Zyxel's June firmware update for its GS1900 switches addressed a different vulnerability from the one attackers were exploiting. The June advisory covered CVE-2026-7273, a stack-based buffer overflow in a CGI program. The exploit observed in the wild instead targets CVE-2026-107441, an out-of-bounds write in dispatcher.cgi. Rated 9.8, the flaw allows anyone able to reach the web management interface to execute operating system commands as root without authentication. Switches that received the earlier update therefore remained vulnerable. Binarly reports that the exploit was used against 996 switches, prompting Zyxel to release new firmware for 10 GS1900 models. The earlier attacks had been attributed to the flaw covered by the June update. The latest finding indicates that attackers were exploiting a separate, previously unpatched vulnerability.

OpenAI's research into Linux kernel security provides a measure of how far automated vulnerability discovery and exploit development have advanced. A pipeline run in mid-October against the latest kernel produced 2,308 candidate findings, reproduced 1,724 as vulnerabilities and developed 1,169 working local privilege-escalation exploits. After variant analysis, these represented 948 distinct flaws, at an end-to-end cost of approximately $1.2 million in API credits. Kernel maintainers were already responding during the scan: 61 flaws had been patched upstream and 43 had staging patches by the time it finished. The work also exposed a problem with exploit validation. In an early run, 20 of 200 reported successes had obtained root access through a different zero-day from the one assigned. OpenAI added an independent check to verify that each exploit used its designated vulnerability. Separately, Check Point counted more than 1,800 publicly exposed instances of the ARTEX agentic hacking platform, while Microsoft observed threat actors using the same tooling to search public GitHub repositories for exposed secrets.

Chainalysis's October intrusion appears more extensive than its initial updates suggested. The company detected the breach on 30 October and initially confirmed that user IDs, full names, email addresses and organisational role labels had been exposed. Its latest update adds usernames, password hashes and live tokens to the affected data. Chainalysis has not disclosed the hashing algorithm used to protect passwords, leaving the risk of offline cracking difficult to assess. It also says that information belonging to all its users was exposed. The company's website identifies law enforcement and national security agencies among its customers, making the scope of the incident particularly significant. Norway's aid agency Norad reported a similarly extensive exposure: all 20,614 registered users of its grants portal, spanning 12,511 organisations, had their names and email addresses taken. Applications from at least three organisations were also affected, and the agency says further cases may emerge as its investigation continues.

Queens Public Library confirmed a ransomware attack that encrypted its systems across 66 branches serving the New York City borough. On-site computers, self-service check-out machines, Wi-Fi, digital media services and the mobile app are offline. All locations remain open, and no ransomware group has claimed responsibility.

OpenAI built an automated research pipeline that analysed 2,308 candidate Linux kernel findings and reproduced 1,724 vulnerabilities in isolated virtual machines. Its agents produced working local privilege escalation exploits for 948 distinct flaws, allowing unprivileged users to gain root access. Hundreds of reports and patches have been sent to kernel maintainers, with 61 of the flaws already patched upstream.

Zyxel GS1900 switches contain CVE-2026-107441, a critical out-of-bounds write in the dispatcher.cgi CGI program, rated 9.8 on the CVSS v3.1 scale. A remote attacker without authentication could exploit it to run arbitrary operating system commands with root privileges.

A flaw in ChatGPT's HTML preview sandbox let attackers open popup windows that escaped its restrictions, bypassing Lockdown Mode. Attackers could use it to exfiltrate chat history, deliver malware through spoofed windows, and steal credentials. In the ChatGPT Classic app, the attack required no user interaction, and OpenAI has fixed it by removing the popup permissions.

Layer3 Intel detected residential proxy nodes beaconing from the Executive Office of the President network between 5 October and 3 November, exiting 236 times. Synthient linked the activity to Windows 11 installations running Infatica, a proxy service founded by the owner of King Servers. Layer3 found 28 separate proxy services could route traffic through the network.

An authentication flaw in OpenSSH on musl-based systems such as Alpine lets unauthenticated attackers log in over password authentication as accounts that should not accept passwords, including root. A password of 257 to 1024 bytes makes musl's crypt() fail and return "*", which matches the locked account's stored field. OpenSSH 10.6p2 fixes the issue, and no in-the-wild exploitation has been reported.