Cybersecurity

Thursday’s brief: APT can install a swapped package, then Rails uploads, Xen hosts and old phones

Thursday’s brief: APT can install a swapped package, then Rails uploads, Xen hosts and old phones

APT CVE-2026-109518 package swap to root, the critical Rails Active Storage ImageMagick flaw, Xen XSA-523 guest escape and Apple CVE-2024-27834 on CISA KEV.
CISA lists an old Apple bug as exploited, and a spy campaign is using it on phones that missed updates

CISA lists an old Apple bug as exploited, and a spy campaign is using it on phones that missed updates

CISA added Apple CVE-2024-27834 to KEV on November 4 (due November 18). Sekoia ties it to an APT29 watering-hole campaign hitting old iOS and Android Chrome. Which phones to update or retire.
Xen hosts: one malicious VM can read and write every other VM’s memory. Patch the hypervisor and reboot

Xen hosts: one malicious VM can read and write every other VM’s memory. Patch the hypervisor and reboot

Xen XSA-523 (CVE-2026-102703, CVE-2026-102704) lets a malicious guest read and write any VM memory, including dom0, on Xen 4.6 and later. XCP-ng, Qubes and source patches.
Rails apps that use ImageMagick: one crafted upload can write files on the server. Upgrade this week

Rails apps that use ImageMagick: one crafted upload can write files on the server. Upgrade this week

Critical Rails flaw GHSA-f3w6-w445-fwh9 (9.8) lets a crafted upload write files through ImageMagick in Active Storage. Who is affected, Rails 8.1.4.1 and 8.0.5.2, policy checks and secret rotation.
Debian and Ubuntu machines: an APT flaw lets a network attacker swap in a package that runs as root. Update APT first

Debian and Ubuntu machines: an APT flaw lets a network attacker swap in a package that runs as root. Update APT first

CVE-2026-109518 lets an on-path attacker swap a verified .deb when APT retries a download. Fixed apt versions for Debian 12/13 and Ubuntu 22.04 to 26.10, HTTPS sources and checks.
Wednesday’s brief: Barracuda gateways go from no login to root, then Chrome 157, cPGuard and WordPress

Wednesday’s brief: Barracuda gateways go from no login to root, then Chrome 157, cPGuard and WordPress

Barracuda CVE-2026-116606 chain to root, Chrome 157 critical fixes, the cPGuard update channel hijack and WordPress CVE-2026-119977 on CISA KEV with a November 6 deadline.
CISA now lists the WordPress update bug as exploited. Patch, then check your last update

CISA now lists the WordPress update bug as exploited. Patch, then check your last update

CISA added WordPress Core CVE-2026-119977 to its KEV catalog on November 3 with a November 6 deadline and forensic triage. Confirm 7.1.4 or your branch release and review logs around core updates.
Hosting servers running cPGuard: hijacked updates copied password hashes and SSH keys. Update, then rotate

Hosting servers running cPGuard: hijacked updates copied password hashes and SSH keys. Update, then rotate

OPSSHIELD says cPGuard 5.88.12 to 5.88.19 shipped a backdoor that copied /etc/shadow, MySQL settings and root SSH files on November 2. Update to 5.88.25, check install_log and rotate credentials.
Chrome 157 fixes seven critical bugs. Push it and make browsers restart

Chrome 157 fixes seven critical bugs. Push it and make browsers restart

Chrome 157 (157.0.8103.38/.39) fixes 213 security bugs, including critical CVE-2026-121156, CVE-2026-121035 and CVE-2026-121126. Desktop, Android and Extended Stable versions and rollout checks.
Barracuda email gateways: two bugs go from no login to root. Confirm the November 2 patch landed

Barracuda email gateways: two bugs go from no login to root. Confirm the November 2 patch landed

Barracuda CVE-2026-116606 (9.3) and CVE-2026-111560 (8.6) chain to root on Email Security Gateway; the command injection also hits WAF, ADC, BMA, WCC and WSG. Patch numbers and checks.
Tuesday’s brief: Linux servers need a kernel reboot, then TeamViewer, Android phones and unpatched GitLab

Tuesday’s brief: Linux servers need a kernel reboot, then TeamViewer, Android phones and unpatched GitLab

Linux kernel CVE-2026-98432 fixed kernels and reboots, TeamViewer CVE-2026-111585 viewer flaw, the November Android update and 1,000+ GitLab servers still open to CVE-2026-97229.
Run your own GitLab? More than 1,000 servers still have the bug attackers use. Upgrade, then update Runner

Run your own GitLab? More than 1,000 servers still have the bug attackers use. Upgrade, then update Runner

Shadowserver counts over 1,000 GitLab servers open to exploited CVE-2026-97229 and 11,300 to CVE-2026-110264. Upgrade to 19.5.3 or your branch release and update GitLab Runner to 19.5.1.
Company Android phones: November’s update fixes a flaw that needs no tap. Check every patch level

Company Android phones: November’s update fixes a flaw that needs no tap. Check every patch level

The Android November 2026 bulletin fixes critical Framework flaw CVE-2026-58868 and System bugs CVE-2026-58876 and CVE-2026-58936. Patch levels 2026-11-01 and 2026-11-05 and fleet checks.