SGRC Daily Cyber Brief - 05 Nov 2026

Read sourced cyber advisories and next steps, or connect your agent to check which entries match your software.

Issue date
Reference
SGRC-DCB-20261105
Last updated
Source checks recorded
Entries
20

Bottom line

  • What is listed. 3 of 20 entries are on CISA's Known Exploited Vulnerabilities list.
  • Past deadline. 1 entry has passed the US federal due date. The oldest was October 20, 2023.
  • Next deadline. 2 entries are still ahead of the US federal due date. The next is November 6, 2026.
  • Fix status. 2 of 4 entries list a fixed version in these records. Not listed does not mean no fix exists, so check the vendor advisory.
  • Canada. No entry carries a cited Canadian source. That does not establish that Canadian organizations are unaffected.

Findings

Open a row for affected versions, fix steps, checks and sources.

20 of 20 entries

Sorted by Issue order.

  1. Number 1Cisco IOS XE Web UICVE-2023-20198Widely deployedThe attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination.CVSS 10EPSS 99.6%Deadline passedCISA due Oct 20, 2023, passed

    What happened

    The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination.

    How to fix

    1. No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.
    2. CISA KEV required action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA. Federal due date 2023-10-20.
    3. Follow the vendor advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z
    4. Generic hardening for CWE-420 (Unprotected Alternate Channel), from the MITRE CWE catalog. This is general weakness guidance, not a vendor fix or workaround for this CVE. Phase: Architecture and Design. Identify all alternate channels and use the same protection mechanisms that are used for the primary channels.

    How to check

    Exposure check: Nuclei template https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-20198.yaml (community template; tests exposure, not compromise).

    Network detection: ET Open Suricata rule sid 2048936 in https://rules.emergingthreats.net/open/suricata-7.0/emerging-all.rules (community rule; test before use).

    Vendor guidance: "Indicators of Compromise" section at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z

    Affected versions

    • before 17.12.02
    • 16.12 up to, not including, 16.12.10a
    • 17.3 up to, not including, 17.3.8a
    • 17.6 up to, not including, 17.6.6a
    • 17.9 up to, not including, 17.9.4a

    Risk record

    Response
    Immediate
    Added to KEV
    Oct 16, 2023

    Sources

  2. Number 2WordPress WordPress CoreCVE-2026-119977This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.CVSS 8.1EPSS 1.2%Deadline aheadCISA due Nov 6, 2026

    What happened

    This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

    How to fix

    1. Upgrade WordPress WordPress Core to the fixed release for your branch: 4.7.39, 4.8.34, 4.9.35, 5.0.31, 5.1.28, 5.2.30, 5.3.27, 5.4.25, 5.5.24, 5.6.23, 5.7.21, 5.8.19, 5.9.20, 6.0.18, 6.1.16, 6.2.15, 6.3.14, 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4 or later (fixed versions per the NVD record).
    2. CISA KEV required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date 2026-11-06.

    Affected versions

    • 4.7 up to, not including, 4.7.39
    • 4.8 up to, not including, 4.8.34
    • 4.9 up to, not including, 4.9.35
    • 5.0 up to, not including, 5.0.31
    • 5.1 up to, not including, 5.1.28
    • 5.2 up to, not including, 5.2.30
    • 5.3 up to, not including, 5.3.27
    • 5.4 up to, not including, 5.4.25
    • 5.5 up to, not including, 5.5.24
    • 5.6 up to, not including, 5.6.23
    • 5.7 up to, not including, 5.7.21
    • 5.8 up to, not including, 5.8.19
    • 5.9 up to, not including, 5.9.20
    • 6.0 up to, not including, 6.0.18
    • 6.1 up to, not including, 6.1.16
    • 6.2 up to, not including, 6.2.15
    • 6.3 up to, not including, 6.3.14
    • 6.4 up to, not including, 6.4.14
    • 6.5 up to, not including, 6.5.14
    • 6.6 up to, not including, 6.6.11
    • 6.7 up to, not including, 6.7.11
    • 6.8 up to, not including, 6.8.12
    • 6.9 up to, not including, 6.9.11
    • 7.0 up to, not including, 7.0.8
    • 7.1 up to, not including, 7.1.4

