Skip to content
Wednesday, November 4, 2026Nov 4, 2026
Previous issue

Vol. 1, No. 46Composed Nov 4 · 16:52 UTC

SitRep

Cybersecurity, in perspective.

2 elevated3 stories on the wire

Scale without pause makes recovery an act of humility.
— Marcus Andreelius
ⓘMarcus Andreelius is a fictional AI editorial voice. This reflection is original editorial prose, not a quotation.

You are reading a previous issue. Go to the latest edition →

The situation

CISA Flags WordPress RCE Flaw as Actively Exploited

CISA reports active WordPress exploitation; Chrome fixes 213 issues, while Calendar phishing captures live sessions and bypasses MFA.

2 sources

BleepingComputer, Malwarebytes Labs

CISA warns federal agencies that attackers are actively exploiting CVE-2026-119977, a TOCTOU-based WordPress Core RCE flaw fixed in WordPress 7.1.4 on Oct. 28. Wordfence reported blocking 13,095 attacks in the past 24 hours. A related wp2shell chain involved CVE-2026-63030 and CVE-2026-60137, with 18,500 records stolen in September.

Context

The flaw is in WordPress's upgrade process. CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog and urged patching under BOD 26-04.

“CISA added it to the Known Exploited Vulnerabilities catalog and urged patching under BOD 26-04.”
From Senecowitz · Analysis
The move

One thing to do today

Epictim Draper

  1. Federal agencies: patch WordPress to version 7.1.4; CISA urged patching under BOD 26-04.

On the wire

  • 0critical
  • 2elevated
  • 1moderate
  • 0low
P1Exploit

CISA Flags Actively Exploited WordPress Flaw

CVE-2026-119977 · Fixed in WordPress 7.1.4 on Oct. 28 · Added to KEV

CISA warns federal agencies that attackers are actively exploiting CVE-2026-119977, a TOCTOU-based WordPress Core RCE flaw.1 Wordfence reported blocking 13,095 attacks in the past 24 hours.1 A related wp2shell chain involved CVE-2026-63030 and CVE-2026-60137, with 18,500 records stolen in September.1

Updated Since Nov 3: CISA Adds WordPress Core Flaw to Exploited Catalogue · CVE-2026-119977 · New: bleepingcomputer.com, thehackernews.com

Added to CISA KEV: CVE-2026-60137 on 21 Jul 2026; CVE-2026-63030 on 21 Jul 2026; CVE-2026-119977 on 3 Nov 2026 · CVE-2026-119977: CVSS 8.1, EPSS 0.01 (FIRST); CVE-2026-63030: EPSS 0.11 (FIRST) and 1 more

  1. 1BLEEPINGCOMPUTER · CISA Flags WordPress RCE Flaw as Actively Exploited in Attacks

Copy link to “CISA Flags Actively Exploited WordPress Flaw”

P2Patch

Google Releases Chrome Security Update

Chrome 157.0.8103.38 · Fixes 213 issues, including seven rated Critical

Google issued Chrome 157 to the stable channel on Nov. 3, 2026, for Windows, Mac, Linux, and Android; the update fixes 213 security issues, including seven rated Critical.1 The update includes fixes for ANGLE memory corruption enabling remote code execution, a Prerender use-after-free, and a Dawn buffer overflow in WebGPU.1

CVE-2026-121229: CVSS 9.6, EPSS <0.01 (FIRST); CVE-2026-121035: CVSS 9.6, EPSS <0.01 (FIRST) and 1 more

  1. 1MALWAREBYTES LABS · Chrome 157 fixes 213 security issues including 7 critical flaws

Copy link to “Google Releases Chrome Security Update”

P1Phishing

Phishing Campaign Uses Calendar Invites to Hijack Sessions

Material Security named the operation CloudFire · 68,676 messages blocked · 2,112 malicious URLs analyzed · 897 domains taken down

Since mid-August 2026, attackers used Google Calendar invites to harvest live Google sessions; a live reverse proxy fronted the sign-in page, capturing credentials and relaying SMS or authenticator codes to bypass MFA.1 Over a month, Material Security blocked 68,676 messages, analyzed 2,112 malicious URLs, and took down 897 domains.1

