CISA confirmed a WordPress Core flaw as exploited three days after publication and a SonicWall VPN flaw on the day it was published, and events on the decoys rose 30.7%.
SECTION 01
What the signals mean
Events recorded on the Venus decoys rose 30.7% this week, to 1,143,098 from 874,619. Distinct sources rose 37.7%, to 7,852 from 5,704, and sessions rose 9.0%, to 16,201 from 14,865. The Windows surface supplied 250,840 of the 268,479 events gained, and every other surface together rose 23.8%, to 91,861 from 74,222. 5,496 sources were new and 2,356 had been seen before, against 3,077 and 2,627 in Edition 014.
WordPress Core went from published to exploited in three days
CVE-2026-119977 affects WordPress Core versions 4.7 through 7.1.3. Predictable staging paths used during a full-package core upgrade let an unauthenticated attacker run code on the server while the upgrade runs. It was published on 31 October, and CISA added it to its catalogue of flaws confirmed as exploited on 3 November, with remediation due 6 November (The Hacker News, Bleeping Computer). Its CVSS score is 8.1 and its exploitation forecast 0.0116. The Hacker News reports that installing the fix can expose some sites one last time.
SonicWall’s VPN bypass reached the catalogue on its publication day
CVE-2026-19868 in SonicOS SSLVPN lets a user holding credentials for an alternate login method bypass SAML checks, including SAML-enforced multi-factor authentication. It was published and added to the catalogue on 6 November, with remediation due 20 November (SecurityWeek, Bleeping Computer). Its score is 7.5 and its forecast 0.0062. SonicWall also said it will not patch two flaws in end-of-life Global Management System software (The Hacker News). SecurityWeek reports that CISA added two further Ivanti Connect Secure flaws, CVE-2026-111357 and CVE-2026-118527, after they were chained in zero-day attacks (SecurityWeek, Rapid7).
An Apple flaw from May 2024 was added 904 days after publication
CVE-2024-27834 lets an attacker with arbitrary read and write capability bypass Pointer Authentication in Safari, iOS, iPadOS, macOS, tvOS and watchOS. It was fixed in May 2024 and scores 5.5. CISA added it on 4 November, with remediation due 18 November, and says it is used to deliver info-stealing malware (The Hacker News).
OpenSSH’s sign-in flaw drew attempts within hours of disclosure
Previdian reports attackers attempting to exploit CVE-2026-123158, an OpenSSH flaw that can allow sign-ins to accounts with no password set, within hours of disclosure, and gaining root on a honeypot (The Hacker News). OpenSSH rushed patches (SecurityWeek). The flaw is not on the catalogue, and its forecast is 0.0101. SSH access probing on the decoys fell 11.9%, to 18,925 from 21,484.
Forecasts rose on flaws added in earlier weeks
EPSS estimates the chance that a flaw is exploited in the next 30 days. 19 vulnerabilities qualified this week, against 91 in Edition 014. Adobe Commerce CVE-2026-75650 rose from 0.039 to 0.994, VMware vCenter CVE-2026-59310 from 0.026 to 0.617, BeyondTrust Remote Support CVE-2026-102764 from 0.190 to 0.780, GitLab CVE-2026-97229 from 0.273 to 0.652 and Zammad CVE-2026-102489 from 0.225 to 0.499. All five have been on the catalogue since between 18 August and 29 October, and CISA records ransomware use for the VMware flaw.
Secrets requests came from ten times as many sources
Requests for secrets and configuration files rose 49.2%, to 29,038 from 19,461, from 1,517 sources against 147. Each source asked for fewer files: 19 requests against 132 a week earlier. Distinct paths fell to 1,600 from 1,930. /.env drew 462 requests, /.git/config 325, /.env.production 246 and /.env.local 217. /api/.env entered the leading five with 208. Terraform state drew 57 and 52 requests on its two paths, against 40 and 35. Traversal requests rose 25.3%, to 1,491 from 1,190, from 190 sources against 21. The five leading paths drew 46 each: /dist../.env, /img../.env, /media../.env, /public../.env and /static../.env. Each follows a folder name with two dots and no slash, a form that can step outside the folder on servers whose aliases lack a trailing slash.
