Binance has published its post-mortem. It says the $6.34 billion theft began with a tampered Homebrew download in June and a fake job interview in September, and that the attackers reached wallet signing through an internal AI tool and a container deployment token. CISA added the WordPress core upgrade-window race (CVE-2026-119977) to KEV with a 6 November deadline. Separately, attackers hijacked the cPGuard update channel and used it to collect /etc/shadow, root SSH files and database credentials from Linux hosting servers.

Do today

  • WordPress: confirm every site is on 7.1.4 or a patched backport branch. CVE-2026-119977 is now in KEV, and the federal deadline is Friday 6 November. (NVD CVE-2026-119977, WordPress 7.1.4)
  • cPGuard: update to 5.88.25 or later. Check the install log for 5.88.12 through 5.88.19, and if those versions ever ran, rotate root and local passwords, database credentials, cloud tokens and /root/.ssh keys. (OPSSHIELD advisory)
  • Barracuda ESG, WAF, ADC, WSG, BMA and WCC: apply the patches for CVE-2026-116606 and CVE-2026-111560, and restrict admin interfaces to trusted networks. (Barracuda advisory)
  • BTCPay Server 2.4.1 or earlier: sweep hot-wallet funds to a new seed, retire the old server and rebuild on the latest release, then rotate every credential from a trusted device. (BTCPay incident post)
  • GitHub public repositories: review Actions Insights for pull_request_target runs before the first brownout on 9 November, then allow only the workflows you have reviewed. (GitHub changelog)
  • RHEL and Ubuntu: install Red Hat’s 1 November kernels for CVE-2026-98432 and reboot. On Ubuntu, either test the -proposed kernels or plan the reboot for when they reach updates. (RHSA-2026:93412, Canonical)

AI and agent security5 stories

  • WorkOS: an AI-assisted offensive framework got into the sales team’s internal app — WorkOS says it found unauthorized access on 30 October to an internal application used by sales and customer-facing teams. The app held business contacts, account histories, and summaries and excerpts of sales calls, support threads and customer Slack conversations. WorkOS has seen no evidence that production services or customer application data were reached. Its bulletin attributes the automated reconnaissance and exploitation to an “AI-assisted offensive security framework” without naming a tool. Press reports call it ARTEX, a name that appears in the bulletin only inside its links to reports by other firms. Our take: CRM and call-summary stores now contain enough real conversation to make very convincing follow-up phishing, so customers of any affected SaaS vendor should check unexpected requests through a second channel. (WorkOS bulletin)
  • Chainstack: a third-party component, then dev, then production, in three days — Chainstack says an attacker entered its development environment on 26 October through a third-party component it doesn’t name, reached parts of production on 29 October, and was cut off on 31 October. The attacker reached a database of organization names, member emails and password hashes. Systems holding node credentials were also reachable, and Chainstack is treating those credentials as exposed although it has no evidence they were read. Chainstack links the intrusion to the broader AI-powered campaign reported in late October. Chainalysis’s 2 November update says Reactor and Data Solutions stay offline while outside assessors finish their work. Our take: if you use Chainstack, rotate node credentials and platform API keys now. Self-service rotation keeps current endpoints working until you finish. (Chainstack incident, Chainalysis update)
  • Bitdefender: a 3AM affiliate appears to have let a model drive part of a school intrusion — Bitdefender describes a UK school estate of 47 systems in several separate AD domains. The attacker linked the domains with trusts, took credentials from three Veeam servers, created two backdoor domain admins and encrypted machines on 19 September. Retries came every 40 to 101 seconds whatever the size of the change, and some commands contained mistakes typical of a model working from memory, such as a Veeam API call on the wrong port. The authors say the evidence strongly supports model-generated commands in a loop, but they could not see the operator’s host and call the hybrid reading a working model. The tools were ordinary: built-in utilities, public tools and a commodity encryptor. Our take: the detection signal is the rhythm, so alert on bursts of near-identical admin commands at a steady interval. (Bitdefender)
  • MCPhantom: coding agents keep installing archived MCP reference servers — Glow Labs reviewed real coding-agent sessions and found agents choosing deprecated @modelcontextprotocol servers from training data. In 98% of the sessions where that happened, the user had not asked for the package. The pattern appeared in Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, with models from three vendors. Glow reports four high-severity flaws across the archived servers, including command execution through the Puppeteer server after a prompt injection. The maintainers say no fixes will come, and the packages have about 17.4 million npm downloads since July 2025. These servers run through npx and appear in no manifest, so SCA and inventory tools miss them. Glow sells a product for this problem, and it reports no in-the-wild exploitation. (Glow Labs)
  • Anthropic open-sources FlashProve, a zero-knowledge proof that a reply came from a committed model — Anthropic’s Frontier Red Team, working with EPFL, MIT and StarkWare researchers, released FlashProve under Apache 2.0. It includes a C++ prover, C++ and Lean verifiers, and a soundness proof written in Lean 4. A provider commits to one set of weights, and any client can then check on a CPU, in seconds, that a reply came from that model. The project says it runs Llama 4 Maverick on one H100, at about 72x average per-GPU overhead compared with ordinary FP8 serving. It is an unmaintained research prototype: the prover itself is not formally verified, and some values that depend on the weights are not hidden. Our take: this is a credible start on “which model actually answered”, which matters when agents call third-party inference, but the cost rules it out for routine production use today. (FlashProve repository, Help Net Security)

