Three-day deadlines don't leave room
for a missed email.
CyberComply monitors the CISA KEV catalog 24/7 and alerts you within minutes of every new listing, so the clock never starts without you.
KEV Brief: November 3, 2026
Eight KEV entries are due or overdue this week, and most are about chaining and exposure rather than isolated bugs. Several deadlines have already passed, and one is only three days out. Prioritize by internet exposure first, then by what the exploit hands the attacker. Three of these entries also extend attacks we have been tracking for weeks: the Ivanti Connect Secure zero-day chain, PHP2Shell, and the Node.js Brotli flaw.
Unauthenticated Code Execution on Internet-Facing Platforms
The most urgent group is unauthenticated paths to code execution on widely deployed, externally reachable software.
CVE-2026-119977 (WordPress Core) is a TOCTOU race condition that allows unauthenticated server-side code execution during the upgrade window. During a full-package core upgrade, WordPress unpacks the new files, including its installer, into a predictable, web-accessible folder under wp-content/upgrade/, and an attacker who reaches that folder in the seconds before cleanup can run code. It affects WordPress 4.7 through 7.1.3. The fix is 7.1.4, with security releases for every older branch back to 4.7 (including 7.0.8, 6.9.11, and 6.8.12). WordPress 4.6 and older get no fix. The deadline is November 6.
Two points matter more than the severity score. Wordfence rates it 8.1, while WordPress's own advisory rates it Low, because an attacker has to win a race lasting seconds. But attackers are trying at scale: Wordfence logged about 18,500 exploitation attempts in the first 21 hours after release, and The Hacker News reported nearly 63,000 in 24 hours. And because the vulnerable moment is the upgrade itself, the act of patching opens the window. So the order of operations matters:
- Block web access to
wp-content/upgrade/first, at the web server, WAF, or reverse proxy. - Then update to 7.1.4 or your branch's security release.
- Then review your access logs for requests to
wp-content/upgrade/, and check web directories for unexpected PHP files.
Auto-update fleets and managed hosts deserve scrutiny, since you may not control upgrade timing. Ask your host whether the folder is blocked.
CVE-2026-97229 (GitLab CE/EE) is an integer overflow that lets an unauthenticated user execute arbitrary code through a crafted regular expression in a CI/CD configuration. Fixed versions are 19.2.8, 19.3.5, and 19.4.2. The deadline was November 1, so it is overdue. A compromised GitLab server is a software supply chain compromise, not just a host compromise. If you were exposed and unpatched, assume exposure of CI/CD variables, runner registration tokens, deploy keys, and signing material. Rotate those secrets, audit recent pipeline and config changes, and check runners for unexpected jobs. Self-managed instances reachable from the internet should be restricted to VPN or allowlists until verified.
CVE-2026-111497 (Google Brotli), nicknamed "Node2Shell," is a flaw in the Brotli decoder. A crafted compressed stream can corrupt decoder state memory, leak memory contents, cause denial of service, or potentially lead to code execution. The deadline is November 10. It was first disclosed in Node.js's October 21 security release, and the exposure is broader than "Google Brotli" suggests:
- Node.js is fixed in 22.23.4, 24.22.1, and 26.12.1; Node 20 and earlier get no fix. Node's built-in
fetchdecompresses Brotli responses automatically, and some frameworks decompress Brotli request bodies, so applications are exposed even if they never call the decoder directly. - .NET received an emergency update from Microsoft.
- HTTP servers, proxies, clients, CDNs, and container base images built on vulnerable Brotli copies are also affected.
Because Brotli is a library, not a product, the hard part is inventory. Use SBOMs and image scanning to find vendored copies, and expect vendor-by-vendor patch timing. After patching, restart affected processes and rebuild container images. Where you can't patch quickly, blocking or disabling Brotli on inbound traffic at the edge is a reasonable stopgap, accepting the bandwidth cost, but it does nothing for compressed responses your applications fetch from other servers.
Ivanti and Linux: Chains Over Single Bugs
Both entries in this section complete chains that began with flaws already in the catalog. If you patched the earlier flaws and moved on, you are not finished.
Ivanti Connect Secure has two new entries, both added October 30. They are the remaining pieces of the zero-day chain Volexity disclosed in October, which began with CVE-2026-104935 (added to KEV October 13, deadline October 16).
- CVE-2026-111357 is the privilege escalation that took attackers from the web server account to root, by abusing how the appliance's dsinvoked service trusts its DSCache configuration data. Its deadline was November 2 (overdue).
- CVE-2026-118527 is a predictable-filename issue that lets an authenticated remote attacker upload attacker-controlled files to a known disk location. It is due November 13.
