Crédit Mutuel Arkéa confirmed on 4 November that attackers went through a third-party provider’s platform to move money out of the bank’s own account. It did not confirm the reported $133 million, but said the loss is of that order of magnitude. CISA added a 2024 Apple Pointer Authentication bypass (CVE-2024-27834) to KEV after Sekoia tied it to an APT29 watering-hole campaign. Xen, Debian and Ubuntu’s apt, and Rails Active Storage all shipped critical fixes in the same 24 hours.

Do today

  • Apple iOS, iPadOS, macOS and Safari: confirm every managed device is past the May 2024 fixes for CVE-2024-27834 (iOS 16.7.8 / 17.5, macOS Sonoma 14.5, Safari 17.5), and that iOS 18 devices are fully current. The KEV deadline is 18 November. (CISA KEV catalog)
  • Debian and Ubuntu: upgrade the apt package before any other packages, on every host that installs over plain HTTP or through a mirror or proxy you don’t control. (Ubuntu CVE-2026-109518)
  • Xen hosts (XCP-ng, Qubes, self-built): apply the XSA-523 patches and reboot. There is no mitigation short of patching. (Xen Security Advisory 523)
  • Rails apps with Active Storage: upgrade to 8.1.4.1 or 8.0.5.2, or deploy the ImageMagick deny policy from the advisory, if you accept uploads from untrusted users. (Rails GHSA-f3w6-w445-fwh9)
  • Payment and treasury operations: list every third-party platform that can start transfers from the institution’s own accounts, and check its limits and out-of-band approvals. (Crédit Mutuel Arkéa statement)

AI and agent security4 stories

  • Xen XSA-523: a model-found grant-copy bug lets one guest read and write any other guest’s memory — The Xen Project published XSA-523 on 3 November. It covers two flaws in grant copy, CVE-2026-102703 and CVE-2026-102704, which let a malicious guest read and write memory in other domains, including Dom0. Every release from Xen 4.6 on is affected and there is no known mitigation. Patches cover xen-unstable and 4.19.x, plus 4.18.x and 4.17.x. The advisory credits Anthropic, using Claude, with the discovery, with validation by Ada Logics. The CodeAnt AI Security Research Team reported the same issue independently. Two separate teams finding the same hypervisor bug suggests AI-assisted auditing now reaches code that was assumed to be well reviewed. Our take: on multi-tenant Xen this is a reboot-now patch. XCP-ng 8.3 and Qubes 4.3 have shipped packages, and Debian stable was still listed as vulnerable on 4 November. (Xen Security Advisory 523, XCP-ng November updates, Qubes QSB-121, Debian tracker)
    CVSS unconfirmed EPSS not yet scored KEV no
  • Check Point: a Codex jailbreak bundle rewrites the agent’s instructions to serve ads — Check Point Research analysed Haiou, a Chinese jailbreak bundle for OpenAI Codex, in a report published on 3 November. It found the bundle on a threat actor’s misconfigured server, next to Cobalt Strike. The bundle edits Codex’s global instruction files so that replies to common greetings promote a paid LLM gateway. Check Point calls this “prompt adware”. The prompt content ships inside encrypted archives, which the researchers think is meant to get past scanners. They found no evidence that the author is a criminal and no clear sign that the gateway is malicious. Our take: global agent instruction files and third-party “skills” are now a persistence layer, so treat changes to them like changes to shell profiles and alert on them. (Check Point Research)
  • Trigger.dev: an exploit exposed environment variables for a subset of organizations — Trigger.dev disclosed on 1 November that an attacker used an exploit to read environment variables belonging to a subset of customer organizations. The company says it has blocked the exploit and emailed affected account owners with mitigation steps. It does not say which variables were read. This is another case in the run of October breaches at developer and AI-infrastructure platforms where attackers went after stored customer secrets. Our take: if you run jobs on the platform, rotate every secret held in its environment variables, whether or not you got the email, and check provider logs for use of those keys since mid-October. (Trigger.dev disclosure)
  • Meta Muse bug bounty: $1.2 million paid, top award for a trusted proxy header — Meta published the top findings from the Muse personal-agent bounty on 2 November. It received more than 630 reports and 64 were valid. The largest award, $300,000, was for an authentication check that trusted a header added by a local proxy. Once a second proxy layer was added, outside requests could carry that header and reach conversations and tokens on pre-release VMs. Two awards of $90,000 each went to a web page that imitated the browsing tool’s own status messages (prompt injection) and to email formatting that got one-time passcodes past redaction. Our take: the top bug is classic infrastructure, not model behaviour. Agent platforms still fail on header trust and proxy chains first. (Meta: Securing Muse)

