Here are today’s top cybersecurity stories for Wednesday, November 4, 2026.
CISA Confirms Hackers Exploit WordPress Core Flaw During Software Upgrades
CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog. The CVSS 8.1 race condition stems from predictable, web-accessible staging paths used during full-package core upgrades. Unauthenticated attackers run code during the upgrade window. Wordfence recorded more than 18,500 requests aimed at staged installer paths in the first 21 hours after disclosure. Federal agencies must patch by November 6. The Hacker News
APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
Sekoia reports a watering hole campaign named Poisoned Source, attributed to Russia-linked APT29. Attackers injected code into compromised sites, lookalike domains, and the Plerdy SEO Tracker analytics service. The script fingerprints each visitor and serves an iOS or Android exploit chain built from known flaws. The payloads steal cookies, Wi-Fi passwords, and device data. The Hacker News
Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads
An Active Storage flaw rated CVSS 9.8 lets an unauthenticated attacker write arbitrary files when an app processes uploads with ImageMagick. Apps on the Disk service also expose readable files, including secret_key_base. The advisory is GHSA-f3w6-w445-fwh9 and has no CVE yet. Rails fixed it in versions 8.1.4.1 and 8.0.5.2. The Hacker News
Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM’s Memory
CVE-2026-102703 and CVE-2026-102704, tracked as XSA-523, sit in the Xen grant copy operation. They affect all Xen versions from 4.6 onward and expose memory of other guests, including dom0. Patches exist for supported branches and no mitigation is known. The Xen Project credits Anthropic, which used its Claude model to find the flaws. The Hacker News
cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes
An attacker used compromised credentials on November 2 to push a malicious script through the OPSSHIELD update system. Versions 5.88.12 through 5.88.19 installed a backdoor and collected /etc/shadow, SSH keys, and shell history. Version 5.88.25 and later removes the backdoor, and affected servers still need new passwords and keys. The Hacker News SecurityWeek
Chainstack Reports Production Systems Breach Exposing Customer Data and Password Hashes
Chainstack says an attacker entered through a third-party component, reached a development environment on October 26, and moved into parts of production. The company detected the intrusion on October 31. Exposed data includes organization names, account holder names, member emails, and password hashes. The incident overlaps with an AI-powered campaign linked to the WorkOS and Chainalysis incidents and Chainalysis. The Hacker News
Google Issues Patches for Critical Android Flaw Allowing Remote Code Execution Without User Interaction
The November Android bulletin lists 216 vulnerabilities, 23 rated Critical. CVE-2026-58868 is a possible heap buffer overflow in FrameDecoder.cpp on Android 14 through 17. Fixes arrive with security patch level 2026-11-01, and the full bulletin needs 2026-11-05. Google reports no known exploitation. The Hacker News
China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor
ESET attributes the campaign to SlippyNunchucks, which abuses insecure HTTP update traffic in Sogou Input Method and other Chinese apps. The group deploys the DarkVigil implant. ESET has observed the activity since July 1 against targets in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka. The Hacker News
Canadian Extradited to US Over Cryptomining Hacks on University Supercomputers
A US federal grand jury indicted two Canadian men for hijacking university supercomputers to mine Electroneum cryptocurrency in secret. One of the men has been extradited to the United States. SecurityWeek
Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical
Google released Chrome 157 with 213 security fixes. Seven are rated Critical. The update resolves dozens of memory safety bugs and incorrect or missing authorization issues. SecurityWeek
Russian Police Arrest 3 Suspected VasyGrek Hackers
Russia’s Interior Ministry arrested three suspected members of VasyGrek, also called Fluffy Wolf. The group has operated since 2016 against Russian and international companies. Charges include embezzlement and the creation and use of malware. The Hacker News
NIST Publishes Cybersecurity Guide for Businesses Too Small to Have IT Staff
NIST released a cybersecurity guide for small businesses without dedicated IT staff. Help Net Security
Stay tuned for today’s in-depth analysis posts.
