Inferlume

Zyxel GS1900 Switches: Silent Patch Bypass and Mass Switch Hijacking (CVE-2026-107441)

[+] Attack Progression and Flaw Discovery: During security research conducted in September 2026, researchers investigating an open directory on threat actor command and control infrastructure recovered an active exploit bundle targeting Zyxel GS1900 series smart managed switches. Detailed binary reverse engineering established that the captured exploit did not weaponize CVE-2026-7273, which Zyxel had patched on 16 June 2026. Instead, the exploit weaponized a previously unknown out of bounds write vulnerability in the Common Gateway Interface binary dispatcher.cgi, designated CVE-2026-107441. The June 2026 patch had introduced a counter check after the memory copy operation had already occurred, allowing crafted inputs to corrupt memory before validation executed.

[+] Threat Actor Profile and Campaign Tooling: The campaign is operated by Kapibala, a threat cluster described by consulted sensor intelligence as suspected Chinese speaking. Kapibala demonstrated advanced exploit engineering capability by constructing a PyArmor obfuscated Python 3.10 exploitation framework named exp.py packaged within gs1900_bundle.tar.gz. The framework executes automated firmware fingerprinting, contains hardcoded memory address offsets for switch builds dating from 2015 to May 2026, and implements two distinct exploitation primitives: a deterministic Global Offset Table overwrite requiring a single HTTP request, and an Address Space Layout Randomization stack brute force mode averaging 2048 requests.

[+] Post Compromise Actions and Red Heron Lineage: Upon achieving root command execution via /bin/busybox telnetd, the adversary downloads a data collection script via Trivial File Transfer Protocol from remote staging servers. The script harvests switch configuration files, hashed root administrative passwords, and network topology data, staging the stolen material in web readable directories for exfiltration. GreyNoise and Acronis TRU established a direct operational link between Kapibala and campaign Red Heron, which exploited self hosted Gitea instances. Both operations share backend command and control infrastructure under apex domain 981666[.]xyz and deploy identical malware families, including the JITTERLY ELF implant and the SIXZUT ring 3 rootkit designed to conceal processes named configd.

WordPress Core: TOCTOU Upgrade Race Condition (CVE-2026-119977)

[+] Vulnerability Architecture and Timing Window: WordPress Core versions 4.7 through 7.1.3 contain a high severity time of check time of use race condition within the automated full package core upgrade mechanism. During an upgrade procedure, WordPress unpacks replacement core files into predictable staging directories located beneath upgrade staging paths. Because these temporary directories remain web accessible during the unpacking and validation sequence, an unauthenticated remote attacker can issue precisely timed HTTP requests to execute staged PHP scripts or inject malicious logic before file integrity verification concludes.

[+] Exploitation Telemetry and Blast Radius: On 03 November 2026, CISA added CVE-2026-119977 to the Known Exploited Vulnerabilities catalog, confirming active in the wild weaponization. Consulted security sensor networks reported blocking 13095 exploitation attempts in a twenty four hour window, confirming that threat actors are actively automating scanning to locate WordPress installations undergoing maintenance or automated updates. While successful exploitation requires winning a narrow timing window, automated botnets repeatedly trigger or monitor update hooks to force upgrade states, threatening millions of exposed digital publishing, e commerce, and public sector web platforms.

Apple Safari and Operating Systems: APT29 Zero Click Browser Chain (CVE-2024-27834)

[+] Zero Click Watering Hole Delivery Model: Consulted intelligence sources confirmed that Russian foreign intelligence unit APT29 weaponized Apple Pointer Authentication bypass flaw CVE-2024-27834 within a sophisticated zero click mobile exploit chain. Attackers compromised legitimate regional websites, government portals, and commercial analytics pipelines, including Ukrainian analytics tool Plerdy SEO Tracker, to inject malicious JavaScript. When target personnel visit compromised pages from iOS or macOS devices, the script executes automated profiling and initiates the exploit chain without requiring user interaction.

[+] Pointer Authentication Bypass Mechanics: The exploit combines a WebKit remote code execution vulnerability (reported as CVE-2025-43529) with CVE-2024-27834, an improper authentication weakness in the pointer authentication mechanism. While Apple originally patched CVE-2024-27834 in May 2024 across Safari 17.5 and companion operating systems, adversary weaponization demonstrates that patched n day vulnerabilities remain potent against unmanaged mobile devices. Once memory protections are subverted, the exploit drops an infostealer that harvests browser session cookies, enabling the adversary to hijack active web sessions and bypass multi factor authentication across corporate enterprise environments.

Multi Vendor Enterprise Infrastructure: High Severity KEV Catalog Additions

[+] Palo Alto Networks PAN-OS Management Interface (CVE-2026-0322): CISA confirmed active exploitation of CVE-2026-0322, a high severity unauthenticated remote code execution vulnerability impacting PAN-OS management interfaces. Adversaries exploit exposed web management ports to execute operating system commands, establishing beachheads for internal network pivot.

[+] Cisco Secure Email Gateway Path Traversal (CVE-2026-76519): Confirmed under active exploitation in KEV. The flaw permits unauthenticated attackers to traverse directory structures via crafted HTTP requests, exposing sensitive gateway configuration files and mail logs.

[+] Atlassian Data Center Path Traversal (CVE-2026-21589): Cataloged in KEV on 05 November 2026 with a CVSS score of 9.3. First observed in public honeypots within two hours of disclosure in October, the flaw allows unauthenticated remote attackers to read configuration files, extract database connection secrets, and abuse identity management integrations to forge persistent administrative accounts.

[+] Plex Media Server Plex2Shell Exploit Chain (CVE-2026-96652 and CVE-2026-96654): Actively exploited chain combining server side request forgery and encoded URI scheme manipulation. Threat actors exploit media server endpoints to pivot to internal services and deploy XMRig cryptocurrency miners.

[+] Longitudinal Campaign Continuity Across Enterprise Remote Gateways: Workspace threat reports across the past thirty days confirm sustained pressure against enterprise remote access hardware. Threat actor UTA0576 continues to exploit Ivanti Connect Secure through a three flaw zero day chain (CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527), operating entirely in memory to harvest Active Directory credentials while evading appliance integrity checker scripts. Concurrently, supply chain risks materialized in automated hosting management tools, exemplified by the compromise of OpsShield cPGuard CDN credentials on 02 November which distributed root backdoors across 2950 servers.