Good morning. Singapore’s CSA says attackers are still taking over Metabase dashboards with a no-login SQL injection, so self-hosted instances need the patched build and a credentials pass. WatchGuard fixed four AuthPoint Gateway bugs that hit MFA sync, Apache OFBiz closed unauthenticated RCE paths in 24.09.08, and CISA’s WordPress upgrade-window deadline is today.
Coffee first. Then the Metabase version check, the AuthPoint Gateway installer, the OFBiz upgrade, and a quick pass over any WordPress site still below 7.1.4.
Lead Story
Metabase: unauthenticated SQL injection still being exploited for admin access. Singapore’s CSA re-alerted on November 4. Upgrade your 58–63 branch, block the reset-password endpoint until you do, then revoke sessions and rotate connected database credentials.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Also Worth Your Attention
WatchGuard AuthPoint Gateway: four flaws, three critical, fixed in 7.6.0. The gateway does not auto-update. Download the installer from the management UI and confirm each host shows green.
Apache OFBiz before 24.09.08: unauthenticated RCE on the login path. CVE-2026-83542 and related bugs landed in the November 4 drop. Upgrade every instance and keep stragglers off the public internet.
CISA’s WordPress KEV due date is today, November 6. We flagged the listing on November 4. Confirm 7.1.4 (or the patched branch build) and review logs from any recent full-package Core upgrade.
Slack paste
Today’s brief: (1) Metabase CVE-2026-72898 still exploited — upgrade 58–63 branches, revoke sessions, rotate DB creds. (2) AuthPoint Gateway → 7.6.0 (manual install). (3) OFBiz → 24.09.08 for unauth RCE. (4) WordPress KEV due today — confirm 7.1.4 and check last upgrade logs.
Go Deeper
Identity and access: IAM library. Tools and checkers: cybersecurity tools. Working a Metabase or WordPress hunt this week? Our CySA+ exam guide walks the analyst workflow.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
