Morning Threat Brief: WordPress joins KEV with a Friday deadline, a Zyxel patch that did not patch, a perfect 10 Node-RED flaw under attack, and ransomware that may have run on autopilot

Good morning. WordPress is now in CISA's exploited list with a Friday deadline, and the attack window is the update itself. A Zyxel switch patch shipped for one bug left a second root flaw open, industrial gateways running Node-RED without a login are being hit, and a UK school ransomware case looks like it ran on an automated loop. Update WordPress, replace the switch firmware, lock down Node-RED, and check your backups.

1. WordPress joins KEV with a Friday deadline: update now, then check the upgrade folder (CVE-2026-119977). CISA added WordPress Core CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3, with a federal remediation deadline of Friday, November 6. The flaw is a time-of-check time-of-use race condition in the full-package core upgrade process: when WordPress unpacks a complete update, it stages files in a predictable folder under wp-content/upgrade, and an unauthenticated attacker who reaches the staged installer before cleanup finishes can point the install at a database they control, opening a path to server code execution. It affects WordPress Core 4.7 through 7.1.3, carries a CVSS score of 8.1, and needs no account and no user interaction, though the timing window is narrow. WordPress shipped the fix in 7.1.4 on October 28, with backports for older branches, and WordPress itself rates the issue Low while Wordfence scores it 8.1. CISA's KEV listing settles the priority: this one is being exploited. Wordfence deployed a firewall rule on October 28, saw the first matching request nine minutes later, and counted more than 18,500 requests for staged setup-config.php paths in the first 21 hours; its rolling count on November 4 showed 12,289 blocked attempts in 24 hours. Those are blocked attempts, not confirmed compromises, and CISA names no actor and reports ransomware use as unknown. Update to the fixed release for your branch, confirm automatic background updates actually applied, block web access to wp-content/upgrade if you cannot patch yet, and review web logs and file integrity for staged installers left behind.

2. Zyxel GS1900 zero-day: the patch that did not patch (CVE-2026-107441). Zyxel published an advisory on November 3 confirming a second, previously unpatched flaw in its GS1900 switches, tracked as CVE-2026-107441, after researchers at Binarly found that the June 16 fix for CVE-2026-7273 did not close the hole. Binarly tested all ten firmware releases sold as fixes on September 28 and found every one still open; Zyxel confirmed the new bug on October 11, shipped a fix on October 22, and published the advisory November 3. The flaw sits in the dispatcher.cgi web program, with the same weak code also in httprestorecfg.cgi and httpupload.cgi, and lets an unauthenticated attacker run commands as root over ordinary HTTP from any network that can reach the switch. Binarly rates it 9.8; Zyxel gave it 8.8. GreyNoise reports one actor hit 996 GS1900 switches in 48 countries around August 17, stealing device settings, hashed root passwords, and network details, with 564 of those switches still on factory default logins and Italy, the United States, and Taiwan hit hardest. The actor used a PyArmor hidden Python script that pulled a collector script over TFTP, and GreyNoise ties the actor to the Gitea campaign Acronis called Red Heron, which used the JITTERLY backdoor and its SIXZUT rootkit. Binarly notes the open question: either Zyxel's first patch was wrong, or the attacks hit a different bug than CISA named. Either way, update every GS1900 switch to the October 22 fix or newer, take web management off the internet, change every default password, and rotate credentials on any exposed switch, since hashed root passwords were stolen.

3. Perfect 10 Node-RED flaw under attack on Siemens gateways: put a login on it or take it offline (CVE-2026-58115). VulnCheck reported November 2 that its canary network caught exploitation of CVE-2026-58115, a CVSS 10.0 missing authentication flaw in the Node-RED interface on Siemens SIMATIC IoT2050 Advanced gateways, on October 30, with 16 attempts from the same source address by November 1. The flaw lets an unauthenticated attacker send a single POST /flows request that deploys a flow wiring an inject node to an exec node, running system commands with maximum privileges, and VulnCheck observed flows used to fetch a Linux bot binary and stage webshells. Siemens documented the flaw in advisory SSA-834709 on August 11, CISA republished it as ICSA-26-237-03 on August 25, and the fix is Industrial OS V4.3.4.1 or later. Read the caveats before you brief this one: VulnCheck observed the attacks against its own honeypot network, it did not retrieve the later stage payloads, no confirmed production compromise has been publicly reported, and the flaw was not in CISA's KEV catalog as of November 3, only in VulnCheck's own exploited list. Update affected gateways to V4.3.4.1 or later, and if Node-RED is not needed, uninstall it. If it is needed, turn on its built in authentication, require HTTPS, and take it off the public internet: the same missing login configuration exposes standalone Node-RED too.

4. 3AM ransomware at a UK school estate: the attack that may have run on autopilot. Bitdefender reported November 3 that a 3AM ransomware affiliate encrypted around 37 of nearly 50 machines it reached at a UK school estate, in an intrusion that ran September 10 to 19 from an unmanaged host. The attacker used a modified public PowerShell tool to extract and decrypt credentials stored on three Veeam backup servers, copied a Chrome database holding credentials, deployed Mimikatz and LSASS memory dumping tools, created rogue domain admins named library and svc_bkpmon, and in the final stage tried to remove Sophos and Bitdefender protection, delete system state backups, and deploy 3AM's Rust based encryptor. Bitdefender believes the commands may have been AI generated and driven by an automated agentic loop, based on the pattern: the same commands returning repeatedly, slightly modified each time, at roughly regular intervals of 40 to 100 seconds. Bitdefender is explicit about the limit of that claim: it could not access the machine the attacker worked from, so it cannot document which model was used, whether it ran locally or remotely, or even whether a person was copying and pasting instructions and results. Initial access was not established. Treat the AI angle as an interpretation, not a proven fact, and take the defensive lesson at face value: protect backup servers like domain controllers, alert on Veeam credential access and rogue admin creation, and keep offline backups that ransomware cannot delete.

Warning: the WordPress KEV deadline lands Friday, November 6, and the second Ivanti flaw, CVE-2026-118527, is due Friday, November 13. The Plex and Siemens deadlines from yesterday are now overdue: if those servers are still unpatched, patch them today.

Full writeups: kevinthecyberguy.com/vuln-watch
Indicators to hunt: kevinthecyberguy.com/ioc-library

New CISA KEV additions today: one, WordPress Core CVE-2026-119977, added November 3. The catalog stands at 1,767 entries, last updated November 3.

← kevintswaney.com