Application security5 stories

  • cPGuard’s update channel pushed a backdoor and a root-secret stealer — OPSSHIELD says an attacker used stolen credentials to reach its update CDN at 02:06 UTC on 2 November and pushed a malicious script to cPGuard 5.88.12 through 5.88.19. The script installed a backdoor and collected /etc/shadow, /etc/passwd, root’s MySQL or MariaDB my.cnf, root shell history and root SSH files. It sent them through a compromised account on OPSSHIELD’s own licensing server, where the attacker picked them up. The vendor stopped distribution within 12 hours. A spokesperson told BleepingComputer that 2,946 servers were affected and that the billing database was copied too, figures not in the advisory itself. Our take: a missing log or missing staging file doesn’t clear a host. If any of those versions ran, rotate every secret root could read, and treat SSH trust relationships from that server as burned. (OPSSHIELD advisory, BleepingComputer)
  • GitHub moves pull_request_target blocking to 2 December, with brownouts first — GitHub Actions will block pull_request_target by default on public repositories under Free, Team and Enterprise Cloud, unless an event policy allows it. This was first planned for 2 November. Two-hour brownouts on 9 and 16 November (16:00–18:00 UTC) will fail blocked runs, and enforcement becomes permanent on 2 December. Private and internal repositories, and GitHub Enterprise Server, are not affected. Our take: this trigger is behind many “pwn request” compromises. Use the evaluate-mode window to move fork-facing logic to plain pull_request with a separate workflow_run job, rather than simply allow-listing the old workflow. (GitHub changelog)
  • Composer 2.11 adds release cooldowns and fixes token leakage into lock files — Composer 2.11, released 29 October, adds an optional config.policy.cooldown that holds back newly published versions during update and require. It measures age with a published-time field that Packagist records, not a date the publisher supplies, and --no-cooldown skips only the cooldown, so other policies stay on for urgent fixes. The release also stops repository HTTP headers such as API tokens being written into composer.lock or installed.json. It also stops package names escaping the vendor directory and rejects the distrusted eMudhra intermediates. Our take: a one-day cooldown would have avoided most of this year’s hijacked-release windows. Audit committed lock files for leaked headers from older versions. (Packagist blog)
  • Elo 1.0.1: an expression language meant to be safe could run arbitrary JavaScript (CVE-2026-44267) — @enspirit/elo 1.0.0 and earlier did not filter .constructor member access in its JavaScript emitter. So anyone who controls an Elo expression could escape to the host Node.js or browser runtime through the library’s parse API, the CLI or the playground. Two related advisories published the same day cover the same package. Elo is marketed for rule engines, configuration DSLs and form builders, which are places where end users write expressions. Our take: if you let tenants or users write Elo rules, upgrade to 1.0.1 now and review stored expressions for constructor chains. EPSS hasn’t scored it yet.
    CVSS 9.8 (v3.1, GHSA) EPSS not yet scored KEV no (GHSA-33r5-xmm8-v6x5)
  • BuddyPress XProfile Custom Image Field: unauthenticated file deletion through signup (CVE-2026-120518) — Through 3.1.0, this WordPress plugin resolved a crafted registration value against the document root when a signup was activated. That lets an unauthenticated attacker delete arbitrary files. Wordfence notes that deleting wp-config.php can lead to site takeover. Exploitation needs open registration and an image-type profile field. The NVD record’s first reference points at an unrelated 2025 CVE, and the plugin’s name differs between the description and the product field, so match the plugin by slug. No fixed version is listed. Our take: disable the plugin or close registration until a fix ships.
    CVSS 9.1 (v3.1, Wordfence) EPSS 0.0078 KEV no (NVD CVE-2026-120518, Wordfence)

