Skip to content
Tuesday, November 3, 2026Nov 3, 2026
Previous issue

Vol. 1, No. 45Composed Nov 4 · 06:04 UTC

SitRep

Cybersecurity, in perspective.

3 elevated4 stories on the wire

Scale without attention magnifies inevitable errors.
— Marcus Andreelius
ⓘMarcus Andreelius is a fictional AI editorial voice. This reflection is original editorial prose, not a quotation.

You are reading a previous issue. Go to the latest edition →

The situation

CISA Adds WordPress Flaw to Exploited Catalogue

CISA added a WordPress Core flaw to its exploited-vulnerabilities catalogue; updates and incident reports cover three other security stories.

3 sources

CISA KEV catalogue, Cisco PSIRT Security Advisories, BleepingComputer

CISA added CVE-2026-119977 in WordPress Core to its catalogue of vulnerabilities exploited in the wild on 2026-11-03. The catalogue describes a time-of-check time-of-use race condition that could allow unauthenticated attackers to execute code on the server during the upgrade window.

Context

The CISA entry is a catalogue record, not a report describing how exploitation occurred. It identifies a possible unauthenticated code-execution path during the upgrade window; it does not establish which systems were affected.

“The catalogue entry records the vulnerability as exploited in the wild; it is a record, not a report describing how exploitation occurred.”
From Senecowitz · Analysis
The move

2 things to do today

Epictim Draper

  1. Upgrade Cisco Secure Email Gateway to fixed releases 16.0.4-302 or 16.5.0-780 to remediate CVE-2026-76461.
  2. Harden IAM, manage secrets, use MFA, and monitor.

On the wire

  • 0critical
  • 3elevated
  • 1moderate
  • 0low
P1Exploit

CISA Adds WordPress Core Flaw to Exploited Catalogue

CVE-2026-119977 · Added on 2026-11-03

CISA added CVE-2026-119977 in WordPress Core to its catalogue of vulnerabilities exploited in the wild on 2026-11-03.1 The catalogue describes a time-of-check time-of-use race condition that could allow unauthenticated attackers to execute code on the server during the upgrade window.1

Added to CISA KEV on 3 Nov 2026 (CVE-2026-119977) · CVE-2026-119977: CVSS 8.1

  1. 1CISA KEV CATALOGUE · CISA adds CVE-2026-119977 (WordPress WordPress Core) to its known exploited vulnerabilities catalogue

Copy link to “CISA Adds WordPress Core Flaw to Exploited Catalogue”

P1Exploit

Cisco Reports Secure Email Gateway SQL Injection

Cisco Secure Email Gateway · CVE-2026-76461 · Fixed releases: 16.0.4-302 and 16.5.0-780

Cisco describes CVE-2026-76461 in Secure Email Gateway as an unauthenticated SQL injection via crafted emails that can lead to remote root command execution.1 Cisco lists fixed releases 16.0.4-302 and 16.5.0-780 and says there are no workarounds.1

Added to CISA KEV on 14 Sept 2026 (CVE-2026-76461)

  1. 1CISCO PSIRT SECURITY ADVISORIES · Cisco Secure Email Gateway SQL Injection Vulnerability

Copy link to “Cisco Reports Secure Email Gateway SQL Injection”

P1Supply chain

Attacker Hijacks cPGuard Update Channel

cPGuard 5.88.12–5.88.19 · About 2,946 servers affected

An unidentified attacker used compromised credentials to access OpsShield’s update CDN on 2026-11-02 at 02:06 UTC and distributed a malicious script via the update channel to cPGuard versions 5.88.12–5.88.19.1 About 2,946 servers were affected; the script targeted Linux password hashes, root database configuration, root shell history, and root SSH authorization and known-hosts files.1

  1. 1BLEEPINGCOMPUTER · Hackers Hijack cPGuard Autoupdate to Deploy Backdoor

Copy link to “Attacker Hijacks cPGuard Update Channel”

P2Cloud

Llmjacking Campaigns Drive Million-dollar Cloud Charges

Up to $1 million in fraudulent charges · Daily spikes over $100,000

Google GTIG and Mandiant describe LLMjacking campaigns in which attackers used stolen API keys to hijack enterprise LLMs, triggering fraudulent cloud charges up to $1 million, with daily spikes over $100,000.1 Their guidance includes IAM hardening, secrets management, MFA, and monitoring.1

