Daily Brief

Wednesday, November 4, 2026

Added to KEV

1 addition

Attackers target WordPress core flaw that lets them run code during updates

Wordfence saw attempts to exploit it from Oct 28, the day WordPress released 7.1.4 and security releases for older branches back to 4.7.

Further readingWordfence research, further reading on Attackers target WordPress core flaw that lets them run code during updates WordPress release notes, further reading on Attackers target WordPress core flaw that lets them run code during updates

Source: CISA’s Known Exploited Vulnerabilities catalog, version 2026.11.03

Vulnerabilities and patches

3 items

Ruby on Rails

Ruby on Rails flaw lets attackers write server files through crafted uploads

Apps that process uploads with ImageMagick under a policy that doesn’t block the coders involved are exposed, and Rails v8.1.4.1 and v8.0.5.2 fix it.

Further readingRails advisory GHSA-f3w6-w445-fwh9, further reading on Ruby on Rails flaw lets attackers write server files through crafted uploads Rails notice, further reading on Ruby on Rails flaw lets attackers write server files through crafted uploads

Cisco Secure Email Gateway

Exploited

Cisco updates its fix for exploited Secure Email Gateway flaw that gives root

An unauthenticated attacker only has to send a crafted email, and on Oct 31 Cisco updated its 15.5.5-014 fix because of new information about exploit code online.

Further readingCisco advisory, further reading on Cisco updates its fix for exploited Secure Email Gateway flaw that gives root

SonicWall GMS

SonicWall GMS flaw lets unauthenticated attackers read files and has no fix

SonicWall rates it 9.1 and won’t fix Global Management System 9.5.2 or earlier, since support for it has ended, and points customers to Network Security Manager.

Further readingSonicWall advisory, further reading on SonicWall GMS flaw lets unauthenticated attackers read files and has no fix

Breaches and campaigns

1 item

Defense firm ILC Dover pays $13 million to settle US cybersecurity fraud claims

The Justice Department alleged that ILC stored controlled defense data with a cloud provider it didn’t hold to federal standards and hadn’t fully implemented required security controls.

Further readingJustice Department notice, further reading on Defense firm ILC Dover pays $13 million to settle US cybersecurity fraud claims

Worth reading