ICHI Briefs & Podcasts · ICHI Daily · five-minute podcast

ICHI Global Five Minute Cyber Rundown

ICHI Daily · Published November 5, 2026 · 5 min listen

Akari's Thursday briefing: the Zyxel GS1900 zero-day behind 996 compromised switches, Sekoia's APT29 mobile watering-hole campaign and the Apple flaw CISA just listed, a root flaw in Debian and Ubuntu's APT package manager, and DigiCert's archived-data breach.

Listen to this episode

MP3, 5.2 MB · · the full transcript is below.

Show notes

ICHI Global Five Minute Cyber Rundown — Thursday, November 5, 2026

Today's theme is trust in the tools themselves: a switch patch that did not stop the attack it was credited with stopping, a state campaign built entirely on already-patched phone flaws, and a flaw in the package manager that verifies Linux software.

Most important development — Zyxel GS1900 zero-day CVE-2026-107441 was behind the compromise of 996 switches

Zyxel has patched a zero-day that attackers actually used to compromise 996 GS1900 switches across 48 countries, beginning around August 17, according to GreyNoise. The actor, tracked as Kapibala, collected device configurations, network information, and hashed root credentials. The attacks were initially blamed on CVE-2026-7273, a separate buffer overflow Zyxel fixed in June and CISA added to KEV in September. Researchers at Binarly then found the real exploit — CVE-2026-107441, a CVSS 8.8 out-of-bounds write in the web management interface (CGI program) that lets a LAN-based, unauthenticated attacker execute OS commands via a crafted HTTP request — and showed it still worked on switches running the June firmware. Binarly reported it to Zyxel on September 29. The flaw affects ten GS1900 models on firmware 2.90 Patch 2 and earlier; Zyxel released Patch 3 firmware on October 22 and published its advisory on November 3. Canada's Centre for Cyber Security (alert AV26-1114, Update 1 on November 4) said open-source reporting indicates the flaw is exploited in the wild; Zyxel's own advisory does not itself claim exploitation. Patching in June is not sufficient — update again and treat exposed configurations and root hashes as compromised.

Adversary activity — Sekoia: APT29 "Poisoned Source" watering holes serve n-day mobile exploit chains

Sekoia's Threat Detection & Research team, which spotted the operation in mid-October 2026, assesses with moderate to high confidence that it is linked to APT29 (Midnight Blizzard / Cozy Bear, tied to Russia's SVR). Three delivery vectors — direct JavaScript injection on legitimate sites, adversary-in-the-middle-like lookalike domains, and the supply-chain compromise of Ukrainian analytics service Plerdy (its tracking script served attacker code August 27 – September 3, 2026, reaching thousands of mostly Ukrainian sites) — deliver the same profiling payload, which then serves platform-specific n-day chains with no user interaction. Every flaw used had already been patched:

iOS 16.7: CVE-2025-43529 + CVE-2024-27834 chained to steal cookies, enabling session reuse into services such as webmail.
iOS 18.5: a chain built on the DarkSword kit (CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520) taking SMS, iMessage, WhatsApp and Telegram data, Keychain passwords, location, health data, and photos.
Android (Chrome 139–145, except 143): CVE-2026-3910 + CVE-2025-27038 (Adreno GPU driver) taking Chrome cookies, saved logins, browsing history, and Wi-Fi passwords. No payload persists after exfiltration.

Sekoia stresses a user running an up-to-date operating system is safe from these attacks. Separately, CISA added CVE-2024-27834 to KEV on November 4, citing evidence of active exploitation, with a federal deadline of November 18; CISA did not name an actor or tie the listing to Sekoia's findings.

Major vulnerability — APT package manager CVE-2026-109518: verified package can be swapped, installs as root (no exploitation reported)

CVE-2026-109518 (CVSS 4.0 7.7, High), discovered by Max Justicz, is a flaw in APT's HTTP backend: an on-path attacker who can manipulate HTTP traffic between a system and its archive server — including a malicious mirror or proxy — can trigger installation of an attacker-controlled .deb package and obtain root, bypassing the archive signature check via download retries and redirect handling. Exploitation requires Acquire::Retries to be non-zero, which is the default in Ubuntu 22.04 LTS and newer and Debian 12 and newer; older releases are affected only if retries were enabled. HTTPS/TLS protects against it, and snaps are unaffected. Debian and Ubuntu released fixed APT builds on November 4 (Ubuntu notice USN-8996-1; update APT itself first with Acquire::Retries=0). The advisories report no known exploitation in the wild — this is a patch-first disclosure, distinct from the confirmed exploitation above.

Incidents — DigiCert archived-data breach confirmed; NTT DOCOMO suspected access (unconfirmed)

DigiCert: In its incident report filed in Mozilla's public CA compliance tracker on November 1, DigiCert confirmed unauthorized read access between June 27 and July 2, 2026 to an internal business system holding archived customer information — primarily names, business email addresses, telephone numbers, and business addresses, plus identity documents (driver's licences, passports, utility bills) for a small minority of accounts. The cause was an February 4, 2025 infrastructure migration that moved the system from a VPN-restricted segment into an externally accessible zone, with a separate authorization failure beyond the self-registration issue first spotted June 18. DigiCert fixed authorization on July 2, confirmed the reportable incident on October 19, disabled self-registration, moved endpoints to private addresses, and reset business-system passwords; its final audit and alert review were due November 6. DigiCert says its CA services, CertCentral, and DigiCert ONE were not affected, login credentials and issued certificates remain secure, and customers do not need to replace certificates. No affected count was disclosed.