WordPress login paths led the script-probing list
Requests for server-side script files rose 90.8%, to 9,536 from 4,999, from 229 sources against 152. Three WordPress login paths led the list: /wp-login.php with 163, /wordpress/wp-login.php with 132 and /wp/wp-login.php with 131. Requests matching the WordPress login-bypass identifier CVE-2023-2982 rose 465.9%, to 730 from 129. Admin console requests rose 92.1%, to 3,293 from 1,714.
File sharing, API and Portal events rose
File sharing probes rose 45.4%, to 179,689 events from 123,623, and file sharing credential attacks rose 51.7%, to 168,233 from 110,891. API events rose 210.0%, to 7,622 from 2,459, and Portal events 210.4%, to 7,613 from 2,453. Auth events rose 44.0%, to 3,115 from 2,163, and VPN events 6.3%, to 6,051 from 5,691. MySQL credential attack requests fell 19.0%, to 1,277 from 1,576, and Database events fell 16.9%, to 1,617 from 1,947.
The fingerprint cluster held
The remote desktop tool identified by fingerprint 73ede1f461b6 ran from 132 addresses and produced 3,738 sessions, against 135 addresses and 4,056 sessions in Edition 014. The address count has stayed between 116 and 135 for three editions.
My view
The WordPress and SonicWall flaws carry forecasts of 0.0116 and 0.0062, and both are confirmed exploited. A queue sorted by forecast would have placed them near the bottom. I patch anything on the internet edge, and any CMS core, when the vendor advisory appears, and use the forecast to order what remains.
Secrets requests came from 1,517 sources against 147, while requests per source fell from 132 to 19. A pool that wide cannot be managed by blocking addresses, so removing the files is the control that holds.
96.4% of the CVE-identified hits on the decoys carry identifiers from 2022 or earlier, and 12 of the 19 flaws Medulus qualified are from 2026. None appears on both lists.
What to act on
Patch WordPress Core first; its remediation date was 6 November. SonicOS SSLVPN, due 20 November, and Apple products, due 18 November, follow. Apply the OpenSSH patches and list any accounts with no password set. Raise the priority of Adobe Commerce, VMware vCenter, BeyondTrust and GitLab, where forecasts rose on flaws already exploited. Remove environment files, Git directories, Terraform state and site archives from any path a web server can reach.
2 Nov – 8 Nov 2026
2 Nov – 8 Nov 2026
1,143,098 external events (+30.7%). 7,852 distinct sources (+37.7%). 16,201 sessions (+9.0%).
Against Edition 014’s published figures, events rose from 874,619 to 1,143,098, sources from 5,704 to 7,852 and sessions from 14,865 to 16,201. New sources rose 78.6%, to 5,496 from 3,077, and returning sources fell 10.3%, to 2,356 from 2,627. By surface, Windows rose 31.3% to 1,051,237 from 800,397, Web rose 23.4% to 46,918 from 38,025, Shell fell 11.9% to 18,925 from 21,484, API rose 210.0% to 7,622 from 2,459, Portal rose 210.4% to 7,613 from 2,453, Database fell 16.9% to 1,617 from 1,947, Auth rose 44.0% to 3,115 from 2,163 and VPN rose 6.3% to 6,051 from 5,691. 1,922 campaigns were active against 1,479, and 1,350 are flagged recurring, against 1,069.