Application security6 stories

  • Rails Active Storage: unauthenticated arbitrary file write via ImageMagick, rated 9.8 — Rails published GHSA-f3w6-w445-fwh9 on 4 November. It is a critical flaw in Active Storage that lets an unauthenticated user write files on the server by uploading a crafted file, when ImageMagick processes images. All three conditions must hold: the app uses the mini_magick processor (the default under load_defaults 6.1 or earlier), the system ImageMagick policy does not block the coders involved, and the app accepts untrusted uploads. Just attaching the file triggers it. The fixed releases are 8.1.4.1 and 8.0.5.2, and series older than 8.0 get no fix. The workaround is a deny policy for MSL, the gs delegate and the Ghostscript coders. The same release fixes a related high-severity advisory, GHSA-v924-7rp8-4mxh, where temporary filenames kept the uploaded extension. No CVE has been assigned yet. Our take: if the Disk service stored attachments, follow the advisory and rotate secret_key_base too. (Rails GHSA-f3w6-w445-fwh9, Rails GHSA-v924-7rp8-4mxh, oss-security announcement)
    CVSS 9.8 (v3.0, Rails) CVE not yet assigned KEV no
  • Debian and Ubuntu apt: a hostile mirror or proxy can get an unverified package installed as root (CVE-2026-109518) — Debian (DSA 6607-1) and Ubuntu published fixes on 4 November for an apt flaw in hard-link reuse. An on-path attacker who can tamper with HTTP traffic can make apt install an attacker-controlled package that skips verification. Exploitation needs apt to follow redirects and retry downloads. Retries are on by default (three) from Debian 12 and Ubuntu 22.04 onward, so older releases are exposed only where someone set Acquire::Retries. Ubuntu rates it High at CVSS 4.0 7.7, and the apt developers call it critical. Ubuntu’s fixed builds include 2.4.15ubuntu0.1 (22.04), 2.8.4ubuntu0.1 (24.04) and 3.2.1ubuntu0.1 (26.04), with ESM builds back to 14.04. The advisories mention no in-the-wild use. Our take: the fix is to update apt itself, and it has to happen first. The advisories describe the attack over HTTP and don’t say whether HTTPS sources are exposed. (Ubuntu CVE-2026-109518, Debian DSA 6607-1, Debian tracker)
    CVSS 7.7 (v4.0, Ubuntu) EPSS not yet scored KEV no
  • NIKKE PC launcher: CDN scripts tampered with to install a remote-access agent — Level Infinite said on 4 November that script files in the Goddess of Victory: NIKKE PC launcher may have been tampered with by a third party. A community write-up traces it to four JavaScript files on the publisher’s CDN, changed on 27 September. They loaded a payload that installed a remote-control agent able to take saved passwords, cookies, SSH keys, developer tokens and crypto-wallet data. The same write-up says all four files were clean on the CDN servers it checked by 4 November, and that the launcher cache may still hold modified copies. How the attacker got write access to the CDN is still unknown. Our take: on any affected Windows or Steam Deck machine, assume developer credentials are gone. Rotate SSH and API keys from a clean device, not just the game password. (MotherSphere analysis)
  • Django 6.1.3, 6.0.10 and 5.2.19 fix six issues, two of them in GeoDjango URL handling — Django’s 3 November security release fixes six CVEs. The one rated Moderate, CVE-2026-111362, is GDAL following URLs in GeoJSON crs members, so crafted geometries could make the server send requests or read files. CVE-2026-114582 is the same class of bug through string input to SpatialReference, and full protection needs GDAL 3.9 or later. The Low-rated issues are a multipart memory-limit bypass, log injection, cache-key confusion between missing and empty Vary headers, and view-only admins seeing full password hashes. Our take: GeoDjango apps that accept user geometry should patch now and check the GDAL version. Everyone else can patch in the normal cycle. (Django security releases)
  • rsync 3.5.2 fixes an unauthenticated CPU-exhaustion bug in the sender (CVE-2026-119741) — rsync before 3.5.2 lets a malicious receiver force the sender to compute strong checksums over and over, through crafted weak checksums in hash_search(). Unauthenticated clients pulling from a public daemon module can use up sender CPU across concurrent connections. VulnCheck scores it 8.7 under CVSS 4.0 and 7.5 under 3.1. The impact is availability only. Our take: public rsync mirrors are the exposed group. Upgrade them, or limit connections per client until you can. (NVD CVE-2026-119741, rsync 3.5.2 release)
    CVSS 7.5 (v3.1, VulnCheck) EPSS 0.0063 KEV no
  • Node.js: security releases for 22, 24 and 26 are due on or after 11 November — The Node.js project posted a pre-alert on 4 November. Releases for the 22.x, 24.x and 26.x lines are planned for 11 November or shortly after, and the most severe issue is rated High. No details are public yet. Our take: book the rollout window now, especially for internet-facing services and build images. (Node.js pre-alert on oss-security)

