{"id":3894,"date":"2026-11-04T06:23:22","date_gmt":"2026-11-04T14:23:22","guid":{"rendered":"https:\/\/cyber.mag212.com\/when-the-update-becomes-the-attack-mag212-cyber-daily-november-4-2026\/"},"modified":"2026-11-04T06:51:27","modified_gmt":"2026-11-04T14:51:27","slug":"when-the-update-becomes-the-attack-mag212-cyber-daily-november-4-2026","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/when-the-update-becomes-the-attack-mag212-cyber-daily-november-4-2026\/","title":{"rendered":"Quand la mise \u00e0 jour se transforme en attaque\u00a0: WordPress Core, cPGuard, APT29 Mobile et le ransomware 3AM\u00a0: MAG212 CYBER Daily, 4 novembre 2026"},"content":{"rendered":"<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-fe48e5de wp-block-buttons-is-layout-flex\"><div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/MAG212_CYBER_Daily_2026-11-04-3.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Read the full edition (PDF, 17 pages, 1.0 MB) \u2192<\/a><\/div><\/div>\n\n<p class=\"wp-block-paragraph\">Today the routine maintenance window is the entry point. A WordPress core flaw can be exploited during the seconds a site spends updating itself, and a Linux hosting security product&#8217;s own update channel delivered a root-level data thief to thousands of servers. Alongside them, Russia&#8217;s APT29 is serving patched-but-effective exploits to phones that missed updates, and two ransomware cases show attackers going straight for backups. Every story is checked against vendor, government or original research sources, with ordered steps to contain, fix and verify.<\/p>\n\n<h2 class=\"wp-block-heading\">Qu&#039;est-ce qui requiert notre attention aujourd&#039;hui ?<\/h2>\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Histoire<\/th><th>Statut<\/th><th>Faites ceci<\/th><\/tr><\/thead><tbody><tr><td>WordPress core race (CVE-2026-119977)<\/td><td>CISA KEV, added Nov 3; federal due date Nov 6<\/td><td>Block HTTP to <code data-no-translation=\"\">\/wp-content\/upgrade\/<\/code>, then update to 7.1.4 or your branch fix (7.0.8, 6.9.11, 6.8.12 \u2026)<\/td><\/tr><tr><td>cPGuard update channel hijack<\/td><td>Confirmed: fake update ran as root on ~2,950 servers, Nov 2 02:08\u201303:20 UTC<\/td><td>Update to the latest (5.88.26+), remove artifacts, rotate root, SSH, MySQL and cloud secrets, remove old keys fleet-wide<\/td><\/tr><tr><td>APT29 mobile watering holes<\/td><td>Observed campaign (Sekoia, Nov 4)<\/td><td>Enforce current iOS and Chrome\/WebView via MDM; revoke sessions for exposed users<\/td><\/tr><tr><td>3AM ransomware, UK school estate<\/td><td>Single case study (Bitdefender, Nov 3)<\/td><td>Isolate backup servers, rotate stored backup credentials, alert on new domain trusts<\/td><\/tr><tr><td>Synology C3RB3R<\/td><td>Vendor-confirmed attacks on outdated DSM<\/td><td>Install the latest DSM (SA-26:13 minimums, e.g. 7.2.2-72806-9), turn on auto-update, remove internet exposure<\/td><\/tr><\/tbody><\/table><\/figure>\n\n<h2 class=\"wp-block-heading\">Corrig\u00e9 depuis le premier rapport<\/h2>\n\n<ul class=\"wp-block-list\"><li>An early draft of today&#8217;s issue described Google&#8217;s &#8220;LLMjacking&#8221; research as new. The GTIG reporting it relied on dates from September 2026, so it has been removed from today&#8217;s news.<\/li><li>cPGuard: the vendor disclosure names <strong>5.88.26<\/strong> as the clean build; its earlier advisory said &#8220;5.88.25 or later.&#8221; Use the latest available.<\/li><li>Synology: its September 2026 advisory (SA-26:13) sets newer minimum DSM builds than the 2024 advisory its statement links to. The issue lists both.