CFToday Curated security signals.

Daily edition · 2026-11-08 · latest

Sunday, 8 November 2026

18 items across 7 sections, selected from 683 candidates. 18 carried the panel unanimously.

Show
Section

India

1

Indian organisations, regulators and infrastructure, pulled out of the sections below.

  1. RBI Tightens Cybersecurity Rules for Payment Firms (opens in a new tab)

    Google News: enforcement · News Karnataka ·Governance, Risk & Compliance ·fetched 8 Nov 2026, 03:43 UTC agreed3/3

    Why readThe RBI is tightening cybersecurity requirements on payment firms, which changes the control and reporting baseline for anyone regulated in Indian payments.

    India's central bank has moved to harden cybersecurity obligations across payment system operators. The coverage does not set out the specific directions, control requirements, or compliance dates, so the detail has to come from the RBI circular itself. Compliance and risk teams in Indian payments should pull the primary text before scoping work.

    news.google.com → (opens in a new tab)

Threat Intel & Breaches

1

  1. The Fridge-Hacking Spree Is an Internet-of-Things Wake-Up Call (opens in a new tab)

    WIRED Security ·Lily Hay Newman, Matt Burgess ·fetched 8 Nov 2026, 03:43 UTC agreed3/3

    Why readCISA has formally alerted on the wave of attacks against cold storage controllers, including freezers at US military bases, with Danfoss confirming affected units ran outdated firmware.

    The reporting pulls the scattered refrigeration incidents into one picture: CISA's alert names authentication bypasses, arbitrary code injection, and weak configurations as the routes in, and Danfoss has said the impacted systems were on outdated firmware. Attribution is unsettled; Russian hacktivist claims came without credible evidence and the Kremlin denied involvement, while US officials reportedly suspect Iran-linked actors behind the attacks on military bases and the investigation continues. For anyone running cold chain or building OT, the actionable part is firmware currency and removing internet-reachable controller interfaces, independent of who turns out to be responsible.

    wired.com → (opens in a new tab)

Vulns & Exploits

12

  1. Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot (opens in a new tab)

    The Hacker News ·The Hacker News ·fetched 8 Nov 2026, 03:43 UTC Must read CVE-2026-123158 EPSS 1.0% agreed3/3

    Why readCVE-2026-123158 lets an unauthenticated attacker log into passwordless accounts on OpenSSH built against musl with PAM disabled, which is Alpine's default, and exploitation started within hours of disclosure.

    The SSHole bug, found by Ozgun Kultekin, stems from a 2016 patch for the CVE-2016-6210 username enumeration issue: under specific conditions a failed password-hashing operation returns the same "*" value used to mark an account as having no usable password, so an oversized password authenticates. Previdian reports attackers gaining root on a honeypot within hours of the advisory. Affected systems are Linux hosts running OpenSSH on musl with PAM disabled, including stock Alpine; the fix is OpenSSH 10.6p2. Container base images and appliance firmware built on Alpine are the realistic blast radius.

    Indicators1
    Addresses
    89[.]116[.]89[.]18

    thehackernews.com → (opens in a new tab)

  2. CVE-2026-82912 (CVSS 8.8): Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBi (opens in a new tab)

    NVD ·fetched 8 Nov 2026, 03:43 UTC CVE-2026-82912 CVSS 8.8 EPSS 0.7% agreed3/3

    Why readTwo view-only permissions in Apache OFBiz 24.09 before 24.09.08 are enough to reach OS command execution through a ${groovy:...} expression in the Send Per Email invoice form.

    sendMailFromScreen passes the caller-supplied bodyText and subject through FlexibleStringExpander.expandString, which compiles and evaluates embedded Groovy on a class loader carrying none of the SecureASTCustomizer restrictions applied by GroovyUtil.eval elsewhere, and the service and request-map declare no permission check beyond base authentication. A user holding only OFBTOOLS_VIEW and ACCOUNTING_VIEW, the pair that opens the Accounting application, executes commands as the OFBiz process account. Fix is 24.09.08; OFBiz RCEs have a consistent record of being weaponised and added to KEV, so patch on the short clock.

    nvd.nist.gov → (opens in a new tab)

  3. CVE-2026-82960 (CVSS 8.8): Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a r (opens in a new tab)

    NVD ·fetched 8 Nov 2026, 03:43 UTC CVE-2026-82960 CVSS 8.8 EPSS 0.6% agreed3/3

    Why readCMS content-editor access on the Apache OFBiz cms plugin before 24.09.08 becomes OS command execution in a single POST, through a Groovy sandbox escape using runtime reflection.

