Attackers exploited a zero-day in Zyxel GS1900 series switches to compromise roughly 996 devices across 48 countries, and Zyxel says its June patch for CVE-2026-7273 didn't fully close the hole. If you manage these switches, install the Oct 22 firmware (Patch 3 / .3C0), keep management interfaces off the internet, and check exposed units for unexpected config changes.
DreamHost says a flaw in its web File Manager was abused from August until Oct 23, exposing FTP/SFTP credentials and some webmail sessions. If you host there, rotate FTP/SFTP and mail passwords, audit your site files for anything you didn't upload, and check mailbox forwarding rules for silent redirects. Shared-hosting customers elsewhere: this is a good week to do the same audit.
A critical bug in Ruby on Rails Active Storage (GHSA-f3w6-w445-fwh9) lets attackers write arbitrary files through the ImageMagick/mini_magick image-processing path. Upgrade to Rails 8.1.4.1 or 8.0.5.2, and if your app uses the Disk storage service, rotate application secrets after patching in case they were read or overwritten.
New since yesterday's issue: Wordfence says it blocked more than 18,500 attempts to exploit the WordPress Core upgrade race condition in about 21 hours, with sites on versions before 7.1.4 being targeted. The federal patch deadline is Nov 6, so if any WordPress site you run (staging included) isn't on a fixed release yet, today is the day. More: The Hacker News.
Bitdefender found that simply installing a crafted APK, without ever opening it or granting permissions, can crash Android's system_server into a persistent boot loop, demonstrated on a Pixel 10 running Android 17. Google has marked it Won't Fix, so the practical defense is the usual one: install apps only from trusted stores and keep Play Protect on.
India's CERT-In is warning banking, financial and crypto firms about an AI-assisted campaign it calls Crafty Falcon, which includes a backdoored ARTEX AI image on Docker Hub (tomicdd/artex and clones) that opens a root shell; 62 consoles were seen Nov 2 to 4 and the image has about 9,000 pulls. Only pull images from verified publishers, pin by digest, and scan anything you run in production.
An attacker abused a sell/burn hook in the Tendril token contract to distort its PancakeSwap V2 pool reserves and walk off with roughly $555K in USDT. Tokens with custom transfer or burn logic that touches liquidity pools are a recurring weak spot, so treat them with extra caution until they've had a real audit.
Following yesterday's report, Level Infinite has confirmed the Goddess of Victory: NIKKE PC launcher was tampered with and pushed a client fix on Nov 4. The payload was a LuaJIT backdoor plus an info-stealing DLL; block or search your logs for insightjs[.]com and insightjs[.]org, and if you played on PC during the window, scan your machine and change saved passwords.
Grype · Apache-2.0 license
Grype is a free vulnerability scanner from Anchore that checks container images, filesystems and SBOMs against known-vulnerability databases and lists what needs patching. It's for developers and ops teams who want a quick check before they run an image or ship a build, the kind of habit that helps after weeks of backdoored Docker images and vulnerable Rails dependencies.