Exploited and critical CVEs6 stories

  • Apple CVE-2024-27834 enters KEV after Sekoia ties it to APT29 watering holes — CISA added CVE-2024-27834 to KEV on 4 November, with a due date of 18 November. It is a Pointer Authentication bypass that Apple fixed in May 2024. Sekoia’s report the same day assesses with moderate to high confidence that APT29 used it. The iOS 16.7 chain pairs it with WebKit bug CVE-2025-43529 to steal cookies. A second chain, against iOS 18.5, uses the DarkSword set to take full device data, and an Android chain against Chrome 139–145 steals Chrome data and Wi-Fi passwords. Every bug involved is an n-day. NVD scores the Apple flaw 5.5, which understates its value inside a chain. Our take: a medium CVSS with a KEV listing goes in Do today. The real exposure is unmanaged and long-unupdated iPhones. (NVD CVE-2024-27834 with KEV data, Sekoia: Poisoned Source)
    CVSS 5.5 (v3.1, NVD) EPSS 0.0060 KEV yes, due 18 Nov
  • Zyxel GS1900: the exploit behind the earlier switch compromises hit a second, separate bug (CVE-2026-107441) — On 3 November Zyxel published a fix for an out-of-bounds write in the GS1900 web interface, across ten models. The fixed builds are 2.90(xxxx.3)C0. Zyxel credits Binarly and scores it 8.8 with an adjacent-network vector. The advisory does not mention exploitation. Press reports citing Binarly say the exploit used in the August–September campaign against 996 switches was aimed at this flaw, not at the KEV-listed CVE-2026-7273 that was blamed then. Binarly’s own page did not load for us, so treat that link as reported, not confirmed. Our take: switches patched only for CVE-2026-7273 should be treated as still exposed. Update them and take the management UI off user VLANs. (Zyxel advisory, NVD CVE-2026-107441)
    CVSS 8.8 (v3.1, Zyxel) EPSS 0.0029 KEV no
  • SonicWall GMS 9.5.2: unauthenticated file read and SQL injection, and no fixes coming — SonicWall’s SNWLID-2026-0019 covers CVE-2026-109593, an unauthenticated read of internal GMS files scored 9.1, and CVE-2026-109594, a post-authentication SQL injection scored 6.8. GMS is end-of-life, so SonicWall will not release fixes and points customers to Network Security Manager. NVD published the records on 3 November. Our take: an unpatchable management server with an unauthenticated file read should come off the internet today, and its migration should be planned rather than deferred. (NVD CVE-2026-109593, SonicWall SNWLID-2026-0019)
    CVSS 9.1 (v3.1, CNA) EPSS 0.0052 KEV no
  • KEV deadlines: WordPress tomorrow, then ESXi, Ivanti and Apple — The 4 November KEV catalog has these dates: the WordPress core upgrade-window race (CVE-2026-119977) is due 6 November, the VMware ESX logging flaw (CVE-2026-41709) 11 November, Ivanti Connect Secure CVE-2026-118527 13 November, and Apple CVE-2024-27834 18 November. Apple’s entry is the only addition since 3 November. Our take: WordPress fleets have one day left, and hosts that upgrade automatically still need checking for the race window. (CISA KEV catalog)
  • Apache OpenOffice 4.1.17: a batch of document-parsing memory bugs, including PDF import — Apache published a run of OpenOffice advisories on 3 November. CVE-2026-90624, rated Important, is an out-of-bounds write in PDF import that affects releases through 4.1.16, and the announcement’s title calls it a heap overflow with code-execution potential. Other entries cover encrypted-PDF import, WW8, DXF, CFF and WMF parsing, local file inclusion through the SQL provider and GStreamer, and a remote document that loads without a prompt. Our take: anywhere OpenOffice opens untrusted files, including conversion servers, upgrade to 4.1.17. (Apache OpenOffice CVE-2026-90624)
    CVSS unconfirmed EPSS not yet scored KEV no
  • Apache Traffic Server: heap overflow via the Host header, published unfixed after 90 days — A researcher published a heap-buffer-overflow in Traffic Server’s Host-header handling on 3 November. They had reported it on 17 May and say the vendor never responded. Their testing shows a write of about 10 MiB that aborts the process. It only triggers when both request-header size limits have been raised well above the 32 KiB defaults. The researcher scores it 6.4 and says it was still present on master on 3 November. Our take: check those two settings. At the defaults, this is an item to track, not an emergency. (oss-security disclosure)
    CVSS 6.4 (v3.1, reporter) CVE not yet assigned KEV no

