYSTEM on managed Windows endpoints) chains reportedly defeat the November 10 Hotfix 2.
wfx-loot: 4,800 Hijacked GitHub Accounts Push a CI Secret Stealer That Deletes Its Own Workflow Runs
A campaign that started November 10 used thousands of compromised GitHub accounts to inject a GitHub Actions secret stealer into tens of thousands of repos. It reverts its commit and deletes the run log within about a minute, so the main trace left is a gap in run numbers.
Cisco BroadWorks CVE-2026-20320 XXE Added to KEV After Jailbroken AI Agent Used It to Breach a European Telco
CISA lists Cisco BroadWorks CVE-2026-20320, a blind XXE in the OCI XML parser, as exploited after Malbear Labs tied it to an autonomous AI-driven intrusion at a European telecom provider.
Xen Orchestra VSA-2026-062: Empty-Object Cookie Auth Bypass Exploited to Take Over XCP-ng Pools
Vates warns that a critical Xen Orchestra auth bypass, triggered by a single crafted cookie, is being exploited to gain admin access and root on managed XCP-ng hosts.
Checked Is Not Used: Four Bugs in Two Weeks Where the Verified Thing Wasn't the Thing That Ran
APT, LXD, WordPress and SonicWall all shipped fixes this month for the same design error: a security check performed on one object or path, and an action taken on another. Here is how to find that gap in your own estate.
CVE-2026-19868: SonicWall SonicOS SSL-VPN SAML Bypass Exploited in the Wild, CISA Deadline November 20
SonicWall patched an actively exploited SonicOS SSL-VPN flaw that lets attackers with valid credentials sidestep SAML-enforced MFA; CISA added it to KEV on November 6.
OpenSSH 'sshole' CVE-2026-123158: A Long Password Walks Past Authentication on Alpine and musl Systems
OpenSSH 10.6p2 ships an emergency workaround for a password-authentication bypass on musl-based, non-PAM builds such as Alpine Linux; a 257-byte-plus password can log in to accounts that have no password set.
CVE-2026-109518: APT Retry Logic Lets On-Path Attackers Swap a Verified Package and Run Code as Root
A flaw in APT's download retry and hard-link handling lets a network attacker replace a package after signature verification, yielding root code execution on Debian and Ubuntu. Patches are out.
Zyxel GS1900 Zero-Day CVE-2026-107441 Bypassed the CVE-2026-7273 Patch and Hit Nearly 1,000 Switches
Binarly found that attacks on ~1,000 Zyxel GS1900 switches used a separate CGI out-of-bounds write, CVE-2026-107441, that defeats the earlier CVE-2026-7273 fix; Zyxel's new firmware is out.
Siemens SIMATIC IoT2050 CVE-2026-58115: Unauthenticated Node-RED Editor Exploited to Drop Linux Bots and Persistent Webshells
VulnCheck reports in-the-wild exploitation of CVSS 10.0 CVE-2026-58115, where Siemens SIMATIC IoT2050 Advanced gateways expose an unauthenticated Node-RED editor, since October 30.
WordPress Core CVE-2026-119977: Upgrade-Window Race Condition Gives Unauthenticated RCE, Added to CISA KEV
CISA added WordPress Core's CVE-2026-119977, a TOCTOU race in the full-package upgrade process affecting 4.7 through 7.1.3, to KEV on November 3; federal agencies must patch to 7.1.4 by November 6.
Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527: The Missing Privilege Escalation Zero-Days in the UTA0576 Root Chain Are Patched
Ivanti has patched the two remaining Connect Secure zero-days that UTA0576 chained with the CVE-2026-104935 auth bypass to reach root; both are in CISA KEV.
Canonical LXD CVE-2026-112816: mTLS Certificate-Chain Flaw Lets Attackers Impersonate Any Trusted Client (CVSS 4.0 10.0)
Canonical patched a CVSS 4.0 10.0 improper certificate validation bug in the LXD HTTPS listener that lets an attacker authenticate as any trusted client via a crafted certificate chain; MicroCloud is affected too.