Comparing 4 November 2026 with the previous day 28 October 2026.
The campaign shows how APT29 attacks mobile devices via a compromised third-party analytics script , a risk that goes beyond classic patch processes.
Active exploitation of Ivanti Connect Secure zero-days by state-backed actors highlights the threat to exposed remote-access infrastructure, even though Ivanti itself is not deployed.
The alert only describes the vulnerability; there is no information on active exploitation or attack campaigns.
The campaign shows that attackers use external Teams chats for social engineering and deliver malware within 15 minutes , a direct attack vector against Microsoft 365.
The report adds that a root RCE vulnerability in the APT package manager is exploitable via manipulated HTTP mirrors or proxies and the default retries starting with Ubuntu 22.04.
The vulnerabilities affect peripheral Creative Cloud components (Bridge, Substance 3D) that are often overlooked in patch cycles even though they process local files and file formats.
The report shows that APT retries failed downloads by default, allowing package verification to be bypassed and enabling root code execution.
The advisory provides no CVE IDs or exploitation evidence, so individual vulnerabilities cannot be prioritized specifically.
The BSI update bundles multiple local Linux kernel vulnerabilities without CVE or exploitation details, so prioritization by immediate threat is not possible.
No changes in this category.
The implant persists on the FortiGate devices as a standalone backdoor after FortiManager is patched and disguises its C2 traffic as regular FGFM management communication , patch information alone therefore does not cover this attack path.
The report shows a state-sponsored actor concealing zero-day exploitation behind a dedicated framework to erase its tracks in critical infrastructure , signature-based detection alone falls short here.
The alert contains no information beyond the CVE description, in particular no indication of active exploitation or a public exploit.
The group operates "Silent Train," a framework of rapidly rotating compromised devices that defeats classic indicator-based detection and perimeter defenses.
The report shows how Lazarus specifically abuses South Korean security software for watering-hole attacks and has significantly evolved the malware chain compared to the previous campaign.
The report adds to patch information the insight that a China-linked group is actively using an exploit chain against firewalls, making state-sponsored attacks on network perimeters concrete.
APT29 is primarily targeting identities: on roughly half of the affected endpoints the Token Broker cache was poisoned without any payload ever arriving , token theft is the actual objective, not the malware.
The report characterizes Belarusian actors as increasingly acting as cyber proxies supporting Russian interests, providing a strategic situational indicator for the DACH region.
The report documents that Volt Typhoon operates an entire infrastructure (Silent Train) for multiple zero-day campaigns, using compromised SOHO/IoT devices as a springboard , shifting the threat from individual vulnerabilities to a persistently operating, hard-to-attribute attack network.
The report shows that China-nexus APTs are exploiting edge and remote-access devices as zero-days before patches are available, increasing the strategic relevance of exposed remote-access solutions.
The case shows for the first time a suspected state-backed actor using AI assistance to chain a web flaw with a kernel exploit in order to fully take over Linux servers down to root level.
The CVSS score of 7.8 with mandatory user interaction indicates a targeted client-side risk; active exploitation is not evidenced in the advisory.
The report only provides the CVE description; there is no indication of active exploitation, specific attackers, or affected sectors.
The advisory provides no information beyond the patch, in particular no indication of active exploitation or a public exploit.
The report adds patch information about a local kernel vulnerability with a high CVSS score, but exploitation requires prior high-privileged access.
The item contains no information on active exploitation, an exploit in circulation, or targeted victims, and describes solely the vulnerability and the affected versions.
The alert confirms a single Chrome vulnerability with no stated evidence of active exploitation, so it adds no campaign information beyond the patch.
Pure patch information with no indication of active exploitation or public exploit code; code execution remains confined to the renderer sandbox process, so a full compromise path would require an additional vulnerability.
The report contains no indication of active exploitation or additional attack details and thus primarily serves to prioritize a Chrome update.
The report only confirms the vulnerability and patch status; it provides no indication of active exploitation or an exploit.
Beyond the patch information itself, the alert contains no indication of active exploitation, exploit availability, or advanced attacker TTPs.
The advisory contains only the NVD description of the vulnerability and no indication of active exploitation, a PoC, or attack campaigns.
The report provides no information beyond the patch details about active exploitation, specific attackers, or affected sectors.
The report only describes a Chrome vulnerability without evidence of active exploitation, specific attackers, or new attack techniques.
Beyond the patch information, the NVD entry provides no indication of active exploitation, exploit code, or attribution to threat actor groups.
The alert contains no indication of active exploitation or additional attack details and only describes a high-severity Chrome vulnerability and its patch status.
Beyond the patch information, the report contains no indications of active exploitation, specific attack tactics, or affected sectors.
The report describes a flaw in Chrome/PDFium without evidence of active exploitation; the main relevance is timely browser patching.
Beyond the pure patch information, the report contains no indications of active exploitation, PoC code, or a specific attack campaign.
Beyond the plain patch information, the advisory contains no indication of active exploitation, proof-of-concept code, or a specific attacker.
The report provides no indication of active exploitation or advanced attack tactics; beyond patch information, its high rating as a remote code execution flaw in the browser is relevant.
Beyond the pure patch information, the entry contains no indication of active exploitation in the wild, public PoC code, or a targeted campaign.
The report only provides patch information for the CVE without any indication of active exploitation or an attack context.
The NVD alert provides no information beyond the patch details about active exploitation, attackers, or affected sectors.
Beyond the pure CVE and patch information, the report provides no evidence of active exploitation, specific attack tactics, or a campaign.
The report highlights that the PXE network boot process itself is an attack surface for remotely exploitable UEFI vulnerabilities and that disclosure occurred uncoordinated through an early leak.
The vulnerabilities include path traversal, deserialization, and integer overflows that together allow code execution.
The report contains no insight beyond patch information; there is no indication of active exploitation or a specific attack campaign.
The fix addresses a local attack vector in which malicious apps already present on the smartphone could read Authenticator tokens , relevant for all MFA-protected cloud access.
The update provides no CVE ID and no exploit details, so it remains a general .NET/ASP.NET security advisory without concrete exploitation information.
Phishing kits and cloud-environment credentials are traded as industrialised goods on a Chinese-language marketplace, so the exposed surface lies less in own code than in hardening identities and mail access.
The BSI update provides no CVE or CVSS details; without them, it remains unclear which OpenSSL versions are affected and how urgently patching is required.
The BSI alert summarizes multiple kernel vulnerabilities without CVE, CVSS, or patch details, so no reliable prioritization is possible.
The BSI advisory provides neither CVE IDs nor exploitation status and therefore adds no situational finding beyond patch information.