NTT DOCOMO (Japan): DOCOMO suspended the Docomo Online Shop and My docomo services shortly after 1:05 AM on November 5, saying there is a high probability its servers were subjected to unauthorized external access — suspected, not confirmed — with cause and extent still under investigation and no restoration estimate. A separate nationwide difficulty with some 5G Standalone calls and data from around 11:20 AM the same day is also under investigation; DOCOMO has not linked the two, and emergency calls were not affected in the earlier reporting.

Defensive implications

Re-patch GS1900 switches to Patch 3 even if the June CVE-2026-7273 fix was applied; rotate credentials and review what stolen configurations and root hashes reveal about your network.
Push mobile OS and browser updates — the entire APT29 chain set fails on a fully updated device; prioritise older iPhones and Macs in supplier and staff fleets ahead of the November 18 KEV deadline for CVE-2024-27834.
On Debian/Ubuntu, update APT itself first (sudo apt update && sudo apt install -o Acquire::Retries=0 --only-upgrade apt), prefer HTTPS archive sources, and treat plain-HTTP mirrors as untrusted until patched.
Audit cloud and network migrations for systems quietly moved from private/VPN-only segments to internet-reachable zones — the DigiCert pattern — and alert on external account creation in internal business systems.

ICHI note

No live ICHI composite score is cited in this episode because no verified live score was checked at production time. ICHI.global's production methodology remains VECTORS v7.1 per the methodology page updated October 13, 2026; no methodology change is announced. Model C scoring refinements remain under development.

SOURCES

Per-story outlet names and verbatim URLs are in sources.json in this folder.

Transcript

Akari: The daily cyber rundown, brought to you by I C H I dot global. I'm Akari, and this is Thursday, November fifth, twenty twenty-six. The threat picture today is about trust in the tools themselves. A switch patch that did not actually stop the attack, a state campaign built entirely on already patched phone flaws, and a flaw in the Linux package manager that verifies your software.

Akari: The most important development is the Zyxel switch zero-day. Zyxel has patched a flaw, C V E twenty twenty-six one zero seven four four one, that attackers actually used to compromise nine hundred ninety-six G S nineteen hundred switches across forty-eight countries, beginning around August seventeenth, according to GreyNoise. The attackers, tracked as Kapibala, collected device configurations, network information, and hashed root credentials. At first, everyone blamed an earlier flaw that Zyxel fixed in June. Then researchers at Binarly found the real exploit, and showed it still worked on switches running that June fix. The new flaw is an out of bounds write in the web management interface, rated eight point eight, and it lets an unauthenticated attacker with network access run operating system commands through a crafted request. It affects ten models. Zyxel released fixed firmware on October twenty-second and published its advisory on November third. If you patched in June and stopped there, you are not done. Update again, and treat any exposed configuration and root hashes as compromised.

Akari: Next, a Russian campaign against phones that simply missed their updates. Sekoia says a watering hole operation it links, with moderate to high confidence, to A P T twenty-nine, also known as Cozy Bear, used compromised websites, lookalike domains, and a hijacked Ukrainian web analytics service to serve exploit chains to iPhone and Android visitors, with no tap required. Every flaw used had already been patched. On older iPhones, the chain stole cookies that could be reused to enter webmail. On newer iPhones, a chain built on the DarkSword kit could take messages, passwords, location, and photos. On Android, it took cookies, saved logins, browsing history, and Wi-Fi passwords. Sekoia is clear that a fully updated phone is safe from these chains. Separately, on November fourth, C I S A added one of those iPhone flaws, C V E twenty twenty-four two seven eight three four, to its Known Exploited Vulnerabilities catalog, with a federal deadline of November eighteenth. C I S A cited active exploitation, but did not name who is behind it.

Akari: Two more trust stories, and they are different in kind. In Debian and Ubuntu, a flaw in the A P T package manager, C V E twenty twenty-six one zero nine five one eight, could let an attacker on the network path swap a package after verification and have it install as root. It needs download retries, which are on by default in recent releases, and using H T T P S protects against it. Debian and Ubuntu shipped fixes on November fourth. No exploitation has been reported for this one, so patch it calmly, but patch it first, using retries set to zero for that update. And DigiCert has confirmed unauthorized access, between June twenty-seventh and July second, to an internal business system holding archived customer records, mostly names, business emails, phone numbers, and addresses, with identity documents for a small minority. A migration in February twenty twenty-five had left that system reachable from the internet. DigiCert says its certificate authority services, CertCentral, and DigiCert One were not affected, and customers do not need to replace certificates.

Akari: In Japan, N T T Docomo suspended its online shop and My Docomo services early on November fifth, saying there is a high probability its servers faced unauthorized access. That is suspected, not confirmed, and there is no restoration estimate. A separate problem with some five G calls and data later that morning is still being investigated, and Docomo has not linked the two.

Akari: Defensively, then. Re-patch the Zyxel switches even if you patched in June, and rotate what those configurations exposed. Push mobile updates, because this campaign fails on a current phone. Update A P T itself first on Debian and Ubuntu. And audit any system a migration quietly made public, which is how the DigiCert archive was exposed. The takeaway is simple. A patch or a verification only protects you if it is actually in place. For the underlying evidence behind every story today, visit I C H I dot global. I'm Akari. Stay safe, stay frosty, and I will see you tomorrow.

Sources

All ICHI Daily episodes · ICHI Briefs & Podcasts

ICHI Daily and ICHI Weekly are editorial commentary on ICHI’s evidence. They never change the VECTORS score, incident evidence classifications or intelligence rankings.

ICHI Briefs & Podcasts · ICHI Daily · ICHI Weekly · Episode calendar · ICHI Perspectives · episodes.json · ICHI dashboard · Methodology