CISA adds exploited WordPress flaw to vulnerability catalogue

CISA added CVE-2026-119977 to the KEV catalogue on 3 November, listing it as a WordPress Core time-of-check to time-of-use race condition that could let an unauthenticated attacker execute code during a core upgrade.CISA The flaw involves predictable, web-accessible staging paths used in full-package upgrades, and CISA confirms it has been exploited in the wild.CISA CISA lists a CVSS score of 8.1, rated HIGH, and says a patch is available.CISA It set 6 November 2026 as the remediation deadline for federal agencies; whether the flaw has been used in ransomware campaigns is unknown.CISA

Binarly said attackers exploited CVE-2026-107441 in Zyxel GS1900 switches, including devices running firmware released in June to address a related flaw.CyberSIXT The researchers said the exploit worked against that firmware without modification; Zyxel released a second fix on 22 October and published an advisory on 3 November.CyberSIXT Zyxel's advisory lists ten GS1900 models and says an unauthenticated attacker on the local network could run operating system commands.CyberSIXT Binarly described the issue as a web-request parameter buffer overflow in dispatcher.cgi; Zyxel's advisory does not say whether this flaw has been exploited.CyberSIXT

The team behind Goddess of Victory: Nikke said on 4 November that launcher script files may have been tampered with by a third party, and that it had pushed client fixes and an update at about 02:30 Korean time.CyberSIXT An analysis by players and independent researchers said four JavaScript files on publisher Level Infinite's content delivery network were modified on 27 September.CyberSIXT The analysis said some launcher sessions fetched a remote-access agent from 23 October at the latest, enabling an operator to run commands and collect files and data while the launcher was open.CyberSIXT On Windows, it said, a registered DLL allowed the agent to persist after the launcher closed.CyberSIXT The route used to gain access to the content delivery network and the incident's scope remain unknown; claims that other Level Infinite launchers were affected have not been demonstrated.CyberSIXT

Hunt.io told Dark Reading that an unknown attacker copied nearly 69GB of data from the Philippine Overseas Employment Administration in a transfer lasting 24 minutes.Dark Reading The files included 27 SQL Server backups covering overseas-employment case management, accreditation, contracts, cashier records and LandBank records.Dark Reading Hunt.io said logs showed the transfer completed, but it had not examined the backups and could not establish where the data went or how the attacker entered the network.Dark Reading The company found privilege-escalation tools and the Impacket Python network library on a staging server in Singapore, but did not attribute the attack to a group or country.Dark Reading