You are reading a previous issue. Go to the latest edition →

The situation

Cyberattack Raises Temperatures at Blood Facilities

Three blood-storage facilities reported raised temperatures after a supplier cyberattack; WordPress exploitation and compromised certificates also feature.

2 sources

BleepingComputer, Cisco PSIRT Security Advisories

France’s blood service said a cyberattack on a refrigeration equipment provider raised temperatures at three facilities. Coolworld Rentals reported a third-party vulnerability; EFS continued operations and transferred affected products.

Context

The report says the incident followed broader European attacks on cooling systems. It notes CISA disclosed CVE-2025-41450 and CVE-2025-41451, and that Sabcobel noted similar exploitation in October.

The move

One thing to do today

Epictim Draper

Update WordPress to version 7.1.4 to address CVE-2026-119977.

On the wire

2critical
2elevated
0moderate
0low

P0Incident

Supplier Vulnerability Raises Blood-storage Temperatures

France’s blood service said a cyberattack on a refrigeration equipment provider raised temperatures at three facilities and required transfers of affected products.¹ Coolworld Rentals reported a third-party vulnerability, and EFS continued operations while transferring affected products.¹

1BLEEPINGCOMPUTER · Cyberattack Exploits Danfoss AK-SM/AK-SC Refrigeration in France

Copy link to “Supplier Vulnerability Raises Blood-storage Temperatures”

P1Certificates

Researcher Demonstrates eMudhra Key Compromise

According to Cisco, a security researcher demonstrated compromise of private keys for eight eMudhra intermediate certificates.¹

Previously in SitRep Oct 30: eMudhra CA Keys Suffer Critical Compromise

1CISCO PSIRT SECURITY ADVISORIES · Cisco Informational for Emergency Distrust of eMudhra Certificate Authorities

Copy link to “Researcher Demonstrates eMudhra Key Compromise”

P0Exploit

CISA Reports Active WordPress Core Exploitation

CVE-2026-119977 · Fixed in WordPress 7.1.4

CISA warns federal agencies that attackers are actively exploiting CVE-2026-119977, a TOCTOU-based WordPress Core remote code execution flaw fixed in WordPress 7.1.4 on October 28.¹ Wordfence reported blocking 13,095 attacks in the past 24 hours.¹

Updated Since Nov 3: CISA Adds WordPress Core Flaw to Exploited Catalogue · CVE-2026-119977 · New: bleepingcomputer.com, thehackernews.com

Single sourceBleepingComputer

Added to CISA KEV: CVE-2026-60137 on 21 Jul 2026; CVE-2026-63030 on 21 Jul 2026; CVE-2026-119977 on 3 Nov 2026 · CVE-2026-119977: CVSS 8.1, EPSS 0.01 (FIRST); CVE-2026-63030: EPSS 0.11 (FIRST) and 1 more

1BLEEPINGCOMPUTER · CISA Flags WordPress RCE Flaw as Actively Exploited in Attacks

Copy link to “CISA Reports Active WordPress Core Exploitation”

P1Supply Chain

Zyxel Patches Exploited GS1900 Switch Flaw

CVE-2026-107441 · About 996 devices in 48 countries

Zyxel patched a zero-day in GS1900 switches after attackers compromised about 996 devices in 48 countries.¹ The out-of-bounds write flaw is reached through the web management interface and affects ten GS1900 models; attackers remotely executed commands and later exfiltrated configurations and credentials.¹

Single sourceBleepingComputer

Added to CISA KEV on 21 Sept 2026 (CVE-2026-7273) · CVE-2026-107441: CVSS 8.8

1BLEEPINGCOMPUTER · Zyxel GS1900 Zero-day Patch After Wide Switch Breach

Copy link to “Zyxel Patches Exploited GS1900 Switch Flaw”

Known exploited

Added 4 Nov1 vulnerability added to CISA’s catalogue of flaws exploited in the wild

CVE	Vendor and product	Added	Due
CVE-2024-27834	Apple Multiple Products	4 Nov	18 Nov

