A patch that does not stop the exploit it was meant to fix is worse than no patch at all - it creates false confidence. That is the situation for nearly 1,000 Zyxel GS1900 switch operators who applied October firmware and believed they were protected against CVE-2026-107441. They were not. Today’s brief covers that failed remediation, a $133 million bank heist that started with a supplier, APT29’s zero-click mobile campaign, and residential proxy nodes beaconing from White House IP space.

In the News

Zyxel Zero-Day Still Exploitable After October Patch - 1,000 Switches Compromised

Zyxel has shipped new firmware for 10 GS1900 switch models after confirming that its October patch for CVE-2026-107441 did not block the exploit chain attackers were using in the wild. The vulnerability is an unauthenticated out-of-bounds write triggered by crafted HTTP requests, scoring CVSS 9.8 and granting remote OS command execution.

Nearly 1,000 GS1900 switches have been compromised globally. The operational problem is straightforward: organizations that ran their patch cycle in October checked the box and moved on. The exploit kept working. This is a textbook case for patch verification - not just “did we apply the update” but “did the update actually close the attack path.”

The November firmware is the actual fix. Any GS1900 operator who patched in October and stopped there is still running a compromised-capable device. Verify firmware versions against the November advisory - not the October one.

What defenders should do: Apply November GS1900 firmware immediately. Treat October-patched switches as potentially compromised - review logs for crafted HTTP requests and unexpected OS-level command execution. Segment managed switches behind network access control that limits management plane exposure.

Crédit Mutuel Arkéa Confirms $133M Cyber Heist via Supplier Compromise

French banking group Crédit Mutuel Arkéa disclosed a $133 million cyber heist - the largest bank theft disclosure this quarter. The attack chain started with an unnamed third-party supplier. Attackers compromised that supplier, then moved laterally into the bank’s internal transfer infrastructure and hijacked the institution’s own transfer account to move funds.

This is the supply-chain-to-lateral-movement playbook that security architects warn about and that microsegmentation is designed to stop. The supplier had enough network access to reach transfer systems. Once inside, the attackers did not need to escalate privileges beyond what the supplier connection already provided - they rode the trust relationship directly to the money.

The $133 million figure makes this one of the largest publicly confirmed cyber heists in European banking history. The unnamed supplier and the specific lateral movement techniques have not been disclosed, but the attack pattern maps to MITRE ATT&CK T1199 (Trusted Relationship) for initial access and T1021 (Remote Services) for lateral movement.

What defenders should do: Audit third-party vendor network access paths to critical financial systems. Enforce microsegmentation between vendor-facing network segments and internal transfer infrastructure. Deploy east-west traffic analytics to detect anomalous lateral movement originating from supplier connections.

APT29 Delivers Zero-Click Mobile Exploits via Compromised Analytics Provider

Russia-linked APT29 compromised Ukrainian analytics vendor Plerdy SEO Tracker and used it to inject zero-click exploit chains targeting both iOS and Android devices. The attack is a watering hole operation: visitors to websites running the compromised Plerdy tracker received mobile exploits with no user interaction required. APT29 also stood up fake domains to widen the delivery surface.

The zero-click aspect is the critical detail. There is no phishing email, no malicious attachment, no “click here” moment. A mobile device visiting a compromised website is enough. This maps to MITRE ATT&CK T1189 (Drive-by Compromise) with a supply chain delivery vector through T1195.002 (Compromise Software Supply Chain).

For organizations with mobile workforces - particularly those operating in or adjacent to Ukrainian and Eastern European contexts - this campaign underscores the need for DNS-layer filtering and mobile threat defense that operates before the exploit chain reaches the device.

What defenders should do: Deploy DNS-layer security that blocks known watering hole and C2 domains. Enforce device trust and posture checks for mobile devices accessing corporate resources. Ensure iOS and Android devices are on the latest security patches - the exploit chains target known vulnerabilities in unpatched mobile operating systems.

White House IP Space Hosts Residential Proxy Nodes Tied to Russian-Founded Service

Layer3 Intel detected 236 residential proxy beacons from White House IP space (AS2650) between October 5 and November 3. Among the proxy services identified is Infatica, founded by Vladimir Fomenko, whose hosting firm King Servers was previously linked to cyberattacks on U.S. election systems in 2016.

Residential proxy nodes on government networks mean that at least one device connected to White House infrastructure is running software that routes third-party internet traffic through the government network. Whether installed intentionally or as part of a bundled application, the result is the same: external actors can rent a White House IP address and route their traffic through it.

This is an endpoint hygiene and BYOD vetting problem. The proxy software had to get onto a device, and that device had to connect to the network. Both of those steps represent control failures - either in software allowlisting, device posture assessment, or network admission policy.

What defenders should do: Scan endpoint fleets for known residential proxy agent signatures and beaconing patterns. Enforce application allowlisting on devices connecting to sensitive networks. Deploy network traffic analytics to detect outbound proxy beaconing - residential proxy traffic generates distinctive traffic profiles that network detection tools can flag.

Defender Action Items

  • Apply Zyxel GS1900 November firmware for CVE-2026-107441 immediately - October patch does not block the exploit. Verify firmware version against the November advisory, not the October one.
  • Audit third-party vendor network access to financial transfer systems and enforce microsegmentation between vendor and critical infrastructure segments.
  • Deploy DNS-layer filtering and mobile threat defense to counter zero-click watering hole delivery - ensure mobile OS patches are current for both iOS and Android.
  • Scan endpoint fleets for residential proxy agent installations and anomalous outbound beaconing patterns, particularly on government and regulated networks.
  • Patch WordPress Core for CVE-2026-119977 (CVSS 8.1, CISA KEV listed) - TOCTOU race condition during upgrades allows RCE. Deploy WAF rules as compensating control.
  • Push November Android security bulletin for CVE-2026-58868 (CVSS 9.8) - zero-interaction RCE in Android Framework 14-17. Flag BYOD patching lag with EMM teams.
  • Migrate off SonicWall GMS 9.5.2 and earlier - CVE-2026-109593 (CVSS 9.1) will not be patched; product is end-of-life.

Detection Queries

The following Splunk SPL query detects anomalous HTTP requests to Zyxel GS1900 management interfaces that may indicate CVE-2026-107441 exploitation attempts - specifically crafted HTTP payloads targeting the out-of-bounds write condition:

index=network sourcetype=firewall OR sourcetype=proxy
dest_port=80 OR dest_port=443
| search dest_ip IN ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
| where match(http_uri, "(?i)gs1900")
  OR match(http_user_agent, "(?i)zyxel")
  OR len(http_content) > 4096
| stats count dc(src_ip) AS unique_sources values(http_method) AS methods values(http_uri) AS uris BY dest_ip
| where count > 10 OR unique_sources > 3
| sort -count

This query targets HTTP traffic directed at internal IP ranges on web management ports, filtering for GS1900-related URIs, Zyxel user-agent strings, or oversized HTTP content payloads that may carry the crafted exploit. Tune the count and unique_sources thresholds to your environment - false positives will come from legitimate switch management traffic, which should be baselined and excluded.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.