Skip to content
Friday, November 6, 2026Nov 6, 2026
Previous issue

Vol. 1, No. 48Composed Nov 7 · 00:52 UTC

SitRep

Cybersecurity, in perspective.

1 critical · 3 elevated5 stories on the wire

Scale tests ethics; automation magnifies inattention.
— Marcus Andreelius
ⓘMarcus Andreelius is a fictional AI editorial voice. This reflection is original editorial prose, not a quotation.

You are reading a previous issue. Go to the latest edition →

The situation

Actors Target Europe’s Refrigeration Systems

Unit 42 reports supermarket spoilage and fires; advisories cover Cisco, OpenSSH, SonicWall, and Windows vulnerabilities.

5 sources

Unit 42, Cisco PSIRT Security Advisories, The Hacker News, CISA KEV catalogue, Cisco Talos Vulnerability Reports

Unit 42 reports unidentified threat actors targeted Europe’s refrigeration systems and defrosting units, causing spoilage across hundreds of supermarkets. It estimates about 700 stores in France were hit on Oct. 11–12, followed by 100–115 locations across more than 10 countries on Nov. 1–2. Unit 42 identified more than 5,000 internet-exposed devices; some reached 50°C (122°F), triggering fires.

Context

Unit 42 reports that NoName057(16) and Z-Pentest claimed involvement; its account identifies the actors as unidentified. CISA issued an advisory, according to Unit 42.

Zeno Khosla

Skeptical perspective

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

Unit 42 Reports Claims of Involvement

Unit 42 identifies the threat actors as unidentified and reports that NoName057(16) and Z-Pentest claimed involvement.

Unit 42

The move

One thing to do today

Epictim Draper

  1. Patch OpenSSH 10.6p2 on musl-based systems with PAM disabled.

On the wire

  • 1critical
  • 3elevated
  • 1moderate
  • 0low
P0Intelligence

Actors Target Europe’s Refrigeration Systems

About 700 France stores · 100–115 locations across 10+ countries · More than 5,000 internet-exposed devices

Unit 42 reports unidentified threat actors targeted Europe’s refrigeration systems and defrosting units, causing spoilage across hundreds of supermarkets.1 Unit 42 estimates about 700 stores in France were hit on Oct. 11–12, and 100–115 locations across more than 10 countries were affected on Nov. 1–2; some devices reached 50°C (122°F), triggering fires.1 Unit 42 identified more than 5,000 internet-exposed devices.1

Single sourceUnit 42

  1. 1UNIT 42 · Attacks on Europe’s Refrigeration Systems Exposed Internet

Copy link to “Actors Target Europe’s Refrigeration Systems”

P1Exploit

Cisco Warns of Node.js and Brotli Flaws

CVE-2026-111497 · CVE-2026-105482 · CVE-2026-105483 · CVE-2026-106069

Cisco warns that Node.js and Brotli vulnerabilities across its 22.x, 24.x, and 26.x product lines could enable remote code execution and traffic interception.1 Cisco says affected products are under investigation, no workarounds are provided, and fixes are expected between November 2026 and March 2027.1

Updated Since Oct 30: PHP2SHELL Attacks Achieve Root on Palo Alto Firewalls · New: recordedfuture.com, github.com

Timeline

  1. 1 earlier appearance
  2. Oct 29Brotli Decoder Buffer Overflow Risks PAN-OS Dataplane
  3. Oct 30PHP2SHELL Attacks Achieve Root on Palo Alto Firewalls
  4. Oct 31Brotli Decoder Overflow Affects Palo Alto PAN-OS
  5. Weekend, Oct 31Microsoft Details Brotli Decoder Buffer Overflow
  6. Nov 5Cisco Advises on Node.js and Brotli Flaws
  7. This edition

Added to CISA KEV on 27 Oct 2026 (CVE-2026-111497) · CVE-2026-111497: CVSS 9.2, EPSS 0.83 (FIRST), patch listed (GitHub); CVE-2026-105482: CVSS 7.4, EPSS <0.01 (FIRST) and 2 more

  1. 1CISCO PSIRT SECURITY ADVISORIES · Vulnerabilities in Node.js and Brotli Affecting Cisco Products

Copy link to “Cisco Warns of Node.js and Brotli Flaws”

P1News

OpenSSH Flaw Allows Oversized Password Logins

CVE-2026-123158 · OpenSSH 10.6p2

The Hacker News reports CVE-2026-123158, also called SSHole, affects musl-based systems with PAM disabled and allows unauthenticated attackers to log in to password-disabled accounts using oversized passwords.1 The Hacker News reports exploitation within hours of disclosure to gain root access on an Alpine Linux honeypot running OpenSSH; OpenSSH 10.6p2 is the patch.1

CVE-2026-123158: CVSS 8.1, EPSS <0.01 (FIRST); CVE-2016-6210: EPSS 0.89 (FIRST)

  1. 1THE HACKER NEWS · OpenSSH SSHole Flaw Exploited, Root Access on Honeypot

Copy link to “OpenSSH Flaw Allows Oversized Password Logins”

P1Exploit

CISA Lists SonicWall Vulnerability as Exploited

CVE-2026-19868

CISA added CVE-2026-19868 in SonicWall SonicOS SSLVPN to its Known Exploited Vulnerabilities catalogue on Nov. 6, 2026.1 The catalogue describes a vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls.1

