Daily DefSec Brief·Nov 5, 2026·4m

APT29-linked phone exploits, Zyxel patch bypass, White House proxy | Cyber Security News Nov 5

Show notes

1. APT29 hits out-of-date phones from hacked websites - CVE-2024-27834, CVE-2025-14174, CVE-2025-27038 (+ 5 more) - federal due 2026-11-18 - Do: Require current iOS and Android versions on phones - https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain

2. Update: Zyxel exploit beats the June patch - CVE-2026-107441, CVE-2026-7273 - Fixed: 2.90(xxxx.3)C0 - Do: Patch Zyxel GS1900 switches and change passwords - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026

3. DreamHost breach exposed FTP logins for two months - Do: Check DreamHost-hosted sites for changed files - https://www.dreamhost.com/news/announcements/october-security-incident/

4. APT flaw lets a tampered download run as root - CVE-2026-109518 - Fixed: 2.6.2, 3.0.4, 3.3.3ubuntu0.1, 3.2.1ubuntu0.1, 2.8.4ubuntu0.1, 2.4.15ubuntu0.1, 2.2.5 - Do: Update APT on Debian and Ubuntu servers - https://lists.debian.org/debian-security-announce/2026/msg00526.html

5. Xen flaws let one guest VM take the host - CVE-2026-102703, CVE-2026-102704 - Fixed: xen-4.17.7-4.2.xcpng8.3 - Do: Patch and reboot Xen and XenServer hosts - https://support.citrix.com/external/article/CTX697256

6. Web traffic ZIP files can hijack Snort 3 - CVE-2026-20043 - Fixed: FTD 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2; Snort 3.12.4.0 - Do: Upgrade Cisco Secure Firewall Threat Defense - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe

7. Foglight for Databases fixes three critical flaws - CVE-2026-92188, CVE-2026-92189, CVE-2026-92190 - Fixed: 8.3 - Do: Upgrade Quest Foglight for Databases - http://www.zerodayinitiative.com/advisories/ZDI-26-854/

8. SonicWall won't patch end-of-life GMS flaws - CVE-2026-109593, CVE-2026-109594 - Do: Replace SonicWall GMS with Network Security Manager - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019

9. DigiCert migration left internal system exposed - Do: Re-check what's reachable after every migration - https://bugzilla.mozilla.org/show_bug.cgi?id=2084460

10. White House network was a residential proxy exit - Do: Hunt for proxyware on company machines - https://krebsonsecurity.com/2026/11/want-to-rent-an-internet-address-at-the-white-house/

← Previous

Stolen Entra app secrets, cPGuard update hijack, Binance fake interview | Cyber Security News Nov 4

Hackers tied to APT29 are serving exploits for already-patched flaws to out-of-date phones, the Zyxel looting exploit beats June's patch, and the White House network was a rentable proxy. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: What got your team to enforce a minimum phone OS version? Reply in the comments or at [email protected] . 1. APT29 hits out-of-date phones from hacked websites - CVE-2024-27834, CVE-2025-14174, CVE-2025-27038 (+ 5 more) - federal due 2026-11-18 - Do: Require current iOS and Android versions on phones - https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain 2. Update: Zyxel exploit beats the June patch - CVE-2026-107441, CVE-2026-7273 - Fixed: 2.90(xxxx.3)C0 - Do: Patch Zyxel GS1900 switches and change passwords - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026 3. DreamHost breach exposed FTP logins for two months - Do: Check DreamHost-hosted sites for changed files - https://www.dreamhost.com/news/announcements/october-security-incident/ 4. APT flaw lets a tampered download run as root - CVE-2026-109518 - Fixed: 2.6.2, 3.0.4, 3.3.3ubuntu0.1, 3.2.1ubuntu0.1, 2.8.4ubuntu0.1, 2.4.15ubuntu0.1, 2.2.5 - Do: Update APT on Debian and Ubuntu servers - https://lists.debian.org/debian-security-announce/2026/msg00526.html 5. Xen flaws let one guest VM take the host - CVE-2026-102703, CVE-2026-102704 - Fixed: xen-4.17.7-4.2.xcpng8.3 - Do: Patch and reboot Xen and XenServer hosts - https://support.citrix.com/external/article/CTX697256 6. Web traffic ZIP files can hijack Snort 3 - CVE-2026-20043 - Fixed: FTD 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2; Snort 3.12.4.0 - Do: Upgrade Cisco Secure Firewall Threat Defense - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe 7. Foglight for Databases fixes three critical flaws - CVE-2026-92188, CVE-2026-92189, CVE-2026-92190 - Fixed: 8.3 - Do: Upgrade Quest Foglight for Databases - http://www.zerodayinitiative.com/advisories/ZDI-26-854/ 8. SonicWall won't patch end-of-life GMS flaws - CVE-2026-109593, CVE-2026-109594 - Do: Replace SonicWall GMS with Network Security Manager - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019 9. DigiCert migration left internal system exposed - Do: Re-check what's reachable after every migration - https://bugzilla.mozilla.org/show_bug.cgi?id=2084460 10. White House network was a residential proxy exit - Do: Hunt for proxyware on company machines - https://krebsonsecurity.com/2026/11/want-to-rent-an-internet-address-at-the-white-house/