Three-day deadlines don't leave room
for a missed email.
CyberComply monitors the CISA KEV catalog 24/7 and alerts you within minutes of every new listing, so the clock never starts without you.
KEV Brief: November 3, 2026
Eight KEV entries are due or overdue this week, and most are about chaining and exposure rather than isolated bugs. Several deadlines have already passed, and one is only three days out. Prioritize by internet exposure first, then by what the exploit hands the attacker. Three of these entries also extend attacks we have been tracking for weeks: the Ivanti Connect Secure zero-day chain, PHP2Shell, and the Node.js Brotli flaw.
Unauthenticated Code Execution on Internet-Facing Platforms
The most urgent group is unauthenticated paths to code execution on widely deployed, externally reachable software.
CVE-2026-119977 (WordPress Core) is a TOCTOU race condition that allows unauthenticated server-side code execution during the upgrade window. During a full-package core upgrade, WordPress unpacks the new files, including its installer, into a predictable, web-accessible folder under wp-content/upgrade/, and an attacker who reaches that folder in the seconds before cleanup can run code. It affects WordPress 4.7 through 7.1.3. The fix is 7.1.4, with security releases for every older branch back to 4.7 (including 7.0.8, 6.9.11, and 6.8.12). WordPress 4.6 and older get no fix. The deadline is November 6.
Two points matter more than the severity score. Wordfence rates it 8.1, while WordPress's own advisory rates it Low, because an attacker has to win a race lasting seconds. But attackers are trying at scale: Wordfence logged about 18,500 exploitation attempts in the first 21 hours after release, and The Hacker News reported nearly 63,000 in 24 hours. And because the vulnerable moment is the upgrade itself, the act of patching opens the window. So the order of operations matters:
- Block web access to
wp-content/upgrade/first, at the web server, WAF, or reverse proxy. - Then update to 7.1.4 or your branch's security release.
- Then review your access logs for requests to
wp-content/upgrade/, and check web directories for unexpected PHP files.
Auto-update fleets and managed hosts deserve scrutiny, since you may not control upgrade timing. Ask your host whether the folder is blocked.
CVE-2026-97229 (GitLab CE/EE) is an integer overflow that lets an unauthenticated user execute arbitrary code through a crafted regular expression in a CI/CD configuration. Fixed versions are 19.2.8, 19.3.5, and 19.4.2. The deadline was November 1, so it is overdue. A compromised GitLab server is a software supply chain compromise, not just a host compromise. If you were exposed and unpatched, assume exposure of CI/CD variables, runner registration tokens, deploy keys, and signing material. Rotate those secrets, audit recent pipeline and config changes, and check runners for unexpected jobs. Self-managed instances reachable from the internet should be restricted to VPN or allowlists until verified.
CVE-2026-111497 (Google Brotli), nicknamed "Node2Shell," is a flaw in the Brotli decoder. A crafted compressed stream can corrupt decoder state memory, leak memory contents, cause denial of service, or potentially lead to code execution. The deadline is November 10. It was first disclosed in Node.js's October 21 security release, and the exposure is broader than "Google Brotli" suggests:
- Node.js is fixed in 22.23.4, 24.22.1, and 26.12.1; Node 20 and earlier get no fix. Node's built-in
fetchdecompresses Brotli responses automatically, and some frameworks decompress Brotli request bodies, so applications are exposed even if they never call the decoder directly. - .NET received an emergency update from Microsoft.
- HTTP servers, proxies, clients, CDNs, and container base images built on vulnerable Brotli copies are also affected.
Because Brotli is a library, not a product, the hard part is inventory. Use SBOMs and image scanning to find vendored copies, and expect vendor-by-vendor patch timing. After patching, restart affected processes and rebuild container images. Where you can't patch quickly, blocking or disabling Brotli on inbound traffic at the edge is a reasonable stopgap, accepting the bandwidth cost, but it does nothing for compressed responses your applications fetch from other servers.
Ivanti and Linux: Chains Over Single Bugs
Both entries in this section complete chains that began with flaws already in the catalog. If you patched the earlier flaws and moved on, you are not finished.
Ivanti Connect Secure has two new entries, both added October 30. They are the remaining pieces of the zero-day chain Volexity disclosed in October, which began with CVE-2026-104935 (added to KEV October 13, deadline October 16).
- CVE-2026-111357 is the privilege escalation that took attackers from the web server account to root, by abusing how the appliance's dsinvoked service trusts its DSCache configuration data. Its deadline was November 2 (overdue).