Exploited and critical CVEs5 stories

  • WordPress core upgrade-window race is now in KEV, due 6 November (CVE-2026-119977) — CISA added the TOCTOU flaw to KEV on 3 November with a three-day deadline. NVD’s SSVC entry records exploitation as active. The bug affects WordPress 4.7 through 7.1.3. Full-package core upgrades used predictable, web-reachable staging paths, so an unauthenticated attacker who wins the race can run code during the upgrade. Fixes are in 7.1.4 and backports. Probing of the path was reported on 31 October. The new development is CISA confirming exploitation. Wordfence scores it 8.1 because the attack is hard to pull off. WordPress’s own severity rating could not be confirmed. Our take: KEV status outranks the modest EPSS here. Upgrade during quiet hours and watch for requests to upgrade staging paths while it runs.
    CVSS 8.1 (v3.1, Wordfence) EPSS 0.0060 KEV yes, due 2026-11-06 (NVD, CISA KEV, Wordfence)
  • Barracuda: pre-auth bypass plus command injection gives root on Email Security Gateway (CVE-2026-116606, CVE-2026-111560) — Barracuda’s 2 November advisory pairs an authorization bypass that affects only ESG (9.3) with a command injection (8.6) in ESG, Load Balancer ADC, Message Archiver, WAF Control Center, WAF and Web Security Gateway. Chained, they give root. Both require access to the administrative interface. For ESG, the fix is firmware 9.4.017 or later with patch BNSF-40425, and BNSF-40430 for older builds. Other products have patch IDs but no version numbers. Barracuda doesn’t say whether either flaw is exploited. Our take: ESG has a history of being a target, so check that no ESG admin interface is reachable from the internet, then patch. Appliances several releases behind may need staged updates.
    CVSS 9.3 / 8.6 (Barracuda) EPSS 0.0073 / 0.0047 KEV no (Barracuda advisory)
  • Android November bulletin: a critical zero-click Framework RCE (CVE-2026-58868) — Google’s bulletin, published 2 November, lists a heap overflow in FrameDecoder.cpp as the most severe issue. It allows remote code execution without user interaction on Android 14 through 17. The bulletin has the usual 2026-11-01 and 2026-11-05 patch levels and doesn’t mention exploitation. SecurityWeek counts more than 200 fixes across both levels. NVD has no CVSS for the CVE yet, and CISA’s SSVC marks exploitation as “none” but automatable. Our take: zero-click media-parsing bugs are what spyware vendors look for, so push 2026-11-05 to managed fleets on the normal fast track.
    CVSS not yet assigned EPSS 0.0021 KEV no (Android bulletin, SecurityWeek)
  • KEV deadlines: WordPress Friday, then Adobe Commerce, Brotli, ESXi and Ivanti — The 3 November catalog has one addition (WordPress CVE-2026-119977, due 6 November). The next deadlines are Adobe Commerce PolyShell CVE-2026-48356 and Brotli CVE-2026-111497 on 10 November, the ESX logging bypass CVE-2026-41709 on 11 November, and Ivanti Connect Secure CVE-2026-118527 on 13 November. Our take: Brotli is the one to watch, because it sits in runtimes, images and appliances that don’t look like Brotli. The .NET advisory for the same CVE reached the GitHub database on 3 November. (CISA KEV feed, GHSA-p3jp-9v83-76w9)
  • Another batch of unpatched home-router criticals: TOTOLINK, Qihoo 360 and Linksys — Between 2 and 4 November, VulDB published critical CVEs with public write-ups for the TOTOLINK A950RG (CVE-2026-121597 to CVE-2026-121600, stack overflows). It also published them for several Qihoo 360 routers (CVE-2026-121606 firmware-signature bypass, CVE-2026-121607 command injection, CVE-2026-121609 hard-coded credentials) and the Linksys E5600 (CVE-2026-121615, mesh login bypass). VulDB notes the E5600 is unsupported. None lists a fix. Our take: these are botnet fodder, not enterprise emergencies. If they turn up on remote-worker or branch networks, replace them rather than wait for firmware.
    CVSS 9.9–10.0 (v3.1, VulDB) EPSS not yet scored KEV no (NVD CVE-2026-121606, NVD CVE-2026-121615, NVD CVE-2026-121597)

