Week 45, 2026

The week in five bullets — the five developments that mattered most, one sentence each.

• VulnCheck detected in-the-wild exploitation of CVE-2026-58115 in Node-RED, installing Linux bots and webshells on unprotected servers. VulnCheck detects in-the-wild exploitation of CVE-2026-58115 deploying a Linux bot and webshells.
• North Korean hackers tricked a Binance engineer into downloading malware via fake job interview, enabling $6.3B theft through social engineering and AI tooling. Binance engineer downloaded malware during fake job interview, enabling $6.3B theft via social engineering and AI tooling.
• CISA added active exploitation of BeyondTrust Remote Support probes and WordPress core upgrades to KEV catalog. Probes target BeyondTrust Remote Support versions 26.2.3 and earlier; CISA added to KEV with active exploitation.
• Citrix disclosed critical unauthenticated host takeover flaw in XenServer 8.4 and 9 requiring only management network access. CVE-2026-98432 in XenServer 8.4 and 9 requires management network access for unauthenticated host takeover.
• CISA added CVE-2026-119977 WordPress TOCTOU race condition to KEV catalog after active exploitation. CISA added CVE-2026-119977 to its KEV catalog after attackers exploited the high-severity TOCTOU race condition in WordPress core upgrades.

Exploitation & threats — 4-7 bullets: trends, actors, notable KEV additions.

• North Korean TraderTraitor group stole more than $6.3B from Binance via fake interviews and malware. Binance engineer downloaded malware during fake job interview, enabling $6.3B theft via social engineering and AI tooling.
• Volt Typhoon used silent zero-day attacks on critical infrastructure through rotating compromised devices. Volt Typhoon uses silent train for zero-day attacks; Cursor extension has SSH backdoor and Polymarket loses $2.7M to hack.
• APT29 targeted iOS and Android users through hijacked websites and a compromised Ukrainian analytics service. Sekoia linked APT29 to a mid-October 2026 campaign targeting iOS and Android via hacked sites and compromised analytics service.
• CISA added CVE-2026-119977, a TOCTOU race condition in WordPress core upgrades, to KEV catalog after active exploitation. CISA added CVE-2026-119977 to its KEV catalog after attackers exploited the high-severity TOCTOU race condition in WordPress core upgrades.
• CISA added CVE-2026-19868, a single-factor authentication vulnerability in SonicWall SonicOS SSLVPN, to KEV catalog. [KEV ADDITIONS THIS WEEK (3): CVE-2026-19868: SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability (SonicWall SonicOS SSLVPN) https://zerohour.day/cves/CVE-2026-19868]
• Attackers compromised nearly 1,000 Zyxel GS1900 switches via pre-authentication RCE before vendor patch. Attackers compromised nearly 1,000 Zyxel GS1900 switches via pre-authentication RCE before Zyxel patched the flaw.

Patch priorities — 4-8 bullets, one line each: CVE, product, what to do (the fixed version or mitigation when given; "see vendor advisory" only when no fix detail is given). Exploited first.

• CVE-2026-58115, Node-RED, upgrade to V4.3.4.1. VulnCheck detects in-the-wild exploitation of CVE-2026-58115 deploying a Linux bot and webshells.
• CVE-2026-98432, XenServer 8.4 and 9, apply Citrix fixes via Normal and Early Access channels. CVE-2026-98432 in XenServer 8.4 and 9 requires management network access for unauthenticated host takeover.
• CVE-2026-119977, WordPress core upgrades, apply patches released after October 12. CISA added CVE-2026-119977 to its KEV catalog after attackers exploited the high-severity TOCTOU race condition in WordPress core upgrades.
• CVE-2026-19868, SonicWall SonicOS SSLVPN, apply SonicWall update. [KEV ADDITIONS THIS WEEK (3): CVE-2026-19868: SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability (SonicWall SonicOS SSLVPN) https://zerohour.day/cves/CVE-2026-19868]
• CVE-2024-27834, Apple iOS iPadOS macOS Safari tvOS watchOS, see vendor advisory. CISA added CVE-2024-27834, an Apple Multiple Products Improper Authentication Vulnerability, to its KEV Catalog due to active exploitation.
• CVE-2026-97229, GitLab, upgrade to 19.4.2 19.3.5 or 19.2.8. CISA added CVE-2026-97229 to KEV catalog; over 1,000 unpatched GitLab instances exposed to exploitation.
• CVE-2026-7273, Zyxel GS1900 switches, upgrade to latest firmware. Attackers compromised nearly 1,000 Zyxel GS1900 switches via pre-authentication RCE before Zyxel patched the flaw.
• CVE-2026-111357 and CVE-2026-118527, Ivanti Connect Secure, apply Ivanti updates. Attackers chained both flaws with CVE-2026-104935 for VPN footholds; federal deadlines are November 2 and November 13.