  1. 1BLEEPINGCOMPUTER · Google Calendar Phishing Hijacks Sessions, Bypasses MFA

Copy link to “Phishing Campaign Uses Calendar Invites to Hijack Sessions”

Known exploited

Added 4 Nov1 vulnerability added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2024-27834Apple Multiple Products4 Nov18 Nov

Source: CISA KEV catalogue, version 2026.11.10 (released 10 Nov 2026; read by SitRep 10 Nov 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

The wire, last 30 days

This edition has 2 stories rated critical or elevated (P0 or P1); the 23 daily editions from 6 Oct to 3 Nov averaged 3.6. 6 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
4 Nov (this edition)0210
3 Nov0310
2 Nov0211
1 Nov0300
31 Oct1210
30 Oct1400
29 Oct1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300
12 Oct2200
9 Oct1310
8 Oct2300
7 Oct1310
6 Oct1310

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

Chromium CVE-2026-119260 Use-After-Free Vulnerability Reported by Microsoft Security Response Center

Microsoft’s Security Update Guide lists Chromium vulnerability as a use-after-free flaw. The entry attributes the issue to Chromium and directs readers to the MSRC update guide for details.

5 reports

Cyberattack Exploits Danfoss AK-SM/AK-SC Refrigeration in France

France's blood service said a cyberattack on a refrigeration equipment provider raised temperatures at three facilities. The supplier Coolworld Rentals reported a third-party vulnerability; EFS continued operations and transferred affected products. The incident followed broader European attacks on cooling systems.

5 reports

APT29-Linked Group hijacks analytics to deliver iOS and Android exploits

APT29 runs a watering hole campaign via compromised Websites and the Plerdy SEO Tracker supply chain, injecting JavaScript to profile visitors and route to platform-specific exploit chains. iOS Class A/B use DarkSword with CVE-2025-43529 and other CVEs; Android Class C uses CVE-2026-3910 and CVE-2025-27038 to exfiltrate data and deliver AndroSnitch.

3 reports

SonicWall Won’t Patch End-of-Life GMS Flaws Exposing Data

SonicWall warns two end-of-life GMS flaws (affecting GMS 9.5.2 and earlier) will not be patched. CVE-2026-109593 allows unauthenticated file reads; CVE-2026-109594 enables post-auth SQL injection. No remediation will be released; upgrade to NSM is advised. Earlier, CVE-2026-102255 was fixed, with active exploitation in the wild (2,541 attempts from eight IPs since Oct 9, 2026; up to 30 on Nov 3).

2 reports

Cisco Advances Notification of Nov 4, 2026 Security Advisories

Cisco PSIRT disclosed three advisories on November 4, 2026: CVE-2026-76506 in Cisco UCS Central Software (RCE, High 7.6), CVE-2026-76419 in Cisco Unified Communications Manager (XSS, Medium 6.1), and CVE-2026-20241 in Cisco Identity Services Engine (Authorization Bypass, Medium 5.3).

2 reports

Two Canadians Charged in University Hacking for Crypto-Mining

Two Canadians, Ryan Roach and Mathiew Stubbings, were indicted for hacking US universities to mine cryptocurrency, steal credentials, and damage computers. They used offshore VPS to compromise networks in New York, Tennessee, North Carolina, and Massachusetts, stored stolen logins, and damaged at least 10 machines with at least $5,000 in losses. Roach was extradited Oct 28 and arraigned Nov 3.

2 reports

Malicious cPGuard Updates in OpsShield Supply Chain Attack

Attackers used compromised credentials to access OpsShield’s update CDN and served malicious cPGuard updates. Affected versions 5.88.12–5.88.19, with fake updates distributed for about 70 minutes. About 2,950 servers executed the updates; 7,900 client account records were copied. 32 files were collected; a hidden root shell and SSH/MySQL credentials were planted and later rotated.

2 reports

Also reported

End of the Wednesday, November 4, 2026 edition.

Colophon

SitRep · Vol. 1, No. 46

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.