Cloud and infrastructure5 stories

  • Google: LLMjacking bills reach $100,000 a day and $1 million in total — GTIG and Mandiant describe attackers who steal cloud identities, then turn on model services and pass the cost to the victim. They saw single-day fraud above $100,000, cumulative losses near $1 million, and one actor making more than 500,000 API calls in under eight hours. Entry points include misconfigured service-account keys, GitHub tokens, exposed Ollama endpoints and the LiteLLM /key/regenerate flaw CVE-2026-40217. Resellers called “LLM mixers” sell the stolen access on. Our take: Google’s checklist is the useful part. Treat any unexpected enablement of an AI service as critical, and log Bedrock InvokeModel/Converse events, Azure Cognitive Services deployments and GCP aiplatform data access, which is off by default. Watch for max_tokens=1 validation sweeps. (Google Threat Intelligence)
  • Linux TCP use-after-free: Red Hat ships kernels, and Ubuntu’s are in -proposed (CVE-2026-98432) — Red Hat issued fixed kernels on 1 November for RHEL 8.10 (RHSA-2026:93414), 9.8 (RHSA-2026:93412, 5.14.0-687.64.1.el9_8) and 10.2 (RHSA-2026:93413), and a reboot is needed. On 2 November, Canonical put fixed generic kernels for 22.04, 24.04 and 26.04 into the opt-in -proposed pocket for qualification testing. Fixes for 20.04 and older are still pending under Ubuntu Pro. Canonical says updating is the only real mitigation, and it does not endorse disabling MPTCP. Red Hat’s errata calls itself Important, while its bulletin rates the CVE Critical. Our take: no exploitation is reported, but the bug is remote and unauthenticated. Red Hat’s nftables workaround does not cover container-to-container traffic on the same host.
    CVSS 9.8 (kernel CNA, Red Hat) EPSS 0.0076 KEV no (RHSA-2026:93412, Canonical, Ubuntu CVE page)
  • Amazon Redshift JDBC driver: connection parameters could load arbitrary classes (CVE-2026-119084) — AWS bulletin 2026-168, dated 3 November, says versions before 2.3.0 could load and run arbitrary classes while processing JDBC URL parameters or credentials-profile fields. Anyone who can influence those inputs can run code in the application. The fix is 2.3.0, and AWS asks that forks be patched too. If you can’t upgrade, don’t build connection strings from untrusted input, or check them against an allowlist. AWS gives no CVSS. Our take: this matters most for BI tools and multi-tenant data platforms that let users type in their own connection details.
    CVSS not provided (AWS) EPSS not yet scored KEV no (AWS bulletin 2026-168)
  • Babelfish for PostgreSQL: authenticated privilege escalation, no workaround (CVE-2026-119922) — AWS bulletin 2026-165 says improper access control in the Babelfish extension lets remote authenticated users raise their privileges. Affected versions are 1.2–1.5, 2.1–2.15, 3.1–3.12, 4.0–4.8 and 5.1–5.4, and the fixes are 4.10, 5.6 and 6.1 or later. No fixed release is listed for the 1.x to 3.x branches, so those need a major-version move. Our take: on Aurora PostgreSQL with Babelfish, plan an engine upgrade in the next window and review which low-privilege SQL Server-dialect logins can reach shared databases.
    CVSS not provided (AWS) EPSS not yet scored KEV no (AWS bulletin 2026-165)
  • Etrel INCH EV chargers ship a factory admin account over plain HTTP (CVE-2026-112354) — VulnCheck says the INCH AC charger’s web interface, before firmware 7.1.2 and 8.0.1, accepts a hard-coded default administrator login over cleartext HTTP. That exposes the charger configuration, OCPP ChargePoint identity and back-end WebSocket details. Nir Yehoshua of Force Majeure is credited. Our take: with the OCPP identity and back-end details, an attacker can impersonate the charger to its management system. Update the firmware and keep charger management interfaces off public and guest networks.
    CVSS 9.8 (v3.1, VulnCheck) EPSS not yet scored KEV no (VulnCheck advisory, NVD)

