MSP Threat Briefing: November 5, 2026

Two exploited items today. Zyxel GS1900 switches compromised since August were hit by a flaw nobody knew about, not the June bug they were blamed on. Firmware patched for that June bug is still exposed. CISA has also added a 2024 Apple flaw to its exploited list after researchers tied it to watering-hole attacks on outdated iPhones. Both need patching, not new controls.

1. Update every Zyxel GS1900 switch to the 2.90 Patch 3 firmware for its model. Take its web interface off user and guest networks.
2. Find iPhones, iPads and Macs below current releases in your MDM. Update or retire them. Federal deadline: November 18.
3. Update Chrome on managed Android phones.
4. If you or a client use the mSecure password manager with cloud sync, start a credential reset for the accounts in it.

1. Zyxel GS1900 switches: the August compromises used a zero-day

Zyxel published an advisory on November 3 for CVE-2026-107441. It is an out-of-bounds write in the switch's CGI program. An unauthenticated attacker on the LAN can send a crafted HTTP request and potentially run OS commands. Ten GS1900 models are affected.

The flaw has already been used. Binarly found that a group which compromised almost 1,000 GS1900 switches used this bug, as reported by SecurityWeek on November 5. Those attacks were first blamed on CVE-2026-7273, patched in June and added to CISA's exploited list in September. Binarly says the June patch did not stop this actor. Binarly reported the bug to Zyxel on September 29. Zyxel released fixes on October 23.

Who is exposed. Small offices, clinics, schools and branch sites that use GS1900 smart managed switches, often installed once and never updated. A switch that was patched in June for CVE-2026-7273 is still vulnerable. A compromised switch sits inside the network, where most monitoring does not look.

What to do.

• Update to the patched firmware below. Zyxel lists it as the only remediation.
• Zyxel patches only models still inside their vulnerability support period. Plan to replace any GS1900 that cannot take this firmware.
• Restrict the switch management interface to a management VLAN or admin hosts. The attack needs HTTP access to the switch.
• Treat any switch that was exposed since August as suspect. Reflash it, reset admin credentials and review its configuration for changes. SecurityWeek reports the attackers deployed Jitterly and Sixzut malware variants.

Patched firmware, per Zyxel:

2. CISA lists a 2024 Apple flaw used against outdated iPhones

CISA added CVE-2024-27834 to its exploited catalog on November 4. It lets an attacker who already has memory read and write access bypass Pointer Authentication. Apple fixed it in May 2024 in iOS 17.5 and iPadOS 17.5, iOS 16.7.8, macOS Sonoma 14.5, Safari 17.5, tvOS 17.5 and watchOS 10.5. Federal agencies must fix it by November 18.

The listing follows a Sekoia report published November 4. Sekoia calls the campaign Poisoned Source and attributes it to APT29 with moderate to high confidence. Attackers injected JavaScript into legitimate websites, built lookalike sites, and compromised the Plerdy SEO Tracker analytics script. Visitors on vulnerable devices received one of three exploit chains:

• iOS 16.7, possibly 16.0 to 17.4: CVE-2025-43529 with CVE-2024-27834, to steal cookies.
• iOS 18.5: a DarkSword-based chain, to collect messages, keychain data, Wi-Fi passwords and browser data.
• Chrome 139 to 145 on Android, except 143: CVE-2026-3910 and CVE-2025-27038, to steal Chrome data and Wi-Fi passwords.

Every flaw used was already patched. Sekoia says an up-to-date operating system is safe from these attacks.

Who is exposed. Staff and executives on old iPhones and iPads that stopped updating, or on Android phones with stale Chrome. Sekoia describes victims across Europe and the US, with a focus on Ukraine. Stolen cookies can mean stolen sessions for cloud apps.

What to do.

• Report on Apple devices below current iOS, iPadOS and macOS in your MDM. Update them, or retire hardware that cannot reach a supported release.
• Enforce minimum OS versions in device compliance policies for mobile access to Microsoft 365 or Google Workspace.
• Update Chrome on managed Android devices.
• If you manage client websites, check whether any load a.plerdy[.]com. The script was compromised from August 27 to September 3, 2026.
• Search DNS and proxy logs for the indicators below.

Indicators published by Sekoia:

Quick hits

mSecure password manager. mSeven Software told mSecure customers on November 3 to change passwords, reset two-factor authentication and remove passkeys, as reported by BleepingComputer. Customers say support told them an encrypted database was stolen from mSecure Cloud. The company has not said how many users are affected. Vaults are encrypted on the device, so the risk rests on master password strength. Users who synced to mSecure Cloud should change their master password and rotate their most important stored credentials first.

Sources

• Zyxel: security advisory for out-of-bounds write vulnerability in GS1900 series switches
• SecurityWeek: Zyxel switch hacks blamed on patched flaw actually exploited a zero-day
• CISA: Known Exploited Vulnerabilities catalog
• Sekoia: Poisoned Source, APT29 watering holes target mobile devices with n-day exploits
• Apple: security content of iOS 17.5 and iPadOS 17.5
• Apple: security content of iOS 16.7.8 and iPadOS 16.7.8
• Apple: security content of macOS Sonoma 14.5
• Apple: security content of Safari 17.5
• Apple: security content of tvOS 17.5
• Apple: security content of watchOS 10.5
• The Hacker News: hackers exploit patched Apple flaw to deliver info-stealing malware
• BleepingComputer: mSecure password manager hack prompts password reset warnings