- CVE-2026-118527 is a predictable-filename issue that lets an authenticated remote attacker upload attacker-controlled files to a known disk location. It is due November 13.
The October fix for CVE-2026-104935 did not close these. Ivanti said at the time that the privilege escalation fix would come in a later release, and reporting on the new advisory lists 22.8R2.5, the October build, among the affected versions. Organizations that patched in October need this update too. Reporting points to 25.1.1.3 and 22.8R2.6 as fixed builds, but published version lists conflict, so confirm against Ivanti's current advisory. Don't let the staggered deadlines split the work: patching only one piece leaves a partial chain.
Because this chain was used to steal Active Directory credentials, LAPS passwords, and BitLocker recovery keys from fully patched appliances, assume compromise is possible until you have checked:
- Do not rely on Ivanti's Integrity Checker Tool. The attackers modified code only in memory and restored what they changed, so the tool is unlikely to detect this activity. Network and memory forensics are required.
- Hunt web logs for bursts of requests to
/dana-na/auth/url_default/welcome.cgicarrying anX-DSCGI-PATHheader, and check/tmp/on the appliance. - Rotate credentials and certificates handled by the appliance, reset VPN user sessions, and rotate LAPS passwords and BitLocker keys domain-wide.
CVE-2026-46300 (Linux Kernel), nicknamed "Fragnesia," is a missing variable initialization bug. It breaks shared-fragment tracking during socket buffer coalescing, so ESP input processing decrypts shared fragments in place and can modify page-cache-backed data. It is chained with PHP2Shell (CVE-2026-109618 and CVE-2026-109619) to implant PHP webshells and run commands as root. The deadline was October 31 and is overdue.
This is the second stage of PHP2Shell: PHP2Shell gives an attacker code execution as the web server account, and Fragnesia turns that into root. Any Linux web server that was exposed to PHP2Shell before it was patched should be checked for this follow-on, not only hosts that run IPsec.
- Patch the kernel, or use live patching where available. Fragnesia is not fixed by the earlier "Dirty Frag" kernel patches, so confirm your distribution's update covers this CVE specifically.
- On internet-facing hosts that do not terminate IPsec, unload the
esp4andesp6modules to remove the attack path until you can patch. - Hunt for modified web content and unexpected PHP files, and remember that page-cache tampering may not match on-disk file hashes.
- If you suspect compromise, capture memory before rebooting or dropping caches. Both clear the poisoned page cache, but they also erase the evidence.
Edge and Infrastructure Resilience: Firewall DoS and Hypervisor Logging
CVE-2026-76418 (Cisco Secure Firewall ASA and FTD) is an unchecked return value leading to a NULL pointer dereference that lets an unauthenticated remote attacker force a device reload. The deadline was November 1 (overdue). Though the impact is only denial of service, repeated reloads of a perimeter firewall create outages and can degrade security posture during failover. Cisco ASA/FTD devices have been repeatedly targeted, so treat this as a priority. Confirm HA pairs are patched in sequence, review logs for unexplained reloads, and treat unexplained crashes as possible exploitation or reconnaissance.
CVE-2026-41709 (Broadcom VMware ESX) is an insufficient logging flaw that lets an attacker with admin access perform certain operations without being logged. The deadline is November 11. It needs privileged access, so it is a post-compromise anti-forensics enabler rather than an entry point. Its KEV listing implies attackers are using it to hide activity on hypervisors. Patch, but also forward ESX logs off-host, restrict management network access, and review hypervisor activity from before the patch with the assumption that gaps may exist. Compare against vCenter and network telemetry.
Deadline Priorities
- Overdue: Linux kernel (CVE-2026-46300), Cisco ASA/FTD (CVE-2026-76418), GitLab (CVE-2026-97229), Ivanti (CVE-2026-111357)
- Imminent: WordPress (CVE-2026-119977), November 6. Block
wp-content/upgrade/before you update. - Upcoming: Brotli/Node2Shell and Adobe Commerce/Magento CVE-2026-48356 (November 10), ESX (November 11), Ivanti CVE-2026-118527 (November 13). Pull the Ivanti fix forward, since it completes an active chain.
Under BOD 26-04, federal contractors should evaluate each asset's exposure, apply vendor mitigations, and complete forensic triage on overdue, internet-facing systems. Where no mitigation exists, discontinue use.