CVE-2026-40217: EPSS 0.16 (FIRST)

  1. 1BLEEPINGCOMPUTER · Google Warns LLMjacking Attacks Trigger Million-Dollar Cloud Charges

Copy link to “Llmjacking Campaigns Drive Million-dollar Cloud Charges”

Known exploited

Added 3 Nov1 vulnerability added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-119977WordPress WordPress Core3 Nov6 Nov

Source: CISA KEV catalogue, version 2026.11.10 (released 10 Nov 2026; read by SitRep 11 Nov 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

The wire, last 30 days

This edition has 3 stories rated critical or elevated (P0 or P1); the 23 daily editions from 5 Oct to 2 Nov averaged 3.7. 6 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
3 Nov (this edition)0310
2 Nov0211
1 Nov0300
31 Oct1210
30 Oct1400
29 Oct1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300
12 Oct2200
9 Oct1310
8 Oct2300
7 Oct1310
6 Oct1310
5 Oct2210

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

Google Dismantles XCPE Botnet Targeting Android Devices

Google dismantled XCPE, a backdoor botnet built into Android devices by Videostrong Technology, affecting over 1.3 million devices and used for ad fraud and data exfiltration as residential proxies. The takedown disrupted domains and C2, likely cutting access to at least 10 million more devices.

5 reports

Binance Says Fake Job Interview Fueled $6.3 Billion Heist

North Korean traders used a fake job interview to plant malware, enabling theft of about $6.34 billion from Binance. The FBI links the attackers to TraderTraitor, Lazarus Group, Jade Sleet, and APT38. The intrusion began with impersonation of a project director; two interviews followed, with a malicious coding assignment.

4 reports

CrowdStrike to Acquire Fiddler AI and Dreadnode for $495 Million

CrowdStrike will acquire Fiddler AI for about $400 million and Dreadnode for about $95 million, totaling $495 million, paid mostly in cash with some stock vesting. Closings expected in Q4 FY2027 (by Jan 31, 2027). Fiddler provides AI-agent observability; Dreadnode offers AI-security testing. The deals accompany a new AI Kill Switch in Falcon Guardian and prior deals for SGNL, Seraphic, and Pangea.

4 reports

NCSC Warns AI-Powered Attacks on UK Infrastructure by 2028

The NCSC warns that hostile actors using AI could boost ransomware, social engineering and vulnerability exploitation within two years, with AI-powered malware likely to target Britain’s critical national infrastructure by 2028.

4 reports

Harvard Data Breach Exposed 851,000 Accounts

Hackers breached Harvard University’s Alumni Affairs and Development systems in Nov 2025, exposing data for about 851,000 unique emails from students, alumni, donors, staff, and faculty, including addresses and donor details. Harvard said no Social Security numbers, passwords, or payment data were stored.

4 reports

Europe on alert after supermarket freezers cyber-attacks in 10 countries

Hackers hit supermarket freezers across 10 European countries, prompting cybersecurity warnings. BBC is the report source; Reuters, AP News, and CNBC reference the incident.

4 reports

Critical Node-RED Flaw Exploited in Attacks

Attackers exploited CVE-2026-58115 in Node-RED to deploy a Linux bot and webshells. Exploits came from an IP in AS8075 (Microsoft’s network) via a single HTTP request. Siemens reported the flaw in SIMATIC IoT2050 Advanced devices with Industrial OS; patches exist in 4[.]3[.]4[.]1+. VulnCheck noted in-the-wild activity starting Oct 30, with 15 additional attacks by Nov 1.

3 reports

European Supermarket Fridge Attacks Return Target Danfoss StoreView

Attackers again tampered with internet-exposed refrigeration controllers, impacting 100+ European stores across Belgium, Sweden, Ireland and more. Incidents link to Danfoss AK-SM/AK-SC and Copeland XWEB controllers; some devices reached defrost or 50°C. French CERT initially flagged the Danfoss vulnerabilities; most affected units are legacy with no patches.

3 reports

Also reported

End of the Tuesday, November 3, 2026 edition.

Colophon

SitRep · Vol. 1, No. 45

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.