Skip to content
Tuesday, November 3, 2026Nov 3, 2026
Previous issue

Vol. 1, No. 45Composed Nov 3 · 16:51 UTC

SitRep

Cybersecurity, in perspective.

1 critical · 2 elevated3 stories on the wire

Scale rewards automation; attention preserves control.
— Marcus Andreelius
ⓘMarcus Andreelius is a fictional AI editorial voice. This reflection is original editorial prose, not a quotation.

You are reading a previous issue. Go to the latest edition →

The situation

European Supermarket Fridge Attacks Return Target Danfoss StoreView

Barracuda says two critical flaws can enable root access; it advises patches and latest firmware for affected products.

3 sources

BleepingComputer, SecurityWeek, The Hacker News

Barracuda warns that two critical flaws allow root access via ESG authentication and admin-interface exploitation. CVE-2026-116606 and CVE-2026-111560 affect Barracuda products including ESG, Load Balancer ADC, WAF, WCC and WSG. The vendor says exploitation requires admin-interface access and elevated privileges to bypass controls, and notes CVE-2023-2868 was previously exploited against ESG appliances.

Context

Barracuda's account ties exploitation to admin-interface access and elevated privileges to bypass controls. The vendor separately says CVE-2023-2868 was previously exploited against ESG appliances; it does not report that the two newly disclosed flaws have been exploited.

The move

One thing to do today

Epictim Draper

  1. Install Barracuda firmware updates addressing CVE-2026-116606 and CVE-2026-111560 on affected ESG, Load Balancer ADC, WAF, WCC and WSG appliances.

On the wire

  • 1critical
  • 2elevated
  • 0moderate
  • 0low
P1Patch

Barracuda Warns of Critical Root-access Flaws

CVE-2026-116606 · CVE-2026-111560 · CVE-2023-2868

Barracuda warns that two critical flaws allow root access via ESG authentication and admin-interface exploitation. Affected products include ESG, Load Balancer ADC, WAF, WCC and WSG. The vendor says exploitation requires admin-interface access and elevated privileges to bypass controls, and notes CVE-2023-2868 was previously exploited against ESG appliances.

Added to CISA KEV on 26 May 2023 (CVE-2023-2868) · CVE-2026-116606: CVSS 9.3, EPSS <0.01 (FIRST); CVE-2026-111560: CVSS 8.6, EPSS <0.01 (FIRST) and 2 more

BLEEPINGCOMPUTER · Barracuda warns of critical flaws enabling root access on devices

Copy link to “Barracuda Warns of Critical Root-access Flaws”

P0Exploit

Attackers Exploit Node-red Flaw to Deploy Malware

CVE-2026-58115 in Node-RED · In-the-wild activity noted starting Oct. 30

SecurityWeek reports attackers exploited CVE-2026-58115 in Node-RED to deploy a Linux bot and webshells via a single HTTP request. Exploits came from an IP in AS8075. VulnCheck noted in-the-wild activity starting Oct. 30, with 15 additional attacks by Nov. 1. Siemens reported the flaw in SIMATIC IoT2050 Advanced devices with Industrial OS; patches exist in version 4.3.4.1 and later.

CVE-2026-58115: EPSS <0.01 (FIRST)

SECURITYWEEK · Critical Node-RED Flaw Exploited in Attacks

Copy link to “Attackers Exploit Node-red Flaw to Deploy Malware”

P1Patch

Red Hat Fixes Linux TCP Remote-code-execution Flaw

CVE-2026-98432 · RHEL 8, 9 and 10

The Hacker News reports Red Hat fixes a 9.8-rated Linux TCP remote-code-execution flaw in IPv4 code affecting RHEL 8, 9 and 10. The issue stems from IPv4 TCP option handling and can be exploited remotely without login; the upstream fix landed in October. No confirmed attacks were reported. A mitigation is an nftables rule to drop inbound TCP packets with IP options.

CVE-2026-98432: CVSS 9.8, EPSS <0.01 (FIRST)

THE HACKER NEWS · Red Hat Patches 9.8 CVSS Linux TCP RCE Flaw

Copy link to “Red Hat Fixes Linux TCP Remote-code-execution Flaw”

Known exploited

Added 3 Nov1 vulnerability added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-119977WordPress WordPress Core3 Nov6 Nov

Source: CISA KEV catalogue, version 2026.11.10 (released 10 Nov 2026; read by SitRep 11 Nov 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

The wire, last 30 days

This edition has 3 stories rated critical or elevated (P0 or P1); the 23 daily editions from 5 Oct to 2 Nov averaged 3.7. 6 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
3 Nov (this edition)1200
2 Nov0211
1 Nov0300
31 Oct1210
30 Oct1400
29 Oct1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300
12 Oct2200
9 Oct1310
8 Oct2300
7 Oct1310
6 Oct1310
5 Oct2210

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

Google Dismantles XCPE Botnet Targeting Android Devices

Google dismantled XCPE, a backdoor botnet built into Android devices by Videostrong Technology, affecting over 1.3 million devices and used for ad fraud and data exfiltration as residential proxies. The takedown disrupted domains and C2, likely cutting access to at least 10 million more devices.

5 reports

Binance Says Fake Job Interview Fueled $6.3 Billion Heist

North Korean traders used a fake job interview to plant malware, enabling theft of about $6.34 billion from Binance. The FBI links the attackers to TraderTraitor, Lazarus Group, Jade Sleet, and APT38. The intrusion began with impersonation of a project director; two interviews followed, with a malicious coding assignment.

4 reports

CrowdStrike to Acquire Fiddler AI and Dreadnode for $495 Million

CrowdStrike will acquire Fiddler AI for about $400 million and Dreadnode for about $95 million, totaling $495 million, paid mostly in cash with some stock vesting. Closings expected in Q4 FY2027 (by Jan 31, 2027). Fiddler provides AI-agent observability; Dreadnode offers AI-security testing. The deals accompany a new AI Kill Switch in Falcon Guardian and prior deals for SGNL, Seraphic, and Pangea.

4 reports

NCSC Warns AI-Powered Attacks on UK Infrastructure by 2028

The NCSC warns that hostile actors using AI could boost ransomware, social engineering and vulnerability exploitation within two years, with AI-powered malware likely to target Britain’s critical national infrastructure by 2028.

4 reports

Harvard Data Breach Exposed 851,000 Accounts

Hackers breached Harvard University’s Alumni Affairs and Development systems in Nov 2025, exposing data for about 851,000 unique emails from students, alumni, donors, staff, and faculty, including addresses and donor details. Harvard said no Social Security numbers, passwords, or payment data were stored.

4 reports

Europe on alert after supermarket freezers cyber-attacks in 10 countries

Hackers hit supermarket freezers across 10 European countries, prompting cybersecurity warnings. BBC is the report source; Reuters, AP News, and CNBC reference the incident.

4 reports

Google Warns LLMjacking Attacks Trigger Million-Dollar Cloud Charges

Google GTIG and Mandiant flag LLMjacking where attackers use stolen API keys to hijack enterprise LLMs, triggering fraudulent cloud charges up to $1 million, with daily spikes over $100k. They identified two clusters, attackers leveraging exposed keys and LLM mixers like Jet Night; CVE-2026-40217 is exploited. Guidance includes IAM hardening, secrets management, MFA, and monitoring.

3 reports

Also reported

End of the Tuesday, November 3, 2026 edition.

Colophon

SitRep · Vol. 1, No. 45

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.