The October fix for CVE-2026-104935 did not close these. Ivanti said at the time that the privilege escalation fix would come in a later release, and reporting on the new advisory lists 22.8R2.5, the October build, among the affected versions. Organizations that patched in October need this update too. Reporting points to 25.1.1.3 and 22.8R2.6 as fixed builds, but published version lists conflict, so confirm against Ivanti's current advisory. Don't let the staggered deadlines split the work: patching only one piece leaves a partial chain.
Because this chain was used to steal Active Directory credentials, LAPS passwords, and BitLocker recovery keys from fully patched appliances, assume compromise is possible until you have checked:
- Do not rely on Ivanti's Integrity Checker Tool. The attackers modified code only in memory and restored what they changed, so the tool is unlikely to detect this activity. Network and memory forensics are required.
- Hunt web logs for bursts of requests to
/dana-na/auth/url_default/welcome.cgicarrying anX-DSCGI-PATHheader, and check/tmp/on the appliance. - Rotate credentials and certificates handled by the appliance, reset VPN user sessions, and rotate LAPS passwords and BitLocker keys domain-wide.
CVE-2026-46300 (Linux Kernel), nicknamed "Fragnesia," is a missing variable initialization bug. It breaks shared-fragment tracking during socket buffer coalescing, so ESP input processing decrypts shared fragments in place and can modify page-cache-backed data. It is chained with PHP2Shell (CVE-2026-109618 and CVE-2026-109619) to implant PHP webshells and run commands as root. The deadline was October 31 and is overdue.
This is the second stage of PHP2Shell: PHP2Shell gives an attacker code execution as the web server account, and Fragnesia turns that into root. Any Linux web server that was exposed to PHP2Shell before it was patched should be checked for this follow-on, not only hosts that run IPsec.
- Patch the kernel, or use live patching where available. Fragnesia is not fixed by the earlier "Dirty Frag" kernel patches, so confirm your distribution's update covers this CVE specifically.
- On internet-facing hosts that do not terminate IPsec, unload the
esp4andesp6modules to remove the attack path until you can patch. - Hunt for modified web content and unexpected PHP files, and remember that page-cache tampering may not match on-disk file hashes.
- If you suspect compromise, capture memory before rebooting or dropping caches. Both clear the poisoned page cache, but they also erase the evidence.
Edge and Infrastructure Resilience: Firewall DoS and Hypervisor Logging
CVE-2026-76418 (Cisco Secure Firewall ASA and FTD) is an unchecked return value leading to a NULL pointer dereference that lets an unauthenticated remote attacker force a device reload. The deadline was November 1 (overdue). Though the impact is only denial of service, repeated reloads of a perimeter firewall create outages and can degrade security posture during failover. Cisco ASA/FTD devices have been repeatedly targeted, so treat this as a priority. Confirm HA pairs are patched in sequence, review logs for unexplained reloads, and treat unexplained crashes as possible exploitation or reconnaissance.
CVE-2026-41709 (Broadcom VMware ESX) is an insufficient logging flaw that lets an attacker with admin access perform certain operations without being logged. The deadline is November 11. It needs privileged access, so it is a post-compromise anti-forensics enabler rather than an entry point. Its KEV listing implies attackers are using it to hide activity on hypervisors. Patch, but also forward ESX logs off-host, restrict management network access, and review hypervisor activity from before the patch with the assumption that gaps may exist. Compare against vCenter and network telemetry.
Deadline Priorities
- Overdue: Linux kernel (CVE-2026-46300), Cisco ASA/FTD (CVE-2026-76418), GitLab (CVE-2026-97229), Ivanti (CVE-2026-111357)
- Imminent: WordPress (CVE-2026-119977), November 6. Block
wp-content/upgrade/before you update. - Upcoming: Brotli/Node2Shell and Adobe Commerce/Magento CVE-2026-48356 (November 10), ESX (November 11), Ivanti CVE-2026-118527 (November 13). Pull the Ivanti fix forward, since it completes an active chain.
Under BOD 26-04, federal contractors should evaluate each asset's exposure, apply vendor mitigations, and complete forensic triage on overdue, internet-facing systems. Where no mitigation exists, discontinue use.
