Apple flaw exploited in the wild, added to CISA KEV
An improper authentication bug lets an attacker with read/write capability bypass pointer authentication. CISA lists it as actively exploited. It affects iOS, iPadOS, macOS, Safari, tvOS and watchOS.
Affects: Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS
WordPress core flaw exploited during upgrades, CISA warns
CISA added a high-severity WordPress Core flaw (CVE-2026-119977, CVSS 8.1) to its KEV catalogue after attacks were seen in the wild. It is reportedly an RCE issue exploited during software upgrades.
Affects: WordPress sites
Debian and Ubuntu APT flaw lets attackers run code as root
An attacker who can modify package downloads can swap a verified package for their own, and the code runs as root. Debian, Ubuntu and APT developers published advisories on 4 November.
Affects: Debian and Ubuntu systems using APT
Google patches critical Android remote code execution flaw
Google's November bulletin fixes CVE-2026-58868, which could let an attacker run code on a phone without any user interaction. It affects Android 14 through 17.
Affects: Android 14 to 17 devices
SonicWall won't patch two flaws in end-of-life GMS
SonicWall warned of two vulnerabilities in end-of-life Global Management System software, including one rated CVSS 9.1 (CVE-2026-109593). No fixes will be released, so the risk stays.
Affects: SonicWall GMS 9.5.2 and earlier
Cisco ISE authorisation bypass exposes endpoint identity certificates
An unauthenticated remote attacker could obtain an endpoint identity certificate from Cisco ISE or ISE-PIC because of improper authorisation. Cisco published the advisory on 4 November.
Affects: Cisco Identity Services Engine and ISE Passive Identity Connector
Barracuda warns of two flaws giving attackers root access
Barracuda Networks told customers to patch two vulnerabilities that let attackers run commands with root privileges on its devices.
Affects: Barracuda devices (see vendor advisory for models)
Xen flaws let a rogue VM read and write other VMs' memory
Two Xen hypervisor flaws let a malicious guest access the memory of other VMs on the host, including dom0. Patches are out, and there is no known mitigation.
Affects: Xen hypervisor hosts
Node.js and Brotli fixes affect multiple Cisco products
Node.js released fixes on 21 October for several flaws in the Brotli decoder, DNS resolution and TLS certificate validation. Cisco has listed the impact on its products.
Affects: Node.js 22.x, 24.x and 26.x; some Cisco products
DreamHost breach exposed customers' FTP logins and webmail sessions
Attackers had access to DreamHost's File Manager platform for two months and stole customer FTP/SFTP usernames and passwords. Client sites hosted there may be exposed.
Affects: DreamHost customers
VMware brings back low-end virtualisation with vSphere Express
VMware is launching vSphere Express, capped at 128 cores and sold through distributors' marketplaces. It could give MSPs a cheaper option for small clients.
Affects: Small-business VMware customers
NSW Health server targeted in cyber incident
A NSW Health server was targeted in a cyber incident. Cybercrime detectives have taken over the investigation. No further details were available.
Affects: NSW Health
This is what you get — free, in your inbox.
Subscribers also get the full “From the Floor” take with every issue — not just the summary you just read.
Written from 12 years on the helpdesk floor. Always free.