Source: CISA KEV catalogue, version 2026.11.10 (released 10 Nov 2026; read by SitRep 10 Nov 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

The wire, last 30 days

This edition has 4 stories rated critical or elevated (P0 or P1); the 23 daily editions from 6 Oct to 3 Nov averaged 3.6. 6 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table

Edition	P0	P1	P2	P3
4 Nov (this edition)	2	2	0	0
3 Nov	0	3	1	0
2 Nov	0	2	1	1
1 Nov	0	3	0	0
31 Oct	1	2	1	0
30 Oct	1	4	0	0
29 Oct	1	1	1	0
28 Oct	1	2	1	1
27 Oct	1	3	1	0
26 Oct	1	1	1	1
23 Oct	0	3	2	0
22 Oct	1	4	0	0
21 Oct	2	2	0	0
20 Oct	2	2	1	0
19 Oct	2	3	0	0
16 Oct	1	2	1	0
15 Oct	1	3	1	0
14 Oct	2	1	1	1
13 Oct	1	3	0	0
12 Oct	2	2	0	0
9 Oct	1	3	1	0
8 Oct	2	3	0	0
7 Oct	1	3	1	0
6 Oct	1	3	1	0

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

Chromium CVE-2026-119260 Use-After-Free Vulnerability Reported by Microsoft Security Response Center

Microsoft’s Security Update Guide lists Chromium vulnerability as a use-after-free flaw. The entry attributes the issue to Chromium and directs readers to the MSRC update guide for details.

5 reports

MICROSOFT SECURITY UPDATE GUIDEChromium CVE-2026-119260 Use-After-Free Vulnerability Reported by Microsoft Security Response Center
MICROSOFT SECURITY UPDATE GUIDEChromium CVE-2026-118314: Incorrect Reference Resolution
MICROSOFT SECURITY UPDATE GUIDEChromium CVE-2026-119261 Improper Input Validation
MICROSOFT SECURITY UPDATE GUIDEChromium CVE-2026-119262 Improper Input Validation
MICROSOFT SECURITY UPDATE GUIDEChromium CVE-2026-119265 Memory Corruption in Security Update Guide

mSecure Hack Prompts Password Reset Warnings

mSeven Software is warning current and former mSecure password manager customers to change passwords, reset two-factor authentication, and remove passkeys following a cyberattack that reportedly exposed an encrypted customer database.

3 reports

BLEEPINGCOMPUTERmSecure Hack Prompts Password Reset Warnings
MALWAREBYTES LABSmSecure Urges Password Changes Without Details
MALWAREBYTES LABSMSecure Warns Users to Change Passwords Without Details

APT29-Linked Group hijacks analytics to deliver iOS and Android exploits

APT29 runs a watering hole campaign via compromised Websites and the Plerdy SEO Tracker supply chain, injecting JavaScript to profile visitors and route to platform-specific exploit chains. iOS Class A/B use DarkSword with CVE-2025-43529 and other CVEs; Android Class C uses CVE-2026-3910 and CVE-2025-27038 to exfiltrate data and deliver AndroSnitch.

3 reports

THE HACKER NEWSAPT29-Linked Group hijacks analytics to deliver iOS and Android exploits
BLEEPINGCOMPUTERHackers Use N-day Exploits in Zero-Click Attacks on iOS, Android
HELP NET SECURITYAPT29 targets iOS and Android with n-day mobile exploits

SonicWall Won’t Patch End-of-Life GMS Flaws Exposing Data

SonicWall warns two end-of-life GMS flaws (affecting GMS 9.5.2 and earlier) will not be patched. CVE-2026-109593 allows unauthenticated file reads; CVE-2026-109594 enables post-auth SQL injection. No remediation will be released; upgrade to NSM is advised. Earlier, CVE-2026-102255 was fixed, with active exploitation in the wild (2,541 attempts from eight IPs since Oct 9, 2026; up to 30 on Nov 3).

