The Hack Sheet #010

Wednesday, November 4, 2026 · 8 stories

  1. Security cPGuard update channel hijacked: versions 5.88.12 to 5.88.19 shipped a credential-stealing script

    OPSSHIELD says attackers took over the update channel for cPGuard, its security plugin for cPanel servers, and pushed a stealer script in builds 5.88.12 through 5.88.19 on Nov 2. If you run cPGuard, update to 5.88.25 or later, then treat the server as exposed and rotate every credential and key it held. A security tool with root access is a prime supply-chain target. More: MSP Business's Patchwork Wednesday roundup.

    source: opsshield.com

  2. Security CISA adds WordPress Core upgrade race condition CVE-2026-119977 to KEV; federal deadline Nov 6

    Attackers are exploiting a race condition in the WordPress Core upgrade process (CVSS 8.1) affecting versions 7.0.0 to 7.0.7 and 7.1.0 to 7.1.3, and CISA has added it to its Known Exploited Vulnerabilities catalog with a Nov 6 deadline for federal agencies. Check every WordPress site you run, including forgotten staging copies, and update to a fixed release now.

    source: thehackernews.com

  3. Security Update: PHP2Shell and Fragnesia chained to root 25 PAN-OS systems; Cisco, Citrix, F5 and Siemens also affected

    New since our earlier coverage: Singapore's CSA reports the PHP2Shell bugs (CVE-2026-109618/109619) chained with Fragnesia (CVE-2026-46300) were used to get root on 25 Palo Alto PAN-OS systems, and says products from Cisco, Citrix, F5 and Siemens are affected too. Patched PHP builds are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; for appliances, watch each vendor's advisory. More: F5 Labs' Nov 4 threat bulletin.

    source: csa.gov.sg

  4. Security Update: Ivanti patches two more Connect Secure zero-days used in the same attack chain

    Ivanti fixed CVE-2026-111357 and CVE-2026-118527, which attackers chained with the earlier CVE-2026-104935, so devices patched only for the first bug need updating again: move to 25.1.1.3 or 22.8R2.6. A clean result from Ivanti's Integrity Checker Tool does not prove a device is clean, so hunt for signs of compromise too.

    source: securityweek.com

  5. Security Russian-linked watering hole hits unpatched iPhones and Android Chrome with zero-click exploits

    Sekoia found a watering-hole campaign using already-patched (n-day) exploits against iOS 16.7 and 18.5 and Chrome on Android versions 139 to 145, needing no click beyond visiting a compromised site. These bugs have fixes, so the defense is simple: update phone OS and Chrome, and push it through MDM for company devices.

    source: bleepingcomputer.com

  6. IT Supermarket freezer controllers hacked into defrost across France and Europe

    Internet-facing refrigeration controllers in supermarkets were accessed and switched into defrost, and US commissary failures in August are being looked at as well. The common thread is controllers reachable from the internet with default passwords. If you install or manage building and refrigeration controls, change default credentials and put them behind a VPN, not on the open web. More: SANS ISC StormCast.

    source: claroty.com

  7. Crypto Mercado Bitcoin hot wallets drained for roughly $40M to $49M; exchange says it will cover losses

    Brazil's Mercado Bitcoin lost an estimated $40M to $49M on Nov 2 in what looks like a theft of private keys, with funds swept from 36,042 deposit addresses; about $11M has been frozen, and the exchange says it will make users whole. Expect fake refund and compensation scams aimed at its customers, so only trust announcements from the exchange's official channels. Tracing: Bitquery and Chainalysis.

    source: coindesk.com

  8. Gaming NIKKE PC launcher reportedly served a RAT through a poisoned CDN

    Reports say the PC launcher for Goddess of Victory: NIKKE pulled a remote-access trojan from a compromised Level Infinite CDN starting Nov 1; the files were reportedly replaced Nov 3, and Level Infinite hasn't commented yet. If you play on PC, check the launcher's debug.log for "k2f_chan" and scan your machine. Separately, Sega's ALL.Net/Aime arcade service is offline after a breach (Kotaku).

    source: invenglobal.com

// tool_of_the_day

Wazuh · GPL-2.0 (engine AGPL-3.0) license

Wazuh is an open-source security platform whose agents watch servers and endpoints for changed files, suspicious log events, known vulnerabilities and misconfigurations, then alert from a central dashboard. It's for admins and small security teams who want free host monitoring and file-integrity alerts, the kind that would flag a security plugin's update suddenly dropping new scripts on a web server.

Verified Nov 4, 2026: repo loads, actively maintained (last push Nov 4), GPL-2.0 with AGPL-3.0 engine.

← back to the front page