> InfoSec News Nuggets – 11/05/2026

Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes Russian state-sponsored group Midnight Blizzard (APT29) is believed to be behind a large-scale watering hole campaign that targeted iOS and Android users in the US and Europe, mainly Ukraine, with zero-click exploit chains abusing previously patched vulnerabilities, according to Sekoia. The attackers injected malicious JavaScript into compromised websites, set up lookalike reverse-proxy copies of high-profile sites such as america250.org and a London luxury hotel, and poisoned the tracker file of Ukrainian analytics service Plerdy to expose hundreds of military-related sites for a week. Two iOS chains lean heavily on the DarkSword exploit kit to steal cookies or fully harvest devices, while an Android chain pairs a Chrome bug with a Qualcomm flaw to drop the AndroSnitch data stealer, and CISA has added the iOS PAC bypass CVE-2024-27834 to its KEV catalog.   CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades CISA has added CVE-2026-119977, a high-severity (CVSS 8.1) time-of-check time-of-use race condition in WordPress Core, to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. The flaw stems from predictable, web-accessible staging paths used during full-package core upgrades and lets unauthenticated attackers execute code on the server during that brief upgrade window. Wordfence recorded more than 18,500 requests targeting staged setup-config.php installer paths within 21 hours of disclosure and has blocked over 12,000 exploit attempts in a single day, and federal civilian agencies have until November 6 to apply the patches released late last month.   Zyxel fixes zero-day exploited to hack nearly 1,000 network switches Zyxel has patched CVE-2026-107441, an out-of-bounds write flaw in the web management interface of ten GS1900 series switch models that let unauthenticated attackers run OS commands and was exploited to compromise 996 devices across 48 countries. The attacks, attributed to a suspected Chinese-speaking actor tracked as Kapibala and linked to the Red Heron campaign, were originally blamed on CVE-2026-7273, a bug Zyxel fixed in June. Binarly later found the recovered exploit specifically checked for firmware already patched for that earlier flaw and bypassed its fixes by corrupting a parameter counter before validation, prompting Zyxel to ship new firmware on October 22 that admins are urged to install.   Cyberattack hits French blood banks Three blood banks run by the French Blood Establishment (EFS) detected and reversed a dangerous temperature spike in their cold rooms after a cyberattack on one of its refrigeration equipment providers changed operating parameters, setting temperature and defrost thresholds to very high values. Monitoring and alarm systems caught the anomalies quickly, products were moved to other facilities, and blood collection and distribution were not affected, with EFS now working alongside ANSSI and the Ministry of Health. The incident coincides with a renewed wave of attacks on supermarket refrigeration units across several European countries, and threat intelligence firm Lupovis reported weeks of default-credential login attempts against Danfoss refrigeration controllers from bulletproof hosting infrastructure used by Russian adversaries.   Google shuts down global botnet running on certified Android devices Google and partners including Japan’s National Police Agency, Lumen, HUMAN Security, Plume and Synthient have disrupted XCPE, a botnet of more than 1.3 million Android TV set-top boxes and other devices that China-based manufacturer Videostrong Technology deliberately backdoored before selling them. The malicious code loaded after first boot to evade Google’s certification testing, and the backdoor was used to rent device access to criminals for ad fraud, data theft and residential proxy traffic across more than 170 countries. Google took legal action against the botnet’s domains and servers, knocked out command infrastructure for more than a dozen malware families that it says cuts off access to at least 10 million more compromised devices, and banned Videostrong from building or selling certified Android devices. The post InfoSec News Nuggets – 11/05/2026 appeared first on AboutDFIR - The Definitive Compendium Project.