Crypto and Web35 stories

  • Binance post-mortem: a Homebrew download, a fake interview, an internal AI tool, then the signing service — Binance’s 3 November report puts the impact at about $6.34 billion. The chain began in June, when a wallet-infrastructure engineer installed a tampered Homebrew package that exposed his role and colleagues. In September, another engineer ran a “coding assignment” repository after two fake interviews, and the malware went undetected. On 20 October, the attacker used an internal AI tool to reach two more engineers and a container deployment token. On 29 October, between 17:15 and 19:56 UTC, the attacker deployed a container that reached internal wallet signing and drained hot wallets, ending with a 2,961.9 ETH transfer at 23:56. An EIP-7702 delegation on one MPC hot wallet kept working after withdrawals were halted, and Binance only cleared it at 00:10 on 30 October. Binance cites the FBI’s North Korea attribution. The Record reports that Pyongyang has publicly denied it. Our take: the lesson isn’t “train staff about recruiters”. It’s that a deployment token on a developer laptop could reach production signing, and that on-chain delegations survive a pause on the exchange side. (Binance incident report, Binance Recovery Update #6, The Record)
  • Binance laundering: the trackers disagree on how much is still loose — TRM Labs counts $6.36 billion stolen, nearly $2.7 billion frozen and about $2.4 billion still held in ETH and BTC. Elliptic counts $6.43 billion stolen, $2.85 billion frozen or seized (about 44%) and $3.18 billion still in linked addresses. Binance itself says $6.34 billion and $2.85 billion. TRM describes tokens the attacker minted and sold into its own TRON liquidity pool, lending receipt tokens passed between unlinked wallets, and swaps chained back to back with no intermediate wallet. Elliptic counts about 7,700 TRON addresses, at least $147 million bridged off TRON, about $16 million overlapping with Bitget-exploit addresses, and 68,600 ETH that hasn’t moved since 30 October. Even TRM’s own figures conflict on one pool: “nearly USD 100 million” withdrawn in the narrative, about $2.7 million in its FAQ. Our take: compliance teams should screen on the trackers’ address lists, not on amounts. (TRM Labs, Elliptic)
  • Chainalysis: the fake-interview playbook was refined over dozens of smaller thefts — Chainalysis says it has tied dozens of job-interview compromises to wallet thefts. It puts more than $14.3 million in losses over 18 months on similar North Korea-linked schemes, and says blockchain-assisted attacks rose fivefold in a year. One technique it describes splits command-and-control lookups across TRON and Aptos, both pointing to a payload stored on BSC. Our take: block developer machines from running coding-test repositories outside a disposable VM, and treat blockchain RPC lookups from non-wallet processes as suspicious. (Chainalysis)
  • Mercado Bitcoin: Chainalysis says about $49 million taken, with up to $10 million frozen — Chainalysis says the 2 November attack moved funds across 17 blockchains, mostly from Bitcoin and Ethereum. It was alerted at 2:30 a.m. ET and had law enforcement on the case within 30 minutes. Its post says “nearly $10 million” frozen in the introduction and $9 million in the body, with Tether freezing over $4 million in USDT. Mercado Bitcoin’s own statement, as reported, puts the affected assets at about $38 million. The $38M–$49M gap flagged in yesterday’s roundup is still open. (Chainalysis, The Record)
  • BTCPay: the hot-wallet thefts use a new way into a flaw fixed in August — BTCPay’s 2 November post says Bitcoin and Litecoin were stolen from hot wallets on 2.4.1 (23 July) and earlier. The attackers used a different method against the vulnerability fixed in 2.4.2 (7 August), and servers already on 2.4.2 or later when the warning went out showed no impact. The start date of exploitation is unknown. BTCPay gives no loss total and warns that some activity at the reported addresses predates the thefts, so balances aren’t confirmed losses. Its advice for 2.4.1 and earlier is to sweep funds to a new seed, take the old server offline with logs preserved, build a fresh VM without restoring the old one, and rotate every credential. Our take: an unpatched self-hosted payment server was the real problem. Keep only operating float on any server-held key. (BTCPay incident post, BTCPay 2.4.2 advisory)