Ranked signals
| Rank | Signal | Events | Ed. 014 | Change | Sources | Score |
|---|---|---|---|---|---|---|
| 1 | PHP Injection / Remote Include | 28 | 82 | −65.9% | 5 | 0.7555 |
| 2 | Webshell / RCE Script Probing | 9,536 | 4,999 | +90.8% | 229 | 0.4485 |
| 3 | Atlassian Data Center Exploit Attempts | 2 | 0 | new | 2 | 0.3774 |
| 4 | MySQL Credential Attack | 1,277 | 1,576 | −19.0% | 84 | 0.3311 |
| 5 | SQL Injection Probing | 1 | 0 | new | 1 | 0.2750 |
| 6 | SSH Campaign Targeting | 993 | 1,616 | −38.6% | 86 | 0.2665 |
| 7 | Admin Console Discovery | 3,293 | 1,714 | +92.1% | 273 | 0.2552 |
| 8 | SMB Access Probing | 179,689 | 123,623 | +45.4% | 2,119 | 0.2240 |
| 9 | Automated Scanner / Recon Tooling | 905 | 763 | +18.6% | 104 | 0.2176 |
| 10 | SSH Invalid-User Enumeration | 18,126 | 20,740 | −12.6% | 371 | 0.2127 |
| 11 | Sensitive File & Secret Exposure | 29,038 | 19,461 | +49.2% | 1,517 | 0.2047 |
| 12 | SMB Credential Attack | 168,233 | 110,891 | +51.7% | 56 | 0.1967 |
| 13 | SSH Access Probing | 18,925 | 21,484 | −11.9% | 762 | 0.1685 |
| 14 | Directory / Path Traversal | 1,491 | 1,190 | +25.3% | 190 | 0.1416 |
| 15 | VPN Gateway Fingerprinting | 3 | 4 | −25.0% | 2 | 0.0563 |
AI Workflow Builder exploit attempts fell to 0 from 6 and probing to 0 from 2. WordPress plugin probing stayed at 0.
Remote desktop fingerprint campaigns
| Client signature | Sessions | Ed. 014 | Change | Sources | Ed. 014 | Change |
|---|---|---|---|---|---|---|
TLS 73ede1f461b6 | 3,738 | 4,056 | −7.8% | 132 | 135 | −2.2% |
| RDP cookie "hello" | 432 | 427 | +1.2% | 50 | 72 | −30.6% |
TLS 43e25370946f | 428 | not published | – | 47 | not published | – |
Fingerprint 73ede1f461b6 fell from 135 addresses to 132. The "hello" cookie held at 432 sessions from 50 sources, against 427 from 72. 43e25370946f, published in Edition 012, returned with 428 sessions from 47 sources. The rdp-async cookie and 113d359fe776, at 1,016 and 588 sessions in Edition 014, are no longer among the ten largest campaigns, the smallest of which ran 428 sessions. An address can carry several signatures, so the counts are not totalled.
Path families
| Family | Events | Ed. 014 | Change | Paths | Ed. 014 | Sources | Most requested |
|---|---|---|---|---|---|---|---|
| Sensitive File & Secret Exposure | 29,038 | 19,461 | +49.2% | 1,600 | 1,930 | 1,517 | /.env (462), /.git/config (325) |
| Backup & Archive Download Probing | 424 | 392 | +8.2% | 28 | 40 | 46 | /terraform.tfstate (57), /.terraform/terraform.tfstate (52) |
| Webshell / RCE Script Probing | 9,536 | 4,999 | +90.8% | 2,021 | 981 | 229 | /wp-login.php (163), /wordpress/wp-login.php (132) |
| Admin Console Discovery | 3,293 | 1,714 | +92.1% | 491 | 205 | 273 | /admin/.env (159), /dashboard/.env (126) |
| Directory / Path Traversal | 1,491 | 1,190 | +25.3% | 62 | 76 | 190 | /dist../.env (46), /img../.env (46) |
| SQL Injection Probing | 1 | 0 | new | 1 | 0 | 1 | / (1) |
Distinct paths rose in the webshell and admin families, to 2,021 from 981 and to 491 from 205, and fell in the sensitive-file, backup and traversal families. The sensitive-file list fell 17.1%, to 1,600 from 1,930, while its sources rose to 1,517 from 147. Two of the five leading admin paths end in .env. The single SQL injection request, on 3 November at 16:53 IST, asked for /.
Representative paths
| Secrets and configuration | Events | Ed. 014 | Backup and archive | Events | Ed. 014 |
|---|---|---|---|---|---|
/.env | 462 | 366 | /terraform.tfstate | 57 | 40 |
/.git/config | 325 | 239 | /.terraform/terraform.tfstate | 52 | 35 |
/.env.production | 246 | 170 | /backup.tar.gz | 41 | not published |
/.env.local | 217 | 179 | /backup.zip | 41 | 22 |
/api/.env | 208 | not published | /site.zip | 32 | 24 |
Every path present in both weeks rose. /.git/config rose 36.0%, /.env 26.2% and /backup.zip 86.4%.
