Cyber Threat Brief

Today: Zyxel GS1900 switches need 2.90 Patch 3, because Binarly found that Patch 2 does not stop the exploit used in earlier attacks. Prioritize exposed SharePoint servers and retire unsupported SonicWall GMS installations. Apple exploitation reporting cites a November 18 federal remediation date for CVE-2024-27834; verify the applicable CISA entry before using that date for compliance.

Critical Alerts

Zyxel GS1900 fix fails to stop exploited command-execution chain (CVE-2026-107441, CVE-2026-7273)

Summary: Binarly found that the exploit used against Zyxel GS1900 switches still works against 2.90 Patch 2, because its parameter-count check does not prevent an oversized parameter from corrupting memory first. CVE-2026-107441 allows unauthenticated root command execution through a reachable management interface; Zyxel rates it CVSS 8.8, while Binarly rates it 9.8. GreyNoise observed data theft from 996 switches, but the reporting does not establish that those devices were running Patch 2.

• Action: Install the model-specific 2.90 Patch 3 build on affected GS1900 switches running Patch 2 or earlier. Restrict management access to trusted administrative networks and investigate previously exposed devices separately, rather than treating a firmware update as evidence that compromise has been removed.
• Sources: The Hacker News | SecurityWeek

Fileless SharePoint access linked to Storm-2603 tactics (CVE-2025-53770, CVE-2025-53771)

Summary: Kaspersky describes an intrusion consistent with Storm-2603 tactics in which the access bridge remained inside the IIS worker process, w3wp.exe, although later activity left disk artifacts. Microsoft previously attributed ransomware-related ToolShell exploitation against on-premises SharePoint to Storm-2603. CVE-2025-53770 is ransomware-linked in CISA KEV, with a historical July 21, 2025 deadline; enrichment gives it EPSS 1.000 and CVE-2025-53771 EPSS 0.999.

• Action: Verify installation of the applicable Microsoft ToolShell fixes for each SharePoint release. Review IIS requests and w3wp.exe behavior, preserve volatile evidence when investigating suspicious activity, and correlate reconnaissance with exploitation across multiple days rather than relying on disk-only searches.
• Source: Securelist

Apple authentication bypass added to KEV amid browser exploitation (CVE-2024-27834)

Summary: CISA added CVE-2024-27834, CVSS 5.5, to KEV following exploitation reporting; the flaw lets an attacker already possessing arbitrary read/write capability bypass Pointer Authentication. Sekoia attributes the associated browser-data theft campaign to APT29 with moderate-to-high confidence, describing compromised websites, impersonation sites, and abuse of Plerdy SEO Tracker. The reporting gives November 18, 2026 as the federal remediation date, but repeats another CVE identifier inconsistently when describing the exploit chain.

• Action: Verify current supported Apple releases and the operative KEV entry before rollout or compliance reporting. Apple originally addressed CVE-2024-27834 in releases including iOS/iPadOS 17.5 and 16.7.8, macOS Sonoma 14.5, and Safari 17.5; do not treat those historical versions as current security baselines.
• Sources: The Hacker News | Campaign coverage

Ransomware Claims (Last 48h)

Seven dated claims tracked across two groups on November 4. These are unverified leak-site claims, not confirmed breaches; sector and location details also reflect listing information.

Group	Victim	Sector	Country
Soul	Noble Inc.	Oilfield services	United States
Soul	United Medical Doctors	Healthcare	United States
Soul	METO Systems	Industrial equipment	United States
Soul	Nephrology Associates	Healthcare	United States
Soul	Mid-Cumberland Human Resource Agency	Nonprofit / human services	United States
Soul	The Vant Group	M&A advisory	Not established
Destello	MAPFRE Brasil	Insurance	Brazil

• Action: Check relevant supplier and customer relationships, then seek confirmation through trusted contacts. Do not interpret a listing, claimed data volume, or attacker deadline as independently verified evidence.
• Sources: RansomLook, Soul | RansomLook, Destello

Ransomware & Extortion

Bristol school files published following shared-platform attack

Summary: Reporting describes at least 320,000 stolen school files posted to the dark web after an attack on Bristol City Council's Trading with Schools platform. The September incident involved data from 39 schools, illustrating how a shared service can expose multiple organizations through one intrusion.

• Action: Schools using shared administrative platforms should establish which datasets and users are affected through their provider. Review connected accounts and prepare notification decisions using verified exposure details, not leak-site descriptions alone.
• Source: DataBreaches.net

IOCs & Detection

DarkVigil delivery infrastructure associated with Sogou DNS hijacking

Summary: ESET identified two staging servers used to redirect Sogou Input Method configuration requests and deliver DarkVigil through DLL sideloading. These are source-reported campaign indicators, with high confidence in their association with the described activity, not proof that every historical connection was malicious.