Cloud and infrastructure5 stories

  • Beget: an attack on the management layer wiped VPS, S3 and Kubernetes data at a major Russian host — Beget, one of Russia’s largest hosting providers and registrars, said attackers got into its infrastructure management layer overnight on 1–2 November and ran scripts that wiped data. All data on its VPS, S3 and Kubernetes services was lost, along with the binary backups of virtual servers. File-level backups survived. Its latest update says 35% of shared-hosting servers and 15% of Beget-administered dedicated servers were back, and every server has to be checked by hand before it returns. Beget says it has no sign that customer data was downloaded or changed, but tells customers to rotate credentials. Our take: backups held in the same control plane as production failed here, as they have before. Keep at least one copy the management plane cannot delete. (Beget official channel)
  • DreamHost: File Manager exploit exposed FTP/SFTP and some webmail credentials from August to 23 October — DreamHost’s notice says an attacker exploited a flaw in the third-party software behind its web File Manager. The attacker captured FTP/SFTP usernames and passwords for users who logged in there between about August and 23 October, plus webmail credentials for a limited number of users. DreamHost estimates that fewer than about 10% of email and FTP/SFTP accounts were affected and says it found no access to control-panel logins or billing. Formal notifications are now going out. Our take: affected site owners should treat this as a possible site compromise, not just a password reset. Diff web roots against version control and check mail forwarding rules. (DreamHost incident notice)
  • OpenVox Server: report deserialization RCE and certificate-wildcard impersonation, and Puppet won’t be fixed — The OpenVox project announced two critical-range flaws on 3 November. The first is code execution on the server through Ruby object deserialization in agent reports, in some custom-resource-type setups. The second is a trapperkeeper-authorization bug where wildcard auth.conf rules were matched as plain strings, so a certificate for a lookalike name could impersonate a real host. The project says all known OpenVox and Puppet versions are affected and that open-source Puppet will not get fixes. Fixed releases are openvox-server 9.2.0 and 8.18.0, openvoxdb 9.2.0 and 8.18.0, and openvox-agent 9.3.0 and 8.32.0. Our take: a configuration-management server compromise reaches every managed node, so upgrade it urgently and plan the move off unmaintained Puppet. (OpenVox announcement)
  • Apache ZooKeeper 3.8.8 and 3.9.7: SASL clients can claim any identity, up to superuser (CVE-2026-100252) — Apache disclosed five ZooKeeper flaws on 3 November. The most serious, CVE-2026-100252 (CVSS 4.0 8.6), lets an authenticated SASL client ask for any authorization ID. The server never checks it against the authenticated principal, so the client can take another identity’s ACLs, or full superuser access if the ID matches zookeeper.superUser. Versions 3.8.0–3.8.7 and 3.9.0–3.9.6 are affected. The rest of the batch covers an ACL-revocation race, unauthenticated persistent denial of service, and memory and recursion exhaustion. Our take: Kafka, HBase and similar clusters on SASL-enabled ZooKeeper should upgrade, because this flaw breaks the identity check their ACLs depend on. (Apache ZooKeeper CVE-2026-100252)
    CVSS 8.6 (v4.0, Apache) EPSS not yet scored KEV no
  • Apache ActiveMQ: LDAP DN injection bypasses authorization (CVE-2026-108500) — Apache published several ActiveMQ advisories on 3 November. CVE-2026-108500, rated Moderate, affects brokers that use the LDAPAuthorizationMapPlugin. An authenticated user can name a destination with LDAP DN special characters and change the search base used for ACL lookups. Fixed versions are 6.4.0, 6.3.3 and 5.19.12. Related advisories cover connection-ID spoofing, KahaDB journal poisoning and write access kept after live ACL revocation. Our take: this matters only where LDAP authorization is on, but there it lets any authenticated user bypass the ACLs. (Apache ActiveMQ CVE-2026-108500)
    CVSS unconfirmed EPSS not yet scored KEV no

