ITsecurity Daily
Daily Briefing
CISA adds an actively exploited WordPress Core flaw to its KEV catalog, and a day of supply-chain and credential compromises
Good morning. CISA added one vulnerability to its Known Exploited Vulnerabilities catalog on 3 November, based on evidence of active exploitation: a WordPress Core time-of-check time-of-use (TOCTOU) race condition vulnerability. CISA's alert says this class of flaw "is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise." Federal Civilian Executive Branch agencies must remediate under Binding Operational Directive 26-04; anyone running WordPress Core should match their estate against the advisory and apply the vendor's fix. If you run WordPress, treat this as the day's priority.
Two supply-chain-style compromises hit software you trust by default. BleepingComputer reported that attackers hijacked the autoupdate infrastructure of the cPGuard web security suite to push a backdoor and a data-stealing script to users. Separately, The Hacker News reported that an email sent on 3 November in the name of mSeven Software urged customers of the mSecure password manager to change passwords, reset two-factor authentication, and remove passkeys after suspicious activity. If you use either product, act on the vendor's instructions now.
Two breaches stemmed from compromised access. SecurityWeek reported that Frontline Education suffered a data breach affecting over 1.3 million people, after hackers exploited a flaw in third-party software and stole personal information on school district staff and students. BleepingComputer reported that WorkOS was breached after a threat actor accessed business contact records and customer communication summaries, with WorkOS saying the attacker used the ARTEX AI tool to breach an internal sales app.
Zoom out: AI ran through the day's reporting — an NCSC threat assessment, Google's LLMjacking cost figures, and a breach WorkOS attributes to the ARTEX AI tool.
Vulnerability in focus
CVE-2026-118527 — Ivanti. CVSS 4.3 CISA lists it as known to be exploited.
Affected: ivanti-cs.
What to do: Follow the vendor advisory for the fixed release and any interim mitigation.
Elsewhere
- Help Net Security: Ghostunnel: Open-source TLS proxy with mutual authentication Read it
- Help Net Security: Secure your containers without breaking what works Read it
- BleepingComputer: Hackers hijack cPGuard autoupdate to deploy backdoor, steal data Read it
- CISA: CISA Adds One Known Exploited Vulnerability to Catalog Read it
- The Hacker News: mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious Activity Read it
- The Record: Several German lawmakers and foreign policy staff received Apple warnings on spyware Read it
- BleepingComputer: Google: LLMjacking attacks rack up $1 million in cloud AI charges Read it
- The Record: British businesses caught in Europe-wide supermarket fridge attacks Read it
- The Hacker News: Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access Read it
- CISA: Subnet Solutions PowerSYSTEM Center Read it
- The Register: Password manager mSecure tells users to change passwords, won't say why Read it
- The Hacker News: cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes Read it
Sources
- Hackers hijack cPGuard autoupdate to deploy backdoor, steal data BleepingComputer
- North Korean fake job interview led to $6.3B Binance heist The Register
- Google dismantles massive botnet hidden in Android TV boxes The Record
- mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious Activity The Hacker News
- Frontline Education Data Breach Impacts Over 1.3 Million SecurityWeek
- Police seize over 100 servers linked to investment fraud with more than €4 million in losses Help Net Security
- AIs Hacking the Law Schneier on Security
- CISA Adds One Known Exploited Vulnerability to Catalog CISA
- Artificial intelligence and cyber intrusion NCSC
- Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies Krebs on Security
- WorkOS says attacker used ARTEX AI to breach internal sales app BleepingComputer
- Binance says fake job interview led to $6.3 billion crypto heist BleepingComputer
- Google: LLMjacking attacks rack up $1 million in cloud AI charges BleepingComputer
- Several German lawmakers and foreign policy staff received Apple warnings on spyware The Record
Share this issue
Facebook · X · Reddit · LinkedIn · WhatsApp · Email · Bluesky
Every briefing is on the site, with the advisory record behind it. All briefings