    The EditAddContent screen copies the caContentIdTo parameter into a top-level context variable that is interpolated into a form field's use-when attribute and handed unvalidated to GroovyUtil.eval(). The SecureASTCustomizer sandbox restricts compilation but not runtime reflection, so a payload that closes the expanded string literal and reaches java.lang.Runtime by reflection runs commands as the OFBiz process user. Same fixed version, 24.09.08, as the EmailServices expression-language bug, so one upgrade closes both.

    nvd.nist.gov → (opens in a new tab)

  4. CVE-2026-123025 (CVSS 9.4): An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The (opens in a new tab)

    NVD ·fetched 8 Nov 2026, 03:43 UTC CVE-2026-123025 CVSS 9.4 EPSS 0.6% agreed3/3

    Why readAn authenticated OPNsense user with certificate-issuing rights gets root code execution on the firewall via unescaped gcloud fields in the os-acme-client plugin through 4.17.

    DnsGcloud::prepare() decodes the dns_gcloud_key model field and interpolates the gcloud_account and gcloud_project strings straight into a shell command run through LeUtils::run_shell_command() and proc_open(), with no validation or escaping. Anyone who can issue or renew certificates through the WebGUI or API reaches root on the appliance. The privilege bar is low in practice because certificate management is a routinely delegated function, and the target is a perimeter device.

    nvd.nist.gov → (opens in a new tab)

  5. CVE-2026-73098 (CVSS 10.0): Improper control of dynamically-loaded code vulnerability in Apache Juneau. When Apache Juneau parses a value into a property of type java.lang.Class (opens in a new tab)

    NVD ·fetched 8 Nov 2026, 03:43 UTC CVE-2026-73098 CVSS 10.0 EPSS 0.5% agreed3/3

    Why readParsing untrusted input into a java.lang.Class property in Apache Juneau loads the named class with initialization on, running arbitrary static initializers from the application classpath.

    Apache Juneau through 9.2.0 used a default class swap that resolved attacker-supplied class names with initialization enabled, so any class on the deployment's classpath could have its static initializer triggered by parsed input. Impact is gadget-dependent and varies with what is on the classpath, but unlike the other Juneau issues this one does not require an opt-in setting. Fixed in 9.2.1.

    nvd.nist.gov → (opens in a new tab)

  6. ZDI-26-870: (0Day) Ashlar-Vellum Cobalt XE File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (opens in a new tab)

    ZDI Published Advisories ·fetched 8 Nov 2026, 03:43 UTC Research CVE-2026-121744 agreed3/3

    Why readSecond unpatched Ashlar-Vellum Cobalt file-parsing RCE, this one a stack overflow in the XE parser, also released as a 0-day.

    CVE-2026-121744 is a stack-based buffer overflow in Cobalt's handling of XE files, triggered by opening a malicious file or visiting a crafted page, and yields arbitrary code execution as the current user. The disclosure timeline shows the vendor acknowledged receipt on 12 November 2025 and then went quiet through three ZDI follow-ups before publication. No fix exists; restricting which files the product is allowed to open is the only control.

    zerodayinitiative.com → (opens in a new tab)

  7. ZDI-26-871: (0Day) Ashlar-Vellum Cobalt LI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (opens in a new tab)

    ZDI Published Advisories ·fetched 8 Nov 2026, 03:43 UTC Research CVE-2026-121752 agreed3/3

    Why readUnpatched heap overflow in Ashlar-Vellum Cobalt LI file parsing, published as a 0-day after the vendor sat on it for eleven months.

    CVE-2026-121752 is a heap-based buffer overflow in Cobalt's LI file parser: user-supplied data is copied without a length check, giving code execution in the process context when a victim opens a crafted file. ZDI reported it on 04 December 2025, got no fix, and published on 29 October 2026 notice. With no patch available, the only mitigation is restricting interaction with the product, which matters for CAD and engineering workstations that routinely open third-party geometry files.

    zerodayinitiative.com → (opens in a new tab)

  8. ZDI-26-896: (Pwn2Own) Home Assistant Green Cleartext Storage of Credentials Local Privilege Escalation Vulnerability (opens in a new tab)

    ZDI Published Advisories ·fetched 8 Nov 2026, 03:43 UTC Research CVE-2026-91131 agreed3/3

    Why readHome Assistant Green stores user account tokens in cleartext, letting code inside a container escape to root on the host.

    ZDI-26-896 (CVE-2026-91131), from Pwn2Own, turns low-privileged execution inside a container into root on the appliance by reading plaintext account tokens. Home Assistant has published a fix and an advisory at GHSA-6456-4qg9-cqpj. The container boundary on this device is not a security boundary once tokens are readable, which matters anywhere these sit on a flat home or small-office network.

    zerodayinitiative.com → (opens in a new tab)

  9. CVE-2026-121489 (CVSS 10.0): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau. The microservice DirectoryResource doe (opens in a new tab)

    NVD ·fetched 8 Nov 2026, 03:43 UTC CVE-2026-121489 CVSS 10.0 EPSS 0.5% agreed3/3

    Why readApache Juneau's DirectoryResource microservice lets a client read, write or delete files anywhere the server process can reach when view, upload or delete are enabled; fixed in 9.2.1.

