Between November 3 and November 5, 2026, three actively exploited vulnerabilities landed in CISA’s Known Exploited Vulnerabilities catalog — a Zyxel switch zero-day, a WordPress Core upgrade flaw, and an Apple WebKit bug. Each one is different, each one is already being used in real attacks, and each one has a patch or a workaround available now. This is the week to stop putting off updates.
The theme running through the week is trust in the tools themselves. A switch patch that did not stop the attack it was credited with stopping. A package manager flaw in the software that verifies Linux software. And a WordPress flaw in the very process that keeps WordPress itself up to date. When the update mechanism is the vulnerability, the usual advice — just patch — gets more complicated, but it does not get optional. Here is what happened, what is actually urgent, and what to do about it.
Zyxel GS1900 zero-day: 996 switches compromised
The most important development of the week is a Zyxel zero-day that attackers were already using before anyone knew it existed. According to GreyNoise, an actor tracked as Kapibala compromised 996 GS1900 switches across 48 countries, beginning around August 17, 2026, collecting device configurations, network information and hashed root credentials.
The flaw is CVE-2026-107441, a CVSS 8.8 out-of-bounds write in the switch’s web management interface that lets a LAN-based, unauthenticated attacker execute operating system commands through a crafted HTTP request. The attacks were initially blamed on a different bug, CVE-2026-7273, a buffer overflow Zyxel fixed in June that CISA added to its exploited list in September. Researchers at Binarly then found the real exploit — and showed it still worked on switches running the June firmware. The June patch had fixed a different bug entirely.
Zyxel released corrected firmware, version 2.90 Patch 3, on October 22 and published its advisory on November 3. Canada’s Centre for Cyber Security said open-source reporting indicates the flaw is exploited in the wild. If you run GS1900 switches, the fix is to reflash to the Patch 3 firmware on the affected models and rotate switch credentials, because the attackers were harvesting hashed root passwords. A switch that has been compromised and merely patched is not clean — the credentials it held are already gone.
WordPress Core: an upgrade flaw with a deadline that has passed
The second addition to CISA’s list hits close to home for anyone running a website — including this one. CVE-2026-119977 is a time-of-check time-of-use race condition in WordPress Core’s full-package upgrade process. It lets an unauthenticated attacker execute code through predictable, web-accessible staging paths during a core upgrade. It is internet-facing, it is exploited in the wild, and CISA set the federal remediation deadline at November 6 — yesterday.
The fix is to update to WordPress 7.1.4 or the branch backport, and to keep automatic updates on. Because the flaw lives in the upgrade path itself, site owners should also check for signs of compromise: unexpected files in the upgrade staging directories, unfamiliar administrator accounts, and plugins or themes that appeared without explanation. An upgrade flaw is a reminder that the maintenance window is itself an attack surface, and that the sites most likely to be hit are the ones whose owners treat updates as a chore to postpone.
Apple WebKit joins the list
The third CISA addition is older but no less real. CVE-2024-27834, an improper-authentication flaw in WebKit, was added to the exploited list on November 4 with a federal deadline of November 18. It affects iOS, iPadOS, macOS, Safari, tvOS and watchOS, and it can let an attacker bypass pointer authentication — but only if the attacker already has arbitrary read and write access on the device. That precondition matters: this is a link in an attack chain, not a standalone remote exploit. It needs to be patched, but it is not the fire the Zyxel and WordPress flaws are.
The same week, Sekoia’s threat research team reported a mobile watering-hole campaign it assesses with moderate to high confidence is linked to APT29, the group tied to Russia’s SVR, built entirely on already-patched phone flaws. The lesson is the same one the Zyxel story teaches: attackers do not need zero-days when the patches for known flaws sit uninstalled.
The rest of the week’s patch list
The three CISA additions were not the only urgent items. A flaw in APT, the package manager that verifies Linux software, was disclosed this week: CVE-2026-109518, rated 7.7, lets an on-path attacker who can manipulate HTTP traffic between a system and its archive server — including a malicious mirror or proxy — trigger installation of an attacker-controlled package and obtain root, bypassing the archive signature check. It was discovered by Max Justicz, and the advisories report no known exploitation in the wild. This one is a patch-first disclosure: fix it before it is used, not after.
SonicWall’s SonicOS SSLVPN flaw, CVE-2026-19868, also joined CISA’s exploited list, with a federal deadline of November 20. OpenSSH had a worse week: CVE-2026-123158 lets an attacker log in to accounts with no password set on systems running sshd before 10.6p2 on Linux with musl libc and no PAM, by sending a password of 257 to 1,024 bytes — and it was attacked within hours of disclosure. And Google’s November Android security updates address more than 200 vulnerabilities, including a critical remote code execution flaw, CVE-2026-58868, affecting Android 14 through 17 with no user interaction required.
What to do this weekend
Start with an inventory, because you cannot patch what you do not know you own. List every Zyxel GS1900 switch, every WordPress installation, every Apple device, every SonicWall gateway and every Linux server running OpenSSH on musl-based distributions. Then work in this order: Zyxel switches first, because the compromise is confirmed and the attackers took credentials; WordPress Core next, because the federal deadline has already passed and the flaw is internet-facing; then SonicWall and Apple, ahead of their November 18 and 20 deadlines; then APT and OpenSSH as patch-first items.
For the Zyxel switches, patching alone is not enough — rotate credentials and check for persistence, since the attackers collected configurations and hashed root passwords. For WordPress, update to 7.1.4, keep auto-updates on, and audit the site for unexpected files and accounts. For everything else, apply the vendor fix and verify it took: check the firmware version, the package version, the build number. A patch that was downloaded but never applied is the most common vulnerability of all.
Why this week matters beyond the patches
There is a second story underneath the CVE numbers. The week also brought the first real-world signs of autonomous AI tooling in attacks: Microsoft observed an agentic framework go from a GitHub secret search to Azure Key Vault exfiltration in five minutes, and CrowdStrike attributed an agentic attack framework to a China-nexus actor running it against more than 200 organisations in 14 countries. The defensive side is responding in kind — CrowdStrike’s AI Kill Switch, announced November 3, lets security teams terminate a rogue AI agent at the gateway, block it from relaunching and cut off its network access.
That is the direction of travel. Attackers are automating the boring parts of intrusion — the credential hunting, the lateral movement, the exfiltration — and defenders are automating the response. The organisations that will cope are the ones that treat patching as a continuous discipline rather than a quarterly event, and that can see and stop an agent — human or artificial — that steps outside its job. Tencent’s 770-billion-parameter Hy4 model, trained with its cybersecurity data deliberately limited to defensive material, shows the same instinct on the model side: capability with guardrails built in, not bolted on.
The November wave is not a single incident to weather and forget. It is a worklist, and most of it is not urgent for most organisations — but two items are, and the deadline on one of them has already passed. Patch the Zyxel switches and the WordPress installs first, rotate what the attackers may have taken, and use the weekend to close the rest before the next wave arrives. It always does.
