{"id":3953,"date":"2026-11-05T07:08:24","date_gmt":"2026-11-05T15:08:24","guid":{"rendered":"https:\/\/cyber.mag212.com\/the-patch-that-didnt-hold-mag212-cyber-daily-november-5-2026\/"},"modified":"2026-11-05T07:08:24","modified_gmt":"2026-11-05T15:08:24","slug":"the-patch-that-didnt-hold-mag212-cyber-daily-november-5-2026","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/the-patch-that-didnt-hold-mag212-cyber-daily-november-5-2026\/","title":{"rendered":"The Patch That Didn’t Hold: Zyxel Zero-Day, Crafty Falcon, AI Platform Breaches & Rails: MAG212 CYBER Daily, 5 November 2026"},"content":{"rendered":"
Read the full edition (PDF, 18 pages, 0.8 MB) \u2192<\/a><\/div><\/div>\n\n

Today’s lead is a fix that didn’t hold: Binarly says Zyxel GS1900 switches patched in June stayed exploitable, and Zyxel has shipped a second fix. Around it, AI-assisted tooling shows up on the attacker’s side, in CERT-In’s warning about “Crafty Falcon” raids on India’s payment firms and in a wave of breaches at AI developer platforms. Rails, Barracuda and Android have urgent patches. Every story was checked against vendor, government and original research sources.<\/p>\n\n

Qu'est-ce qui requiert notre attention aujourd'hui ?<\/h2>\n\n
Histoire<\/th>Status<\/th>Do this<\/th><\/tr><\/thead>
Zyxel GS1900 (CVE-2026-107441)<\/td>Zero-day per Binarly; June fix did not stop the exploit<\/td>Install 2.90 Patch 3 on every model; restrict web management to an admin VLAN<\/td><\/tr>
Crafty Falcon (CERT-In CIAD-2026-0058)<\/td>“Active and ongoing” against Indian lenders, fintechs and payment firms<\/td>Separate staging from production credentials; alert on SSM\/Lambda changes and micro-then-large transfers<\/td><\/tr>
AI developer platform breaches<\/td>WorkOS, Trigger.dev, Chainstack and others disclosed incidents<\/td>Rotate secrets stored with affected vendors; cap and monitor AI provider keys<\/td><\/tr>
Rails Active Storage (GHSA-f3w6-w445-fwh9)<\/td>No exploitation reported<\/td>Upgrade to 8.0.5.2 \/ 8.1.4.1 with mini_magick 5.1+; rotate secret_key_base on Disk service<\/td><\/tr>
Barracuda (CVE-2026-116606 \/ -111560)<\/td>No exploitation reported<\/td>Close admin interfaces to untrusted networks; apply the product-specific patch<\/td><\/tr>
Android CVE-2026-58868 \/ Chrome 157<\/td>Not confirmed exploited<\/td>Android patch level 2026-11-05; Chrome 157<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Corrig\u00e9 depuis le premier rapport<\/h2>\n\n