WEEK OF NOVEMBER 9, 2026

Four KEV additions — down from the eight-to-ten of recent weeks. Two complete October's Ivanti Connect Secure zero-day chain, including the privilege-escalation flaw that had remained unpatched since W43: that gap is closed. A WordPress core race condition is exploited during software upgrades — CISA confirmed the exploitation, and the flaw sits in roughly forty percent of the web. A Zyxel GS1900 zero-day was used to compromise nearly 1,000 network switches, and follow-up research shows the vendor's patch fails to block the root-command-execution path. Synology NAS devices are being hit with ransomware through a patched DSM flaw, and CISA says a patched Apple flaw is being exploited to deliver info-stealers. Volume eased; the pattern — ubiquitous software and network equipment exploited faster than fixes hold — did not. Steady. Confidence is high.

A password manager compromise leads the week: mSecure warned users to change passwords and reset two-factor methods and passkeys after suspicious activity — a direct hit on stored credential material. DigiCert disclosed a breach exposing customer information and identity documents (corporate systems, not CA key material), and Chainalysis confirmed an intrusion into internal tools exposing customer identity data — two trust-industry operators breached in one window. The VOLTA infostealer uses AI models to rank victims by financial value, fake OpenAI and SpaceX event invitations are harvesting Microsoft and Google accounts, and attackers posing as IT support on Teams are abusing AD CS for persistence. Third consecutive heavy identity week held steady by the two-source rule — all single-class evidence. Confidence is medium.

Two confirmed developments raise the signal from two source classes, at high confidence for the first time. The FBI attributed the Binance theft — now operator-confirmed at $6.43 billion, the largest crypto heist on record, with roughly $2.85 billion frozen on-chain — to North Korea's TraderTraitor; Binance's own account describes recruitment-lure social engineering and AI tool abuse as the entry path, and Pyongyang denies involvement. Last week's held item resolves confirmed. Separately, the refrigeration campaign that began with French supermarkets in October spread across at least eight European countries — Carrefour, SuperValu, and Coop among confirmed victims, food pulled and spoiled — and reached three French blood-service cold-storage sites via a third-party provider (no blood products lost; ANSSI and the Health Ministry investigating). CISA, the FBI, HHS, USDA, and DOT issued a joint fact sheet confirming ongoing attacks on cold-chain systems, including at US military bases, and urging operators to pull end-of-life internet-connected controllers offline. Google's disruption of a 1.3-million-device Android botnet is logged as a pressure-reducing receipt. Confidence is high: operator confirmations, federal attribution, and a five-agency advisory align.