• DarkVigil, IP: 47.239.250[.]102, high confidence.
• DarkVigil, IP: 47.237.122[.]175, high confidence.
• DarkVigil, domain: sogou-cdn[.]com, high confidence.
• DarkVigil, domain: dev.soft-png-cdn[.]com, high confidence.
• Action: Block the listed staging indicators where appropriate and search DNS, proxy, and endpoint history. Investigate SGTool.exe activity followed by biz_helper.exe loading libcef.dll; those filenames alone are insufficient for a malicious verdict.
• Source: The Hacker News

Business & Infrastructure Threats

Unsupported SonicWall GMS exposes internal files (CVE-2026-109593)

Summary: SonicWall warns that end-of-life GMS 9.5.2 and earlier contain vulnerabilities that will not receive patches. The described flaw, CVE-2026-109593, carries CVSS 9.1 and allows an unauthenticated attacker with network access to read internal GMS files.

• Action: Remove unnecessary network access immediately and plan retirement or migration from affected GMS installations. Review accessible files and logs to determine whether credentials or other sensitive configuration require replacement.
• Source: The Hacker News

Sogou HTTP configuration delivery abused to install DarkVigil (CVE-2026-120422)

Summary: ESET attributes a DNS-hijacking campaign against Windows Sogou Input Method users to the China-aligned SlippyNunchucks intrusion set. Attackers redirected unencrypted configuration requests to staging servers, then used a legitimate executable and malicious DLL to deploy the modular DarkVigil implant.

• Action: Update affected installations to Sogou Input Method 16.10, released October 29, which moves the affected requests to HTTPS. An inventory match identifies systems to assess, not proof that their DNS traffic was redirected or malware executed.
• Source: The Hacker News

Beget cloud attack destroys data and disrupts websites

Summary: Reporting describes a cyberattack that destroyed data across Beget's cloud infrastructure and disrupted hundreds of websites. The hosting provider said Wednesday that it had begun bringing some servers back online.

• Action: Confirm that critical hosted workloads have independently controlled backups and test restoration outside the primary provider. Check whether identity, DNS, and backup dependencies would remain available during a provider-wide outage.
• Source: DataBreaches.net

General Security News

Breach datasets expose organizations beyond the primary victim

Summary: Lab 1 analyzed 328 million files across 2,089 exposed datasets and found that the median breach contained data linked to 542 organizations beyond the named victim. Its study identified 13,436 unique organizations exposed through incidents recorded in 2025 and 2026.

• Action: Include supplier incidents in exposure monitoring. Check for your organization's documents, credentials, and customer information without assuming that a supplier breach necessarily exposed your data.
• Source: DataBreaches.net

Patch Priority

• Zyxel GS1900, high to critical: Install model-specific 2.90 Patch 3; Binarly found Patch 2 ineffective against the observed exploit.
• On-premises SharePoint, exploited RCE: Verify applicable ToolShell fixes and investigate suspicious IIS activity.
• SonicWall GMS, critical CVSS 9.1: Retire or isolate affected unsupported installations; SonicWall will not patch them.
• Ruby on Rails, critical: Upgrade applicable branches to 8.1.4.1 or 8.0.5.2 where Active Storage processes uploads through ImageMagick.
• Xen, cross-VM memory access: Apply vendor-provided fixes after checking deployment applicability; the advisory covers versions from 4.6 onward.

Vulnerability Disclosures

Rails Active Storage image processing permits arbitrary file access

Summary: A critical Rails flaw allows unauthenticated arbitrary server-file writes through crafted uploads when an application processes them using ImageMagick. Coverage also describes sensitive-file reads through the Active Storage integration; an installed Rails package alone does not establish that the affected processing path is reachable.

• Action: Verify Active Storage and ImageMagick usage, then upgrade applicable branches to 8.1.4.1 or 8.0.5.2. Prioritize applications accepting untrusted uploads.
• Sources: The Hacker News | Dark Reading

Xen flaws cross guest and management-domain boundaries

Summary: Two Xen vulnerabilities allow a malicious guest VM to read and write other VMs' memory, including dom0, the management domain. The Xen Project says versions from 4.6 onward are vulnerable, patches are available, and there is no known mitigation.

• Action: Check the Xen advisory and platform vendor guidance for applicable fixed packages before rollout. Prioritize hosts running mutually untrusted guests because the impact crosses VM isolation boundaries.
• Source: The Hacker News

APT download-retry flaw permits root-level package substitution

Summary: Debian, Ubuntu, and APT developers disclosed a flaw allowing an attacker who can modify package downloads to substitute an attacker-controlled package after verification. Exploitation requires failed-download retries, and the substituted code executes as root.

• Action: Verify the applicable fixed APT package in your distribution's November 4 advisory and deploy it through trusted update channels. Prioritize systems whose package-download traffic traverses untrusted networks.
• Source: The Hacker News

Trends & Context

Management interfaces and trusted delivery mechanisms remain central exposure points: Zyxel's incomplete fix, Sogou's HTTP configuration flow, and APT's retry behavior each undermine a different trust boundary. Shared platforms and supplier-held documents also expand incident scope, making dependency mapping and independently tested recovery as important as patch deployment.