    Path traversal in Apache Juneau through 9.2.0: DirectoryResource does not confine request paths to its configured root, so an unauthenticated client can escape it for read, write or delete. The affected view, upload and delete settings are off by default, which limits real exposure despite the CVSS 10.0 rating and the 0.005 EPSS score reflects that. Upgrade to 9.2.1 or confirm those settings remain disabled.

    nvd.nist.gov → (opens in a new tab)

  10. ZDI-26-872: (0Day) Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability (opens in a new tab)

    ZDI Published Advisories ·fetched 8 Nov 2026, 03:43 UTC Research CVE-2026-121753 agreed3/3

    Why readUnpatched use-after-free in Ashlar-Vellum Cobalt XE file parsing, published as a 0day after the vendor missed its fix window for nearly eleven months.

    Parsing of XE files in Ashlar-Vellum Cobalt performs operations on an object without validating that it still exists, giving an attacker code execution in the current process when a user opens a crafted CAD file. The disclosure timeline is the real content: reported 16 December 2025, acknowledged the same day, vendor confirmed on 15 July 2026 that the fix was incomplete, and ZDI announced publication on 29 October 2026. No patch exists, so the only mitigation is restricting interaction with untrusted XE files, which matters for engineering and manufacturing workstations that routinely receive CAD files from suppliers.

    zerodayinitiative.com → (opens in a new tab)

  11. CVE-2026-118193 (CVSS 8.8): The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, (opens in a new tab)

    NVD ·fetched 8 Nov 2026, 03:43 UTC CVE-2026-118193 CVSS 8.8 EPSS 0.4% agreed3/3

    Why readGiveWP up to 4.19.1 lets a Manager-role user set the default donor registration role to Administrator through the settings import path, silently promoting every new donor account.

    sanitize_option_donor_default_user_role() checks only for the literal string 'administrator' instead of enforcing the plugin's own give_get_donor_safe_user_roles() allowlist, so Editor, Author and other elevated roles pass through the settings save path. Worse, give_core_settings_import_callback() writes imported JSON straight into the give_settings option via update_option() without running the sanitize filter at all, which reinstates Administrator. The escalation is persistent and quiet because it fires on every subsequent donor signup rather than at the moment of attack, which is what makes it worth hunting for in existing installs.

    nvd.nist.gov → (opens in a new tab)

  12. CVE-2026-73117 (CVSS 10.0): Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache Juneau. The Apache Juneau REST server p (opens in a new tab)

    NVD ·fetched 8 Nov 2026, 03:43 UTC CVE-2026-73117 CVSS 10.0 EPSS 0.4% agreed3/3

    Why readApache Juneau passed response headers and redirect targets to the servlet container unchecked, allowing CRLF header injection and open redirect; 9.2.1 sanitizes headers and adds sendSafeRedirect().

    HTTP response splitting in Apache Juneau through 9.2.0, exploitable only where application code builds a response header or redirect target from request data and the servlet container does not itself reject CR/LF. The framework does not construct these from request input itself, so exposure is application-specific. After upgrading to 9.2.1, applications building redirect targets from request data must also move from sendRedirect() to sendSafeRedirect(), which is a code change rather than a drop-in fix.

    nvd.nist.gov → (opens in a new tab)

Defense & AppSec

1

  1. Digital Security Under Compound Threats: Surveillance, Threat Reasoning, and Habituation Among North Korean Defectors in China (opens in a new tab)

    arXiv cs.CR (all) ·Yibo Meng, Bingyi Liu, Lionel Z. Wang, Hongkun Yang ·fetched 8 Nov 2026, 03:43 UTC Research agreed3/3

    Why readInterviews with 19 North Korean defectors in China document a failure mode every awareness programme should recognise: security practice decaying precisely because nothing bad has happened yet.

    The authors conducted semi-structured interviews to map how defectors reason about digital threats while living under transnational surveillance pressure, identity-linked infrastructure, and dependence on intermediaries. They distinguish adaptive habituation, where practice improves as knowledge accumulates, from erosive habituation, where a long run without visible harm steadily dissolves protective behaviour. The erosive pattern generalises well beyond this population and argues against treating an absence of incidents as evidence that training worked.

    arxiv.org → (opens in a new tab)

DFIR

1

  1. arnold117/iOS-NOIR: No-jailbreak iOS privacy, entitlement, sandbox & telemetry forensic auditor (inspired by Verlintas/NOIR) (opens in a new tab)

    GitHub: new security tools ·arnold117 ·fetched 8 Nov 2026, 03:43 UTC Research ★ 278 agreed3/3