Sources: CISA KEV Catalog · CISA Binding Operational Directives · WordPress Security Advisory GHSA-4w3m-c66w-69mg · Wordfence: WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE · Ivanti Security Advisories · Volexity: Chained Exploitation of Ivanti Connect Secure Zero-Days · CSO Online: PHP2Shell plus Fragnesia · BleepingComputer: CISA Warns of Node2Shell Exploitation · Node.js October 2026 Security Releases · Cisco Security Advisories · GitLab Releases · Broadcom VMware Security Advisories · Linux Kernel CVE Announcements
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — November 5, 2026
Active Exploitation Confirmed Against Siemens Industrial Devices and BTCPay Server Cryptocurrency Infrastructure
Researchers report active exploitation of CVE-2026-58115, a maximum-severity vulnerability in Siemens SIMATIC IoT2050 devices, enabling remote attackers to execute arbitrary code and deploy Linux bot payloads, according to The Hacker News. The flaw affects industrial IoT gateway devices used in manufacturing and critical infrastructure environments, though operational details of successful compromises have not been independently verified. Separately, attackers exploited a vulnerability in BTCPay Server versions 2.4.1 and earlier to steal Bitcoin and Litecoin from hot wallets in ongoing cryptocurrency theft campaigns, The Hacker News reports. BTCPay Server is an open-source cryptocurrency payment processor used by merchants and exchanges, though the number of affected installations and total cryptocurrency losses remain undisclosed. Neither campaign attribution nor overlap with known threat actor clusters has been established.
European Refrigeration Infrastructure Attack and North Korean Cryptocurrency Laundering Activity
Multiple sources report cyberattacks on November 2 altered refrigeration control systems at European supermarkets and French blood banks, forcing stores to discard food and raising concerns about operational technology vulnerabilities. Reuters, RTE, and ABC News documented the incidents, though attribution, technical exploitation methods, and the full scope of affected facilities remain under investigation. Separately, blockchain analysts observed North Korea-linked TraderTraitor group resuming laundering operations for proceeds from the Binance breach, routing ether through THORChain to convert to bitcoin, CoinDesk reports. The activity appears linked to the $6.3 billion Binance compromise reported yesterday, though exact transaction volumes and destination wallets have not been fully mapped.
Additional Exploitation and Compromise Disclosures
CISA added a patched Apple vulnerability (CVE-2024-27834) to its Known Exploited Vulnerabilities catalog after confirming exploitation to deliver information-stealing malware, The Hacker News reports. Security Week documented China-linked actors exploiting PHP2Shell flaws chained with the Fragnesia kernel privilege escalation vulnerability to gain root access on Palo Alto Networks firewalls and deploy webshells. Researchers reported exploitation of Chrome and Qualcomm Adreno GPU driver flaws to infect Android devices through malicious websites, Android Authority reports, though campaign scale and victim counts remain unconfirmed. A French banking firm confirmed experiencing a "sophisticated attack" with reports estimating $133 million stolen, The Record reports, though the bank has not disclosed technical details or attribution. A U.S. federal grand jury indicted two Canadian nationals for allegedly hacking multiple U.S. universities to conduct cryptocurrency mining operations, SC Media reports.
Sources: The Hacker News · The Hacker News · Reuters · RTE · CoinDesk · The Record · Security Week · Android Authority · SC Media
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls
Chinese APT group Warp Panda exploited a VMware ESX zero-day vulnerability to hide their tracks while chaining other exploits to compromise firewall s...
Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets
Attackers exploited a vulnerability in BTCPay Server versions 2.4.1 and earlier to steal Bitcoin and Litecoin from hot wallets in ongoing cryptocurren...
Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors
CVE-2026-58115, a maximum-severity flaw in Siemens SIMATIC IoT2050 devices, is under active exploitation allowing remote attackers to execute arbitrar...
Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes
Russian state-sponsored threat actor Midnight Blizzard targeted iOS and Android users in Europe and the US with zero-click exploits through a large-sc...
OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run
#1 Trusted Cybersecurity News Platform ... The development is once again an indication of how frontier AI is redrawing the contours of cybersecurity ....
Volt Typhoon Silent Train Network Tied to 4 US Zero-Day Campaigns
Volt Typhoon's Silent Train covert operational relay framework is tied to 4 zero-day campaigns on US critical infrastructure with confirmed C2 IPs.
Vapor Panda's ARTEX AI Campaign: How China-Nexus Hackers Automated Attacks on 200+ Organizations
A Chinese APT group deployed multi-agent AI to simultaneously breach telecoms, governments, and pharma firms across 14 countries, compressing the enti...
Binance Suffers Cyberattack Resulting in Theft of Approximately $6.3 Billion in Digital Assets
Binance, a global cryptocurrency exchange, suffered a cyberattack resulting in the theft of approximately $6.3 billion after attackers compromised a D...
Updated daily