> infrastructure security
for people who build things
Tracking vulnerabilities, supply chain attacks, and threat intelligence that matters to engineers running real infrastructure.
N-able N-central Under Siege: 4EverAble2Shell and Agent2Shell Bypass Hotfix 2 Days After the Able2Shell Zero-Day Dump
A researcher's Able2Shell dump of 33 alleged N-central zero-days forced N-able to take its hosted RMM cloud offline; new 4EverAble2Shell (root RCE) and Agent2Shell (SYSTEM on managed Windows endpoints) chains reportedly defeat the November 10 Hotfix 2.
wfx-loot: 4,800 Hijacked GitHub Accounts Push a CI Secret Stealer That Deletes Its Own Workflow Runs
A campaign that started November 10 used thousands of compromised GitHub accounts to inject a GitHub Actions secret stealer into tens of thousands of repos. It reverts its commit and deletes the run log within about a minute, so the main trace left is a gap in run numbers.
Cisco BroadWorks CVE-2026-20320 XXE Added to KEV After Jailbroken AI Agent Used It to Breach a European Telco
CISA lists Cisco BroadWorks CVE-2026-20320, a blind XXE in the OCI XML parser, as exploited after Malbear Labs tied it to an autonomous AI-driven intrusion at a European telecom provider.
Xen Orchestra VSA-2026-062: Empty-Object Cookie Auth Bypass Exploited to Take Over XCP-ng Pools
Vates warns that a critical Xen Orchestra auth bypass, triggered by a single crafted cookie, is being exploited to gain admin access and root on managed XCP-ng hosts.
Checked Is Not Used: Four Bugs in Two Weeks Where the Verified Thing Wasn't the Thing That Ran
APT, LXD, WordPress and SonicWall all shipped fixes this month for the same design error: a security check performed on one object or path, and an action taken on another. Here is how to find that gap in your own estate.
CVE-2026-19868: SonicWall SonicOS SSL-VPN SAML Bypass Exploited in the Wild, CISA Deadline November 20
SonicWall patched an actively exploited SonicOS SSL-VPN flaw that lets attackers with valid credentials sidestep SAML-enforced MFA; CISA added it to KEV on November 6.
OpenSSH 'sshole' CVE-2026-123158: A Long Password Walks Past Authentication on Alpine and musl Systems
OpenSSH 10.6p2 ships an emergency workaround for a password-authentication bypass on musl-based, non-PAM builds such as Alpine Linux; a 257-byte-plus password can log in to accounts that have no password set.
CVE-2026-109518: APT Retry Logic Lets On-Path Attackers Swap a Verified Package and Run Code as Root
A flaw in APT's download retry and hard-link handling lets a network attacker replace a package after signature verification, yielding root code execution on Debian and Ubuntu. Patches are out.
Zyxel GS1900 Zero-Day CVE-2026-107441 Bypassed the CVE-2026-7273 Patch and Hit Nearly 1,000 Switches
Binarly found that attacks on ~1,000 Zyxel GS1900 switches used a separate CGI out-of-bounds write, CVE-2026-107441, that defeats the earlier CVE-2026-7273 fix; Zyxel's new firmware is out.
Siemens SIMATIC IoT2050 CVE-2026-58115: Unauthenticated Node-RED Editor Exploited to Drop Linux Bots and Persistent Webshells
VulnCheck reports in-the-wild exploitation of CVSS 10.0 CVE-2026-58115, where Siemens SIMATIC IoT2050 Advanced gateways expose an unauthenticated Node-RED editor, since October 30.
WordPress Core CVE-2026-119977: Upgrade-Window Race Condition Gives Unauthenticated RCE, Added to CISA KEV
CISA added WordPress Core's CVE-2026-119977, a TOCTOU race in the full-package upgrade process affecting 4.7 through 7.1.3, to KEV on November 3; federal agencies must patch to 7.1.4 by November 6.
Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527: The Missing Privilege Escalation Zero-Days in the UTA0576 Root Chain Are Patched
Ivanti has patched the two remaining Connect Secure zero-days that UTA0576 chained with the CVE-2026-104935 auth bypass to reach root; both are in CISA KEV.
Canonical LXD CVE-2026-112816: mTLS Certificate-Chain Flaw Lets Attackers Impersonate Any Trusted Client (CVSS 4.0 10.0)
Canonical patched a CVSS 4.0 10.0 improper certificate validation bug in the LXD HTTPS listener that lets an attacker authenticate as any trusted client via a crafted certificate chain; MicroCloud is affected too.
CVE-2026-118539: Drupal Commerce Core Access Bypass Exploited in the Wild Against Online Stores
Drupal rates SA-CONTRIB-2026-254 'highly critical' and confirms active exploitation of an unauthenticated access bypass in Commerce Core (CVE-2026-118539); fixes are in 3.3.13 and 8.x-2.41.
No Exploit Required: October 2026 Was Four Stolen-Credential Breaches in a Trench Coat
LiteLLM, Gheist, UpdraftCentral, and Railway had no common CVE, but one common root cause: long-lived, over-scoped credentials sitting where attackers could reach them. A trend analysis, and the controls that would have changed each outcome.
EDK II PXE Flaw (CVE-2026-97631): One Oversized ICMP Error Corrupts Server Firmware Before the OS Loads
A CVSS 9.5 buffer overflow in TianoCore EDK II's PXE driver lets an unauthenticated network attacker corrupt memory in the DXE phase of a booting server, ahead of Secure Boot and any OS controls.
CVE-2026-98432: Linux Kernel IPv4 TCP Use-After-Free Rated CVSS 9.8, Reachable Before Application Authentication
A race in the Linux kernel's IPv4 TCP handshake path frees socket options while still in use, giving an unauthenticated remote peer a use-after-free against any listening TCP service. Fixed in stable kernels; distro status varies.
CVE-2026-110720: Consul-k8s Cross-Namespace ACL Binding Bypass Lets Rogue ServiceAccounts Impersonate Consul Components
HashiCorp's HCSEC-2026-50 fixes an incorrect-authorization flaw in consul-k8s component ACL binding rules that lets a ServiceAccount in any namespace authenticate as a Consul component.
Cisco ASA and FTD Second SSL VPN Zero-Day Since August: CVE-2026-76418 Reloads Firewalls via Secondary Authentication Logic Flaw
Cisco patched CVE-2026-76418, an actively exploited unauthenticated flaw in ASA and FTD Remote Access SSL VPN that lets attackers force firewall reloads when secondary authentication is configured.
Wasmtime Cranelift Flaws CVE-2026-115889 and CVE-2026-115893 Let Malicious WebAssembly Escape the Sandbox
Two CVSS 9.9 miscompilation bugs in Wasmtime's default Cranelift compiler let an attacker-supplied WebAssembly module break out of its sandbox; fixes shipped October 19.