Crypto and Web35 stories

  • Crédit Mutuel Arkéa: a supplier platform used to move about $133 million out of the bank’s own account — On 4 November Crédit Mutuel Arkéa confirmed what it calls a sophisticated external attack. The attackers went through a third-party provider’s platform to reach the bank and sent transfers from its own account to other banks. The bank names the provider only as a third party and says the entry point was not its Fortuneo subsidiary. The bank says the money may then have been converted to cryptocurrency through specialised platforms, and part of it has been frozen. It would not confirm the €118 million ($133 million) figure first estimated by investigator ZachXBT, saying only that the loss is of that order of magnitude and does not threaten its solvency. Customer savings were not affected beyond delayed transfers. We could not trace the on-chain portion to an explorer record, so the dollar figure is reported, not verified. Our take: the attack went through a provider that could send transfers from the bank’s own account, so watch that kind of channel as closely as customer channels. (Crédit Mutuel Arkéa update)
  • Binance: 98% replenished, a 44-token reserve snapshot, and 69 more withdrawal routes reopen — Binance’s Recovery Update #7 on 4 November says it has replenished about 98% of the affected amount and is still buying less liquid tokens through market and OTC channels. It also took a new Proof of Reserves snapshot at 00:00 UTC that day, covering 44 tokens, up from 10. The zero-knowledge proof is expected in 50–60 hours. Update #8 on 5 November reopens withdrawals from 04:00 UTC for 69 network-asset pairs across Ethereum, BSC, Base, TRON, Polygon and Sui. They will come back in stages. Our take: the 44-token proof only counts once it is published and users can check it. Until then the coverage claim is Binance’s own. (Binance Recovery Update #7, Binance Recovery Update #8)
  • Binance laundering: Elliptic and TRM still disagree on what is left, and new routes appear — Elliptic’s 3 November analysis, updated on 4 November, puts the theft at $6.43 billion with $2.85 billion frozen. It counts about $3.21 billion still in theft-linked addresses, mostly 18,270 unmoved BTC and about 68,300 ETH. It also tracks about $67 million in SOL moving out on 3–4 November and about $10.7 million in ETH swapped to BTC through THORChain. TRM’s 3 November update says $6.36 billion was taken, nearly $2.7 billion frozen and about $2.4 billion is still held. It describes a self-minted token on TRON that only its creator can mint, used to move value through a single liquidity pool. TRM’s own page gives two different figures for that pool, about $100 million and about $2.7 million. Our take: the firms disagree by about $800 million on the amount still held, so use attributed address lists for screening, not a dollar total. (Elliptic laundering analysis, TRM Labs update)
  • Chainalysis: the breach reached live tokens for all users, and KYT went offline — Chainalysis widened its incident notice late on 4 November. On 2 November it found that customer names, usernames, password hashes and live tokens for all users had been exposed. Its earlier post had said there was no evidence of session-token access. New monitoring then caught more abnormal activity, so it took KYT, address screening and the login page offline. Reactor and Data Solutions stay down while they are hardened. The company says it has no evidence that investigations data was accessed or attribution data manipulated. Every user will have to reset their password and rotate API keys, and KYT restoration needs customers to send IP allowlists. Our take: crypto compliance teams that use KYT through the API should rotate keys and review screening results logged since 30 October. (Chainalysis security incident update)
  • Zcash NU7 makes the remaining Sprout pool unspendable, partly on security grounds — ZIP 2003, set to ship with NU7, stops v4 transactions, the only format that can spend Sprout funds. The funds are not destroyed, but they may never be spendable again. The ZIP cites the attack surface and denial-of-service cost of verifying Sprout’s old JoinSplit circuit. Press reports put the activation at block 3,543,405, expected late on 5 November, with about 12,226 ZEC still in Sprout. Our take: custodians and exchanges with legacy Sprout balances have hours, not days, to move them. (ZIP 2003)

