InfoSecBulletin Cybersecurity for mankind
A flaw in Zyxel GS1900 switches was being used by hackers, and the update to fix it did not work. Researchers at Binarly found that a public exploit targeted a different bug than the one Zyxel fixed. Zyxel has now confirmed this as a new flaw, tracked as CVE-2026-107441.
Zyxel released its fix for CVE-2026-7273 on June 16, 2026. After GreyNoise said there were real attacks in September, Binarly checked all ten fixed firmware versions on September 28 and found that all were still vulnerable. Zyxel confirmed the new issue on October 11, sent out a fix on October 22, and shared its advisory on November 3.
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
Daily Cyber security update for 04.11. 2026
Daily Cyber security update for 03.11. 2026
Using ARTEX AI, Hacker to attack 200 Organizations Across 14 Countries
Amadeus cyber incident impacted “Cathay Pacific, Qantas, Japan, Malaysia, Korean & Asiana” Airlines
Multiple European supermarket fridges got hacked: Temperatures reached high as 55°C
Apple Warns 99 Countries iPhone Users of Mercenary Spyware Attacks
Daily Cyber security update for 31.10. 2026
NetamLoader malware to attack Win10: Customized for Gov.t in Asia
‘SMS of Death’ Zero-Click Flaw Disrupting Android Phones With a Single Text
GreyNoise reports that one person attacked 996 GS1900 switches in 48 countries around August 17. This person took device settings, hashed root passwords, and network information. Out of those, 564 switches still had factory default logins. Italy, the United States, and Taiwan had the highest number of victims.
CISA included CVE-2026-7273 on its Known Exploited Vulnerabilities list on September 21. The earlier report on the CISA warning for Zyxel GS1900 switches talks about this step. Binarly now says Zyxel’s first patch was either incorrect or the attacks targeted a different issue than CISA mentioned. Either way, the problem in Binarly’s advisory is found in all ten versions sold as fixes.
Update all GS1900 switches to the fix from October 22 or a newer one from Zyxel. Remove web management pages from the internet and restrict access to trusted admin networks. Change all default passwords immediately.
WinRaR Flaw
Gorbag hacker is using a WinRAR flaw to take browser passwords, VPN setups, and private files from Ukrainian groups. ESET researchers writing on WeLiveSecurity identified the group’s main malware as BeautyStealer, a C++ information stealer, alongside an earlier tool called Prime ReverseShell.
Their report on November 3 links old GIFTEDCROOK activity, which CERT-UA says is from UAC-0226, to a bigger operation that gathers information on Ukrainian targets. Click here to read full report.
WordPress flaw
The US Cybersecurity and Infrastructure Security Agency (CISA) told federal agencies that hackers are using a recently fixed serious WordPress weakness. Tracked as CVE-2026-119977, this serious WordPress flaw comes from a Time-of-check Time-of-use (TOCTOU) race issue and was reported by Umut Bayram from Picus Security.
Successful attacks can let hackers run code on the server without special access because of easy-to-follow, online paths used during big upgrades.
“A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window,” the WordPress security team said on October 28 when it released WordPress 7.1.4 with patches to address this security issue. “Because this is a security release, it is recommended that you update your sites immediately.”
CISA confirmed that CVE-2026-119977 is actively being exploited on Tuesday. They added this flaw to its Known Exploited Vulnerabilities (KEV) list and told Federal Civilian Executive Branch (FCEB) agencies to secure their systems by Friday, as required by Binding Operational Directive (BOD) 26-04.
“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” the cybersecurity agency warned.
