Daily Brief

Friday’s brief: Metabase still under exploit, then AuthPoint, OFBiz and today’s WordPress deadline

Friday’s brief: Metabase still under exploit, then AuthPoint, OFBiz and today’s WordPress deadline

Metabase CVE-2026-72898 still exploited, WatchGuard AuthPoint Gateway 7.6.0, Apache OFBiz 24.09.08 unauth RCE and WordPress CVE-2026-119977 KEV due November 6.
CISA’s WordPress upgrade-window deadline is today. Confirm 7.1.4 and check the last Core update

CISA’s WordPress upgrade-window deadline is today. Confirm 7.1.4 and check the last Core update

CISA KEV due date for WordPress CVE-2026-119977 is November 6. Confirm 7.1.4 or the patched branch build and review logs from recent full-package Core upgrades.
Apache OFBiz before 24.09.08: unauthenticated code execution on the login path. Upgrade this week

Apache OFBiz before 24.09.08: unauthenticated code execution on the login path. Upgrade this week

Apache OFBiz CVE-2026-83542 and related unauthenticated RCE and auth-bypass bugs fixed in 24.09.08. Who is affected, upgrade steps and log checks.
WatchGuard AuthPoint Gateway: four authentication flaws, three of them critical. Install 7.6.0 by hand

WatchGuard AuthPoint Gateway: four authentication flaws, three of them critical. Install 7.6.0 by hand

WatchGuard AuthPoint Gateway CVE-2026-121639, CVE-2026-121638, CVE-2026-121640 and CVE-2026-121637. Install Gateway 7.6.0 manually and verify status.
Self-hosted Metabase: attackers are still using a no-login SQL injection to become admin. Upgrade your branch today

Self-hosted Metabase: attackers are still using a no-login SQL injection to become admin. Upgrade your branch today

CVE-2026-72898 lets an unauthenticated attacker inject SQL into Metabase and gain admin. Safe builds for branches 58–63, workaround, session revoke and credential rotation.
Thursday’s brief: APT can install a swapped package, then Rails uploads, Xen hosts and old phones

Thursday’s brief: APT can install a swapped package, then Rails uploads, Xen hosts and old phones

APT CVE-2026-109518 package swap to root, the critical Rails Active Storage ImageMagick flaw, Xen XSA-523 guest escape and Apple CVE-2024-27834 on CISA KEV.
CISA lists an old Apple bug as exploited, and a spy campaign is using it on phones that missed updates

CISA lists an old Apple bug as exploited, and a spy campaign is using it on phones that missed updates

CISA added Apple CVE-2024-27834 to KEV on November 4 (due November 18). Sekoia ties it to an APT29 watering-hole campaign hitting old iOS and Android Chrome. Which phones to update or retire.
Xen hosts: one malicious VM can read and write every other VM’s memory. Patch the hypervisor and reboot

Xen hosts: one malicious VM can read and write every other VM’s memory. Patch the hypervisor and reboot

Xen XSA-523 (CVE-2026-102703, CVE-2026-102704) lets a malicious guest read and write any VM memory, including dom0, on Xen 4.6 and later. XCP-ng, Qubes and source patches.
Rails apps that use ImageMagick: one crafted upload can write files on the server. Upgrade this week

Rails apps that use ImageMagick: one crafted upload can write files on the server. Upgrade this week

Critical Rails flaw GHSA-f3w6-w445-fwh9 (9.8) lets a crafted upload write files through ImageMagick in Active Storage. Who is affected, Rails 8.1.4.1 and 8.0.5.2, policy checks and secret rotation.
Debian and Ubuntu machines: an APT flaw lets a network attacker swap in a package that runs as root. Update APT first

Debian and Ubuntu machines: an APT flaw lets a network attacker swap in a package that runs as root. Update APT first

CVE-2026-109518 lets an on-path attacker swap a verified .deb when APT retries a download. Fixed apt versions for Debian 12/13 and Ubuntu 22.04 to 26.10, HTTPS sources and checks.
Wednesday’s brief: Barracuda gateways go from no login to root, then Chrome 157, cPGuard and WordPress

Wednesday’s brief: Barracuda gateways go from no login to root, then Chrome 157, cPGuard and WordPress

Barracuda CVE-2026-116606 chain to root, Chrome 157 critical fixes, the cPGuard update channel hijack and WordPress CVE-2026-119977 on CISA KEV with a November 6 deadline.
CISA now lists the WordPress update bug as exploited. Patch, then check your last update

CISA now lists the WordPress update bug as exploited. Patch, then check your last update

CISA added WordPress Core CVE-2026-119977 to its KEV catalog on November 3 with a November 6 deadline and forensic triage. Confirm 7.1.4 or your branch release and review logs around core updates.
Hosting servers running cPGuard: hijacked updates copied password hashes and SSH keys. Update, then rotate

Hosting servers running cPGuard: hijacked updates copied password hashes and SSH keys. Update, then rotate

OPSSHIELD says cPGuard 5.88.12 to 5.88.19 shipped a backdoor that copied /etc/shadow, MySQL settings and root SSH files on November 2. Update to 5.88.25, check install_log and rotate credentials.