<\/li><\/ul>\n\n<h2 class=\"wp-block-heading\">Dans ce num\u00e9ro<\/h2>\n\n<ul class=\"wp-block-list\"><li><strong>WordPress core: attackers race the update window.<\/strong> How the upgrade-window race works, the full fixed-version table for every branch, NGINX and Apache deny rules, WP-CLI checks, and how to verify recovery.<\/li><li><strong>cPGuard: a security tool&#8217;s update channel turned on its customers.<\/strong> OPSSHIELD&#8217;s UTC timeline, artifacts, IPs and SHA-256 hashes, plus a credential-rotation worksheet for every secret the script took.<\/li><li><strong>APT29 mobile: one page visit, three n-day exploit chains.<\/strong> The iOS 16.x, iOS 18.5 (DarkSword) and Chrome-for-Android chains, the indicators Sekoia published, and why session revocation matters more than password resets.<\/li><li><strong>3AM ransomware: backups, domain trusts and a suspected AI loop.<\/strong> Veeam credential theft, backdoor Domain Admins and cross-domain trusts at a UK school estate, with event IDs and read-only PowerShell hunts.<\/li><li><strong>Synology NAS: C3RB3R targets outdated DSM.<\/strong> Minimum fixed builds from both advisories and what to do if you&#8217;re hit.<\/li><li><strong>Briefs:<\/strong> the exploited Drupal Commerce Core access bypass, and Chainalysis&#8217;s breach disclosure.<\/li><li><strong>Defender&#8217;s Action Desk<\/strong>: seven actions, each with &#8220;done when&#8221; proof, plus a five-minute staff lesson and a printable break-room card.<\/li><\/ul>\n\n<h2 class=\"wp-block-heading\">Lisez chaque histoire en entier<\/h2>\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/cyber.mag212.com\/fr\/cve-2026-119977-wordpress-core-update-race-cisa-kev\/\">CVE-2026-119977\u00a0: La vuln\u00e9rabilit\u00e9 de mise \u00e0 jour du noyau WordPress dans CISA KEV, expliqu\u00e9e, avec les versions corrig\u00e9es pour chaque branche<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/cpguard-update-channel-hijacked-linux-servers\/\">Canal de mise \u00e0 jour de cPGuard pirat\u00e9\u00a0: ce qui s\u2019ex\u00e9cutait sur 2\u00a0950 serveurs Linux et comment faire tourner chaque secret expos\u00e9<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/apt29-watering-hole-outdated-iphone-android-exploits\/\">APT29 Watering Holes exploite des failles de s\u00e9curit\u00e9 sur les iPhones et t\u00e9l\u00e9phones Android obsol\u00e8tes\u00a0: comment v\u00e9rifier votre flotte<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/3am-ransomware-uk-school-veeam-domain-trusts\/\">Attaque par ransomware \u00e0 3 h du matin dans un \u00e9tablissement scolaire britannique\u00a0: identifiants Veeam, domaines frauduleux et suspicion de boucle d\u2019IA<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/synology-c3rb3r-ransomware-dsm-builds\/\">Ransomware C3RB3R pour Synology\u00a0: Quelles versions de DSM sont s\u00fbres et que faire si votre NAS est infect\u00e9\u00a0?<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/drupal-commerce-core-cve-2026-118539-exploited\/\">La vuln\u00e9rabilit\u00e9 CVE-2026-118539 du noyau de Drupal Commerce est exploit\u00e9e\u00a0: appliquez le correctif, puis auditez vos commandes.<\/a><\/li><\/ul>\n\n<h2 class=\"wp-block-heading\">Feuilletez l&#039;\u00e9dition<\/h2>\n\n<div class=\"_df_book df-lite\" id=\"0\"  data-title=\"\" wpoptions=\"true\" thumbtype=\"\" source=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/MAG212_CYBER_Daily_2026-11-04-3.pdf\" height=\"auto\" webgl=\"true\" ><\/div>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n<p class=\"wp-block-paragraph\"><em>Sources : <a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2026\/11\/03\/cisa-adds-one-known-exploited-vulnerability-catalog\" target=\"_blank\" rel=\"noreferrer noopener\">CISA<\/a>, <a