Briefing · Thursday 5 November 2026 · 07:00 UTC
CISA adds actively exploited Apple flaw to KEV catalogue
By CyberSIXT Briefing · from 71 reports by 15 outlets · Editorial policy
Since this morning1
DreamHost confirms File Manager breach exposed FTP passwords
DreamHost says a threat actor exploited its File Manager from about August until October 23, taking FTP and SFTP logins and some webmail credentials.CyberSIXT It says well under 10% of accounts were hit and some mailboxes may have been read.CyberSIXT
CISA added Apple vulnerability CVE-2024-27834 to its Known Exploited Vulnerabilities catalogue on 4 November, the first catalogue addition in this edition after the previous edition's WordPress flaw.CISA The entry covers iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5, and says exploitation requires arbitrary read and write capability.CISA Separately, SecurityOnline reported active exploitation of a GPUStack authentication flaw, while the available details do not establish its initial attack vector or whether the Apple flaw has been used in ransomware campaigns.SecurityOnlineCISA
CISA adds Apple flaw to exploited vulnerabilities catalogue#
CISA added CVE-2024-27834 to its KEV catalogue on 4 November 2026, listing it as the Apple Multiple Products Improper Authentication Vulnerability.CISA The entry names iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5, and says an attacker needs arbitrary read and write capability to bypass pointer authentication.CISA The vulnerability is rated CVSS 5.5, Medium, and CISA set a remediation deadline of 18 November 2026.CISA
The catalogue inclusion confirms active exploitation, but its entry does not specify an initial attack vector or confirm use in ransomware campaigns.CISA
AnalysisThe addition shifts the catalogue focus from the exploited WordPress Core flaw named in the previous edition to an Apple vulnerability spanning several operating systems and products.CISA
GPUStack authentication flaw is exploited against AI servers#
SecurityOnline reported active exploitation of GPUStack vulnerability CVE-2026-102895 against a v2.1.1 deployment, citing researcher Javier Sixto of ulex[.]fr.SecurityOnline The report says the authentication bypass can give remote attackers unauthenticated administrator access and allow reverse shells on worker hosts.SecurityOnline It describes two possible paths: requests routed through a same-host reverse proxy that appear to come from 127.0.0[.]1, or a forged X-GPUStack-Real-IP header.SecurityOnline
CVE-2026-102895 affects builds before 2.2.0, while a separate SAML callback flaw, CVE-2026-102894, affects versions 0.7.1 to before 2.2.2 and has no confirmed in-the-wild attacks.SecurityOnline The report identifies version 2.2.2 as the patch for both flaws.SecurityOnline
AnalysisThe reported exploitation applies to CVE-2026-102895; the same report distinguishes CVE-2026-102894 as not confirmed exploited in the wild.SecurityOnline
DigiCert confirms access to customer identity archive#
DigiCert confirmed unauthorised access to part of an internal archive containing documents customers had supplied to verify their identities.CyberSIXT The company said most of the archive held business contact details, while a small minority of customer accounts also contained a passport, driving licence, utility bill or another document showing a name and address.CyberSIXT DigiCert said one account created through a self-service registration feature accessed a small proportion of the archive.CyberSIXT
DigiCert traced the exposure to an infrastructure migration on 4 February 2025 that moved the archive system, intended to be VPN-only, into an internet-reachable network zone.CyberSIXT It said certificate issuance, CertCentral, DigiCert ONE, customer logins and issued certificates were not affected, while the number of affected customers was not given.CyberSIXT
Cisco patches flaws in UCS Central, ISE and Unified CM#
Cisco released fixes for CVE-2026-76506 in UCS Central, CVE-2026-20241 in Identity Services Engine and CVE-2026-76419 in Unified Communications Manager.SecurityOnline Cisco said the flaws were not yet exploited in public campaigns; they involve authenticated remote code execution, possible endpoint certificate theft through an authorisation bypass, and cross-site scripting, respectively.SecurityOnline
Affected versions include UCS Central 2.0 and earlier and 2.1 before 2.1(2c), ISE and ISE-PIC branches 3.1–3.5 before the latest patches, and Unified CM versions 14 and 15 before 15SU5.SecurityOnline The fixes include UCS Central 2.1(2c) or later, ISE patches for the listed branches, and Unified CM 15SU5.SecurityOnline
Also
- Debian and Ubuntu. The Hacker News reported that CVE-2026-109518 could let an on-path attacker who can modify HTTP package downloads replace a verified APT package and run code as root, with advisories issued on 4 November and no confirmed exploits in the wild.The Hacker News
- OpenAI. OpenAI said its mid-October automated research run produced working exploits for 948 distinct Linux kernel flaws that let a local user become root, at a stated total cost of $1,213,430 in API credits.CyberSIXT
- Barracuda. SecurityWeek reported that Barracuda patched two flaws that can be chained for root access on Email Security Gateway appliances, while the sources did not state whether exploitation had occurred in the wild.SecurityWeek
- mSecure. Malwarebytes reported that mSecure warned current and former customers of suspicious activity tied to its app, but gave no details on affected systems or whether customer data was accessed.Malwarebytes
- Apache. SecurityOnline reported 35 security flaws across nine Apache projects disclosed on 2–3 November, with no public exploitation confirmed at the time of its report.SecurityOnline
Watching
CISA's KEV entry sets 18 November 2026 as the remediation deadline for CVE-2024-27834.CISA