Incidents and industry5 stories

  • Sekoia: APT29 “Poisoned Source” hijacked an analytics script to push mobile exploits — Sekoia’s 4 November report describes watering holes it attributes, with moderate to high confidence, to APT29. They worked through compromised sites, lookalike domains, and a week-long injection into the Plerdy SEO tracker script from 27 August to 3 September 2026. The Plerdy compromise hit mostly Ukrainian military-related sites. Other targets included a US chemical trade association, a Bulgarian military site and a European political party. The exploit chains used only patched bugs, covering iOS 16.7, iOS 18.5 (DarkSword) and Android Chrome 139–145. Our take: a third-party analytics script runs with full page privileges. Use subresource integrity or self-host such scripts on high-value sites, and make sure fleet updates actually reach phones. (Sekoia: Poisoned Source)
  • ESET: SlippyNunchucks hijacked Sogou Input Method’s promotion config to plant DarkVigil — ESET reported on 4 November that the China-aligned group SlippyNunchucks redirected DNS for a Sogou Input Method configuration endpoint that was fetched over plain HTTP. The returned config made the genuine updater drop a renamed Adobe binary, which sideloaded a malicious libcef.dll. That DLL is DarkVigil, a modular .NET implant. Targets were organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka. ESET has not determined how the DNS was manipulated. Tencent fixed the issue as CVE-2026-120422 in Sogou Input Method 16.10, moving the requests to HTTPS with certificate pinning. Our take: inventory input-method and other “helper” software, because their update channels are just as exposed as the main application’s. (ESET Research)
  • France’s blood service: a refrigeration supplier’s remote monitoring was used to change storage temperatures — France’s EFS said a 2 November attack on a refrigeration equipment supplier raised temperature and defrost settings at three facilities that store blood products and samples. It reported no health impact and no loss of products. Coolworld Rentals confirmed a 4 November incident involving remote monitoring software in a limited number of its refrigeration units. It blamed a vulnerable component from a third party. This follows the supermarket refrigeration attacks covered earlier this week. Our take: remote refrigeration management now has to be treated as OT. Put it behind VPN, monitor setpoint changes, and alarm locally on temperature, not just through the vendor’s cloud. (Coolworld Rentals statement, EFS statement)
  • Kyiv Independent: CMS and newsletter accounts used to send fake nuclear and assassination claims — The Kyiv Independent said on 4 November that attackers got into its website content management system and its newsletter service. They sent four emails to subscribers, in Russian and English, falsely claiming a nuclear strike on Kyiv and an attack on President Zelensky, and posted similar messages on the site. Staff removed the posts. The outlet suspects Russia because of what the messages said and has not published technical evidence. Payment data is handled by third parties and was not at risk. Our take: newsletter platforms are a trusted publishing channel. Require strong MFA and send approval on them, as you would for the CMS. (Kyiv Independent)
  • Russia: MVD detains three alleged VasyGrek members and takes down infrastructure — Russia’s Interior Ministry said on 2 November that it had broken up the VasyGrek (Fluffy Wolf) group with help from Kaspersky. Police searched homes and offices and seized equipment. The alleged organizer is under house arrest and two others must not leave town. The ministry describes phishing emails disguised as accounting documents and remote access used to move money through company bank-client systems, including a September 2025 case of more than 660,000 roubles. Kaspersky separately counted more than 100 VasyGrek attack attempts in the first three quarters of 2026 against Russia, Belarus and Kazakhstan, with metallurgy most targeted. (MVD statement, Kaspersky)

Bottom line

  1. Suppliers were the way in again. A provider platform reached Arkéa’s own treasury account, a monitoring component changed blood-storage temperatures, and an analytics script carried APT29’s exploits. Map which outside parties can move money, change setpoints or run code on your pages.
  2. Old bugs still work. CVE-2024-27834 was fixed in May 2024 and joined KEV this week because APT29 exploited it on unpatched phones. Zyxel owners learned that the patch they applied was for a different bug from the one being exploited. Check that the fix is actually installed, not just that it was released.
  3. Fixes that change trust boundaries go first today: Xen XSA-523 on multi-tenant hosts, apt before any other package, and Rails Active Storage wherever untrusted uploads meet ImageMagick.