Daily brief: Thursday 5 November 2026

A flaw in APT lets a tampered mirror run code as root on Debian and Ubuntu, Xen fixes a VM escape found with Claude, and SonicWall won't patch two flaws in its end-of-life GMS.

Cybersecurity

APT flaw lets a tampered download run code as root on Debian and Ubuntu

Debian, Ubuntu and the APT developers published advisories on 4 November for CVE-2026-109518. Someone who can change traffic between APT and the package server, such as a bad mirror or proxy, can swap a checked package for their own, and their code then runs as root. The attack relies on APT retrying failed downloads, which it does by default from Debian 12 and Ubuntu 22.04. Debian has fixed versions out, and Ubuntu was still rolling out its updates on 4 November. No attacks have been reported.

Why it matters for IT: Run your normal apt update and upgrade on Debian and Ubuntu servers as soon as the fixed APT package reaches your release, and check that mirrors and proxies you use are ones you control or trust. Ubuntu says Debian 11 and Ubuntu 20.04 are not exposed by default, but scripts that set Acquire::Retries can change that.

Source: The Hacker News

Cybersecurity

Xen fixes flaws that let one VM read and write another VM's memory

The Xen Project's advisory XSA-523, published on 3 November, covers CVE-2026-102703 and CVE-2026-102704. A malicious guest can read and write the memory of other VMs on the same host, including dom0, and every Xen version from 4.6 onward is affected. The advisory says patches are out and there is no known mitigation. Anthropic is credited with finding the flaws using Claude. XCP-ng and Qubes OS have shipped fixed packages, and both need reboots.

Why it matters for IT: If you run XCP-ng or another Xen-based platform, plan the update and the host reboots now, especially on hosts that run VMs for different customers. There's no workaround, so patching is the only fix.

Source: The Hacker News

Cybersecurity

SonicWall won't patch two flaws in its end-of-life GMS

SonicWall has warned of two flaws in Global Management System (GMS) 9.5.2 and earlier, which is end of life. CVE-2026-109593 (CVSS 9.1) lets a network-adjacent attacker read internal GMS files without logging in, and CVE-2026-109594 (CVSS 6.8) is a SQL injection for someone who is already logged in. SonicWall says no security update will be released and tells customers to move to Network Security Manager (NSM). The report does not say these two flaws are being exploited.

Why it matters for IT: If any customer still runs GMS, put it on a restricted management network now and plan the move to NSM. An unpatched tool that manages firewalls is a valuable target.

Source: The Hacker News

Cybersecurity

Android's November update fixes 216 flaws, 23 of them critical

Google's November 2026 Android bulletin lists 216 vulnerabilities, 23 rated critical. The main one, CVE-2026-58868, is a heap overflow in a media decoder affecting Android 14 to 17 that could allow remote code execution without the user doing anything. Phones need security patch level 2026-11-01 or later, and 2026-11-05 covers every flaw in the bulletin. The bulletin reports no exploitation so far.

Why it matters for IT: Check in Intune or your MDM which company phones are below the 2026-11-01 patch level, and set a compliance rule if you don't already have one. Phones that no longer get updates should be replaced.

Source: The Hacker News

Cybersecurity

mSecure password manager tells users to change passwords after 'suspicious activity'

On 3 November, current and former mSecure customers got an email from its developer, mSeven Software, about 'suspicious activity linked to the app'. It suggests changing passwords, resetting 2FA and removing passkeys, but does not say what happened or whether stored data was exposed. mSeven says it has brought in outside security experts. mSecure says vaults are encrypted on the device before syncing.

Why it matters for IT: If anyone you support uses mSecure, start with their most important accounts: email, Microsoft 365 and banking. Change those passwords and reset their 2FA first, and wait for a clearer statement before storing anything new in the app.

Source: The Hacker News

Codex jailbreak bundle quietly adds adverts to the AI's answers

Check Point Research found a jailbreak bundle for OpenAI Codex, called Haiou, that changes Codex's configuration files so later answers carry adverts for the author's AI gateway site. The ads appear when the user types greetings such as 'hi' or 'hello'. It is shared on GitHub as a 'local enhancement configuration package' and is also bundled in a Chinese GUI tool for Codex. Check Point calls this 'prompt adware' because it works through plain-language instructions, not a normal program.

Why it matters for IT: Treat third-party skills, prompts and config packs for AI coding tools like any other software you install: check where they came from and what they change. Ask developers not to install 'jailbreak' or 'unlock' packs on work machines.

Source: The Hacker News

Cybersecurity

Attack disrupts fridge monitoring at French blood banks

Attacks overnight between Sunday and Monday disrupted refrigeration monitoring systems at regional sites of the French Blood Establishment (EFS). The French Health Ministry said there was no impact on blood supplies, and Reuters reports remote access to the affected fridges was switched off. Security Affairs says supermarket refrigeration was also attacked in eight European countries in the same period. Investigations are still going on.

Why it matters for IT: Fridge, heating and building systems often have remote access set up by a supplier and then forgotten. Find out what's connected at each site, who can reach it, and switch off remote access that nobody needs.

Source: Security Affairs

Weather

Live forecast

Loading the forecast…

Fact of the day

All facts

← All daily briefs