Active exploits hit QNAP NAS devices, while D-Link switches face unpatched zero-days. Phishing lures impersonate AI firms to steal cloud accounts. Multiple threats are being exploited in the wild.
Threats With a Full Page
These affect a common MSP tool and come with versions and a fix, so each has its own page.
- SonicWall SonicOS SSL-VPN Vulnerability: MFA Bypass Exploited in Attacks
- OpenSSH Vulnerability: Emergency Fix for SSHole Authentication Bypass
- Critical Rails Active Storage Vulnerability Could Let Attackers Write Server Files
- mSecure Password Manager Hack: What MSPs and Clients Should Do This Week
- DreamHost File Manager Data Breach: What MSPs Should Do
- Zyxel GS1900 Vulnerability: Patch Zero-Day Exploited in the Wild
- Hackers Exploit Patched Apple Vulnerability CVE-2024-27834
- Zyxel GS1900 Vulnerability: Earlier Patch Left Switches Exploitable
Friday 6 November 2026
QNAP Says Hackers Are Exploiting the Plex2Shell Vulnerability Chain to Breach NAS Devices
QNAP says hackers are breaching NAS devices by exploiting the Plex2Shell vulnerability chain. The company urges users to update Plex Media Server to the latest version available in the QNAP App Center.
- Affected: NAS devices; Plex Media Server
- What to do: Update Plex Media Server to the latest version available in the QNAP App Center
- Exploited in the wild, according to the sources.
D-Link Warns of Multiple Zero-Days in DGS-3130 Series Switches
D-Link shared mitigation measures for multiple unpatched security flaws affecting DGS-3130 series managed Gigabit stackable switches. The flaws are described as zero-days.
- Affected: DGS-3130 series managed Gigabit stackable switches
- What to do: the sources give no fix yet.
Thursday 5 November 2026
Three People Charged in Scheme Using AI to Impersonate CEOs and Attorneys to Steal $129 Million
Three people have been charged in a scheme that used AI to impersonate CEOs and attorneys to steal $129 million. The trio, who have nicknames that include "Rocky Balboa," "Superman Cash" and "Fat Boy," often targeted companies' accounting departments.
- What to do: the sources give no fix yet.
- Exploited in the wild, according to the sources.
- 3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 Million (Securityweek)
- CEO-spoofing scammers indicted for using AI to help steal more than $100 million (Record)
- Authorities accuse trio of using AI deepfakes to defraud $129M from businesses (Cyberscoop)
Threat Actors Use ARTEX Agentic AI to Find and Abuse Exposed OAuth Application Secrets on GitHub
Microsoft Threat Intelligence reports threat actors are using the agentic offensive security framework ARTEX to search GitHub for exposed OAuth application secrets. The secrets can be used to compromise the associated OAuth application and perform authenticated actions in its tenant. Agents operating on behalf of the threat actors then used the compromised OAuth applications to perform subsequent actions within compromised organizations.
- Affected: OAuth application secrets; associated OAuth application; application's tenant; compromised organizations
- What to do: the sources give no fix yet.
- Exploited in the wild, according to the sources.
Fake OpenAI, SpaceX and Anthropic Event Invitations Used in Phishing Attacks to Steal Microsoft and Google Accounts
Hackers are using fake OpenAI, SpaceX, and Anthropic event invitations to lure employees into phishing attacks. The campaign relies on two different phishing-as-a-service platforms to steal Microsoft and Google account credentials and authentication sessions.
- Affected: Microsoft and Google accounts; employees targeted via fake OpenAI, SpaceX, and Anthropic event invitations
- What to do: the sources give no fix yet.
- Exploited in the wild, according to the sources.
Ubuntu Ca-Certificates Update Fixes JKS Keystore Retaining Removed CA Certificates
Ubuntu's ca-certificates update fixes a bug in the JKS integration where CA certificates removed from the system bundle were not being removed from the JKS keystore. The update resyncs the keystore with the system CA certificates list.
- Affected: ca-certificates; JKS keystore
- What to do: the sources give no fix yet.
Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws
Cisco patched a remote code execution vulnerability in UCS Central Software. WatchGuard fixed authentication and man-in-the-middle flaws. SonicWall will not fix flaws in its Global Management System (GMS).
- Affected: UCS Central Software; WatchGuard; Global Management System (GMS)
- What to do: the sources give no fix yet.
How This Digest Is Made
Every item was checked against the reports it links to, and anything a report did not support was removed. A threat gets its own page only when it affects a tool most MSPs run, such as RMM, PSA, backup, Microsoft 365, firewalls, endpoint security or remote access, and the reports give the affected versions and a fix. Everything else that touches MSPs is listed here and refreshed through the day.