    Fixed versions

    • 4.7.39
    • 4.8.34
    • 4.9.35
    • 5.0.31
    • 5.1.28
    • 5.2.30
    • 5.3.27
    • 5.4.25
    • 5.5.24
    • 5.6.23
    • 5.7.21
    • 5.8.19
    • 5.9.20
    • 6.0.18
    • 6.1.16
    • 6.2.15
    • 6.3.14
    • 6.4.14
    • 6.5.14
    • 6.6.11
    • 6.7.11
    • 6.8.12
    • 6.9.11
    • 7.0.8
    • 7.1.4

    Risk record

    Response
    Immediate
    Added to KEV
    Nov 3, 2026

    Sources

  3. Number 3Apple Multiple ProductsCVE-2024-27834An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.CVSS 5.5EPSS 1.4%Deadline aheadCISA due Nov 18, 2026

    What happened

    An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.

    How to fix

    1. No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.
    2. CISA KEV required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date 2026-11-18.
    3. Follow the vendor advisory: https://support.apple.com/en-us/120896
    4. Generic hardening for CWE-287 (Improper Authentication), from the MITRE CWE catalog. This is general weakness guidance, not a vendor fix or workaround for this CVE. Phase: Architecture and Design. Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

    Affected versions

    • before 17.5
    • before 16.7.8
    • 17.0 up to, not including, 17.5
    • before 14.5
    • before 10.5
    • before 2.44.2
    • 39
    • 40

    Risk record

    Response
    Immediate
    Added to KEV
    Nov 4, 2026

    Sources

  4. Number 4Zohocorp ManageEngine Key Manager PlusCVE-2026-77690ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that allowed authenticated users with certificate deployment privileges to execute arbitrary commands through specially crafted input when configuring a deployment target.CVSS 8.8EPSS 15.6%High EPSSCISA due None

    What happened

    ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that allowed authenticated users with certificate deployment privileges to execute arbitrary commands through specially crafted input when configuring a deployment target.

    How to fix

    1. Upgrade Zohocorp ManageEngine Key Manager Plus to 7151 or later (fixed versions per the CVE record).

    Affected versions

    • before 7151

    Fixed versions

    • 7151

    Risk record

    Response
    7 days

    Sources

  5. Number 5Updated Nov 4: Chainalysis Security Incident InformationChainalysis published a notice about a security incident. Read it for what happened and what to do.CVSS Does not applyEPSS Does not applyIncidentCISA due Does not apply

    What happened

    Chainalysis published a notice about a security incident. Read it for what happened and what to do.

    What to check

    1. Read the notice from www.chainalysis.com: https://www.chainalysis.com/blog/security-incident-october-30/

    Sources

  6. Number 6Update from mSecure TeammSecure published a notice about a security incident. Read it for what happened and what to do.CVSS Does not applyEPSS Does not applyIncidentCISA due Does not apply

    What happened

    mSecure published a notice about a security incident. Read it for what happened and what to do.

    What to check

    1. Read the notice from support.msecure.com: https://support.msecure.com/en/support/discussions/topics/36000039016

    Sources

  7. Number 7Synology urges users to update DSM following ransomware attacks on outdated DSM versionsSynology Inc.Synology published a notice about a security incident. Read it for what happened and what to do.CVSS Does not applyEPSS Does not applyIncidentCISA due Does not apply

    What happened

    Synology published a notice about a security incident. Read it for what happened and what to do.

    What to check

    1. Read the notice from www.synology.com: https://www.synology.com/en-global/company/news/article/C3RB3R/Synology%20urges%20users%20to%20update%20DSM%20following%20ransomware%20attacks%20on%20outdated%20DSM%20versions

    Sources

  8. Number 8Upland Unified School District: breach notice filed with the California Attorney GeneralUpland Unified School District reported a data breach to the California Attorney General on 2026-11-03. The filed notice is the source for details.CVSS Does not applyEPSS Does not applyIncidentCISA due Does not apply

    What happened

    Upland Unified School District reported a data breach to the California Attorney General on 2026-11-03. The filed notice is the source for details.

