What's going on in security: 1–8 November, in a nutshell

I read the week so the coffee can happen first. Window: 1–8 November 2026, collected through 8 November, Europe/Bratislava. Curated pack, not a census. Vectors below were saved from NVD, scoring source named. NVD hosting a score does not mean NIST wrote it.

Patch this before your coffee gets cold

KEV-confirmed exploitation, plus the OpenSSH case that already got root on a honeypot.

SonicWall will take the other password

NVD and KEV, both 6 November. Valid credentials for an alternate authentication method can bypass SAML enforcement, potentially including SAML-enforced MFA. Not a universal unauthenticated MFA bypass. Affected builds: Gen7 through 7.3.3-7015 and Gen8 through 8.2.2-8015. CVSS 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N, source 134c704f-9b21-4f2e-91b3-4a467353bcc0 (CISA-ADP). BleepingComputer reports the vendor score as 7.1. Keep both. In the wild per KEV. Ransomware use unknown. Attack details were not in the collected reporting. No workaround: 7.3.4-7013 or 8.2.3-8015, or a later supported fix, and review VPN authentication records. A product:"SonicWALL SSL-VPN" banner proves neither SAML nor the firmware.

OpenSSH, if the setup is specifically unlucky

CVE-2026-123158 (SSHole): disclosure and NVD publication 5 November, exploitation reporting 6 November. Alpine and the 10.6p2 notes describe a narrow password-authentication bypass on musl systems such as affected Alpine. Every condition has to hold: PAM absent or disabled, password authentication enabled, an accessible account with * in its password field, and a local $5$ or $6$ hash. A banner is a name tag. CVSS 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, source [email protected]. The Hacker News, citing Previdian, reports attempts and successful root on an Alpine honeypot. That does not demonstrate widespread production compromise. An earlier NVD SSVC classified a public PoC, reflecting an earlier assessment. Install 10.6p2 or the distribution backport, restart sshd, and disable password authentication only after keys work.

WordPress saved the last shift for the updater

Published in NVD on 31 October, outside this window. Inside it: KEV on 3 November, and a 6 November update-window analysis. A briefly reachable staged installer can allow unauthenticated code execution during affected full-package core updates. The update installing the fix may still run the old updater. Reported affected maintained releases: 4.7–7.1.3, and accessibility and update conditions matter. Fixed in 7.1.4 or the fixed branch. CVSS 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, source [email protected]. KEV confirms exploitation. Wordfence reports attempts beginning nine minutes after its firewall rule was deployed. Ransomware use unknown.

GitLab: crafted CI/CD regular expressions, unauthenticated server-side arbitrary code execution, on 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2. CVSS 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, source [email protected]. KEV confirms exploitation. Patch to 19.2.8, 19.3.5 or 19.4.2, or a later fixed release, and investigate suspicious CI/CD activity.

Apple: an attacker who already has arbitrary read and write may bypass Pointer Authentication. CVSS 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, source [email protected]. KEV confirms in-the-wild exploitation. Not a standalone remote unauthenticated compromise. No Shodan or GreyNoise counts; affected-device numbers unknown. Install current Apple updates. Original fixes included iOS/iPadOS 17.5 or 16.7.8, Safari 17.5, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5.

Worth knowing

Barracuda, demonstrated, not confirmed in the wild

NVD published both on 2 November. Research reporting is 6 November. CVE-2026-116606, an authorization bypass, can restore an attacker-crafted backup and obtain administrative access. Chained to authenticated command injection CVE-2026-111560, that permits root. CVSS 4.0 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X and 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X, source [email protected] for both. Research demonstration and a public attack chain. No confirmed in-the-wild exploitation in the collected evidence. NVD SSVC: exploitation none at its assessment date. Apply Barracuda’s patches and inspect administrative and backup-restore activity.

Chainalysis, and the tokens were live

The Hacker News, 6 November 2026, 09:04 CET. BleepingComputer too. Chainalysis said the incident exposed names, usernames, password hashes and live tokens for all users. Reactor and Data Solutions access was removed during the investigation. At the cited update the company reported no evidence investigations data had been accessed. Do not read that as proof no such access occurred. No CVE in the collected reporting. An actual breach, per the company’s statements, not a PoC. Revoke sessions and tokens, rotate through their incident guidance, investigate downstream token use. No user count was collected. A user count would not be a host count.

The settings file remembered the secret

7 November 2026, 07:44 CET. Apiiro reported 1,122 public copies of the Claude Code approval-settings file. Approved command strings can include passwords and API keys verbatim in .claude/settings.local.json. 1,122 is a GitHub file-copy count, not unique live credentials and not compromised organizations. No CVE. Public secret exposure is reported. This collection has no confirmed downstream abuse and no country breakdown. Rotate, remove the secrets from history and from the settings, and keep that file out of version control.