Breaches & ransomware — 3-6 bullets: victims, sectors, numbers; claimed vs confirmed.

• North Korean TraderTraitor stole $6.3B from Binance through fake interviews and malware, with $2.85B frozen across 11 blockchains. Binance engineer downloaded malware during fake job interview, enabling $6.3B theft via social engineering and AI tooling.
• Hackers accessed Crédit Mutuel Arkéa bank accounts via third-party provider for up to $133 million in fraudulent transactions. Attackers exploited a third-party provider to withdraw up to $133 million from the bank's accounts.
• French Blood Establishment reported supplier cyberattack affecting refrigeration monitoring at three cold-storage facilities. France's national blood service confirms supplier cyberattack raised temperatures in three cold-storage facilities.
• BYOD hackers mistakenly targeted University of New Mexico hospital and offered $2,500 payments to patients. BYOD hackers offered $2,500 to affected patients after mistakenly targeting the hospital.
• FBI blamed North Korean TraderTraitor for record $6.43B crypto theft from Binance using automated transactions and DeFi. FBI urges crypto platforms to block TraderTraitor addresses and prevent fund laundering.

AI — 3-6 bullets: releases, research, safety, industry.

• OpenAI released GPT-6 Cyber model with 48.5% on ExploitGym benchmark and 99.93% in-scope behavior without deployment prompt. OpenAI reports 48.5% on ExploitGym, up from 32.1%, and 99.93% in-scope behavior without the deployment prompt.
• OpenAI raised $11 billion to reach $1.25 trillion valuation as Anthropic nears IPO. OpenAI raises $11 billion to reach $1.25 trillion valuation as Anthropic nears IPO
• IBM patched four critical vulnerabilities in Langflow versions 1.0.0 to 1.12.8 including two rated 9.8 CVSS. The patches fix four vulnerabilities in Langflow versions 1.0.0 to 1.12.8, including two critical ones rated 9.8 CVSS, and affect Hono framework upgrades.
• Microsoft research analyzed 2,056 exploited CVEs and found 78% allow system takeover or privilege escalation. Attackers prioritize flaws giving remote code execution or privilege escalation, with patch times ranging from two weeks to over a year.
• New models released including moonshotai/Kimi-K3.1-Pro, ricursiveAI/Ripple-65B-Preview, NousResearch/Arete-27B and others. [NEW MODELS: moonshotai/Kimi-K3.1-Pro, ricursiveAI/Ripple-65B-Preview 65B, NousResearch/Arete-27B 27B, ISTA-DASLab/DeepSeek-V4.1-Flash-1017-GSQ-RCO-Coder-GGUF, Scantist/GLM-5.3-SLIM-GGUF, RikiyaT/Qwen3.5-0.8B-weight-space-programming 0.8B, Comfy-Org/RelayVSR, ConwayResearch/Underdog-Woof, VideoRebirthAI/hyperflow-h3-flash, tencent/Qwen3.8-27B-DSpine-b16 27B]

By the numbers — a compact markdown table from NUMBERS.

Metric	Count
Stories	1873
CVEs	3574
KEV	3
Leaks	258
Breaches	1
Models	10

Outlook — 3-4 bullets on what to watch next week (deadlines, pending patches, open questions).

• Federal agencies must complete patching of Ivanti Connect Secure flaws by November 13.
• Monitor pending patches for critical vulnerabilities with fix dates in next week.
• Assess impacts of new AI models including moonshotai/Kimi-K3.1-Pro on security research.
• Watch for further exploitation of over 1,000 unpatched GitLab instances and WordPress upgrades.