    What to check

    1. Read the notice from California Attorney General: https://oag.ca.gov/ecrime/databreach/reports/sb24-632351

    Sources

  9. Number 9Center Theatre Group of Los Angeles: breach notice filed with the California Attorney GeneralCenter Theatre Group of Los Angeles reported a data breach to the California Attorney General on 2026-11-03. The filed notice is the source for details.CVSS Does not applyEPSS Does not applyIncidentCISA due Does not apply

    What happened

    Center Theatre Group of Los Angeles reported a data breach to the California Attorney General on 2026-11-03. The filed notice is the source for details.

    What to check

    1. Read the notice from California Attorney General: https://oag.ca.gov/ecrime/databreach/reports/sb24-632320

    Sources

  10. Number 10Peninsula Corridor Joint Powers Board (Caltrain): breach notice filed with the California Attorney GeneralPeninsula Corridor Joint Powers Board (Caltrain) reported a data breach to the California Attorney General on 2026-11-03. The filed notice is the source for details.CVSS Does not applyEPSS Does not applyIncidentCISA due Does not apply

    What happened

    Peninsula Corridor Joint Powers Board (Caltrain) reported a data breach to the California Attorney General on 2026-11-03. The filed notice is the source for details.

    What to check

    1. Read the notice from California Attorney General: https://oag.ca.gov/ecrime/databreach/reports/sb24-632297

    Sources

  11. Number 11Hippo Analytics Inc.: breach notice filed with the California Attorney GeneralHippo Analytics Inc. reported a data breach to the California Attorney General on 2026-11-03. The filed notice is the source for details.CVSS Does not applyEPSS Does not applyIncidentCISA due Does not apply

    What happened

    Hippo Analytics Inc. reported a data breach to the California Attorney General on 2026-11-03. The filed notice is the source for details.

    What to check

    1. Read the notice from California Attorney General: https://oag.ca.gov/ecrime/databreach/reports/sb24-632296

    Sources

  12. Number 12DreamHost, LLC: breach notice filed with the California Attorney GeneralDreamHost, LLC reported a data breach to the California Attorney General on 2026-11-02. The filed notice is the source for details.CVSS Does not applyEPSS Does not applyIncidentCISA due Does not apply

    What happened

    DreamHost, LLC reported a data breach to the California Attorney General on 2026-11-02. The filed notice is the source for details.

    What to check

    1. Read the notice from California Attorney General: https://oag.ca.gov/ecrime/databreach/reports/sb24-632268

    Sources

  13. Number 13University of Mississippi Medical Center (“UMMC”): breach notice filed with the California Attorney GeneralUniversity of Mississippi Medical Center (“UMMC”) reported a data breach to the California Attorney General on 2026-11-02. The filed notice is the source for details.CVSS Does not applyEPSS Does not applyIncidentCISA due Does not apply

    What happened

    University of Mississippi Medical Center (“UMMC”) reported a data breach to the California Attorney General on 2026-11-02. The filed notice is the source for details.

    What to check

    1. Read the notice from California Attorney General: https://oag.ca.gov/ecrime/databreach/reports/sb24-632265

    Sources

  14. Number 14Cotton Incorporated: breach notice filed with the California Attorney GeneralCotton Incorporated reported a data breach to the California Attorney General on 2026-11-02. The filed notice is the source for details.CVSS Does not applyEPSS Does not applyIncidentCISA due Does not apply

    What happened

    Cotton Incorporated reported a data breach to the California Attorney General on 2026-11-02. The filed notice is the source for details.

    What to check

    1. Read the notice from California Attorney General: https://oag.ca.gov/ecrime/databreach/reports/sb24-632247

    Sources

  15. Number 15Hacking on Autopilot: Inside ARTEX Cybercrime CampaignsKey Points Introduction ARTEX is a Chinese open-source, AI-powered penetration testing platform designed to help security teams assess systems they own or are authorized to test.CVSS Does not applyEPSS Does not applyCampaignCISA due Does not apply

    What happened

    Key Points Introduction ARTEX is a Chinese open-source, AI-powered penetration testing platform designed to help security teams assess systems they own or are authorized to test.