    Why readA Python auditor that pulls entitlement, sandbox and telemetry evidence off an unjailbroken iPhone over pymobiledevice3 and grades each finding by how directly it was observed.

    iOS-NOIR enumerates Apple-signed entitlements, Info.plist whitelists such as LSApplicationQueriesSchemes and NSExceptionDomains, ubiquity-kvstore-identifier values and live HouseArrest sandbox contents, then emits a standalone seven-tab HTML report. Findings are tiered: VERIFIED for directly extracted static or filesystem evidence, CAPABILITY for privileged entitlements like unrestricted-voip-regulatory, HotspotHelper and multipath, with behavioural inference kept separate. That evidence grading is the part worth borrowing even if you do not run the tool, since it keeps capability apart from demonstrated behaviour in a mobile triage report.

    github.com → (opens in a new tab)

Governance, Risk & Compliance

1

  1. NHS breach helpline left staff carrying a 'significant emotional burden' (opens in a new tab)

    The Register Security ·fetched 8 Nov 2026, 03:43 UTC agreed3/3

    Why readTwo separate lessons in one review: a pivot table cache leaked 8,003 people's sickness records through an FOI response, and the helpline set up to handle the fallout put untrained staff in front of safeguarding cases.

    Royal Cornwall Hospitals NHS Trust published an Excel workbook in February 2023 in answer to a Freedom of Information request; the underlying sickness absence records remained reachable through the file's pivot tables until a member of the public noticed in November 2025. The newly published review found call handlers drafted onto the notification helpline faced shouting, anger, and callers potentially at risk from domestic abuse, and were making safeguarding judgements with no training and no defined process. The first failure is a reminder to flatten or rebuild any spreadsheet before publication; the second is a reminder that breach notification is an operational capability requiring staffing and welfare planning, not a comms afterthought.

    theregister.com → (opens in a new tab)

Business & Boardroom

1

  1. Hackers pull off $133 million French bank heist via service provider (opens in a new tab)

    BleepingComputer ·Bill Toulas ·fetched 8 Nov 2026, 03:43 UTC Must read agreed3/3

    Why readCrédit Mutuel Arkéa, a bank with 211.5 billion euros in assets, lost up to 118 million euros to fraudulent transfers initiated through a service provider, and the delay in disclosure let 30 million dollars be laundered before law enforcement could freeze it.

    Crédit Mutuel Arkéa disclosed on 4 November that an attacker used the bank's own account to initiate transactions to other banking organisations, with fraudulent movements reported up to 133 million dollars; the bank suspended certain systems in response and says customer assets are unaffected. Blockchain investigator ZachXBT flagged the unauthorised withdrawals from centralised exchange accounts on 2 November, before any disclosure, and tracked the proceeds out as USDC and USDT. The gap between the 1 November activity and the 4 November statement is the part peers will be asked about: roughly 30 million dollars moved during it.

    bleepingcomputer.com → (opens in a new tab)

Ransomware watch

25

Unverified claims posted by extortion groups on their own leak sites, not confirmed breaches. Listing is the group's assertion; many named organisations have not disclosed an incident, and some entries are false or recycled. Leak sites are never linked from here.

Claimed victimGroup SectorCountry Seen
??? BYOD - - 8 Nov 2026
Twitter BYOD Technology US 8 Nov 2026
Company #147 N0n - US 7 Nov 2026
Company #146 N0n - US 7 Nov 2026
Company #145 N0n - US 7 Nov 2026
Company #144 N0n - US 7 Nov 2026
Company #143 N0n - US 7 Nov 2026
Company #142 N0n - KR 7 Nov 2026
Company #141 N0n - US 7 Nov 2026
Company #140 N0n - CA 7 Nov 2026
Company #139 N0n - US 7 Nov 2026
Company #138 N0n - CA 7 Nov 2026
by.zivor.co.il safepay - IL 7 Nov 2026
XK net SA de CV qilin - MX 7 Nov 2026
BOSH Engineering Private Limited qilin Manufacturing SG 7 Nov 2026
J. J. Louro Pereira qilin - PT 7 Nov 2026
Simply UK qilin - GB 7 Nov 2026
Roxfarma qilin Healthcare BR 7 Nov 2026
AXE - EXPERTS qilin Professional Services FR 7 Nov 2026
Oak Green School qilin Education GB 7 Nov 2026
Gandol Doors qilin Manufacturing TR 7 Nov 2026
Amber Management Ltd qilin - GB 7 Nov 2026
Tribunal de Justica do Estado de Minas Gerais rhysida Government & Defense BR 7 Nov 2026
Autohaus Arnold payload Retail & E-Commerce DE 7 Nov 2026
Brauco payload - - 7 Nov 2026
How this edition was made
Candidates fetched
683
New after deduplication
120
Kept by the panel
29
Published
18
Generated
8 Nov 2026, 03:43 UTC