Behaviour progression
329 sessions carried behaviour from two or more distinct stages, against 303 in Edition 014.
| Ordering | Sessions | Ed. 014 | Change | Sources | Ed. 014 | Busiest source | Evasive |
|---|---|---|---|---|---|---|---|
| Discovery, then Exploitation | 279 | 245 | +13.9% | 170 | 143 | 19 (6.81%) | 5.77% |
| Exploitation, then Discovery | 50 | 58 | −13.8% | 37 | 52 | 10 (20.00%) | 16.00% |
Evasive sessions fell to 5.77% of the forward ordering from 7.30%, and rose to 16.00% of the reverse from 5.45%. The busiest source’s share fell in the forward ordering, to 6.81% from 7.76%, and rose in the reverse, to 20.00% from 6.90%.
Vulnerability mapping
| Identifier | Description | Hits | Ed. 014 | Change | Sources | KEV |
|---|---|---|---|---|---|---|
| CWE-312 | Cleartext secrets (.env) | 24,415 | 15,952 | +53.0% | 1,346 | no |
| CVE-2021-41773 | Apache traversal | 9,544 | 5,019 | +90.2% | 229 | yes |
| CVE-2019-0232 | Tomcat CGI | 9,536 | 4,999 | +90.8% | 229 | no |
| CWE-527 | Exposed Git | 2,020 | 1,373 | +47.1% | 189 | no |
| CVE-2023-2982 | WordPress login bypass | 730 | 129 | +465.9% | 46 | no |
| CVE-2017-9841 | PHPUnit eval-stdin | 139 | 453 | −69.3% | 10 | yes |
| CVE-2022-22963 | Spring Cloud Function | 112 | 40 | +180.0% | 34 | yes |
| CVE-2012-1823 | PHP-CGI argument injection | 28 | 82 | −65.9% | 5 | yes |
| CVE-2022-22965 | Spring4Shell | 14 | 3 | +366.7% | 6 | yes |
| CVE-2021-42013 | Apache traversal, second fix | 8 | 20 | −60.0% | 4 | yes |
15 identifiers were reached, against 15, and 6 are on the KEV catalogue, against 7. CVE-2017-12629 and CVE-2021-27905 each drew 5, against 2. CVE-2026-21589, the Atlassian identifier, drew 2 hits from 2 sources at 17:12 IST on 7 November, against 0 in Editions 013 and 014 and 2 in Edition 012. CWE-89 drew 1, against 0, and CWE-22 drew 1, against 2. CVE-2025-3248 and CVE-2026-0768 recorded no hits, against 6 each.
Medulus correlation
19 vulnerabilities qualified this period, against 91 in Edition 014. Three entered the CISA Known Exploited Vulnerabilities catalogue between 3 and 6 November.
| Product | Identifier | CVSS | EPSS | Added | Due | Days after publication | Reported exploitation |
|---|---|---|---|---|---|---|---|
| WordPress Core | CVE-2026-119977 | 8.1 | 0.0116 | 3 Nov | 6 Nov | 3 | The Hacker News, Bleeping Computer |
| Apple, multiple products | CVE-2024-27834 | 5.5 | 0.0150 | 4 Nov | 18 Nov | 904 | The Hacker News |
| SonicWall SonicOS SSLVPN | CVE-2026-19868 | 7.5 | 0.0062 | 6 Nov | 20 Nov | 0 | SecurityWeek, Bleeping Computer |
All three have an EPSS score below 0.02. EPSS is a forecast of exploitation within 30 days. None has an Exploit-DB entry or a Metasploit module.
Reporting also describes exploitation of a Zyxel switch zero-day, CVE-2026-107441, used against nearly 1,000 switches (Bleeping Computer, SecurityWeek), the Siemens SIMATIC IoT2050 flaw CVE-2026-58115, scored at maximum severity (The Hacker News), and an unpatched flaw in the CryptoPayment Gateway WordPress plugin, CVE-2026-81648 (The Hacker News). Barracuda disclosed two Email Security Gateway flaws that chain to root without a login, CVE-2026-116606 (The Hacker News). None of the four is on the catalogue, and their forecasts are 0.0029, 0.0089, 0.0050 and 0.0073.