2 reports

THE HACKER NEWSSonicWall Won’t Patch End-of-Life GMS Flaws Exposing Data
BLEEPINGCOMPUTERSonicWall warns of unpatched flaws in end-of-life GMS software

Cisco Advances Notification of Nov 4, 2026 Security Advisories

Cisco PSIRT disclosed three advisories on November 4, 2026: CVE-2026-76506 in Cisco UCS Central Software (RCE, High 7.6), CVE-2026-76419 in Cisco Unified Communications Manager (XSS, Medium 6.1), and CVE-2026-20241 in Cisco Identity Services Engine (Authorization Bypass, Medium 5.3).

2 reports

CISCO PSIRT SECURITY ADVISORIESCisco Advances Notification of Nov 4, 2026 Security Advisories
CISCO PSIRT SECURITY ADVISORIESCisco UCS Central Software RCE Vulnerability

Two Canadians Charged in University Hacking for Crypto-Mining

Two Canadians, Ryan Roach and Mathiew Stubbings, were indicted for hacking US universities to mine cryptocurrency, steal credentials, and damage computers. They used offshore VPS to compromise networks in New York, Tennessee, North Carolina, and Massachusetts, stored stolen logins, and damaged at least 10 machines with at least $5,000 in losses. Roach was extradited Oct 28 and arraigned Nov 3.

2 reports

BLEEPINGCOMPUTERTwo Canadians Charged in University Hacking for Crypto-Mining
SECURITYWEEKCanadian Extradited to the United States Over University Cryptomining Attacks

Malicious cPGuard Updates in OpsShield Supply Chain Attack

Attackers used compromised credentials to access OpsShield’s update CDN and served malicious cPGuard updates. Affected versions 5.88.12–5.88.19, with fake updates distributed for about 70 minutes. About 2,950 servers executed the updates; 7,900 client account records were copied. 32 files were collected; a hidden root shell and SSH/MySQL credentials were planted and later rotated.

2 reports

SECURITYWEEKMalicious cPGuard Updates in OpsShield Supply Chain Attack
HELP NET SECURITYPoisoned cPGuard Update Compromises Thousands of Web Hosting Servers

Chrome 157 Rolls Out With 213 Fixes and Seven Critical Flaws

Google rolled Chrome 157 to stable with patches for 213 vulnerabilities, seven of which are critical memory-safety flaws. Dawn’s buffer overflow tops the list; the reporter received $10,000. An ANGLE memory corruption flaw earned $1,000. Two more critical flaws were reported by Anthropic’s Xinyang Ge and another by Wenbin Liu.

2 reports

SECURITYWEEKChrome 157 Rolls Out With 213 Fixes and Seven Critical Flaws
MALWAREBYTES LABSChrome 157 fixes 213 security issues including 7 critical flaws

Also reported

BLEEPINGCOMPUTERVercel Deploys Device-Bound Session Credentials Protection
CISCO PSIRT SECURITY ADVISORIESCisco Identity Services Engine authorization bypass vulnerability
BLEEPINGCOMPUTERDreamHost Data Breach Exposes FTP Logins and Webmail Sessions
CISCO PSIRT SECURITY ADVISORIESVulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026
THE HACKER NEWSDebian and Ubuntu APT Flaw Lets MitM Attackers Swap Packages
BLEEPINGCOMPUTERNIKKE PC Launcher Supply-Chain Attack Delivers Backdoor
THE HACKER NEWSPrompt Adware Haiou Injects Ads in OpenAI Codex Jailbreak
CISCO PSIRT SECURITY ADVISORIESCisco Unified CM XSS Vulnerability Affects CM and SME
BLEEPINGCOMPUTERGoogle Calendar Phishing Hijacks Sessions, Bypasses MFA
SECURITYWEEKSysdig AI Defense Enables Runtime Security and Governance for AI Agents

End of the Wednesday, November 4, 2026 edition.

Get a free cybersecurity brief by email on weekdays. Get the brief →

Colophon

SitRep · Vol. 1, No. 46

Publisher: Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure: SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards: Read our editorial standards.
Corrections: brief@sitrepit.com or the contact page.