Incidents and industry5 stories

  • ESET: Gorbag steals from Ukrainian courts and front-line councils, then deletes itself — ESET describes Gorbag, a Russia-aligned group active since at least February 2025. About a quarter of its targets were law-enforcement and justice bodies, and about a quarter were local administrations, mostly near the front line. The rest were defense organizations and a transport hub for foreign military aid. Since early 2026 it has delivered its C++ BeautyStealer through RAR archives that exploit WinRAR CVE-2025-8088. The stealer takes browser data, OpenVPN configs and files such as .kdbx, .pfx and .rdp, then removes itself. ESET’s attribution confidence is low to moderate, and it says Gorbag “may” pass stolen access to other operators. Press accounts that list GIFTEDCROOK as Gorbag’s tool go further than ESET, which mentions it without detailing a link. (ESET WeLiveSecurity)
  • Harvard alumni-system breach reaches Have I Been Pwned: about 851,000 addresses — HIBP added the November 2025 breach of Harvard’s alumni and fundraising systems on 3 November. It covers about 850,500 addresses, with donation records, dates and places of birth, family members’ names, employers and ethnicity. HIBP ties it to a ShinyHunters pay-or-leak attempt. Harvard has said the systems held no Social Security numbers, passwords or card data. Our take: donor-profile data like this is ideal material for convincing pretexting against alumni, so expect phishing timed to fundraising seasons. (Have I Been Pwned, BleepingComputer)
  • Eurojust: seven arrests and over 100 servers seized in a cross-border trading-scam case — Eurojust says the action on 3 November dismantled an investment-fraud network with estimated losses above €4 million and victims in at least 50 countries. Prosecutors in Itzehoe, Germany led the case, which began in 2022 with a German couple’s complaint. Investigators searched 17 sites, including a call centre in Kosovo. They also traced a Cyprus- and Israel-based company that allegedly sold ready-made fraudulent trading sites to call centres in Albania, Kosovo and North Macedonia. The seven suspects face surrender or extradition to Germany. (Eurojust, Help Net Security)
  • Microsoft: fake cracked-software installers sell victims’ bandwidth and CPU — Microsoft describes lures posing as cracked Navicat and FabFilter, old games, Roblox executors and unlock tools. They launch Inno Setup-style temporary runners that fetch numbered eld payloads. The payloads include WorldProxyPool proxyware, with SYSTEM scheduled tasks for startup, a five-minute watchdog and an hourly updater. Others are CharityEngine/BOINC with a silent VirtualBox install, and adware-style “Windows Manager” utilities. Microsoft gives no victim count. For hunting, look for execution from %TEMP%\is-*.tmp\, staged eld*.exe files, and outbound requests carrying r=offer_execution. Our take: proxyware on a corporate laptop turns your egress IPs into someone else’s residential proxy, so treat it as an incident, not as PUA noise. (Microsoft Security)
  • Microsoft: fewer than 1 in 200 CVEs are ever exploited, and KEV now lists them within days — Microsoft’s 2 November analysis counts about 2,000 exploited CVEs out of about 383,000 disclosed. Server-side RCE rises from 20% of published CVEs to 37% of exploited ones, while XSS falls from 15% to 4%. RCE, auth bypass and local privilege escalation make up 78% of exploited bugs. The median time from CVE publication to KEV listing in 2026 is three days, and the mean is 20 days, down from 57 in 2025. The weak spot is patch speed. Median patch times are about two weeks for Windows workstations, 10+ weeks for Linux servers, and more than a year for network appliances. Our take: these are Microsoft’s own fleet figures, so read the appliance number as a direction rather than a benchmark. It still argues for moving appliances to the front of the queue. (Microsoft Security)

Bottom line

  1. Binance’s post-mortem shows how a developer laptop became a route to production wallet signing. Find where deployment tokens and signing access sit on engineers’ machines, and take them off.
  2. Update channels and package registries are still the cheapest way into thousands of servers at once. Check cPGuard install logs, adopt cooldowns (Composer 2.11, npm min-release-age) and fix pull_request_target workflows before GitHub enforces the block.
  3. Patch on exploitation evidence, not on CVSS alone. The 8.1 WordPress race is in KEV with a three-day deadline, while a CVSS 10 router bug with no fix and no exploitation evidence is a replacement decision, not a fire drill.