Sources: CISA KEV Catalog · CISA Binding Operational Directives · WordPress Security Advisory GHSA-4w3m-c66w-69mg · Wordfence: WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE · Ivanti Security Advisories · Volexity: Chained Exploitation of Ivanti Connect Secure Zero-Days · CSO Online: PHP2Shell plus Fragnesia · BleepingComputer: CISA Warns of Node2Shell Exploitation · Node.js October 2026 Security Releases · Cisco Security Advisories · GitLab Releases · Broadcom VMware Security Advisories · Linux Kernel CVE Announcements
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — November 3, 2026
Coordinated Supermarket Refrigeration Attacks Expand Across European Union
A second wave of cyberattacks targeting supermarket refrigeration systems spread across at least seven European Union countries on Monday, with hackers remotely altering temperature controls to spoil perishable inventory, according to multiple security researchers and media outlets. Stores in Sweden, Estonia, Belgium, and other EU nations reported refrigerators and freezers heated to 50–55°C, forcing mass food withdrawals and equipment shutdowns, The Register and United24Media report. The campaign follows similar attacks on French grocery stores in October and incidents at U.S. military commissaries in August, Fortune reports, though technical attribution and access methodology remain under investigation. The Pentagon has launched an investigation into potential links between the U.S. military incidents and the European compromises, according to Fortune, though no confirmed connection has been established. Security analysts told Euronews that the attacks appear to exploit remote management capabilities in commercial refrigeration systems, though specific vulnerabilities and initial access vectors have not been disclosed. Some researchers observed propaganda videos released following the Israeli grocery store compromise in October, NPR reports, though operational objectives across the broader campaign remain unclear.
North Korea Denies Binance Attribution as Laundering Analysis Projects Extended Timeline
North Korean officials denied U.S. government attribution of the $6.3 billion Binance compromise, with Kim Yo Jong calling the allegations "absurd rhetoric" and "a grave political provocation," The Japan Times reports. The denial follows FBI attribution to North Korean state actors and blockchain intelligence analysis by multiple firms linking the theft to known North Korean cryptocurrency theft operations. Financial Times reporting indicates the stolen tokens remain visible on public blockchains as the attackers begin a complex laundering process expected to take months, according to law enforcement and blockchain intelligence sources. Separate analysis by Bitquery estimates the attackers lost approximately $119 million through inefficient execution during initial token liquidation attempts, Bloomberg reports. Meanwhile, blockchain researchers documented ongoing attacks leveraging fake Cloudflare verification pages to trick users into granting remote access, Mashable reports, though no confirmed link to the Binance compromise has been established.
Additional Breach Disclosures and Vulnerability Analysis
Cloud application platform Northflank disclosed a security breach leading to unauthorized usage of customers' AI API keys, first detected by Wiz security researchers, CISOseries reports, urging customers to rotate credentials though compromise methodology and attacker objectives have not been disclosed. Check Point Research published technical analysis of HTTP2Shell (CVE-2026-111497), an actively exploited remote code execution vulnerability affecting Brotli decompression implementations, according to the firm's threat intelligence report, though exploitation scope and attacker attribution remain under investigation. Separately, hackers claimed responsibility for stealing 23 terabytes of data from Russia's Rosstat statistics agency, including alleged Ukraine war casualty figures, Tom's Hardware reports, though the claim has not been independently verified and Rosstat's website remained inaccessible at time of reporting.
Sources: The Register · United24Media · Fortune · NPR · Euronews · The Japan Times · [Financial Times](https://www.ft.com/content/a6212e33-2175-4957-91d1-8f8f
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
Volt Typhoon Silent Train Network Tied to 4 US Zero-Day Campaigns
Volt Typhoon's Silent Train covert operational relay framework is tied to 4 zero-day campaigns on US critical infrastructure with confirmed C2 IPs.
Vapor Panda's ARTEX AI Campaign: How China-Nexus Hackers Automated Attacks on 200+ Organizations
A Chinese APT group deployed multi-agent AI to simultaneously breach telecoms, governments, and pharma firms across 14 countries, compressing the enti...
Binance Suffers Cyberattack Resulting in Theft of Approximately $6.3 Billion in Digital Assets
Binance, a global cryptocurrency exchange, suffered a cyberattack resulting in the theft of approximately $6.3 billion after attackers compromised a D...
Binance says malicious code, fake job interview led to $6.3B hack - The Hill
Binance attributed a $6.3 billion cryptocurrency hack, linked by the FBI and analysts to North Korea, to a sophisticated multi-stage campaign ...
How fake job interviews helped hackers steal $6.34 billion from Binance - Gulf News
New York: Binance released on Tuesday a detailed investigation into the $6 billion hack of its cryptocurrency platform, showing how attackers used ...
North Korea calls U.S. claims it was behind Binance hack 'a grave political provocation'
Kim Yo Jong, the powerful sister of the North Korean leader, called the allegations “absurd rhetoric and nothing new.”
North Korean hackers expected to take months to launder stolen Binance billions
The stolen tokens are visible to law enforcement on public blockchains, but the hackers are embarking on a long and complex process to shift them in ....
Revolve Data Breach Impacts at Least 180,000 People
Fashion retailer Revolve disclosed a data breach affecting at least 180,000 customers whose personal and payment card information was stolen.
Updated daily