Morning Threat Brief: Ivanti patches the last two VPN zero-days, Synology boxes hit by C3RB3R, a security tool turned backdoor, and Google kills a 1.3 million box botnet

Good morning. Ivanti finally closed the last two flaws in the VPN chain that gave attackers root, and one federal deadline already passed. Old Synology boxes are being encrypted by C3RB3R ransomware, a Linux security tool shipped a backdoor through its own update channel, and Google took down a botnet of 1.3 million TV boxes. Patch the VPN, update the NAS, and check the update logs.

1. Ivanti patches the last two Connect Secure zero-days: upgrade to the newest builds, then hunt (CVE-2026-111357, CVE-2026-118527). Ivanti updated its Connect Secure advisory on October 29 with fixes for the two remaining flaws in the chain that began with CVE-2026-104935, and coverage of the completed patch set landed November 2. Researchers say the three flaws were chained since at least October 1 to reach unauthenticated root on fully patched appliances, with the tracked actor UTA0576 re-exploiting devices per command, avoiding persistent web shells, and tampering with logs to hide activity, according to Volexity and Rapid7. Observed post-exploit actions included credential theft, Active Directory reconnaissance for Windows LAPS and BitLocker recovery keys, network scanning, and data exfiltration. The fixes live in Connect Secure 25.1.1.3 and 22.8R2.6: admins who stopped at the earlier October releases do not have the full chain closed. CISA added both flaws to KEV on October 30; the CVE-2026-111357 deadline was November 2 and CVE-2026-118527 is due November 13. Upgrade to the newest builds, preserve memory and logs, hunt for the reported post-exploit activity, and rotate any credentials that lived on an exposed appliance.

2. Synology warns of C3RB3R ransomware on outdated DSM: update the box, block the management page. Synology warned on October 29, in reporting published November 2, that attackers are exploiting a vulnerability patched in December 2024 to deploy C3RB3R ransomware on NAS devices running outdated DiskStation Manager. Victims report a read-me3.txt ransom note and files renamed with a .L0CK3D extension, with a decryptor sold through a dark web portal. Synology has not named the exact flaw; its advisory SA-24:20 covers CVE-2024-10441 (remote code execution, CVSS 9.8), CVE-2024-50629, and CVE-2024-10445, and which one is under attack is unconfirmed. Shadowserver tracks more than 380,000 internet-exposed Synology devices, though that count does not show how many are vulnerable. Update DSM to a fixed release, enable automatic updates, block internet access to the management interface, and keep offline backups that ransomware cannot reach.

3. cPGuard supply chain attack: a security tool's update channel shipped a backdoor. An attacker used compromised credentials to reach OPSSHIELD's update distribution infrastructure starting November 2 at 02:06 UTC, then pushed a malicious script through cPGuard versions 5.88.12 through 5.88.19 on Linux hosting servers. The script installed a backdoor and collected password hashes, root database configuration, root shell history, and root SSH files, staging them for pickup. OPSSHIELD detected the attack within 12 hours and, in a November 3 update, estimated the attacker retrieved 32 collected files, each from one customer server. That is confirmed retrieval, not a total count of affected servers. Update to cPGuard 5.88.25 or later, check the install log for affected versions, hunt for the indicators below, and rotate every credential the script could have copied, including passwords, database credentials, SSH keys, and cloud tokens. A corrective update removes the backdoor but cannot invalidate credentials already copied.

4. Google dismantles the 1.3 million device XCPE botnet, but the backdoor stays on the boxes. Google's Threat Intelligence Group reported November 2 that it dismantled XCPE, a botnet of more than 1.3 million Android devices, mostly TV set-top boxes, and assesses with high confidence that manufacturer Videostrong Technology deliberately built the x.cpe backdoor into device firmware and sold access to criminal affiliates for ad fraud and residential proxy traffic. Legal action took down the botnet's control servers plus the control domains of more than a dozen affiliate malware families, cutting access to at least 10 million additional devices reached through other channels. Google has banned Videostrong from certified Android devices. The catch: the takedown cuts the servers, not the backdoor, which runs with system privileges and reinstalls from a protected partition, so a reset will not reliably clean an affected box. If you run a cheap Android TV box, assume an affected one stays compromised: take it offline or replace it, and watch your network for proxy or ad-fraud traffic.

Warning: two KEV deadlines land today, Tuesday, November 3: Plex Media Server flaws CVE-2026-96655 and CVE-2026-96652, plus Siemens Software Center CVE-2026-110936. The second Ivanti flaw, CVE-2026-118527, is due Friday, November 13. Patch the Plex servers today.

Full writeups: kevinthecyberguy.com/vuln-watch
Indicators to hunt: kevinthecyberguy.com/ioc-library

New CISA KEV additions today: none. The catalog stands at 1,766 entries, last updated October 30.

← kevintswaney.com