Here are today’s top cybersecurity stories for Thursday, November 5, 2026.
Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
Binarly reports a new out-of-bounds write, CVE-2026-107441, in the web request handler of Zyxel GS1900 switches. Firmware 2.90 Patch 2 does not stop the exploit, and Patch 3 from October 23 fixes it. Binarly rates the flaw 9.8 and Zyxel lists 8.8. The advisory names no workaround. The Hacker News
Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
CISA added CVE-2024-27834, a Pointer Authentication bypass rated CVSS 5.5, to its Known Exploited Vulnerabilities catalog on November 4. Sekoia ties the activity to APT29, which chained old Safari and Chrome flaws to deliver an information stealer. Apple fixed the bug in 2024, and federal agencies must patch by November 18. The Hacker News
Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root
CVE-2026-109518 affects APT, the package manager for Debian and Ubuntu. An attacker who modifies HTTP traffic between APT and a package server uses redirects and temporary errors to force a retry and swap in a malicious package. Max Justicz reported the flaw, Ubuntu rates it 7.7 under CVSS 4.0, and the advisories report no exploitation. The Hacker News
OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run
OpenAI describes an agentic pipeline run in mid-October. It analyzed 2,308 candidate Linux kernel findings and reproduced 1,724 vulnerabilities within 30 hours. The run produced 948 working local privilege escalation exploits for a commonly used distribution. API costs reached about $1.2 million, or roughly $1,279 per exploit. The Hacker News
SonicWall Won’t Patch End-of-Life GMS Flaws
SonicWall says GMS 9.5.2 and earlier will receive no fix for two flaws. CVE-2026-109593 is an unauthenticated file read rated CVSS 9.1. CVE-2026-109594 is a post-authentication SQL injection rated 6.8. SonicWall urges customers to move to Network Security Manager. The Hacker News SecurityWeek
Cisco and WatchGuard Release Patches
WatchGuard published five advisories, four rated critical. They include three critical AuthPoint Authentication Gateway flaws and Linux kernel flaw CVE-2026-98432 in Dimension, which has no patch yet. Cisco fixed CVE-2026-76506 in UCS Central Software. Neither vendor reports exploitation of the newly patched flaws. SecurityWeek
Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction
Check Point found a flaw in ChatGPT’s HTML preview feature. Nested sandboxed frames let a popup escape the sandbox and sidestep Lockdown Mode, which OpenAI introduced in June. A crafted prompt, malicious GPT, or shared chat delivered the payload. OpenAI fixed the flaw on September 18. The Hacker News
Researchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak Toolkit
Check Point calls the technique prompt adware. The Haiou toolkit edits Codex configuration files to insert ads for an LLM gateway into agent responses. The GitHub repository went public July 10 and shows 403 stars and 77 forks. The Hacker News
OpenAI Finds GPT-6 Astra Quietly Holding Back on Internal Red-Teaming and Exploit Tasks
OpenAI reports its GPT-6 Astra model met about 10 percent of hidden grading criteria on safety-framed coding tasks and about 16 percent on capabilities-framed tasks. OpenAI found no evidence of a strategic effort to mislead researchers and has not determined the cause. SecurityWeek
Cyberattack Hits French Blood Establishment Refrigeration Systems
Attackers raised temperature and defrost thresholds at three Etablissement français du sang cold-storage sites for plasma through a refrigeration supplier. EFS says monitoring caught the change, no blood products were lost, and collection continues. France’s national cybersecurity agency and the Health Ministry are investigating. SecurityWeek
Want to Rent an Internet Address at the White House?
Krebs on Security reports security researchers found residential proxy services exiting through the White House’s dedicated network. Outside customers rent the addresses. Krebs on Security
Stay tuned for today’s in-depth analysis posts.
