#3 · 2026-11-10 · Severity: Critical
Threat types: vulnerability-exploit, zero-day · Industries: cross-industry
Verified status
| CVE | CVSS | Vendor/product | Exploitation | References |
|---|---|---|---|---|
| CVE-2026-102895 | 9.8 | GPUStack GPUStack | Confirmed exploited (CISA KEV) | NVD · CISA KEV |
| CVE-2026-116779 | 9.8 | SignalWire FreeSwitch | Confirmed exploited (CISA KEV) | NVD · CISA KEV |
| CVE-2026-123218 | 9.8 | IBM Aspera Faspex | Confirmed exploited (CISA KEV) | NVD · CISA KEV |
| CVE-2026-123158 | 8.1 | OpenBSD OpenSSH | Confirmed exploited (CISA KEV) | NVD · CISA KEV |
| CVE-2026-120017 | 10.0 | — | None known | NVD |
| CVE-2026-76964 | 10.0 | — | None known | NVD |
| CVE-2026-89103 | 10.0 | — | None known | NVD |
| CVE-2026-125350 | N/A | — | Reported by source | NVD |
Checked against NVD and CISA KEV on 2026-11-10.
TL;DR
- Top story: IBM Aspera Faspex: IBM Aspera Faspex Incorrect Authorization Vulnerability (CVE-2026-123218)
- Also notable: SignalWire FreeSwitch: SignalWire FreeSwitch Code Injection Vulnerability (CVE-2026-116779); GPUStack GPUStack: GPUStack Improper Authentication Vulnerability (CVE-2026-102895)
- 4 new CISA KEV entries in the last 24 hours
Executive summary
The overall threat activity level is currently critical, driven by significant vulnerability and exploit reporting over the past twenty-four hours. Multiple critical vulnerabilities and exploits have been identified, including authorization issues in IBM Aspera Faspex, code injection in SignalWire FreeSwitch, and improper authentication in GPUStack. Additionally, Google has issued a security update addressing the eighth actively exploited Chrome zero-day of the year. Threat intelligence feeds also recorded numerous entries across MalwareBazaar, ThreatFox, URLhaus, and ransomware victim disclosures.
Top threats
1. IBM Aspera Faspex: IBM Aspera Faspex Incorrect Authorization Vulnerability (CVE-2026-123218)
Severity: Critical | Type: vulnerability-exploit | Industry: cross-industry
A critical vulnerability has been identified in IBM Aspera Faspex, tracked as CVE-2026-123218, with a CVSS score of 9.8. The flaw involves incorrect authorization within the product. Remediation for this issue is required by November 12, 2026.
Sources: CISA KEV
Recommended actions:
- Patch or mitigate CVE-2026-123218 following the vendor guidance; CISA set a remediation due date of 2026-11-12.
- Check logs of exposed systems for signs of exploitation before and after patching.
2. SignalWire FreeSwitch: SignalWire FreeSwitch Code Injection Vulnerability (CVE-2026-116779)
Severity: Critical | Type: vulnerability-exploit | Industry: cross-industry
SignalWire FreeSwitch contains a code injection vulnerability tracked as CVE-2026-116779, which carries a critical CVSS score of 9.8. Organizations using the affected product should apply remediation steps by the required due date of November 12, 2026.
Sources: CISA KEV
Recommended actions:
- Patch or mitigate CVE-2026-116779 following the vendor guidance; CISA set a remediation due date of 2026-11-12.
- Check logs of exposed systems for signs of exploitation before and after patching.
3. GPUStack GPUStack: GPUStack Improper Authentication Vulnerability (CVE-2026-102895)
Severity: Critical | Type: vulnerability-exploit | Industry: cross-industry
GPUStack is affected by an improper authentication vulnerability identified as CVE-2026-102895. This vulnerability carries a critical CVSS score of 9.8. Users should apply the available mitigation measures and adhere to the remediation timeline.
Sources: CISA KEV
Recommended actions:
- Patch or mitigate CVE-2026-102895 following the vendor guidance; CISA set a remediation due date of 2026-11-12.
- Check logs of exposed systems for signs of exploitation before and after patching.
4. Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
Severity: Critical | Type: vulnerability-exploit, zero-day | Industry: cross-industry
Google has released security updates to address nine vulnerabilities in Chrome, including one high-severity use-after-free bug in the XML component. This particular vulnerability is under active exploitation in the wild.
Sources: The Hacker News
Recommended actions:
- Check the linked report for products you run and verify details with the vendor before acting.
5. Google patches eighth Chrome zero-day exploited in attacks this year
Severity: Critical | Type: zero-day, vulnerability-exploit | Industry: cross-industry
Google has released emergency security updates to address a new Chrome vulnerability that is being actively exploited in zero-day attacks. This security flaw represents the eighth zero-day vulnerability patched in the browser since the beginning of the year.
Sources: BleepingComputer
Recommended actions:
- Check the linked report for products you run and verify details with the vendor before acting.
Ongoing: previously reported
| CVE | Vendor/product | CVSS | KEV due date | First reported |
|---|---|---|---|---|
| CVE-2026-19868 | SonicWall SonicOS SSLVPN | 7.5 | 2026-11-20 | 2026-11-09 |
Today’s action checklist
- Patch or mitigate the newly listed CISA KEV vulnerabilities (CVE-2026-123218, CVE-2026-123158, CVE-2026-116779, CVE-2026-102895) first; they are exploited in the wild and carry a CISA due date.
- Ransomware activity is concentrated in Healthcare: verify offline backups, patch internet-facing edge devices and review remote-access logins.
- Pull current indicators from the linked abuse.ch and OTX pages and add them to blocklists or detection rules where relevant.
- Read the linked sources for the products you run and subscribe to vendor security notices.
Indicators
26 new ransomware victims were listed in this window.
| Sector | Victims | Most active groups |
|---|---|---|
| Healthcare | 8 | interlock, Vortex, N0n |
| Retail & E-Commerce | 6 | interlock, N0n, Aoqin |
| Education | 3 | interlock, BYOD |
| Professional Services | 3 | Vortex, SilentRansomGroup, Global Secret Group |
| Agriculture and Food Production | 1 | interlock |
Raw indicators are not republished here. Pull them from the source pages.
- ThreatFox: 758 new IOCs (view on threatfox.abuse.ch)
- URLhaus: 100 new malicious URLs (view on urlhaus.abuse.ch)
- MalwareBazaar: 9 new malware samples (view on bazaar.abuse.ch)
Sources
- CISA Known Exploited Vulnerabilities Catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- CISA Cybersecurity Advisories and ICS Advisories (https://www.cisa.gov/news-events/cybersecurity-advisories)
- This product uses data from the NVD API but is not endorsed or certified by the NVD (https://nvd.nist.gov).
- EPSS scores by FIRST (https://www.first.org/epss)
- Ransomware victim data: ransomware.live (https://www.ransomware.live)
- Data: abuse.ch (URLhaus, ThreatFox, MalwareBazaar), https://abuse.ch. Used non-commercially.
- BleepingComputer (https://www.bleepingcomputer.com/feed/)
- The Hacker News (https://feeds.feedburner.com/TheHackersNews)
- SecurityWeek (https://feeds.feedburner.com/securityweek)
- The Record (https://therecord.media/feed)
- Krebs on Security (https://krebsonsecurity.com/feed/)
- NCSC UK (https://www.ncsc.gov.uk/api/1/services/v1/all-rss-feed.xml)
- CERT-EU (https://cert.europa.eu/publications/security-advisories-rss)
AI-assisted, published automatically, not human-reviewed; verify with vendors before acting.