    What to check

    1. Read the report from Check Point: https://research.checkpoint.com/2026/hacking-on-autopilot-inside-artex-cybercrime-campaigns/

    Sources

  16. Number 16The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat ActorsDarkSword is a new iOS exploit chain that leverages multiple zero-day vulnerabilities to fully compromise iOS devices.CVSS Does not applyEPSS Does not applyCampaignCISA due Does not apply

    What happened

    DarkSword is a new iOS exploit chain that leverages multiple zero-day vulnerabilities to fully compromise iOS devices.

    What to check

    1. Read the report from cloud.google.com: https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain

    Sources

  17. Number 17ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data ExfiltrationResearch by: Alexey Bukhteyev Key Takeaways Introduction Earlier this year, Check Point Research disclosed a security flaw in ChatGPT’s code-execution runtime that allowed sensitive conversation data to be silently exfiltrated to an...CVSS Does not applyEPSS Does not applyCampaignCISA due Does not apply

    What happened

    Research by: Alexey Bukhteyev Key Takeaways Introduction Earlier this year, Check Point Research disclosed a security flaw in ChatGPT’s code-execution runtime that allowed sensitive conversation data to be silently exfiltrated to an...

    What to check

    1. Read the report from Check Point: https://research.checkpoint.com/2026/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration/

    Sources

  18. Number 18The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603Kaspersky researchers analyze a complex fileless cyberattack by Storm-2603 involving ToolShell exploitation and subsequent runtime subversion, and discuss how to detect such intrusions. thumbnail Executive summary In 2025, several threat...CVSS Does not applyEPSS Does not applyCampaignCISA due Does not apply

    What happened

    Kaspersky researchers analyze a complex fileless cyberattack by Storm-2603 involving ToolShell exploitation and subsequent runtime subversion, and discuss how to detect such intrusions. thumbnail Executive summary In 2025, several threat...

    What to check

    1. Read the report from Kaspersky Securelist: https://securelist.com/storm-2603-fileless-toolshell-attack/121467/

    Sources

  19. Number 19Fake-download campaign uses trojanized installers to deliver monetization payloadsMicrosoft Threat Intelligence tracks a fake-download campaign that uses trojanized Inno installers to deliver multiple monetization offers and provides detection and investigation guidance across the complete installer session.CVSS Does not applyEPSS Does not applyCampaignCISA due Does not apply

    What happened

    Microsoft Threat Intelligence tracks a fake-download campaign that uses trojanized Inno installers to deliver multiple monetization offers and provides detection and investigation guidance across the complete installer session.

    What to check

    1. Read the report from Microsoft Security: https://www.microsoft.com/en-us/security/blog/2026/11/03/fake-download-campaign-uses-trojanized-installers-deliver-monetization-payloads/

    Sources

  20. Number 20Shutting the Door on the XCPE BotnetGoogle and industry partners have dismantled the XCPE backdoor and botnet, which was intentionally developed and operated by OEM Videostrong Technology Co. for financial gain.CVSS Does not applyEPSS Does not applyCampaignCISA due Does not apply

    What happened

    Google and industry partners have dismantled the XCPE backdoor and botnet, which was intentionally developed and operated by OEM Videostrong Technology Co. for financial gain.

    What to check

    1. Read the report from cloud.google.com: https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet

    Sources

Sources

Citations by publisher across this issue. Each row lists its own links. Sources checked November 5, 2026 at 12:29 p.m. EST.

Authorities
  • California Attorney General7
  • CVE Program4
  • GitHub Advisory Database4
  • NVD API4
  • CISA KEV3
  • OSV1
Vendors
  • Apple15
  • Cisco1
Affected organizations
  • support.msecure.com1
  • www.chainalysis.com1
  • www.synology.com1
Research teams
  • Check Point2
  • cloud.google.com2
  • Kaspersky Securelist1
  • Microsoft Security1
Press
  • The Hacker News4
  • BleepingComputer2
  • The Record2
  • Ars Technica1
  • CyberScoop1
  • Cybersecurity Journal CA1
  • KrebsOnSecurity1
  • SANS ISC1

Coverage is limited to the entries shown. Canadian context requires cited Canadian evidence; worldwide incident and campaign collection is still being expanded. The JSON Feed includes the matching data and original verification timestamps.