Weekly report flags attacks on Siemens, Zyxel and Sogou

Between 2 and 8 November 2026, Daily Cybersecurity’s DC flags tracked seven exploited vulnerabilities that had not yet been added to the CISA KEV catalog. The weekly review, which compared DC findings against CISA KEV version 2026.11.06, found four flaws with public attack reports that matched DC signals (Siemens, CryptoPayment, Zyxel and Sogou) but noted no exploitation for the Linux kernel, Puppet Server/OpenVox and OpenSSH flaws at the time of writing.

The piece also highlighted three CVEs in the KEV-only category, including WordPress Core, Apple products and SonicWall SonicOS SSLVPN, as of the KEV dates listed.

Notable items highlighted as exploited in the DC feed include Siemens SIMATIC IoT2050 (CVE-2026-58115, CVSS 10.0), where the Node-RED interface allegedly allowed unauthenticated access; researchers observed attacker activity in honeypots, with malicious flows that fetched a Linux bot and planted a reboot-persistent backdoor, and Siemens issued a fix in version 4.3.4.1.

The CryptoPayment Gateway WordPress plugin (CVE-2026-81648, CVSS 10.0) was described as allowing unauthenticated deletion of files and access to stored wallet credentials; Defused Cyber reported in-the-wild exploitation, and the plugin was subsequently removed from the directory with no available patch.

Sogou Input Method for Windows (CVE-2026-120422, CVSS 8.9) was tied to plain HTTP configuration retrieval by SGTool.exe, with ESET linking the activity to the SlippyNunchucks group exploiting victims in multiple regions, delivering the DarkVigil implant.

The report lists practical responses from defenders: update SIMATIC IoT2050 to 4.3.4.1 or remove Node-RED; remove CryptoPayment Gateway plugin due to lack of patch; apply October Zyxel GS1900 firmware and segment admin pages away from untrusted networks; update Sogou Input Method to 16.10 or later; patch WordPress to 7.1.4 and SonicOS per SonicWall advisory; and prioritise fixes for the Linux kernel, Puppet and OpenSSH. The full weekly CVE report data can be downloaded for independent checks.