href=\"https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-4w3m-c66w-69mg\" target=\"_blank\" rel=\"noreferrer noopener\">WordPress<\/a>, <a href=\"https:\/\/patchstack.com\/articles\/wordpress-7-1-4-security-release\/\" target=\"_blank\" rel=\"noreferrer noopener\">Patchstack<\/a>, <a href=\"https:\/\/opsshield.com\/notice\/security-incident-disclosure-servermanage.html\" target=\"_blank\" rel=\"noreferrer noopener\">OPSSHIELD<\/a>, <a href=\"https:\/\/www.sekoia.com\/blog\/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits\" target=\"_blank\" rel=\"noreferrer noopener\">Sekoia<\/a>, <a href=\"https:\/\/businessinsights.bitdefender.com\/3am-ransomware-hybrid-ai-attack\" target=\"_blank\" rel=\"noreferrer noopener\">Bitdefender<\/a>, <a href=\"https:\/\/www.synology.com\/en-global\/security\/advisory\/Synology_SA_26_13\" target=\"_blank\" rel=\"noreferrer noopener\">Synology<\/a> et <a href=\"https:\/\/www.drupal.org\/sa-contrib-2026-254\" target=\"_blank\" rel=\"noreferrer noopener\">Drupal<\/a>; the full 24-source register is on page 17. Research cutoff 06:15 PST, 4 November 2026. Diagrams are original MAG212 CYBER illustrations. Command panels were checked against vendor documentation but not executed; run them only on systems you are authorized to manage.<\/em><\/p>\n\n<h2 class=\"wp-block-heading\">Articles connexes sur MAG212 CYBER<\/h2>\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/cyber.mag212.com\/fr\/the-forgotten-edge-mag212-cyber-daily-november-3-2026\/\">The Forgotten Edge : MAG212 CYBER Daily, 3 novembre 2026<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/verify-what-is-deployed-ivanti-a-poisoned-extension-ad-cs-sysgorat-mag212-cyber-technical-edition-2-november-2026\/\">V\u00e9rification des moyens d\u00e9ploy\u00e9s : MAG212 CYBER \u00c9dition technique, 2 novembre 2026<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/magazine-library\/\">Chaque num\u00e9ro de la biblioth\u00e8que de magazines<\/a><\/li><\/ul>","protected":false},"excerpt":{"rendered":"<p>CISA flags an exploited WordPress core update race, cPGuard&#8217;s update channel leaks root secrets from ~2,950 servers, APT29 targets outdated phones, and 3AM ransomware goes after school backups. Verified fixes inside.<\/p>","protected":false},"author":1,"featured_media":3893,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,13,21,15,14],"tags":[181,182,72,168,177,184,186,137,62,176,174,126,187,31,180,160,179,185,24,56,163,183,178,175],"class_list":["post-3894","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-critical-cves","category-cyber-incidents","category-digital-magazine","category-threat-intelligence","category-vulnerabilities","tag-3am-ransomware","tag-active-directory","tag-ai-security","tag-android","tag-apt29","tag-backups","tag-c3rb3r","tag-chainalysis","tag-cisa-kev","tag-cpguard","tag-cve-2026-119977","tag-daily-edition","tag-drupal","tag-incident-response","tag-ios","tag-linux","tag-mobile-security","tag-nas","tag-ransomware","tag-supply-chain-attack","tag-synology","tag-veeam","tag-watering-hole","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3894","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3894"}],"version-history":[{"count":1,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3894\/revisions"}],"predecessor-version":[{"id":3920,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3894\/revisions\/3920"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/3893"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3894"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=3894"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=3894"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}