TV boxes, second job

Krebs, 3 November 2026, 03:24 CET. The Hacker News, 2 November. Operational takedown: late October. Google and partners disrupted a botnet of more than 1.3 million Android devices, largely TV boxes, used as proxies and for advertising fraud. Krebs separately reports potential loss of access to over 10 million additional compromised systems. Distinct reported populations, not a summed inventory. No single CVE. Third-party estimates, not Shodan or GreyNoise, and no country breakdown. Isolate suspected devices, replace unsupported or pre-compromised hardware with supported trusted devices, and audit proxy traffic.

Ivanti dates, corrected

An earlier digest grouped CVE-2026-111357 and CVE-2026-118527 as late-October issues. 111357 fits: local root through DSCache trust handling in the dsinvoked broker, published 15 October, KEV 30 October, CVSS 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, source [email protected]. 118527 does not. NVD published it on 3 November. KEV is recorded as 30 October. Publication and KEV dates differ. Authenticated upload to a predictable disk location. CVSS 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, source 3c1d8aa1-5a33-4ea4-8992-aadd6440af75. Fixes in the CVE description: 25.1.1.3 or 22.8R2.6 or later. Exploitation is confirmed by KEV for both. No Shodan or GreyNoise country measurements. Follow the vendor advisory, upgrade, and perform compromise checks.

Meanwhile in the underground

Forum watch began 7 November, not a continuous week. No new verified November breach or ransomware campaign came out of it.

Boannews, 2 November: DarkForums and Dread accessible again after PHP-related downtime, and a BreachForums-branded site accessible too. Operator continuity is unverified.

On 7 November a public index under the Niflheim name showed ads for credentials, session cookies, account checkers, Android RATs and wallet drainers. Unverified seller claims. I am not linking the market.

Flare, 23 October, updated 29 October: PHP exploit-development discussion on Exploit.in and XSS, forum patching, honeypot-observed exploitation. PHP, 21 October, plus 23 and 26 October follow-ups, names CVE-2026-109618 and CVE-2026-109619, fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Reconfirm against the primary advisory. Still older: Europol seized original LeakBase, 4 March 2026; RAMP seizure reported 28 January 2026; KELA, 23 July 2025, DARK4RMY rebranded to DarkForums. Searchlight is context and its page date is unreliable. SOCRadar is an overview. Themes: credential and session monetization, October PHP exploit interest, cloned or rebranded forums.

Open services, not victims

Snapshot: 7 November 2026, 11:44 CET. Compare countries inside one panel. The y-axes do not match.

Queries: product:"SonicWALL SSL-VPN", product:"OpenSSH", http.component:"WordPress". Seven countries are a cut. They do not sum to Global.

GreyNoise, saved snapshot: OpenSSH 6 source IPs (HK 2, CN 1, NL 1, JP 1, GB 1). Seven-country cut: CN 1, and US, RU, CZ, SK, DE, CH at 0. SonicWall and WordPress: 0 globally and in all seven. Exact vuln: queries for the three CVEs: zero indexed matches. That is not zero vulnerable systems.

11:26 CET globals differed: OpenSSH 41,548,753; WordPress 1,419,777; SonicWall 2,062. I am not mixing that pass with 11:44. The 8 November digest, without saved raw results, approximated SonicWall 2,041, OpenSSH ~41.5 million, WordPress ~1.42 million, GitLab http.component:"GitLab" 5,449 (GreyNoise 0), Barracuda ~5 title fingerprints (GreyNoise 0), OpenSSH GreyNoise 10. Digest only. Not a trend.

Rejected as a vulnerable-host count: Alpine product/OS filters returned 0; OpenSSH alpine was one Docker-registry page; product:"OpenSSH" "musl" returned 133 (131 on follow-up), with inspected Debian/Ubuntu samples matching coincidental public-key text. WordPress 7.1.3 in HTML: 416 matches (US 194, CN 10, RU 3, CZ 3, SK 0, DE 41, CH 2). A version string, not verified vulnerability, and not a population bound.

Then finish the cup

• SonicWall 7.3.4-7013 or 8.2.3-8015, then VPN auth logs.
• WordPress: deny /wp-content/upgrade/, then 7.1.4.
• OpenSSH 10.6p2 only if you are the musl case. 41,558,249 is banners.
• GitLab 19.2.8 / 19.3.5 / 19.4.2 if those branches are yours.
• Apple: current updates. Read/write still has to come first.
• Barracuda patches, and a look at backup restores.
• Ivanti: upgrade and a compromise check. 118527’s fixes are 25.1.1.3 or 22.8R2.6 or later.
• Rotate Chainalysis tokens and anything in .claude/settings.local.json.
• Replace the mystery TV box.

The week was loud. The vulnerable-host count, for every CVE above, is still unknown. Quote that, or don’t quote me.