Red Hat patched a 9.8-rated Linux kernel TCP flaw, CVE-2026-98432, while Ubuntu’s fixes remain in an opt-in testing channel (The Hacker News). Google’s November bulletin patches a critical Android flaw that allows remote code execution without user action, CVE-2026-58868 (The Hacker News). Metasploit changed 13 modules, among them two Cisco Secure Email Gateway exploits for CVE-2026-76461 and CVE-2026-76519, the OpenBullet2 exploit for CVE-2026-25856, and scanner and login modules for older products: Sercomm CVE-2014-0659 (forecast 0.7382), Varnish CVE-2009-2936 (0.6382) and the default-password identifier CVE-1999-0502 (0.5334). CISA published one ICS advisory, for Subnet Solutions PowerSYSTEM Center.
Three malware families and five threat actors were named in reporting. APT29 drew two mentions, and Bitter, DarkBlinders, Superman and TraderTraitor one each. Venus labelled 917 sessions as suspected agentic reconnaissance, against 38 in Edition 014. Reporting this week describes OpenAI’s GPT-6 Cyber model finding 81 Firefox flaws and 948 Linux bugs (Bleeping Computer), WorkOS attributing its breach to an AI agent that escaped its sandbox (Bleeping Computer) and LLMjacking costing some enterprises up to $1 million in cloud charges (The Hacker News).
Venus and Medulus together
None of the 19 vulnerabilities qualified by Medulus appears among the 15 identifiers recorded on the decoys.
| Subject | Medulus | Venus | Overlap |
|---|---|---|---|
| WordPress | Core upgrade flaw added to the catalogue 3 days after publication, forecast 0.0116 (The Hacker News) | Script file requests +90.8% to 9,536, led by three login paths; CVE-2023-2982 hits +465.9% to 730 | Same product, different weakness |
| Secrets | Revocation programme for nearly 1.5 million exposed live secrets (Bleeping Computer); 1,122 public copies of a Claude Code settings file exposing passwords and keys (The Hacker News) | Secrets requests +49.2% to 29,038 from 1,517 sources against 147 | Same target |
| VPN gateways | SonicWall SSLVPN bypass added on its publication day; two more Ivanti Connect Secure zero-days (SecurityWeek) | VPN events +6.3% to 6,051; 3 fingerprinting requests from 2 sources, no exploit requests | No shared identifier |
| SSH | OpenSSH sign-in flaw attempted within hours of disclosure (The Hacker News) | SSH access probing −11.9% to 18,925 | Opposite directions |
| Langflow | Critical flaws that let unauthenticated attackers run code on servers (The Hacker News) | AI Workflow Builder exploit requests 0, against 6 | Opposite directions |
| Atlassian | CVE-2026-21589 forecast 0.995 in Edition 014; not among this week’s qualifiers | 2 requests from 2 sources on 7 Nov, against 0 in Editions 013 and 014 | Returned after two weeks |
| Credentials | Metasploit changed the MySQL, DB2 and Brocade login modules for CVE-1999-0502, forecast 0.5334 | MySQL credential attack −19.0% to 1,277 | Same technique, no shared identifier |
Technical checks for the week
- Patch: WordPress Core to the fixed release, and recheck sites after a full-package upgrade, since reporting says installing the fix can expose some sites one last time. SonicOS SSLVPN per SonicWall.
- Patch: Safari 17.5, iOS and iPadOS 17.5 or 16.7.8, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5 for CVE-2024-27834. OpenSSH to the release shipped for CVE-2026-123158.
- Prioritise: Adobe Commerce, VMware vCenter, BeyondTrust Remote Support, GitLab and Zammad. Each is on the CISA catalogue and each forecast rose this week, and CISA records ransomware use for the VMware flaw.
- Review: Zyxel switches, Siemens IoT2050 devices and Barracuda Email Security Gateways against vendor advisories, and any site running the CryptoPayment Gateway plugin, which has no patch.
- Remove: Terraform state, site archives,
.gitdirectories and every.envvariant from web-reachable paths. - Check: Web server folder aliases end in a slash, so a request for a folder name followed by two dots cannot step outside it.
Venus records activity reaching Elytra-operated decoy observation infrastructure. Medulus provides public vulnerability and threat-intelligence context. Every observed request is an attempt. Week-on-week comparisons are drawn from the figures published in Edition 014.