Added to CISA KEV on 6 Nov 2026 (CVE-2026-19868) · CVE-2026-19868: CVSS 7.5

  1. 1CISA KEV CATALOGUE · CISA adds CVE-2026-19868 (SonicWall SonicOS SSLVPN) to its known exploited vulnerabilities catalogue

Copy link to “CISA Lists SonicWall Vulnerability as Exploited”

P2Exploit

Windows Cloud Files Driver Has Use-after-free

Affected driver version 10.0.26100.8457

Cisco Talos reports a use-after-free flaw in the Microsoft Windows Cloud Files Mini Filter Driver (cldflt.sys) that a crafted Cloud Filter API sequence can use to escalate privileges.1 Talos describes exploitation involving an orphaned timer-driven request and a use-after-free path in the driver.1

Updated Since Nov 1: NetamLoader Injects[.]NET Assemblies on Windows 10 · New: msrc.microsoft.com, cve.org, helpnetsecurity.com

Timeline

  1. Oct 31Windows Cloud Files Driver Permits Local Privilege Escalation
  2. Nov 1NetamLoader Injects[.]NET Assemblies on Windows 10
  3. This edition

CVE-2026-58613: EPSS <0.01 (FIRST); CVE-2023-29361: EPSS 0.04 (FIRST)

  1. 1CISCO TALOS VULNERABILITY REPORTS · Microsoft Windows Cloud Files Mini Filter Driver Use-After-Free Vulnerability

Copy link to “Windows Cloud Files Driver Has Use-after-free”

Known exploited

Added 6 Nov1 vulnerability added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-19868SonicWall SonicOS SSLVPN6 Nov20 Nov

Source: CISA KEV catalogue, version 2026.11.10 (released 10 Nov 2026; read by SitRep 10 Nov 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

The wire, last 30 days

This edition has 4 stories rated critical or elevated (P0 or P1); the 23 daily editions from 8 Oct to 5 Nov averaged 3.6. 6 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
6 Nov (this edition)1310
5 Nov0320
4 Nov2200
3 Nov0310
2 Nov0211
1 Nov0300
31 Oct1210
30 Oct1400
29 Oct1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300
12 Oct2200
9 Oct1310
8 Oct2300

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

GPT-6 Cyber Finds Firefox Flaws and Linux Bugs

GPT-6 Cyber discovers 81 Firefox flaws and exploits 948 Linux kernel flaws; identifies 2,308 potential Linux flaws, reproduces 1,724, and develops 948 local privilege escalation exploits. In ExploitGym, it shows 48.5% exploit success vs 32.1% for GPT-5.6 Cyber. OpenAI categorizes it as Critical, with access limited to Daybreak Red, which plans broader rollout.

5 reports

Activists Breach Microsoft Data Center Construction Site Amid Protests

More than 100 activists breached a Microsoft AI data center construction site in Amsterdam as protests spread across 16 countries. Stop Dirty Data Centers organized actions, including calls to pause large-scale construction. Pure Data Centers, backed by Oaktree, plans to invest more than $1 billion. Additional demonstrations targeted Dublin, Warsaw, and a Danish Microsoft data center.

5 reports

Chainalysis Breach Exposes Credentials for All Customers

Chainalysis says attackers exposed names, usernames, password hashes, and live tokens for all customers via an on-path/MITM attack; initial claims of non-sensitive data were updated. The login portal and related services were taken offline as credentials and API keys are rotated; customers were asked to provide trusted IPs to regain access and reset passwords.

3 reports

Exploited WordPress Flaw Fix Can Expose Sites During Update

WordPress flaw CVE-2026-119977 allows code execution during update if an attacker accesses the temporary wp-content/upgrade copy. A fix exists in WordPress 7.1.4 and older branches to 4.7, but updates may briefly expose installers. CISA added the flaw to known exploited vulnerabilities; blocking wp-content/upgrade and updating manually can mitigate risk.

2 reports

Vulnerabilities in PHP Affecting Cisco Products (October 2026)

Cisco warns of PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) affecting select products. PHP Foundation released critical fixes addressing two RCE flaws. Vulnerable Cisco products include URWB, Expressway, Duo Access Gateway, and ISE Portal Builder with fixes deployed or planned. Some products are confirmed not vulnerable.

2 reports

DigiCert Data Breach Impacts Business Customer Information

Hackers created an internal self-registration account on DigiCert’s archived data system, which lacked MFA and exposed names, emails, phone numbers, and business addresses. The data resided on a network segment moved in February 2025, and the unauthorized read-only access occurred between June 27 and July 2.

2 reports

Residential Proxies Found on White House Network

Layer3 Intel reports six IPs on AS2650 used by 28 residential proxy services between Oct 5 and Nov 3, exiting via the White House network 236 times. Activity clustered 5 p.m.–midnight ET, suggesting a person with a proxy-enabled device. Traffic stems from Windows 11 machines using InfaticaSDK; Infatica claims access to over 45 million addresses.

2 reports

Also reported

End of the Friday, November 6, 2026 edition.

Colophon

SitRep · Vol. 1, No. 48

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.